This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Configuring IPv6

I'm hoping someone might be able to help me. I'm trying to setup IPv6 on a CR50iNG running Sophos OS 17.0.6 MR-6. This sits behind a managed Cisco router that the ISP looks after.

IPv6 below have been changed from their real 2001:4d48:x:x values.

My ISP has reserved a /48 prefix. e.g 1111:2222:3333::/48. They have configured 1111:2222:3333::1/64 on the LAN port of the Cisco. They do not use DHCPv6 for IP assignment. To quote the email I had from my ISP: "If you need any more addresses out of the /48 then you need to let us know where to route them to."

On the Cyberoam I have configured on the WAN port:

IP Assignment: Static

IPv6/Prefix: 1111:2222:3333::2/64

Gateway IP: 1111:2222:3333::1/64

The gateway is appearing as green in the WAN link manager. I can ping websites via IPv6 using the diagnostic tools of the Cyberoam.

My issue is I don't have IPv6 connectivity from any of my PCs sitting behind the Cyberoam.

I have configured IPv6 router advertisement using the 1111:2222:3333::/64 range and also tried a different subnet 1111:2222:3333:1::

Windows PCs are picking up an IPv6 address, temporary address and a link local address.

They are picking up a gateway address for the Cyberoam but it is a link local address starting with fe80.

I can ping the link local address and the IPv6 address I've assigned to the LAN port on the Cyberoam ok. I cannot ping out to any websites.

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 7 years ago

Hi,

have you created any IPv6 rules, IPv6 objects, what about your IPv6 DNS setup?

With XG you must remember that IP4 and IPv6 are treated as two seperate firewalls,

Are you planing on having all devices (IPv6) using any IPv6 address they are assigned access the internet?

Have you setup a DHCP server or are you assigning all IPv6 addresses manually?

ian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rfcat_vk over 7 years ago

Hi,

have you created any IPv6 rules, IPv6 objects, what about your IPv6 DNS setup?

With XG you must remember that IP4 and IPv6 are treated as two seperate firewalls,

Are you planing on having all devices (IPv6) using any IPv6 address they are assigned access the internet?

Have you setup a DHCP server or are you assigning all IPv6 addresses manually?

ian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Simon Porter over 7 years ago in reply to rfcat_vk
Hi Ian

Thanks for the reply.

So with some help from Sophos support I have discovered that IPv6 access will work with NAT switched on.

To answer your questions:

I have 2 IPv6 rules setup. 1st one is to deny all IPv6 traffic. The 2nd is an allow rule from LAN to WAN to allow:

PING6

DNS

HTTP

HTTPS

SMTP

SMTPS

SMTP(S)

I've not created any IPv6 objects.

I would like all devices to use thier own IPv6 address to access the internet.

IPv6 addresses are being assigned using using the router advertisement.

I haven't setup DNS on v6 but all PCs are getting AAAA records back from our DNS on IPv4 ok.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Simon Porter

Hi Simon,

you found one of the anomalies of the XG, IPv6 requires a NAT. Also country blocking is not available in the current release.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Porter over 7 years ago in reply to rfcat_vk

Ah OK thanks. Not what I would expect. Will wait for a future update.
Cancel
Vote Up 0 Vote Down

Cancel
0 Pwc over 7 years ago in reply to rfcat_vk

Hi, and user based rules do not work either even though it is available as an option.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Pwc

Hi,

this is one of the threads on IPv6, there are others.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/100988/how-to-set-firewall-rule-precedence-when-using-ip4-and-ipv6

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Pwc over 7 years ago in reply to rfcat_vk

Hi thank you and I have already applied ipv4 as a preference via group policy when accessing external sites. These are still all workarounds for the fact that STAS still cannot map an ipv6 address to a device/username
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Pwc

Another minor but annoying issue, which probably has been mentioned already IPv6 will not work on the XG without a NAT. So that means you can use any IPv6 /64 you create for each of your networks. You could use the first 3 groupings of the /64 provided by your ISP and then add your own groups to make up the correct length. 2001:2002:2003:f00d:bade::1 /64

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Porter over 7 years ago in reply to rfcat_vk

Next question. I'm using http://ipv6-test.com/ and everything looks good except ICMP.

Is being behind NAT interfering with this? Is it possible to fix?

I've tried adding a firewall rule to allow ICMPv6 in but no change to the result.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 7 years ago in reply to Simon Porter

Hi Simon,

you will need to turn it on in administration -> device access.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Simon Porter over 7 years ago in reply to rfcat_vk

Thanks. Ping/Ping6 is enabled for LAN and WAN. Can't see anything for ICMPv6 specifically unless it goes by another name.
Cancel
Vote Up 0 Vote Down

Cancel