>
    Configure the Management Interface for Dynamic IPv6 Address Assignment
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. DHCP
    4. Configure the Management Interface for Dynamic IPv6 Address Assignment
    Download PDF

    Configure the Management Interface for Dynamic IPv6 Address Assignment

    Table of Contents

    Configure the Management Interface for Dynamic IPv6 Address Assignment

    Configure the management interface to receive a dynamic IPv6 address assignment.
    Before you configure the management (MGT) interface for dynamic IPv6 address assignment, read Dynamic IPv6 Addressing on the Management Interface to understand how IPv6 stateless address autoconfiguration (SLAAC) or DHCPv6 determines the address.
    The management interfaces on WildFire and Panorama models don't support this DHCPv6 functionality.
    • For hardware-based firewall models (not VM-Series), configure the management interface with a static IPv6 address when possible.
    • If the firewall acquires a management interface address through DHCPv6, assign a MAC address reservation on the DHCPv6 server that serves that firewall. The reservation ensures that the firewall retains its management IP address after a restart.
    If you use stateless mode (SLAAC/autoconfig), use it in a secured environment.
    As an alternative to using dynamic IPv6 address assignment on the management interface, you can Configure the Management Interface as a DHCP Client using IPv4.
    If you configure the MGT interface as a DHCPv6 client, the following restrictions apply:
    • You can't use the MGT interface in an HA configuration for control link (HA1 or HA1 backup), data link (HA2 or HA2 backup), or packet forwarding (HA3) communication.
    • You can't select
      MGT
       as the Source Interface when you customize service routes (
      Device
      Setup
      Services
      Service Route Configuration
      Customize
      ). However, you can select
      Use default
       to route the packets via the management interface.
    • You can't use the dynamic IP address of the MGT interface to connect to a hardware security module (HSM). The IP address on the HSM client firewall must be a static IP address because HSM authenticates the firewall using the IP address, and operations on HSM would stop working if the IP address were to change during runtime.
    • An additional limitation is that when the preferred lifetime of the IPv6 address on the MGT interface expires, existing IPv6 sessions are disconnected. To elaborate, the configuration is sent by the DHCPv6 server and RADVD server. The firewall takes the valid lifetime and preferred lifetime from these RA messages from the servers and set the times based on the values received. RFC 8415 indicates that existing communications must remain for the duration of the valid lifetime if the preferred lifetime expires (sessions must be active during the time between the preferred lifetime and valid lifetime). However, the NGFW limitation is that sessions are lost when the preferred lifetime expires.
    A prerequisite for getting a DHCPv6 address is that the MGT interface must be able to reach a DHCPv6 server.
    1. Configure the MGT interface for dynamic IPv6 address assignment.
      1. Select
        Device
        Setup
        Interfaces
         and select the
        Management
         interface.
        Selections unrelated to a dynamic address (such as speed, MTU, permitted IP addresses, administrative management services, and network services) are documented in the PAN-OS Administrator's Guide: Perform Initial Configuration.
      2. Select
        IPv6
         and
        Enable IPv6
        .
      3. Select
        Type
         as
        Dynamic
        .
    2. In the DHCPv6 Client Options section, select
      Non Temporary Address
       (default setting). This address type has a longer lifespan than a Temporary Address.
      Whether you request a Non-Temporary Address or Temporary Address for the interface is based on your discretion and the capability of the DHCPv6 server; some servers can provide only a temporary address. You can choose Non Temporary Address or Temporary Address, but not both.
    3. Select
      Temporary Address
       for a greater level of security because the address is intended to be used for a short period of time.
      The IPv6 address isn't automatically renewed and will expire when the valid time reaches 0.
    4. Select
      Rapid Commit
       to use the DHCPv6 process of Solicit and Reply messages (two messages), rather than the process of Solicit, Advertise, Request, and Reply messages (four messages).
    5. Choose the
      DUID Type
       (
      D
      HCPv6
      U
      nique
      Id
      entifier) (RFC-6355) that the MGT interface uses to identify itself to the DHCPv6 server:
      • duid-type-llt
        —DUID-LLT; the Link-Layer address of the MGT interface, concatenated with a timestamp.
      • duid-type-ll
        —DUID-LL; the Link-Layer address of the MGT interface.
    6. Choose a
      Default Gateway Type
      :
      • Static
        —Enter the
        Default IPv6 Gateway Address
        .
      • Dynamic
        —Firewall learns the IPv6 default gateway address for the MGT interface from the Router Advertisement (RA) messages coming from a neighboring router (gateway) in response to a Router Solicitation (RS). If there is only one router attached to the link, the source address (link-local address) of the router advertising the RA is configured as the default gateway address for the MGT interface. The link-local address is specific to the interface and is autoconfigured using the EUI-64 method. If there are multiple routers attached to the link, the firewall sets its default gateway address to the source address of the RA messages that have the highest router preference value (Low, Medium, or High).
    7. Commit
       your changes.
    8. (
      Optional
      ) View the DHCPv6 gateway address.
      2. >
        show dhcp client ipv6-gateway-address
    9. (
      Optional
      ) View DHCPv6 client information.
      1. >
        show dhcp client mgmt6-interface-state
      2. See the hostname, IPv6 address, life-starts, max-life, preferred-life, and dhcpv6-server.
    10. (
      Optional
      ) Renew the DHCP lease with the DHCPv6 server, regardless of the lease term.
      This option is convenient if you're testing or troubleshooting network issues.
      1. >
        show dhcp client mgmt6-interface-state
      2. Renew.
    11. (
      Optional
      ) Release the DHCPv6 address obtained from the DHCPv6 server. (A SLAAC address isn't released.)
      A release frees the IPv6 address, which drops your network connection and renders the firewall unmanageable if no other interface is configured for management access.
      1. >
        show dhcp client mgmt6-interface-state
      2. Release.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.