How to enable IPV6 custom prefix on the firewall interface
Objective
By default, PaloAlto Firewall has a configured /64 subnet mask and can't show the custom prefix and this article guide the user to enable IPv6 subnetting on the firewall interface.
- IPv6 Interface ID is the 64-bit extended unique identifier (EUI-64) in hexadecimal format (for example, 00:26:08:FF:FE:DE:4E:29).
- Select "Use interface ID as host portion" to use the Interface ID as the host portion of the IPv6 address ( / 64)
- Thus, Disable the "User interface ID as host portion" makes you add the custom prefix on the firewall interface.
Environment
- All PAN OS
- All Palo Alto Networks firewalls that support IPv6
By default, the firewall uses an IPv6 Interface ID (EUI-64) for the host portion of the address, which enforces a /64 prefix. To use a custom prefix, this default behavior must be disabled.
Procedure
To configure a custom IPv6 prefix on a firewall interface, follow these steps:
-
Access the web interface of your firewall.
-
Navigate to Network > Interfaces.
-
Select the specific interface you want to configure.
-
Click on the IPv6 tab.
-
Click the Add button to add a new IPv6 address.
-
A new window will appear. First, select the "Enable IPv6 address on interface" checkbox.
-
Crucially, uncheck the "Use interface ID as the host portion" option. This is the key step that allows you to manually enter a custom prefix length.
Note: If this option remains checked, the firewall will automatically configure a /64 prefix, overriding any custom prefix you attempt to set. -
Now, in the IPv6 Address field, enter the desired IPv6 address along with your custom prefix length (e.g.,
2001:db8:abcd:12::1/82). -
Click OK to save the configuration for the interface.
-
Commit the changes to apply them to the firewall.
Additional Information
One can verify the assigned subnet via command "show interface all"
References:
Configuration Guide.
Enabling RA advertisement.
IPv6 Support by Feature