XG750 Dual Stack Captive Portal. How To?

Hi,

a /32 IPv6 is a very large range of addresses.

The current version of XG does not support IPv6 very well, all IPv6 rules need a NAT. 

As of today, I have not found away of using IPv6 addressing FQDNs in XG. A FQDN will be resolved and connected when a device makes a request.

Ian

Hi Ian, Thanks for the reply.

/32 is pretty large for a university, but we only had choices from RIR between 48 and /32, and as we have a multi-site setup, /32 was the better choice.

I am not clear on "all IPv6 rules need a NAT". We have an IPv6 network coming into the WAN interface for the XG750, and I am not sure if NAT applies to IPv6 (both LAN and WAN are on IPv6).

We have a dual-stack setup, so clients have both IPv4 and IPv6 addresses allocated to them via a set of DHCP servers. We have not yet enabled IPv6 over the switches in our network.

The concern we have is, say a user accesses ipv4.google.com, they (browser) will naturally connect to the sophos on the IPv4 interface IP, the captive portal will capture this IP and allow login and pass the request.

Then say the user accesses ipv6.google.com, which exclusively has a AAAA record, the browser will initiate a IPv6 packet towards the sophos firewall on its IPv6 interface, the captive portal might show up again as the previous login was against the IPv4 IP.

We haven't tested it yet but this seems like what is most likely going to happen. If this is true, how can the first login page capture both IPv4 and IPv6 IPs of the client?

Hi,

I am not a captive portal user, so I cannot help you with the question. I  have a dual stack system and you need a NAT for all IPv6 traffic between LAN and WAN.

I need to make a correction, you  can create networks with IPv6 addresses, but you can't use FQDNs' in IPv6 firewall rules

Ian

Hello Akshay,

Thank you for contacting the Sophos Community.

Since the IPv6 address is another address they’ll need to re-auth.

Regards,

Hi Emmanuel,

Thanks for the response. Do you have customers that run dual-stack IPv6/IPv4 behind the firewall and also use user authentication? If yes, any idea on how they handle the double login issue?

I can confirm this.  The "user aware firewall" associates an IP address (either IPv4 or IPv6) with a user.  While you can have the user log into IPv4, the XG does not keep track that a specific IPv4 and IPv6 is held by the same computer and therefore is the same user.  You need to separately associate the IPv6 with the user.

AFAIK Captive Portal supports both but it uses the source IP that you connect with to the XG - not the source IP that you use to connect to the far site. So if you go to ipv6.google.com and it redirects you to myxg.mycompany if your client resolves that as IPv4 and connects as IPv4 then you will log in as IPv4.  When you then go to ipv6.google.com you will still not be logged in.  By changing your internal dns you can log into IPv6 instead.  So I *think* it supports either but not both (at least not easily).

Currently AD SSO only supports IPv4.

As far as I know STAS supports both.

Hello Akshay,

For that question, I would recommend you to reach out to your Sales Engineer. 

Regards,