NPTv6 seems bugged (PAN-OS 9.1.9)

[Freaky]

Hi,

we're running into an issue with IPv6 NPTv6 which we use to route traffic through IPS on PA.

The address isn't translated as expected.

We tried NPTv6 in 2 configurations, both translate the same. We either used:

xxxx:xxxx:xxxx:ffe0::/60 -> xxxx:xxxx:xxxx:fff0::/60

or

xxxx:xxxx:xxxx:ffe3::/64 -> xxxx:xxxx:xxxx:fff3::/64

In both cases we sent traffic towards xxxx:xxxx:xxxx:ffe3:83:0:1:0 and it was translated by NPTv6 to xxxx:xxxx:xxxx:fff3:73:0:1:0.

Any ideas? Seems like a nasty bug.

Tried with 2 completely different source IPv6 addresses by the way, both translated the same with the 5th hextet being 0x10 lower than the original.

[kiwi]

Hi @Freaky ,

Not sure if this is a confirmed bug.

Have you verified the known issues in the OS release notes ? What's the OS version you're using ?

Cheers,

-Kiwi.

[Freaky]

Hi,

couldn't find it in the known issues nor in the fixed issues for 9.1.10.

As mentioned in the title it concerns 9.1.9 🙂

Thanks for the re'!

[Freaky]

We reported this to our PA supplier by the way, don't have access to support myself.

Might take a while to propagate upstream.