How to enable IPV6 custom prefix on the firewall interface

How to enable IPV6 custom prefix on the firewall interface

33798
Created On 08/28/20 02:30 AM - Last Modified 08/01/25 01:52 AM


Objective


By default, PaloAlto Firewall has a configured /64 subnet mask and can't show the custom prefix and this article guide the user to enable IPv6 subnetting on the firewall interface. 
  • IPv6 Interface ID is the 64-bit extended unique identifier (EUI-64) in hexadecimal format (for example, 00:26:08:FF:FE:DE:4E:29).
  • Select "Use interface ID as host portion" to use the Interface ID as the host portion of the IPv6 address ( / 64)
  • Thus, Disable the "User interface ID as host portion" makes you add the custom prefix on the firewall interface.


    Environment


    • All PAN OS 
    • All Palo Alto Networks firewalls that support IPv6

      By default, the firewall uses an IPv6 Interface ID (EUI-64) for the host portion of the address, which enforces a /64 prefix. To use a custom prefix, this default behavior must be disabled.


    Procedure


    To configure a custom IPv6 prefix on a firewall interface, follow these steps:

    1. Access the web interface of your firewall.

    2. Navigate to Network > Interfaces.

    3. Select the specific interface you want to configure.

    4. Click on the IPv6 tab.

    5. Click the Add button to add a new IPv6 address.

    6. A new window will appear. First, select the "Enable IPv6 address on interface" checkbox.

    7. Crucially, uncheck the "Use interface ID as the host portion" option. This is the key step that allows you to manually enter a custom prefix length.
      User-added image
      Note:
      If this option remains checked, the firewall will automatically configure a /64 prefix, overriding any custom prefix you attempt to set.

    8. Now, in the IPv6 Address field, enter the desired IPv6 address along with your custom prefix length (e.g., 2001:db8:abcd:12::1/82).

    9. Click OK to save the configuration for the interface.

    10. Commit the changes to apply them to the firewall.





    Additional Information


     One can verify the assigned subnet via command "show interface all"

    User-added image

    References: 
    Configuration Guide.
    Enabling RA advertisement.
    IPv6 Support by Feature


    Actions
    • Print
    • Copy Link

      https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAXuCAO&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

    Choose Language