IPV6 how to protect the hosts

[nevolex]

Hi everyone, I learn the palo alto firewalls as I configure them.

I have a PA firewall with 3 vlans, with management allowed over main vlan.

My ISP provided the Ipv6/48 block and I have manage to redistribute it over the networks it works great. However considering eveyr ipv6 address is routable and I naturally have no NAT means that the devices with 443 etc ports in theory can be reached over the internet. the the management of the firewall as well. I did edit the mgmt profile only allow my local ipv4 networks I guess it will protect the firewall however what about the other hosts like voip phones, plex etc

is there are rule i can pur in place to build some generic protection like source is all - dest is all, all ports - block, I guess this is something Nat does by default (not that it's built for that )

thank you

[JayGolf · Accepted solution]

Hi @nevolex ,

If traffic is not specifically allowed or denied by a rule, it will get denied. By default, inter-zone traffic is denied and intra-zone traffic is allowed. If you've configured a wide open security policy before these default policies, I would recommend tightening up your security policies to allow specific source IPs.  Here is a Security Policy Rule Best Practices doc that is very insightful.