ACC shows ipv6 addresses in source/destination IP

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

ACC shows ipv6 addresses in source/destination IP

L1 Bithead

Hello, I have a PA-220 with PANOS 10.1.3 installed. I see IPv6 addresses in source/destination IP widget. It started from 10.1.x version

does anybody has the same issue?

RudolfTorvenyi1_0-1636825317441.png

 

104 REPLIES 104

Cyber Elite
Cyber Elite

@RudolfTorvenyi1,

Silly question, but do you have IPv6 enabled on your firewall? Stands to reason if you are getting IPv6 recorded that you simply have IPv6 enabled across one of your interfaces, and thus the traffic is getting recorded. I haven't seen any abnormal IPv6 traffic generation across my 10.1 lab endpoints where I don't actively have IPv6 enabled. 

Cyber Elite
Cyber Elite

Hello,

Also turn off/disable IPv6 on the clients and devices everywhere you can. Its on usually by default.

Regards,

L5 Sessionator

This is a known issue for 220 appliances on 10.1.3, PAN-175149. 

 

This doesn't affect the traffic policies, content inspection, etc.. A cosmetic bug on the MGT interface at this time. 

Help the community! Add tags and mark solutions please.

L1 Bithead

Issue still persists on 10.1.4 and 10.1.3 is preferred with claims that it's fixed.

L0 Member

I confirm issue still there for PA-220.  Tested on three units running PAN-OS 10.1.3 and 10.1.4.
Filed a support case.

L5 Sessionator

This is expected behavior, following the link, PAN-175149 is unaddressed. 

Help the community! Add tags and mark solutions please.

L1 Bithead

Sorry, but it says it's fixed in 10.1.3 and some users reported that it temporarily worked. I'm currently working with support which hasn't produced results yet.

 

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/pan-os-10-1-3-known-and-addressed...

PAN-175149
(PA-800 and PA-7000 Series firewalls and the PA-220 firewall only) Fixed an issue where ACC and scheduled reports (
Monitor > Manage > Manage Custom Reports) incorrectly displayed the IPv6 address instead of the IPv4 address.



L0 Member

I'm also waiting for this problem to be solved

L0 Member

any solution ? problem is still persists pan 10.1.3 PA 220 ?

L5 Sessionator

My apologies, you are correct. There is a duplicate bug for 220s and 800s now, PAN-163831. We are awaiting QA approval to push changes is most up to date information I can pull from JIRA for you. 

Help the community! Add tags and mark solutions please.

L2 Linker

It has already been 2 weeks since the existence of the problem was finally recognized. When will the solution appear? It's not very convenient to work.

L3 Networker

Sure would be nice to get this fixed.  Still a problem on 10.1.4

L5 Sessionator

I've consulted our JIRA again on this. Seems this bug is fixed in every hardware and vm platform except the 220. 

 

The fix version is denoted 10.1.x (unsure why this is obscured), and 11.0. I will update this thread at the end of the week with followup from PM as what the fix version will be for the 220 platform. 

Help the community! Add tags and mark solutions please.

Thanks for the update.  Do you know if there is some sort of work around to get the IPv6 - IPv4 mapping maybe from the CLI?

  • 37461 Views
  • 104 replies
  • 9 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!