IPv6 dual stack configurations.

cancel
Showing results for 
Search instead for 
Did you mean: 

IPv6 dual stack configurations.

L2 Linker

Hello,

 

I want to achieve IPv6 dual stack configuration on PA-850.

 

What are the requirements for this type of configuration? 

 

For IPv4 traffic will hit to our IPv4 configured wan IP and for IPv6 traffic will hit to IPv6 configured wan IP.

 

Please enlighten me how can I achieve my requirements. 

 

@SutareMayur @JoergSchuetter @kiwi @BPry 

@Brandon_Wertz @MP18

Thanks and Regards,
OK.
1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Thank you for reply @OsamaKhan 

 

I assume you are using ISP assigned IPv6 address block. If you want to route IPv6 natively from your Internet Egress point all the way to your server, you will have to break your IPv6 assigned block into smaller subnets and enabled IPv6 on all intermediate nodes where traffic is traversing. Since you have already configured WAN side of your Firewall with IPv6, now you will have to also enabled IPv6 on interfaces facing your switch where your server is connected. For point to point links, you can use /127 addresses and subnet where your server is connect you can use /64. In order to avoid mistakes and better planning, it is better to use IPv6 address calculator.

 

Below is one sample from interface configuration:

PavelK_1-1632226757270.png

 

 

When it comes to NAT, there is no need to enable NAT with IPv6 unless you are running internally ULA (Unique Local Addresses). Since you are planning to run dual stack, all you have to focus is to bring IPv6 connectivity to your server.

Note: On server side, you will have to configure IPv6 DNS server. Also, if in the subnets where your target server is located are also other servers and you leave IPv6 RA/RS enabled, it is possible that other servers will pick up IPv6 through SLAAC and starts to communicate over IPv6 as well.

 

There are more things to consider, however these are major points to focus on.

 

Kind Regards

Pavel

 

 

 

 

 

 

Pavel Kucera

View solution in original post

3 REPLIES 3

L4 Transporter

Thank you for posting question @OsamaKhan 

 

We are currently in the process of migration to IPv6. Regarding your question, there is no pre-requisite. The Dual Stack configuration is fairly straightforward. You will have to enabled IPv6 on interface and configure its IPv6 address, then configure routing for IPv6. After these steps, your IPv6 WAN address should get hit by traffic.

 

We came across a few points:
- Any issue to IPv6 BGP peering also affects IPv4 BGP peering.
- When you configure security policy for IPv6, there is no "any6" object, so all your existing policies that already have "any" will depending on configuration allow or deny IPv4 as well as IPv6 traffic. Somebody in this community found workaround for this: https://live.paloaltonetworks.com/t5/general-topics/create-a-any-ipv6-address-object/td-p/26454

 

Other than this we did not encounter any major issue.

 

Kind Regards
Pavel

Pavel Kucera

Hi Pavel,

 

I have configured the IPv6 interface and route now I can see the traffic but how it will work without nat.

If I give a server an IPv6 IP and try to access the internet how it will work and if I take access to the particular ipv6 server IP will it work??

Thanks and Regards,
OK.

L4 Transporter

Thank you for reply @OsamaKhan 

 

I assume you are using ISP assigned IPv6 address block. If you want to route IPv6 natively from your Internet Egress point all the way to your server, you will have to break your IPv6 assigned block into smaller subnets and enabled IPv6 on all intermediate nodes where traffic is traversing. Since you have already configured WAN side of your Firewall with IPv6, now you will have to also enabled IPv6 on interfaces facing your switch where your server is connected. For point to point links, you can use /127 addresses and subnet where your server is connect you can use /64. In order to avoid mistakes and better planning, it is better to use IPv6 address calculator.

 

Below is one sample from interface configuration:

PavelK_1-1632226757270.png

 

 

When it comes to NAT, there is no need to enable NAT with IPv6 unless you are running internally ULA (Unique Local Addresses). Since you are planning to run dual stack, all you have to focus is to bring IPv6 connectivity to your server.

Note: On server side, you will have to configure IPv6 DNS server. Also, if in the subnets where your target server is located are also other servers and you leave IPv6 RA/RS enabled, it is possible that other servers will pick up IPv6 through SLAAC and starts to communicate over IPv6 as well.

 

There are more things to consider, however these are major points to focus on.

 

Kind Regards

Pavel

 

 

 

 

 

 

Pavel Kucera

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!