ACC shows ipv6 addresses in source/destination IP

[RudolfTorvenyi1]

Hello, I have a PA-220 with PANOS 10.1.3 installed. I see IPv6 addresses in source/destination IP widget. It started from 10.1.x version

does anybody has the same issue?

[BPry]

@RudolfTorvenyi1,

Silly question, but do you have IPv6 enabled on your firewall? Stands to reason if you are getting IPv6 recorded that you simply have IPv6 enabled across one of your interfaces, and thus the traffic is getting recorded. I haven't seen any abnormal IPv6 traffic generation across my 10.1 lab endpoints where I don't actively have IPv6 enabled. 

[OtakarKlier]

Hello,

Also turn off/disable IPv6 on the clients and devices everywhere you can. Its on usually by default.

Regards,

[LAYER_8]

This is a known issue for 220 appliances on 10.1.3, PAN-175149. 

This doesn't affect the traffic policies, content inspection, etc.. A cosmetic bug on the MGT interface at this time. 

[Craig5]

Issue still persists on 10.1.4 and 10.1.3 is preferred with claims that it's fixed.

[Fedor_Travinsky]

I confirm issue still there for PA-220.  Tested on three units running PAN-OS 10.1.3 and 10.1.4.
Filed a support case.

[LAYER_8]

This is expected behavior, following the link, PAN-175149 is unaddressed. 

[Craig5]

Sorry, but it says it's fixed in 10.1.3 and some users reported that it temporarily worked. I'm currently working with support which hasn't produced results yet.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/pan-os-10-1-3-known-and-addressed...

PAN-175149

(PA-800 and PA-7000 Series firewalls and the PA-220 firewall only) Fixed an issue where ACC and scheduled reports ( Monitor > Manage > Manage Custom Reports) incorrectly displayed the IPv6 address instead of the IPv4 address.

[mgedik]

I'm also waiting for this problem to be solved

[aais]

any solution ? problem is still persists pan 10.1.3 PA 220 ?

[LAYER_8]

My apologies, you are correct. There is a duplicate bug for 220s and 800s now, PAN-163831. We are awaiting QA approval to push changes is most up to date information I can pull from JIRA for you. 

[Artemiusm]

It has already been 2 weeks since the existence of the problem was finally recognized. When will the solution appear? It's not very convenient to work.

[rmcrae]

Sure would be nice to get this fixed.  Still a problem on 10.1.4

[LAYER_8]

I've consulted our JIRA again on this. Seems this bug is fixed in every hardware and vm platform except the 220. 

The fix version is denoted 10.1.x (unsure why this is obscured), and 11.0. I will update this thread at the end of the week with followup from PM as what the fix version will be for the 220 platform. 

[rmcrae]

Thanks for the update.  Do you know if there is some sort of work around to get the IPv6 - IPv4 mapping maybe from the CLI?