IPsec (Remote access) with only ipv6 address - XG SFOS 18.5.3 MR-3

Hey roboo,

Thank you for reaching out to the community, based on the **documentation mentioned here:
https://docs.sophos.com/nsg/sophos-firewall/18.5/Help/en-us/webhelp/onlinehelp/AdministratorHelp/IPv6FeaturesServices/index.html

**BUT - For Cisco VPN it does not support IPv6 and the Sophos Connect Client is a replacement of Cisco VPN, so logically that may not support IPv6. 

Again if the DOC claims to support IPsec [remote access] then it should, but if the issue arises. Then please log a support request and let that be investigated further by Sophos Support for further clarification. 

NOTE: We cannot define IPv6 in IP addressing - meaning IPv6 supporting is not related whether the appliance has IP address configured as IPv4 or IPv6 only. You can only assign IPv4 to IPsec clients but there is no restriction on communication between client and XG via IPv6

Hello Vivek,

thanks for your answer.

So i understand that we can't assign ipv6 addresses in the vpn tunnel. But in my setup I need IPv6 support when creating the tunnel. So imagine the firewall has only a ipv6 address facing WAN and no ipv4 address. And my clients are all dualstack working from home. Now I want to create the tunnel connecting to the firewall with only a ipv6.

I'm not sure if it's possible and if it is possible I can't find sufficient documentation on how to configure it. 

If it's possible, please point me to a articel or the documentation. I'll also create a support case.

Best Regards,

Robert

Hello Vivek,

thanks for your answer.

So i understand that we can't assign ipv6 addresses in the vpn tunnel. But in my setup I need IPv6 support when creating the tunnel. So imagine the firewall has only a ipv6 address facing WAN and no ipv4 address. And my clients are all dualstack working from home. Now I want to create the tunnel connecting to the firewall with only a ipv6.

I'm not sure if it's possible and if it is possible I can't find sufficient documentation on how to configure it. 

If it's possible, please point me to a articel or the documentation. I'll also create a support case.

Best Regards,

Robert

This may not be possible, but the concept of IP tunnels under the configure > network > IP tunnels might help !!
An IP tunnel is a mechanism that encapsulates one network protocol as a payload for another network protocol. Using a tunnel, you can encapsulate an IPv6 packet into an IPv4 packet for communication between IPv6-enabled hosts or networks over an IPv4 network, or vice versa.

Hi Vivek,

thanks for the reply.

I've checked into it- but it seems that this is sadly not what I'm looking for. 

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/Network/IPTunnels/NetworkIPTunnelAdd/index.html

I'm still not sure if it's possible to configure IPSec (remote access) in a way that the clients create the vpn tunnel with the ipv6 address of the firewall.

I've opened a ticket with the support and wait for their response