>
    Strata Copilot
    Configure the Management Interface for Dynamic IPv6 Address Assignment
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. DHCP
    4. Configure the Management Interface for Dynamic IPv6 Address Assignment
    Download PDF
    Next-Generation Firewall

    Configure the Management Interface for Dynamic IPv6 Address Assignment

    Table of Contents

    Configure the Management Interface for Dynamic IPv6 Address Assignment

    Configure the management interface to receive a dynamic IPv6 address assignment.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    Before you configure the management (MGT) interface for dynamic IPv6 address assignment, read Dynamic IPv6 Addressing on the Management Interface to understand how IPv6 stateless address autoconfiguration (SLAAC) or DHCPv6 determines the address.
    The management interfaces on WildFire and Panorama models don't support this DHCPv6 functionality.
    • For hardware-based firewall models (not VM-Series), configure the management interface with a static IPv6 address when possible.
    • If the firewall acquires a management interface address through DHCPv6, assign a MAC address reservation on the DHCPv6 server that serves that firewall. The reservation ensures that the firewall retains its management IP address after a restart.
    If you use stateless mode (SLAAC/autoconfig), use it in a secured environment.
    As an alternative to using dynamic IPv6 address assignment on the management interface, you can Configure the Management Interface as a DHCP Client using IPv4.
    If you configure the MGT interface as a DHCPv6 client, the following restrictions apply:
    • You can't use the MGT interface in an HA configuration for control link (HA1 or HA1 backup), data link (HA2 or HA2 backup), or packet forwarding (HA3) communication.
    • You can't select MGT as the Source Interface when you customize service routes (DeviceSetupServicesService Route ConfigurationCustomize). However, you can select Use default to route the packets via the management interface.
    • You can't use the dynamic IP address of the MGT interface to connect to a hardware security module (HSM). The IP address on the HSM client firewall must be a static IP address because HSM authenticates the firewall using the IP address, and operations on HSM would stop working if the IP address were to change during runtime.
    • An additional limitation is that when the preferred lifetime of the IPv6 address on the MGT interface expires, existing IPv6 sessions are disconnected. To elaborate, the configuration is sent by the DHCPv6 server and RADVD server. The firewall takes the valid lifetime and preferred lifetime from these RA messages from the servers and set the times based on the values received. RFC 8415 indicates that existing communications must remain for the duration of the valid lifetime if the preferred lifetime expires (sessions must be active during the time between the preferred lifetime and valid lifetime). However, the NGFW limitation is that sessions are lost when the preferred lifetime expires.
    A prerequisite for getting a DHCPv6 address is that the MGT interface must be able to reach a DHCPv6 server.
    1. Configure the MGT interface for dynamic IPv6 address assignment.
      1. Select DeviceSetupInterfaces and select the Management interface.
        Selections unrelated to a dynamic address (such as speed, MTU, permitted IP addresses, administrative management services, and network services) are documented in the PAN-OS Administrator's Guide: Perform Initial Configuration.
      2. Select IPv6 and Enable IPv6.
      3. Select Type as Dynamic.
    2. In the DHCPv6 Client Options section, select Non Temporary Address (default setting). This address type has a longer lifespan than a Temporary Address.
      Whether you request a Non-Temporary Address or Temporary Address for the interface is based on your discretion and the capability of the DHCPv6 server; some servers can provide only a temporary address. You can choose Non Temporary Address or Temporary Address, but not both.
    3. Select Temporary Address for a greater level of security because the address is intended to be used for a short period of time.
      The IPv6 address isn't automatically renewed and will expire when the valid time reaches 0.
    4. Select Rapid Commit to use the DHCPv6 process of Solicit and Reply messages (two messages), rather than the process of Solicit, Advertise, Request, and Reply messages (four messages).
    5. Choose the DUID Type (DHCPv6 Unique Identifier) (RFC-6355) that the MGT interface uses to identify itself to the DHCPv6 server:
      • duid-type-llt—DUID-LLT; the Link-Layer address of the MGT interface, concatenated with a timestamp.
      • duid-type-ll—DUID-LL; the Link-Layer address of the MGT interface.
    6. Choose a Default Gateway Type:
      • Static—Enter the Default IPv6 Gateway Address.
      • Dynamic—Firewall learns the IPv6 default gateway address for the MGT interface from the Router Advertisement (RA) messages coming from a neighboring router (gateway) in response to a Router Solicitation (RS). If there is only one router attached to the link, the source address (link-local address) of the router advertising the RA is configured as the default gateway address for the MGT interface. The link-local address is specific to the interface and is autoconfigured using the EUI-64 method. If there are multiple routers attached to the link, the firewall sets its default gateway address to the source address of the RA messages that have the highest router preference value (Low, Medium, or High).
    7. Commit your changes.
    8. (Optional) View the DHCPv6 gateway address.
      1. Access the CLI.
      2. >show dhcp client ipv6-gateway-address
    9. (Optional) View DHCPv6 client information.
      1. >show dhcp client mgmt6-interface-state
      2. See the hostname, IPv6 address, life-starts, max-life, preferred-life, and dhcpv6-server.
    10. (Optional) Renew the DHCP lease with the DHCPv6 server, regardless of the lease term.
      This option is convenient if you're testing or troubleshooting network issues.
      1. >show dhcp client mgmt6-interface-state
      2. Renew.
    11. (Optional) Release the DHCPv6 address obtained from the DHCPv6 server. (A SLAAC address isn't released.)
      A release frees the IPv6 address, which drops your network connection and renders the firewall unmanageable if no other interface is configured for management access.
      1. >show dhcp client mgmt6-interface-state
      2. Release.

    © 2026 Palo Alto Networks, Inc. All rights reserved.