create a any-ipv6 address object

Reply
Highlighted
L4 Transporter

create a any-ipv6 address object

Hey all,

Is it possible to create a any-ipv6 address object?
I tried with an object "::/0" (same syntax used to configure default route) but this seems to hit any-ipv4 address as well.

Tried this in PanOS6.0.10, PanOS6.1.3 and PanOS7.0.0.0b23

Tags (1)

Accepted Solutions
Highlighted
L4 Transporter

Re: create a any-ipv6 address object

I found a possible "work-around".

Create a ip-range object: 0::0-0:0:0:0:0:0:ffff:ffff -> this will match any ipv4 address (since ipv4 ips can be written as ipv6 ips ex 0:0:0:0:0:0:192.168.1.1) and then NEGATE this object in your rulebase to get all ipv6 addresses.

View solution in original post


All Replies
Highlighted
L4 Transporter

Re: create a any-ipv6 address object

I believe what you are seeing is expected, basically ::/0 means anything even though there is :: in the beginning. You can verify this by running the command on cli "show running security-policy", and you will see this address is translated to "any".

If you want to use this in security rule, I would recommend to be create a special rule only for IPv6, so IPv4 traffic doesnt hit it.

Amjad

Highlighted
L4 Transporter

Re: create a any-ipv6 address object

Dear Amjad,

And how do I create a ipv6 only rule?
That is the question...

Highlighted
L4 Transporter

Re: create a any-ipv6 address object

I found a possible "work-around".

Create a ip-range object: 0::0-0:0:0:0:0:0:ffff:ffff -> this will match any ipv4 address (since ipv4 ips can be written as ipv6 ips ex 0:0:0:0:0:0:192.168.1.1) and then NEGATE this object in your rulebase to get all ipv6 addresses.

View solution in original post

Highlighted
L5 Sessionator

Re: create a any-ipv6 address object

Would all public unicast IPv6 addresses be good for your scenario? 2000::/3

Or you can include private IPv6 addresses as well: fe80::/10

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!