User manual SONICWALL SONICOS 5.5 IPV6 FEATURE MODULE

[. . . ] Only parent interface of a SwitchPort group can be configured as an IPv6 interface, hence all child of a switch port group must be excluded from this list. Once they are configured at IPv4 side, IPv6 will use the same configuration. Default Gateway and DNS Server 1/2/3 are only available for WAN zone interface. An IPv6 assigned interface cannot be configured either as a switch port non-parent interface. Configuring an Interface for IPv6 Static Mode Static mode provides user a way to assign static IPv6 address besides auto-assigned address. [. . . ] DHCPv6 client is enabled to learn IPv6 address and network parameters when interface is configured to DHCPv6 mode. DHCPv6 defines two different configuration modes: · · DHCPv6 stateful mode: DHCPv6 clients require IPv6 address together with other network parameters (e. g. DHCPv6 stateless mode: DHCPv6 client only obtains network parameters other than IPv6 address. DHCPv6 Mode - Sets the DHCPv6 client mode. ­ Automatic: The interface configures IPv6 addresses using stateless/stateful autoconfiguration in accord with the M and O settings in the most recently received router advertisement message. ­ Manual: The configuration of the IPv6 address is managed by the interface settings. · Only Request Stateless Information - This option is only available for Manual mode. If enabled, DHCPv6 client only requests network parameter setting from DHCPv6 server. IPv6 address is assigned through stateless auto-configuration. Configuring an Interface for Auto Mode Auto mode is a new IP assignment for IPv6 interface. IPv6 interface is set to utilize IPv6 Stateless Address Autoconfiguration to assign IPv6 address. In this mode, user doesn't need to do any other manual configuration except setting IP Assignment type. Firewall listens to the network and prefix information from neighboring routers. IPv6 build-in Stateless Address Autoconfiguration feature handles all configuration details such as IPv6 address assignment, address deleting for address conflicting or lifetime expiration, default gateway selection, etc. , based on the information collected from on-link router. Note Auto mode can only be configured for the WAN zone. For security consideration, Auto mode is not available on LAN zone interface. The following diagram shows a sample topology for IPv6 configured in Auto mode. SonicOS 5. 5 - IPv6 11 Configuring IPv6 In this mode, 2 types of IPv6 address are possible to assign: · · Automatic Address - The interface default link-local address. Autonomous Address - Assigned from Stateless Address Autoconfiguration. Users can manually delete the address if they do not want to wait for its valid lifetime expires. There are no new configuration options for Auto mode. Configuring IPv6 Tunnel Interfaces The features described here are used to tunnel IPv4 packets through IPv6 networks and IPv6 packets through IPv4 networks. For instance, in order to pass IPv6 packets through the IPv4 network, the IPv6 packet will be encapsulated into an IPv4 packet at the ingress side of a tunnel. When the encapsulated packet arrives at the egress of the tunnel, the IPv4 packet will be de-capsulated. A configured tunnel determines the endpoint addresses by configuration information on the encapsulating node. An automatic tunnel determines the IPv4 endpoints from the address of the embedded IPv6 datagram. IPv4 multicast tunneling determines the endpoints through Neighbor Discovery. The following diagram depicts an IPv6 to IPv4 tunnel. Configuring the 6to4 Auto Tunnel The 6to4 Auto Tunnel is an automatic tunnel: tunnel endpoints are extracted from the encapsulated IPv6 datagram, and so you do not need to configure them manually. 6to4 tunnels use a prefix of the form "2002:tunnel-IPv4-address::/48" (for instance, "2002:a01:203::1") to tunnel IPv6 traffic over IPv4. [. . . ] On the Network tab of the VPN policy, IPV6 address objects (or address groups that contain only IPv6 address objects) must be selected for the Local Network and Remote Network. DHCP Over VPN is not supported, thus the DHCP options for protected network are not available The Any address option for Local Networks and the Tunnel All option for Remote Networks are removed. Select an all zero IPv6 Network address object could be selected for the same functionality and behavior On the Proposals tab, the configuration is identical for IPv6 and IPv4, except for the fact that IPv6 only support IKEv2 mode. On the Advanced tab, only Enable Keep Alive and the IKEv2 Settings can be configured for IPv6 VPN policies. Note Because an interface may have multiple IPv6 address, sometimes the local address of the tunnel may vary periodically. [. . . ]