Dynamic IPv6 Address Assignment on the Management Interface
Table of Contents
Expand all | Collapse all
-
- Authenticate LSVPN Satellite with Serial Number and IP Address Method
- Private Key Export in Certificate Management
- Clone a Snippet
- Security Checks
- GlobalProtect Portal and Gateway
- IP Optimization for Mobile Users - GlobalProtect Deployments
- License Enforcement for Mobile Users (Enhancements)
- Multiple Virtual Routers Support on SD-WAN Hubs
- Native SASE Integration with Prisma SD-WAN
- New Prisma Access Cloud Management Location
- Normalized Username Formats
- PAN-OS Software Patch Deployment
- Policy Analyzer
- Saudi Arabia Compute Location
- Site Template Configuration
- TACACS+ Accounting
- Tenant Moves and Acquisitions
- Traceability and Control of Post-Quantum Cryptography in Decryption
- User Session Inactivity Timeout
-
- FedRAMP High "In Process" Requirements and Activation
- License Activation Changes
- Performance Policy with Forward Error Correction (FEC)
- View and Monitor ZTNA Connector Access Objects
- Software Cut-Through Support for PA-3400 and PA-5400 Series Firewalls
- Persistent NAT for DIPP
- ZTNA Connector Wildcard and FQDN Support for Applications and Additional Diagnostic Tools
-
- 5G Cellular Interface for IPv4
- Advanced WildFire Inline Cloud Analysis
- API Key Certificate
- App Acceleration in Prisma Access
- ARM Support on VM-Series Firewall
- Authentication Exemptions for Explicit Proxy
- BGP MRAI Configuration Support
- Cloud Managed Support for Prisma Access China
- Configuration Audit Enhancements
- Cortex Data Lake (CDL) Logging with CN-Series Firewall
- Device-ID Visibility and Policy Rule Recommendations in PAN-OS
- Dynamic IPv6 Address Assignment on the Management Interface
- Dynamic Routing in CN-Series HSF
- Enhanced IoT Policy Recommendation Workflow for Strata Cloud Manager
- Enhanced SaaS Tenants Control
- Exclude All Explicit Proxy Traffic from Authentication
- Region Support for Strata Logging Service
- GlobalProtect Portal and Gateway Support for TLSv1.3
- IKEv2 Certificate Authentication Support for Stronger Authentication
- Improved Throughput with Lockless QoS
- Increased Device Management Capacity for the Panorama Virtual Appliance
- Inline Security Checks
- Integrate Prisma Access with Microsoft Defender for Cloud Apps
- IoT Security: Device Visibility and Automatic Policy Rule Recommendations
- IOT Security Support for CN-Series
- IP Protocol Scan Protection
- IPSec VPN Monitoring
- Link Aggregation Support on VM-Series
- Maximum of 500 Remote Networks Per 1 Gbps IPSec Termination Node
- New Platform Support for Web Proxy
- New Template Variables
- PA-415-5G Next-Generation Firewall
- PA-450R Next-Generation Firewall
- PA-455 Next-Generation Firewall
- PA-5445 Next-Generation Firewall
- PA-7500 Next-Generation Firewall
- Policy Rulebase Management Using Tags
- Post Quantum IKE VPN Support
- PPPoE Client for IPv6
- Public Cloud SD-WAN High Availability (HA)
- Remote Browser Isolation
- Secure Copy Protocol (SCP) Support
- Security Checks
- Service Connection Identity Redistribution Management
- Service Provider Backbone Integration
- Session Resiliency for the VM-Series on Public Clouds
- Intelligent Security with PFCP for N6 and SGI Use Cases
- SNMP Network Discovery for IoT Security
- Strata Cloud Manager: Application Name Updates
- Support for Cortex Data Lake Switzerland Region
- TACACS+ Accounting
- Throughput Enhancements for Web Proxy
- TLSv1.3 Support for Administrative Access Using SSL/TLS Service Profiles
- Traceability and Control of Post-Quantum Cryptography in Decryption
- Traffic Replication Remote Network and Strata Cloud Manager Support
- VM-Series Device Management
- View and Monitor App Acceleration
- View and Monitor Remote Browser Isolation
- Virtual Routing Forwarding for WAN Segmentation
-
- New Prisma Access Cloud Management Location
- Cortex Data Lake Regional Support
- Integrate Prisma Access with Microsoft Defender for Cloud Apps
- Delete a Snippet
- Create a Custom Path Quality Profile
- High-Bandwidth Private App Access with Colo-Connect
- Refresh Pre Shared Keys for Auto VPN
- New Predefined BGP Redistribution Profile
- Troubleshoot NGFW Connectivity and Policy Enforcement Anomalies
- Cloud IP-Tag Collection
- Web Proxy for Cloud-Managed Firewalls
- Config Version Snapshot
- Log Viewer Usability Enhancements
- Introducing ADEM APIs
- July 2023
-
- High-Bandwidth Private App Access with Colo-Connect
- Traffic Replication and PCAP Support
- Third-Party Device-ID in Prisma Access
- New and Remapped Prisma Access Locations and Compute Locations
- Transparent SafeSearch Support
- Private IP Visibility and Enforcement for Explicit Proxy Traffic Originating from Remote Networks
- Service Provider Backbone Integration
- Cloud Management of NGFWs
- Feature Adoption Dashboard
- Best Practices Dashboard
- Compliance Summary Dashboard
- Security Posture Insights Dashboard
- Advanced Threat Prevention Dashboard
- Custom Dashboard
- Device Health Dashboard
- Incidents and Alerts
- NGFW SDWAN Dashboard
- Capacity Analyzer
- Enhancements to CDSS Dashboard
-
- Conditional Connect Method for GlobalProtect
- Enhanced Split Tunnel Configuration
- Prisma Access Explicit Proxy Connectivity in GlobalProtect for Always-On Internet Security
- Host Information Profile (HIP) Exceptions for Patch Management
- Host Information Profile (HIP) Process Remediation
- License Activation
Dynamic IPv6 Address Assignment on the Management Interface
The management interface can receive a dynamic IPv6 address assignment by using
either stateful DHCPv6 or SLAAC with stateless DHCPv6.
The management (MGT) interface on the NGFW now supports dynamic IPv6 address
assignment. Configuring the MGT interface for dynamic IPv6 address assignment
(rather than a static address) makes it easier to insert and manage the firewall in
an IPv6 network.
When you configure the MGT interface, you'll notice new IPv4 and IPv6 tabs to
separate the configurations.
You have two types of addressing to choose from: stateful or stateless. On the
network segment, you control the router where you set flags to indicate that the MGT
interface will be one of the following:
- A stateful DHCPv6 client, which receives its IPv6 address with prefix length and other configuration information from a DHCPv6 server.
- An IPv6 stateless address autoconfiguration (SLAAC) client, which autogenerates its IPv6 address. A stateless IPv6 address avoids a DHCPv6 server having to store dynamic state information about clients; such avoidance is helpful in environments with a large number of endpoints.
The firewall uses Neighbor Discovery Protocol (NDP) to send a Router Solicitation to
all routers on the link. The flags in the Router Advertisement (RA) that the sole
router (or preferred router) on the link sends to the firewall control whether the
firewall will use SLAAC or stateful DHCPv6 to get a dynamic address for the MGT
interface.
However, the current situation is that when the Autonomous (A) flag is set in the RA
message, the firewall chooses both a DHCPv6 address and a SLAC address. Ideally, the
firewall should choose only the SLAAC address and shouldn't send a DHCPv6 Solicit
message. As a result of this known issue, if there is a DHCPv6 server on the segment
and it can assign an IPv6 address, the firewall prefers DHCPv6 address assignment
over SLAAC.
You specify either a static IPv6 default gateway address or request a dynamic IPv6
default gateway address, which the firewall learns from the RA that the router
sends. Even if you configure the MGT interface with a static IPv6 address, you now
have this same choice for configuring the default gateway.
Therefore, you have four possible options for configuring the MGT interface and its
default gateway:
- Static IPv6 address and static IPv6 default gateway address
- Static IPv6 address and dynamic IPv6 default gateway address
- Dynamic IPv6 address and static IPv6 default gateway address
- Dynamic IPv6 address and dynamic IPv6 default gateway address
Configuring the MGT interface as a DHCPv6 client involves requesting a Non-Temporary
or Temporary Address, deciding on the Rapid Commit option, and specifying the DHCPv6
Unique ID type.