Source Address - Show ipv4

cancel
Showing results for 
Search instead for 
Did you mean: 

Source Address - Show ipv4

L2 Linker

I just upgraded from a PA 500 to a PA 820 and something is throwing me for a loop.  In all of my reports and in the monitoring section under App Scope the firewall is reporting what appears to be ipv6 addresses, they are in the format of: "::678b:540:ffff:0".  I'd prefer to see the ipv4 address as it is much simpler to hunt down the offending user, etc.  Any way I can disable ipv6 reporting on the PA 820?  I am in PAN OS 10.1.

 

I should mention that the traffic logs are showing the ipv4 address.

 

Thanks.

 

Screen Shot 2021-07-08 at 8.26.00 AM.png

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

This is a known issue, PAN-167327 & PAN-167870 are P1 by engineering and resolved in the next release of 10.1.x.

 

Some of the IPv4 get rendered as IPv6 addresses, and other times the addresses are in hexadecimal opposed to decimal. Important note, this does not affect data plane processing, just rendering on the MGT plane.

 

Please note at this time 10.1.0 does not have a preferred or recommended status by Palo Alto's TAC (bookmark this page). 

 

Prior to upgrade of software, please review known issues & upgrade considerations, too. 

 

Best shot would be to downgrade to a preferred release like 10.0.6 to get reporting features back to full functionality until 10.1 earns the preferred status.

 

Help the community! Add tags & mark solutions please.

View solution in original post

14 REPLIES 14

L4 Transporter

This is a known issue, PAN-167327 & PAN-167870 are P1 by engineering and resolved in the next release of 10.1.x.

 

Some of the IPv4 get rendered as IPv6 addresses, and other times the addresses are in hexadecimal opposed to decimal. Important note, this does not affect data plane processing, just rendering on the MGT plane.

 

Please note at this time 10.1.0 does not have a preferred or recommended status by Palo Alto's TAC (bookmark this page). 

 

Prior to upgrade of software, please review known issues & upgrade considerations, too. 

 

Best shot would be to downgrade to a preferred release like 10.0.6 to get reporting features back to full functionality until 10.1 earns the preferred status.

 

Help the community! Add tags & mark solutions please.

View solution in original post

L2 Linker

Thanks.  Not going to downgrade as we are currently in our downtime here (school) so will hope something gets released in 10.1.x that will be preferred status before we start back up.

L4 Transporter

No guarantees here, but, typically this occurs 1-3 months post release. Go-live date was June 4th, so we may be able to sneak something in before schools return 🙂  

Help the community! Add tags & mark solutions please.

L1 Bithead

10.1.2 still not solved 😞

L0 Member

ver 10.1.2, as was mentioned by @palokb57 has not yet corrected the problem.

 

An IPv4 address of A.B.C.D will be written backwards, in hex.

 

Example, the report shows: ::dcdc:43d0:ffff:0

 

DC = 220, DC 220, 43 = 67, D0=208 and the tail of :ffff:0 we can toss.

 

Those octets of the IP are flipped, so the actual IP address in the report is:

 

208.67.220.220

L4 Transporter

I'm not seeing any current JIRA tickets open for the same issues, perhaps escalate to your account team to see if your territory SE possess alternative guidance. Please note at this time, PAN-OS 10.1.x is still not TAC preferred.

Help the community! Add tags & mark solutions please.

Hi Slick, I dont' get your "JIRA tickets open..." It's just annoying

Palo v10-1-3 ipv6 insteed ipv4 annoyance.JPG

L4 Transporter

I work at Palo and am relaying that our engineering team (JIRA) doesn't have tickets open on this issue at this time. Which likely means it is resolved in a maintenance release of 10.1.x, I just am unable to see which. 

Help the community! Add tags & mark solutions please.

I am very disappointed that even in new version10.1.3 IP v6 addresses are still displayed instead of IP v4. Why is something so essential simply ignored for months? Am I in the wrong place with my complaint?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!