Does PA firewall really support 6in4 tunnel?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Does PA firewall really support 6in4 tunnel?

L0 Member


I have a free 6in4 tunnel from Hurricane Electric. The tunnel profile inucludes IPv6 Tunnel Endpoints, Routed IPv6 Prefixes and Anycasted IPv6 Caching Nameserver. I used these information to configure a Juniper SSG firewall and it works. I was told by Technical Support Engineer that PA does support 6in4 and it is termed as NAT64. However it needs to configure DNS64 server, which never needed when I configure SSG firewall. I also don't find place to configure the 6in4 tunnel.

3 REPLIES 3

L3 Networker

yq,

If you are asking about IPv6 packets encapsulated in ESP packets (protocol 50), then that is currently supported in Pan-OS 5.0.

For Teredo tunneling, where IPv6 is the data within IPv4 packets, Palo Alto only recognizes this 6in4 tunnel by the protocol 41 value in the IPv4 header. We do not have a decoder for Teredo 6in4 tunnelling yet so we cannot terminate or configure this feature on the PA firewalls.

We simply pass this through the firewall as IPv4 traffic but the application will read ipv6 in the session details.

A feature request (ID #882) has been filed for this to be implemented and you could contact your SE to vote on this as well, for faster fulfilment of the request.

Regards,

tasonibare

According to the Ipv6 support matrix . It seems that it is supported in 5.0.0.Please find the ipv6 support link.

https://live.paloaltonetworks.com/docs/DOC-2383

Further more , I found a document where it says about the configuration of 6in4 tunnel.

https://live.paloaltonetworks.com/docs/DOC-4097

Let me know if the above information's are incomplete/incorrect. It is supported as per the document.If this is not really supported then the document for Ipv6 support needs to be corrected

I clicked https://live.paloaltonetworks.com/docs/DOC-4097, I got You are not authorized to view this.


  • 3779 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!