How to allow all IPv6 traffic while allowing only specific IPv4 traffic through the Palo Alto Firewall.

458

Created On 03/28/19 05:58 AM - Last Modified 11/07/25 21:01 PM

Security Policy

Deployment

Initial Configuration

Policy

8.1

8.0

7.1

9.0

PAN-OS

Objective

Allow all IPv6 traffic to pass through the Palo Alto Firewall.
Only specific IPv4 traffic should be allowed. All other IPv4 traffic should be dropped.

Environment

Palo Alto Firewalls
Security Policy

Procedure

Address ::/0 includes all IPv6 and IPv4 addresses.
A security policy created using ::/0 as the source and destination will allow all IPv6 and IPv4 traffic.
IPv4 Addresses are present as a subset of IPv6 Addresses and are represented by the range 0::0-0:0:0:0:0:0:ffff:ffff
To allow all IPv6 traffic (and not all IPv4), please follow the steps mentioned below :-

Create the following address object :-

address { 
TESTIPv6 { 
ip-range 0::0-0:0:0:0:0:0:ffff:ffff;

Create a Security policy to deny this as a source/destination. This will block all IPv4 communication.

rules { 
IPv4-deny { 
to any; 
from any; 
source TESTIPv6; 
destination TESTIPv6; 
source-user any; 
category any; 
application any; 
service application-default; 
hip-profiles any; 
action deny; 
disabled no;

Create another Security policy after the "IPv4-deny "with "any" as the source and destination to allow all IPv6 communication.
Security policies allowing IPv4 traffic should be present above the "IPv4-deny" rule.

How to allow all IPv6 traffic while allowing only specific IPv4 traffic through the Palo Alto Firewall.

Objective

Environment

Procedure

Other users also viewed: