- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-23-2011 02:19 PM
Hi,
I can't assign an IPv6 address to a L3 interface of a PA-500 in 3.1.
But I can add IPv6 addresses to the objects DB, and there is a 'IPv6 firewalling' flag in the general device configuration.
Has anyone played with IPv6 on a PA? Is there any limitation?
Thanks
01-23-2011 02:22 PM
Hi There,
IPv6 is currently supported in VWire only
PAN-OS 4.0 introduces L3 support
Thanks
James
01-24-2011 10:20 AM
If you are running virtual wire, the firewall will forward IPv6 traffic by default. If you enable the global IPv6 firewalling setting, then the firewall will also inspect that traffic and apply firewall rules.
To address your question of IPv6 limitations, in general, there is one significant one (which we're addressing in the next release):
1. IPv6 is supported only on VWire interfaces with 3.1 (as James mentioned)
Some likely concerns have been addressed already in previous releases:
1. Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured.
2. IPv6 sessions will be synched in HA
3. URL filtering works on IPv6 content
4. The management interface can be accessed using an IPv6 address
Thanks,
Nick
04-12-2011 06:54 AM
ncampagna says that "Content-ID and App-ID will be used to process IPv6 traffic if the IPv6 firewalling setting is configured." That's fine but if the app is "Teredo" (IPv6 within IPv4 udp/3544), will a PAN 3.1x box treat Teredo as IPv4 traffic and dig into the packet past the embedded (tunneled) IPv6 header to see if there is malware or a disallowed app within the payload of the tunneled frame?
04-13-2011 03:40 PM
To which one could add 6to4 and ISATAP. In general, what support is there for IPv6 transition methods (and unpicking the traffic within them)? Is there a roadmap?
04-14-2011 08:15 PM
Hello RNC and gmoerschel,
PAN-OS is able to identify and block IPv6 traffic tunneled within IP packets with the App-IDs you've mentioned. We don't currently decapsulate this tunneled traffic and apply security policy to the inner payload. At this time I don't have a timeframe I can provide for this capability.
Thanks,
Nick Campagna
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!