ipv6 interface

[LoopSupport]

Hi,

  I can't assign an IPv6 address to a L3 interface of a PA-500 in 3.1.

  But I can add IPv6 addresses to the objects DB, and there is a 'IPv6 firewalling' flag in the general device configuration.

  Has anyone played with IPv6 on a PA? Is there any limitation?

Thanks

[James]

Hi There,

IPv6 is currently supported in VWire only

PAN-OS 4.0 introduces L3 support

Thanks

James

[ncampagna]

If you are running virtual wire, the firewall will forward IPv6 traffic by default. If you enable the global IPv6 firewalling setting, then the firewall will also inspect that traffic and apply firewall rules. 

To address your question of IPv6 limitations, in general, there is one significant one (which we're addressing in the next release):

1. IPv6 is supported only on VWire interfaces with 3.1 (as James mentioned)

Some likely concerns have been addressed already in previous releases:

1. Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured.

2. IPv6 sessions will be synched in HA

3. URL filtering works on IPv6 content

4. The management interface can be accessed using an IPv6 address

Thanks,

Nick

[gmoerschel]

ncampagna says that "Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured." That's fine but if the app is "Teredo" (IPv6 within IPv4 udp/3544), will a PAN 3.1x box treat Teredo as IPv4 traffic and dig into the packet past the embedded (tunneled) IPv6 header to see if there is malware or a disallowed app within the payload of the tunneled frame?

[RNC]

To which one could add 6to4 and ISATAP. In general, what support is there for IPv6 transition methods (and unpicking the traffic within them)? Is there a roadmap?

[ncampagna]

Hello RNC and gmoerschel,

PAN-OS is able to identify and block IPv6 traffic tunneled within IP packets with the App-IDs you've mentioned.  We don't currently decapsulate this tunneled traffic and apply security policy to the inner payload.  At this time I don't have a timeframe I can provide for this capability.

Thanks,

Nick Campagna