IPv6 dual stack configurations.

[OsamaKhan]

Hello,

I want to achieve IPv6 dual stack configuration on PA-850.

What are the requirements for this type of configuration? 

For IPv4 traffic will hit to our IPv4 configured wan IP and for IPv6 traffic will hit to IPv6 configured wan IP.

Please enlighten me how can I achieve my requirements. 

@SutareMayur @JoergSchuetter @kiwi @BPry 

@Brandon_Wertz @MP18

[PavelK]

Thank you for posting question @OsamaKhan 

We are currently in the process of migration to IPv6. Regarding your question, there is no pre-requisite. The Dual Stack configuration is fairly straightforward. You will have to enabled IPv6 on interface and configure its IPv6 address, then configure routing for IPv6. After these steps, your IPv6 WAN address should get hit by traffic.

We came across a few points:
- Any issue to IPv6 BGP peering also affects IPv4 BGP peering.
- When you configure security policy for IPv6, there is no "any6" object, so all your existing policies that already have "any" will depending on configuration allow or deny IPv4 as well as IPv6 traffic. Somebody in this community found workaround for this: https://live.paloaltonetworks.com/t5/general-topics/create-a-any-ipv6-address-object/td-p/26454

Other than this we did not encounter any major issue.

Kind Regards
Pavel

[OsamaKhan]

Hi Pavel,

I have configured the IPv6 interface and route now I can see the traffic but how it will work without nat.

If I give a server an IPv6 IP and try to access the internet how it will work and if I take access to the particular ipv6 server IP will it work??

[PavelK · Accepted solution]

Thank you for reply @OsamaKhan 

I assume you are using ISP assigned IPv6 address block. If you want to route IPv6 natively from your Internet Egress point all the way to your server, you will have to break your IPv6 assigned block into smaller subnets and enabled IPv6 on all intermediate nodes where traffic is traversing. Since you have already configured WAN side of your Firewall with IPv6, now you will have to also enabled IPv6 on interfaces facing your switch where your server is connected. For point to point links, you can use /127 addresses and subnet where your server is connect you can use /64. In order to avoid mistakes and better planning, it is better to use IPv6 address calculator.

Below is one sample from interface configuration:

When it comes to NAT, there is no need to enable NAT with IPv6 unless you are running internally ULA (Unique Local Addresses). Since you are planning to run dual stack, all you have to focus is to bring IPv6 connectivity to your server.

Note: On server side, you will have to configure IPv6 DNS server. Also, if in the subnets where your target server is located are also other servers and you leave IPv6 RA/RS enabled, it is possible that other servers will pick up IPv6 through SLAAC and starts to communicate over IPv6 as well.

There are more things to consider, however these are major points to focus on.

Kind Regards

Pavel