05-12-2015 02:13 AM
Hey all,
Is it possible to create a any-ipv6 address object?
I tried with an object "::/0" (same syntax used to configure default route) but this seems to hit any-ipv4 address as well.
Tried this in PanOS6.0.10, PanOS6.1.3 and PanOS7.0.0.0b23
05-13-2015 05:37 AM
I found a possible "work-around".
Create a ip-range object: 0::0-0:0:0:0:0:0:ffff:ffff -> this will match any ipv4 address (since ipv4 ips can be written as ipv6 ips ex 0:0:0:0:0:0:192.168.1.1) and then NEGATE this object in your rulebase to get all ipv6 addresses.
05-12-2015 07:35 PM
I believe what you are seeing is expected, basically ::/0 means anything even though there is :: in the beginning. You can verify this by running the command on cli "show running security-policy", and you will see this address is translated to "any".
If you want to use this in security rule, I would recommend to be create a special rule only for IPv6, so IPv4 traffic doesnt hit it.
Amjad
05-13-2015 12:20 AM
Dear Amjad,
And how do I create a ipv6 only rule?
That is the question...
05-13-2015 05:37 AM
I found a possible "work-around".
Create a ip-range object: 0::0-0:0:0:0:0:0:ffff:ffff -> this will match any ipv4 address (since ipv4 ips can be written as ipv6 ips ex 0:0:0:0:0:0:192.168.1.1) and then NEGATE this object in your rulebase to get all ipv6 addresses.
05-13-2015 06:03 AM
Would all public unicast IPv6 addresses be good for your scenario? 2000::/3
Or you can include private IPv6 addresses as well: fe80::/10
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
