Set Up an IPv6 Sinkhole On the On-Premises Gateway

Table of Contents

Filter

Expand All | Collapse All

Prisma Access Docs

Activation & Onboarding
Administration
Version
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Integrations
Incidents & Alerts
Release Notes
Version
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred

Configure GlobalProtect to Disable Direct Access to the Local Network

Redistribute HIP Information with Prisma Access

Set Up an IPv6 Sinkhole On the On-Premises Gateway

Set up an IPv6 sinkhole for a Prisma Access GlobalProtect mobile users deployment.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Panorama)	Prisma Access license

If you have a hybrid deployment that uses next-generation firewalls configured as gateways with Prisma Access, perform the following task on the on-premises gateway to drop the IPv6 traffic.

Add IPv6 IP pools to your GlobalProtect agent configuration.
1. Select NetworkGlobalProtectGateways.
2. Select an existing GlobalProtect gateway or Add a new one.
3. Select AgentClient Settings.
4. Select the agent configuration to modify or Add a new one.
5. Select IP Pools; then, Add an IPv6 pool to assign to the virtual network adapter on the endpoints that connect to the GlobalProtect gateway uses for mobile network traffic and click OK.
Enable IPv6 on the interface.
1. Select DeviceInterfaceTunnel and select the tunnel Interface that you use for the mobile user’s traffic.
2. Select IPv6; then, select Enable IPv6 on the interface.
Add a security policy to set a TCP reset action that will terminate sessions with IPv6 source traffic that matches the IP pools you configured in Step 1.
1. Select PoliciesSecurity and Add a new security policy.
2. Set the Source Address in the rule to match the IP pools you configured in Step 1.
3. Select Actions; then, select an Action Setting of Reset Client and click OK.
Commit your changes.
(Optional) Perform this task on all the gateway firewalls in your deployment.