IPV6 | How can I create policy for allow destination ip v6 public ip address

[thanawat_l]

 Dear all,

I am new about IPV6. I want to create policy for ipv6. I need to allow destination with public ipv6 address (Internet V6). How can I assign destination with ipv6 prefix for Internet ipv6?

Thank you for your answer.🙂

[BPry]

@thanawat_l,

Can you describe what you're actually trying to do a bit more, because I'm honestly not sure what you're asking for? IPv6 doesn't really change how you build anything out from a firewall aspect once you get it enabled on the firewall; there's some features that just don't work at the moment (like Geolocation), but security policies and NAT work functionally the same as IPv4. 

[thanawat_l]

For example in ipv4, I want allow public ipv4 in destination address. I try to config 3 group private ip10.0.0.0 – 10.255.255.255, 172.16.0.0 – 172.31.255.255, 192.168.0.0 – 192.168.255.255 and negate it. but in ipv6 I'm not sure about how to config like ipv4.

Thank you. 

[BPry · Accepted solution]

@thanawat_l,

So in the example given you're just negating all RFC 1918 private address ranges. In IPv6 the private address ranges are fc00::/7 (RFC 4193) and fec0::/10 (RFC 3813). Something important to note here is that RFC 3879 deprecates RFC 3813 and the FEC0::/10 shouldn't actually be used anymore. 

[thanawat_l]

Thank you for your solution.