IPv6

IPv6

Appendix C: IPv6 Appendix

This appendix provides an overview of SonicWALL’s implementation of IPv6, how IPv6 operates, and how to configure IPv6 for your network. This appendix contains the following sections:

Feature Overview

The following sections provide an overview of IPv6:

IPv6 Ready Certification

logo_ready_phase-2.gif 

SonicWALL has met the requirements for "IPv6 Ready" Phase-1 and Phase-2, as specified by the IPv6 Forum, a world-wide consortium providing technical guidance for the deployment of IPv6. The IPv6 Ready Logo Program is a conformance and interoperability testing program intended to increase user confidence by demonstrating that IPv6 is available now and ready to be used.

The IPv6 Ready series of tests extends from a basic level of minimum coverage in Phase-1 to a more complete coverage with Phase-2:

SonicWALL has been certified for Phase 2 (Gold) IPv6 Ready status. A future Phase-3 level of IPv6 Ready coverage is currently being developed.  

For more information, see: http://www.ipv6ready.org/

IPv6 Technology Overview

Every device that is connected to the Internet (computer, printer, smart phone, smart meter, etc.) requires an IP address. The Internet Protocol version 4 (IPv4) provides for approximately 4.3 billion unique IP addresses. The rapid global expansion in usage of the Internet, mobile phones, and VoIP telephony will soon lead to the exhaustion of these 4.3 billion IP addresses.

On February 3rd, 2011, the Internet Assigned Numbers Authority (IANA) distributed the last-remaining blocks of IPv4 addresses to the Regional Internet Registries (RIRs). After the RIRs distribute these addresses to ISPs later this year, the world’s supply of new IPv4 addresses will be exhausted.

Luckily, the Internet Engineering Task Force (IETF) began planning for this day back around 1992, and in 1998, RFC 2460 was published to define Internet Protocol, Version 6 (IPv6). By increasing the address length from 32 bits to 128 bits, IPv6 dramatically increases the number of available addresses compared to IPv4:

Understanding IPv6 Addresses

IPv6 addresses are written in eight groups of four hexadecimal digits separated by colons, in the form:

XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX:XXXX

IPv6 addresses are logically divided into two parts: a 64-bit (sub-)network prefix, and a 64-bit interface identifier. Here is an example of an IPv6 address:

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Note         The hexadecimal digits in IPv6 addresses are case-insensitive.

IPv6 address can be abbreviated using the following two rules:

  1. Leading zeroes within a 16-bit value may be omitted. Thus, our example address can be abbreviated from the full form:

    2. to this abbreviated form:

  2. Any number of consecutive groups of four zeros (technically 16-bits of zeros) can be expressed by a double colon (the “::” symbol). Combing these two rules, our example address can be abbreviated from the full form:

to this abbreviated form:

Type of Address

Full Address

Abbreviated Address

unicast address

1080:0:0:0:8:800:200C:417A

1080::8:800:200C:417A

multicast address

FF01:0:0:0:0:0:0:101

FF01::101

loopback address

0:0:0:0:0:0:0:1

::1

unspecified address

0:0:0:0:0:0:0:0

::

Note         Networks must have IPv4 internet connectivity in order to get connected to IPv6 internet.

Note         IPv6 stack must be enabled for computers at the local network sites.

 

Here is a simplified picture showing connectivity model for a typical IPv6 deployment.

ipv6_basic_topology.jpg

 

The following diagram shows a comparison of the header elements between IPv4 and IPv6.

ipv6_ipv4_headers.jpg

 

IPv6 Benefits

IPv6 brings some key features to improve the limitations exposed by IPv4. The new IP standard extends IPv4 in a number of important aspects:

SonicWALL IPv6 Feature Support

The following is a list of IPv6 services and features that are currently supported by SonicWALL:

SonicWALL IPv6 Features Not Currently Supported

The following is a list of IPv6 services and features that are not currently supported by SonicWALL.

Note         SonicOS Enhanced 5.5.6.0 is a dual IP stack firmware. Features that are not supported for IPv6 are still supported for IPv4.

Supported IPv6 RFCs

This section lists the IPv6 RFCs that are supported in the SonicOS Enhanced 5.5.6.0 release.

TCP/IP stack and Network Protocols

IPsec Conformance

NAT Conformance

DNS Conformance

Non-Supported IPv6 RFCs

This section lists the IPv6 RFCs that are currently not supported in the SonicOS Enhanced 5.5.6.0 release.

Configuring IPv6

The following sections describe how to configure IPv6:

IPv6 Interface Configuration

IPv6 interfaces are configured on the Network > Interfaces page by clicking the IPv6 option for the View IP Version radio button at the top right corner of the page.

By default, all IPv6 interfaces appear as routed with no IP address. Multiple IPv6 addresses can be added on the same interface. Auto IP assignment can only be configured on WAN interfaces.

Each interface can be configured to receive router advertisement or not. IPv6 can be enabled or disabled on each interface.

Note         The zone assignment for an interface must be configured through the IPv4 interface page before switching to IPv6 mode.

The following sections describe IPv6 interface configuration:

IPv6 Interface Configuration Constraints

Configuring an Interface for IPv6 Static Mode

Static mode provides user a way to assign static IPv6 address as opposed to an auto-assigned address. Using static mode, the IPv6 interface can still listen for Router Advertisements and learn an autonomous address from the appropriate prefix option. Static Mode does not disturb the running of Stateless Address Autoconfiguration on IPv6 interface unless the user manually disables it.

The following diagram shows a sample topology with IPv6 configured in static mode.

ipv6_static_mode_topology.jpg

 

3 types of IPv6 address are possible to assign under this mode:

To configure an interface for a static IPv6 address, perform the following steps:

  1. Navigate to the Network > Interfaces page.

  2. Click on the IPv6 button at the top right corner of the page. IPv6 addresses for the appliance are displayed.

  3. Click on the Configure icon for the interface you want to configure an IPv6 address for. The Edit Interface window displays.

    4. Note         The zone assignment for interfaces must be configured on the IPv4 addressing page. To modify the zone assignment for an IPv6 interface, click the IPv4 button at the top right of the page, modify the zone for the interface, and then return to the IPv6 interface page.

  4. In the IP Assignment pulldown menu, select Static.

  5. Enter the IPv6 Address for the interface.

  6. Enter the Prefix Length for the address.

  7. If this is the primary WAN interface, enter the IPv6 address of the Default Gateway. If this is not the primary WAN interface, any Default Gateway entry will be ignored, so you can leave this as ::. (The double colon is the abbreviation for an empty address, or 0:0:0:0:0:0:0:0.)

  8. If this is the primary WAN interface, enter up to three DNS Server IPv6 addresses. Again, if this is not the primary WAN interface, any DNS Server entries will be ignored.

  9. Select Enable Router Advertisement to make this an advertising interface that distributes network and prefix information.

  10. Select Advertise Subnet Prefix of IPv6 Primary Static Address to add a default prefix into the interface advertising prefix list. This prefix is the subnet prefix of interface IPv6 primary static address. This option will help all hosts on the link stay in the same subnet.

Configuring Advanced IPv6 Interface Options and Multiple IPv6 Addresses

Perform the following steps to modify Advanced IPv6 interface options or to configure multiple static IPv6 addresses.

  1. In the Edit Interface window, click on the Advanced tab.

  2. Click the Add Address button to configure multiple static IPv6 addresses for the interface.

    3. Note         Multiple IPv6 addresses can only be added for an interface that is configured for Static IPv6 address mode. Multiple IPv6 addresses cannot be configured for Auto or DHCPv6 modes.

  3. Enter the IPv6 Address for the additional address for the interface.

  4. Enter the Prefix Length for the address.

  5. Select Advertise Subnet Prefix of IPv6 Primary Static Address to add a default prefix into the interface advertising prefix list. This prefix is the subnet prefix of interface IPv6 primary static address. This option will help all hosts on the link stay in the same subnet.

  6. Click OK.

  7. The following additional options can be configured on the Advanced tab under the Advanced Settings heading:

Similar with IPv4 gratuitous ARP, IPv6 node uses Neighbor Solicitation message to detect duplicate IPv6 address on the same link. DAD must be performed on any Unicast address (except Anycast address) before assigning a tentative to an IPv6 interface.

Configuring Router Advertisement Settings

Router Advertisement allows IPv6 routers to advertise DNS recursive server addresses to IPv6 hosts. Router Advertisement-based DNS configuration is a useful, optional alternative in networks where an IPv6 host's address is autoconfigured through IPv6 stateless address autoconfiguration, and where the delays in acquiring server addresses and communicating with the servers are critical. Router Advertisement allows the host to acquire the nearest server addresses on every link. Furthermore, it learns these addresses from the same RA message that provides configuration information for the link, thereby avoiding an additional protocol run. This can be beneficial in some mobile environments, such as with Mobile IPv6. SonicWALL’s implementation of IPv6 is full conformable with RFC 4861 in Router and Prefix Discovery.

Note         Router Advertisement can only be enabled when interface is under Static mode.

To configure Router Advertisement for an IPv6 interface, perform the following steps.

  1. In the Edit Interface window, click on the Router Advertisement tab.

  2. Select the Enable Router Advertisement checkbox to have make this an advertising interface that will distribute network and prefix information.

  3. Optionally, you can modify the following Router Advertisement settings:

  4. Select the Managed checkbox to set the managed address configuration flag in the Router Advertisement message. If set, it indicates that IPv6 addresses are available via Dynamic Host Configuration Protocol.

  5. Select the Other Configuration checkbox to set the Other configuration flag in Router Advertisement message. If set, it indicates that other configuration information is available via Dynamic Host Configuration Protocol.

Configuring Router Advertisement Prefix Settings

  1. Click the Add Prefix button to configure an advertising prefix. Advertising prefixes are used for providing hosts with prefixes for on-link determination and Address Autoconfiguration.

  2. Enter the Prefix that is to be advertised with the Router Advertisement message.

  3. Enter the Valid Lifetime to set the length of time (in minutes) that the prefix is valid for the purpose of on-link determination. A value of “71582789” means the lifetime is infinite.

  4. Enter the Preferred Lifetime to set the length of time that addresses generated from the prefix via stateless address autoconfiguration remain preferred. A value of “71582789” means the lifetime is infinite.

  5. Optionally click the On-link checkbox to enable the on-link flag in Prefix Information option, which indicates that this prefix can be used for on-link determination.

  6. Optionally click the Autonomous checkbox to enable the autonomous address-configuration flag in Prefix Information option, which indicates that this prefix can be used for stateless address configuration.

  7. Click OK.

Configuring an Interface for DHCPv6 Mode

DHCPv6 (DHCP for IPv6) is a client/server protocol that provides stateful address configuration or stateless configuration setting for IPv6 hosts. DHCPv6 client is enabled to learn IPv6 address and network parameters when interface is configured to DHCPv6 mode.

DHCPv6 defines two different configuration modes:

The following diagram shows a sample DHCPv6 topology.

ipv6_dhcp_mode_topology.jpg

 

There are three types of IPv6 addresses that can be assign under DHCPv6:

To configure an interface for a DHCPv6 address, perform the following steps:

  1. Navigate to the Network > Interfaces page.

  2. Click on the IPv6 button at the top right corner of the page. IPv6 addresses for the appliance are displayed.

  3. Click on the Configure icon for the interface you want to configure an IPv6 address for. The Edit Interface window displays.

  4. In the IP Assignment pulldown menu, select DHCPv6.

  5. The following options can be configured for IPv6 interfaces configured for DHCPv6 mode:

  6. Set the DHCPv6 Mode for the interface. As required by RFC, DHCPv6 client depends on Router Advertisement message to decide which mode (stateful or stateless) it should choose. This definition will limit user's choice if they want to determine DHCPv6 mode by itself. SonicWALL’s implementation of DHCPv6 defines two different modes to balance the conformance and flexibility:

  7. Optionally, select the Only Request Stateless Information checkbox to have DHCPv6 clients only requests network parameter setting from the DHCPv6 server. The IPv6 address is assigned through stateless auto-configuration.

  8. Click OK to complete the configuration, or click the Advanced tab to configure Advanced options or click the Protocol tab to view DHCPv6 stateful and stateless configuration information.

Configuring Advanced Settings for an IPv6 Interface

The following options can be configured on the Advanced tab of the IPv6 Edit Interface window:

Similar with IPv4 gratuitous ARP, IPv6 node uses Neighbor Solicitation message to detect duplicate IPv6 address on the same link. DAD must be performed on any Unicast address (except Anycast address) before assigning a tentative to an IPv6 interface.

DHCPv6 Protocol Tab

When configuring an IPv6 interface in DHCpv6 mode, the Protocol tab displays additional DHCPv6 information.

The following information is displayed on the Protocol tab:

Configuring an Interface for Auto Mode

Auto mode utilities IPv6’s Stateless Address Autoconfiguration to assign IPv6 address. This mode does not require any manual address configuration by the network administrator. The firewall listens to the network and receives prefix information from neighboring routers. The IPv6 Stateless Address Autoconfiguration feature performs all configuration details, such as IPv6 address assignment, address deleting for address conflicting or lifetime expiration, and default gateway selection based on the information collected from on-link router.

Note         Auto mode can only be configured for the WAN zone. For security consideration, Auto mode is not available on LAN zone interface.

The following diagram shows a sample topology for IPv6 configured in Auto mode.

ipv6_auto_mode_topology.jpg

 

In this mode, 2 types of IPv6 address are possible to assign:

To configure an IPv6 interface for Auto mode, perform the following tasks:

  1. Navigate to the Network > Interfaces page.

  2. Click on the IPv6 button at the top right corner of the page. IPv6 addresses for the appliance are displayed.

  3. Click on the Configure icon for the interface you want to configure an IPv6 address for. The Edit Interface window displays.

  4. In the IP Assignment pulldown menu, select Auto.

  5. Optionally, you can select enter a numeric value for Duplicate Address Detection Transmits on the Advanced tab to specify the number of consecutive Neighbor Solicitation messages sent while performing Duplicate Address Detection (DAD) before assigning a tentative address to interface. A value of 0 indicates that DAD is not performed on the interface.

  6. Click OK.

Configuring IPv6 Tunnel Interfaces

This section describes how to tunnel IPv4 packets through IPv6 networks and IPv6 packets through IPv4 networks. For instance, in order to pass IPv6 packets through the IPv4 network, the IPv6 packet will be encapsulated into an IPv4 packet at the ingress side of a tunnel. When the encapsulated packet arrives at the egress of the tunnel, the IPv4 packet will be de-capsulated.

Tunnels can be either automatic or manually configured. A configured tunnel determines the endpoint addresses by configuration information on the encapsulating node. An automatic tunnel determines the IPv4 endpoints from the address of the embedded IPv6 datagram. IPv4 multicast tunneling determines the endpoints through Neighbor Discovery.

The following diagram depicts an IPv6 to IPv4 tunnel.

ipv6_tunnel_graphic.jpg

 

The following sections describe IPv6 Tunnel Interface configuration:

Configuring the 6to4 Auto Tunnel

The 6to4 Auto Tunnel is an automatic tunnel: tunnel endpoints are extracted from the encapsulated IPv6 datagram. No manual configuration is necessary.

6to4 tunnels use a prefix of the form “2002:tunnel-IPv4-address::/48” to tunnel IPv6 traffic over IPv4. (for example, if the tunnel’s IPv4 endpoint has the address a01:203, the 6to4 tunnel prefix is “2002:a01:203::1.”) Routers advertise a prefix of the form “2002:[IPv4]:xxxx/64” to IPv6 clients. For complete information, see RFC 3056.

The following diagram shows a sample 6to4 auto tunnel topology.

ipv6-6to4_tunnel_topology.jpg

 

In the example, customers do not need to specify the tunnel endpoint, but only need to enable the 6to4 auto tunnel. All packets with a 2002 prefix will be routed to the tunnel, and the tunnel's IPv4 destination will be extract from the destination IPv6 address.

6to4 tunnels are easy to configure and use. Users must have a global IPv4 address and IPv6 address, which must also have a 2002 prefix. Therefore, in general, user can only access network resource with a 2002 prefix.

Note         Only one 6to4 auto tunnel can be configured on the firewall.

To configure the 6to4 tunnel on the firewall, perform the following steps:

  1. Navigate to the Network > Interfaces page.

  2. Click the Add Interface button.

  3. Select the Zone for the 6to4 tunnel interface. This is typically the WAN interface.

  4. In the Tunnel Type pulldown menu, select 6to4 Auto Tunnel Interface.

  5. By default, the interface Name is set to 6to4AutoTun.

  6. Select the Enable IPv6 6to4 Tunnel checkbox.

  7. Optionally, you can configure Management login or User Login over the 6to4 tunnel.

  8. Click OK.

Configuring 6to4 Relay for Non-2002 Prefix Access

By default, 6to4 auto tunnel can only access the destination with a 2002 prefix. The 6to4 relay feature can be used to access non-2002 prefix destinations. To enable 6to4 relay, simply create a Route Policy to route all traffic destined for 2003 prefixes over the 6to4 auto tunnel interface, as shown in the following example.

ipv6_6to4_route_policy.jpg

 

This static route can be added on the 6to4 auto tunnel interface to enable the relay feature, which makes it possible to access the IPv6 destination with non-2002: prefix through 6to4 tunnel. Note that, the gateway must be the IPv6 address with the 2002: prefix.

Configuring a Manual Ipv6 Tunnel

To configure the 6to4 tunnel on the firewall, perform the following steps:

  1. Navigate to the Network > Interfaces page.

  2. Click the Add Interface button.

  3. Select the Zone for the tunnel interface.

  4. In the Tunnel Type pulldown menu, select IPv6 Manual Tunnel Interface.

  5. Enter a Name for the tunnel interface.

  6. Enter the Remote IPv4 address for the tunnel endpoint.

  7. For the Remote IPv6 network select an IPv6 Address object, which can be a group, range, network, or Host.

  8. Optionally, you can configure Management login or User Login over the 6to4 tunnel.

  9. Click OK.

Configuring a GRE IPv6 Tunnel

GRE can be used to tunnel IPv4 and IPv6 traffic over IPv4 or IPv6. GRE tunnels are static tunnels where both endpoints are specified manually. The following diagram shows a sample GRE IPv6 tunnel.

ipv6_GRE_tunnel_topology.jpg

 

The configuration of a GRE tunnel is similar to a manual tunnel, except GRE Tunnel Interface is selected for the Tunnel Type.

Accessing the SonicWALL User Interface Using IPv6

After IPv6 addressing has been configured on the firewall, the SonicWALL user interface can be accessed by entering the IPv6 of the firewall in your browser’s URL field.

ipv6_ula.jpg

 

IPv6 Network Configuration

IPv6 DNS

DNS for IPv6 is configured in the same method as for IPv4. Simply click the IPv6 option in the View IP Version radio button at the top left of the Network > DNS page.

Address Objects

IPv6 address objects or address groups can be added in the same manner as IPv4 address objects. On the Network > Address Objects page, the View IP Version radio button has three options: IPv4 only, IPv6 only, or IPv4 and IPv6.

Note         Address Objects of type Host, Range and Network are supported. Dynamic address objects for MAC and FQDN are not currently supported for IPv6 hosts.

IPv4 interfaces define a pair of a default Address Object (DAO) and an Address Object Group for each interface. The basic rule for IPv4 DAO is each IPv4 address corresponds to 2 address objects: Interface IP and Interface Subnet. There are also couples of AO groups for Zone Interface IP, Zone Subnets, All Interface IP, All Interface Management IP, etc.

IPv6 interface prepares the same DAO set for each interface. Because multiple IPv6 can be assigned to one interface, all of those address can be added, edited, and deleted dynamically. Therefore, IPv6 DAOs need to be created and deleted dynamically.

To address this, DAOs are not generated dynamically for IPv6 interfaces. Only limited interface DAO are created, which results in limitation support for other module which needs to refer interface DAO.

Policy Based Routing

Policy Based Routing is fully supported for IPv6 by selecting IPv6 address objects and gateways for route policies on the Network > Routing page. On the Network > Routing page, the View IP Version radio button has three options: IPv4 only, IPv6 only, or IPv4 and IPv6.

IPv6 NAT Policies

NAT policies can be configured for IPv6 by selecting IPv6 address objects on the Network > NAT Policies page. On the Network > NAT Policies page, the View IP Version radio button has three options: IPv4 only, IPv6 only, or IPv4 and IPv6.

When configuring IPv6 NAT policies, the source and destination objects can only be IPv6 address objects.

Note         IPv6 probing for NAT policies is not currently supported.

Neighbor Discovery Protocol

The Neighbor Discovery Protocol (NDP) is a new messaging protocol that was created as part of IPv6 to perform a number of the tasks that ICMP and ARP accomplish in IPv4. Just like ARP, Neighbor Discovery builds a cache of dynamic entries, and the administrator can configure static Neighbor Discovery entries. The following table shows the IPv6 neighbor messages and functions that are analogous to the traditional IPv4 neighbor messages.

IPv4 Neighbor message

IPv6 Neighbor message

ARP request message

Neighbor solicitation message

ARP relay message

Neighbor advertisement message

ARP cache

Neighbor cache

Gratuitous ARP

Duplicate address detection

Router solicitation message (optional)

Router solicitation (required)

Router advertisement message (optional)

Router advertisement (required)

Redirect message

Redirect Message

To configure NDP, navigate to the Network > Neighbor Discovery page.

The Static NDP feature allows for static mappings to be created between a Layer 3 IPv6 address and a Layer 2 MAC address. To configure a Static NDP entry, perform the following steps:

  1. On the Network > Neighbor Discovery page, click the Add button.

  2. In the IP Address field, enter the IPv6 address for the remote device.

  3. In the Interface pulldown menu, select the interface on the firewall that will be used for the entry.

  4. In the MAC Address field, enter the MAC address of the remote device.

  5. Click OK. The static NDP entry is added.

The NDP Cache table displays all current IPv6 neighbors. The follow types of neighbors are displayed:

Multicast Routing

The Network > Multicast Routing page is used to configure multicast settings for IPv6, which are divided into the two following sections:

Multicast Proxy

Maintaining interoperability between IPv6 and IPv4 networks is one of the main challenges of implementing IPv6 in a network. While packet-based multicast translation can be used, SonicWALL supports a multicast proxy solution that can be deployed at the border between IPv6 and IPv4 networks. The SonicWALL receives multicast data from the IPv4 network, caches it, and then multicasts the data to the IPv6 network. (And vice versa for sending multicast data from the IPv6 to the IPv4 network.) This is accomplished without the need for packet-based translation.

To configure Multicast Proxy between IPv6 and IPv4 networks, perform the following steps:

  1. Navigate to the Network > Multicast Routing page.

  2. Select the Enable Multicast Proxy checkbox.

  3. In the Upstream Interface pulldown menu, select the interface that is connected to the IPv6 network.

  4. In the Downstream Interface pulldown menu, select the interface that is connected to the IPv4 network.

  5. Click the Accept button. Multicast data will now be proxied \.

Multicast Listener Discovery

The Multicast Listener Discovery (MLD) protocol is used by IPv6 routers to discover multicast listeners that are directly connected to the firewall. MLD performs a similar function for IPv6 that IGMP is used for in IPv4. There are two versions of MLD. MLDv1 is similar to IGMPv2, and MLDv2 similar to IGMPv3.

MLD Version

RFC

URL

MLDv1

RFC 2710

http://tools.ietf.org/html/rfc2710

MLDv2

RFC 3810

http://tools.ietf.org/html/rfc3810

MLD functionality does not require any explicit configuration. There are several variables that can be fine-tuned to modify the MLD behavior:

DHCPv6 Configuration

DHCPv6 server can be configured similar to IPv4 after selecting the IPv6 option in the View IP Version radio button at the top left of the Network > DNS page.

IPv6 Access Rules Configuration

IPv6 firewall access rules can be configured in the same manner as IPv4 access rules by choosing IPv6 address objects instead of IPv4 address objects. On the Firewall > Access Rules page, the View IP Version radio button has three options: IPv4 only, IPv6 only, or IPv4 and IPv6.

When adding an IPv6 access rule, the source and destination can only be IPv6 address objects.

IPv6 IPSec VPN Configuration

IPSec VPNs can be configured for IPv6 in a similar manner to IPv4 VPNs after selecting the IPv6 option in the View IP Version radio button at the top left of the VPN > Settings page.

There are certain VPN features that are currently not supported for IPv6, including:

When configuring an IPv6 VPN policy, on the General tab the gateways must be configured using IPv6 addresses. FQDN is not supported. When configuring IKE authentication, IPV6 addresses can be used for the local and peer IKE IDs.

Note         DHCP Over VPN and L2TP Server are not supported for IPv6.

On the Network tab of the VPN policy, IPV6 address objects (or address groups that contain only IPv6 address objects) must be selected for the Local Network and Remote Network.

DHCP Over VPN is not supported, thus the DHCP options for protected network are not available.

The Any address option for Local Networks and the Tunnel All option for Remote Networks are removed. Select an all zero IPv6 Network address object could be selected for the same functionality and behavior.

On the Proposals tab, the configuration is identical for IPv6 and IPv4, except for the fact that IPv6 only support IKEv2 mode.

On the Advanced tab, only Enable Keep Alive and the IKEv2 Settings can be configured for IPv6 VPN policies.

Note         Because an interface may have multiple IPv6 address, sometimes the local address of the tunnel may vary periodically. If the user needs a consistent IP address, configure the VPN policy to be bound to an interface instead of Zone, and specify the address manually. The address must be one of IPv6 addresses for that interface.

SSL VPN Configuration for IPv6

SonicOS supports NetExtender connections for users with IPv6 addresses. On the SSLVPN > Client Settings page, first configure the traditional IPv6 IP address pool, and then configure an IPv6 IP Pool. Clients will be assigned two internal addresses: one IPv4 and one IPv6.

Note         IPv6 DNS/Wins Server are not supported

On the SSLVPN > Client Routes page, user can select a client routes from the drop-down list of all address objects including all the pre-defined IPv6 address objects.

Note         IPv6 FQDN is supported.

IPv6 Diagnostics and Monitoring

SonicOS provides a full compliment of diagnostic tools for IPv6, including the following:

Packet Capture

Packet Capture fully supports IPv6.

IPv6 keywords can be used to filter the packet capture.

IPv6 Ping

The ping tool includes a new Ping IPv6 network preferred option.

When pinging a domain name, it uses the first IP address that is returned and shows the actual pinging address. If both an IPv4 and IPv6 address are returned, by default, the firewall pings the IPv4 address.

If the Ping IPv6 network preferred option is enabled, the firewall will ping the IPv6 address.

IPv6 DNS Lookup and Reverse Name Lookup

When performing IPv6 DNS Lookup or IPv6 Reverse Name Lookup, you must enter the DNS server address. Either an IPv6 or IPv4 address can be used.