This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Route IPv6 to DMZ

pgross 3 months ago

Hi there,

we have a /64 subnet (with gateway) and a /56 assigned by the ISP. No PD in place.
I've assigned an address from the /64 subnet together with the gateway to the WAN interface, which is now reachable via IPv6.

I'd like to assign IPv6 Addresses to the servers in our DMZ too.
How can I do that?

I'm not really clear about why I need two subnets and what to do with the /56 subnet.

Any help is appreciated, thanks!

This thread was automatically locked due to age.

Top Replies

rfcat_vk 3 months ago +1 suggested

Hi, the /56 is for your internal use. You assign a /64 to each lan and then assign addresses from that /64 pool. ian

Parents

0 rfcat_vk 3 months ago

Hi,

the /56 is for your internal use. You assign a /64 to each lan and then assign addresses from that /64 pool.

ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 pgross 3 months ago in reply to rfcat_vk

Thanks you for your reply.

Lets say I assign a /64 out of the /56 to the DMZ.
Assume I have a firewall rule allowing traffic from WAN to DMZ.

Is this enough or do I have to add any routes or anything else for the server in ths DMZ to be reachable by the IPv6 address?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 3 months ago in reply to pgross

Hi,

if you are using v20.0.1 or later then you don't need a NAT rule for IPv6. A firewall rule allowing internet (WAN) traffic to the DMZ should be enough to provide access.Assumption is the devices in your DMZ have been assigned an IPv6 address.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 pgross 3 months ago in reply to rfcat_vk

I'm running SFOS 20.0.1 MR-1 but I'm unable to even ping an external ipv6 address from the dmz device.

The device in the DMZ has of course an IPv6 address assigned.

And I am able to ping the DMZ and WAN interface IP of the XGS.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 3 months ago in reply to pgross

Hi,

do you have a firewall rule zone dmz to the internet?

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 pgross 3 months ago in reply to rfcat_vk

sure, from DMZ zone to WAN zone everything is allowed
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 3 months ago in reply to pgross

Hi,

you will need to specifically add ping6. Partially wrong answer.

Please see the screenshot below of the ACL setup to provide access.

Ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 pgross 3 months ago in reply to rfcat_vk

And what should I particularly see there? There are no checkmarks whatsoever for WAN or DMZ.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk 3 months ago in reply to pgross

That is my setting to show you. You should tick boxes in the DMZ, similar to your lan.

ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel

Reply

0 rfcat_vk 3 months ago in reply to pgross

That is my setting to show you. You should tick boxes in the DMZ, similar to your lan.

ian

XG115W - v20.0.2 MR-2 - Home

XG on VM 8 - v21 GA

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel

Children

No Data