PAN-OS 12.1, IPv6 and Region/GeoIP

[UffeRBAndersen]

Hi,

With PAN-OS 12.1, IPv6 addresses are now also showing what Region they belong to. However, this seems to be limited to logs. Security policies, using specific regions/countries, will still not match the IPv6 addresses, even though the same IPv6 addresses shows the appropriate country code in the logs.

Is this a known issue (internally perhaps)? 

[BPry]

@UffeRBAndersen,

There's some caveats to IPv6 geolocation that are suspected that I think you might be running into here. You need to be on a platform with at least 9GBs of memory allocated, if you don't meet that requirement I believe that you'll only get resolution in the logs and not actually see it applied in policy. 

[UffeRBAndersen]

Thanks for your answer 👍. I honestly didn't know of such limitation, but according to PAN-OS 12.1 Release Notes, https://docs.paloaltonetworks.com/ngfw/release-notes/12-1/features-introduced-in-pan-os/networking-f..., it only apply to PA-410*, PA-415* and small PA-VM's, while I've been testing on a PA-440. The size of the GeoIP mapping for IPv6 would be the same, whether used for logging only or for enforcement as well, so I don't see why a smaller device should be able to use geo location for logging but not for enforcement.

I'll see if I can get a larger VM up and running and perform some testing on that.