Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 24 replies
  • Answers 2 answers
  • Subscribers 40 subscribers
  • Views 10270 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG 136 Firewall SFOS 20.0.0 GA-Build222 IPv6 No Internet

Erika Koelle

Need some help getting our Sophos XG 136 (LAB) Firewall working with IPv6.

ABCDC01:  Role = Windows Server 2019 Domain Controller
IPv6 = fc00:2222:3333:4444:cccc:dddd:eeee:10/64
IPv4 = Not Enabled
Gateway = fc00:2222:3333:4444:cccc:dddd:eeee:ffff/64
 
ABCSVR01:  Role = Windows Server 2019 member server
IPv6 = fc00:2222:3333:4444:cccc:dddd:eeee:20/64
IPv4 = Not Enabled
Gateway = fc00:2222:3333:4444:cccc:dddd:eeee:ffff/64
 
Sophos Firewall 01: Local (Home)
Port #1:  Role = LAN IPv6 = fc00:2222:3333:4444:cccc:dddd:eeee:ffff IPv4 = 24.205.107.999
Port #2:  Role = WAN IPv6 = 2600:6c4e:7007:600:2919:f1db:ea13:990f/64 DHCP from Spectrum
 
Sophos Firewall 02: Remote (Remote)
Port #1:  Role = LAN IPv6 = fc00:2222:3333:4444:cccc:dddd:eeee:ffff IPv4 = 174.83.134.999
Port #2:  Role = WAN IPv6 =2600:6c4e:7000:101:6d68:f6ae:db55:9984/64 DHCP from Spectrum
 
Tests:
1.  Good - ABCDC01 can ping ABCSVR01 and vice versa
2.  Good - MacBook (IPv6 = fc00:2222:3333:4444:cccc:dddd:eeee:30/64) can ping6 from terminal to both ABCDC01 and ABCSVR01
3.  Good - ABCDC01 and ABCSVR01 can both ping gateway fc00:2222:3333:4444:cccc:dddd:eeee:ffff
4.  Good - ABCDC01 and ABCSVR01 can both ping internal WAN interface 2600:6c4e:7007:600:2919:f1db:ea13:990f
5.  Good - Sophos is able to ping ABCDC01 and ABCSVR01
6.  Good - Sophos is able to ping ipv6.google.com using Sophos Diagnostics
7.  Good - Sophos is able to complete traceroute to ipv6.google.com using Sophos Diagnostics
8.  Fail - ABCDC01 and ABCSVR01 cannot ping ipv6.google.com
 
Not sure if configuration is correct as we needed to manually assign IPv6 IP’s to our Windows Server devices as Link-Local IP can’t ping Gateway or WAN IP’s.  Not sure if we read this properly, but it seems there’s no IPv6 DHCP server and that they’re stateless.
On another note, we tried to getting a preferred delegated prefix from our ISP and it wouldn't do it following the following Sophos video:
Some IP's have been deliberately modified and we know that there's no such thing as an IPv4 with a .999


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Erika Koelle

    Both addresses are in the same /64. Are you using a bridge between the WAN and the LAN?

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Negative.  WAN and LAN are not bridged.  

    What IPv6 do you suggest is used on Port 1?  Previously fc00:2222:3333:4444:cccc:dddd:eeee:ffff/64 had been used when we statically assigned IP's on the Windows 2019 server.

  • 0 in reply to Erika Koelle

    If you use a NAT you can use what ever address you like. You can also use the DHCP server and enable the boxes in the RA settings. The following are my IPv6 settings using delegated addressing.

    ( The forum is playing havoc with my inserts and adding multiple copies which I have deleted)

    The first screenshot is one of my IPv6 DHCP in normal mode, the second screenshot is DHCP IPv6 when using PD. I will post another thread with my RA settings if you are interested?

    The last one is a standard DHCP setting using IPv6

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Sorry...feeling like we're running around in circles and still not getting it to work.  Going to take a break and maybe tackle this again early next week.  Thanks.

  • 0 in reply to Erika Koelle

    The any any rule was an IPv6 rule?
    ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Started making a new rule for any any and there were no options to select anything related to IPv4 or IPv6.

    Here's the rule we have in place:

  • 0 in reply to Erika Koelle

    Top of the firewall page there are tabs .

    ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    OK.  Found the super obvious IPv6 tab and created a Default IPv6 rule for ANY ANY.  It didn't really seem necessary, but we did it so we could log traffic.  A PING to Google's IPv6 DNS (2001:4860:4860::8888) was listed in Logviewer as Accept.  However, on the Windows Server side the PING didn't respond.  Using Sophos Diagnostics the PING to Google's DNS server does respond with zero packet loss if we let it auto select the interface.  If we manually tell it to use Port 1 or Port 4 or the Bridge then it can't ping Goolge's DNS. 

Unfiltered HTML