User manual SONICWALL SONICOS 5.5 IPV6 FEATURE MODULE

[. . . ] IPv6 in SonicOS Document Scope This document provides an overview of SonicWALL's implementation of IPv6, how IPv6 operates, and how to configure IPv6 for your network. This document contains the following sections: · "Feature Overview" section on page 1 ­ "IPv6 Technology Overview" section on page 2 ­ "IPv6 Benefits" section on page 3 ­ "IPv6 Feature Support" section on page 4 · "Configuring IPv6" on page 4 ­ "IPv6 Interface Configuration" section on page 5 ­ "Configuring IPv6 Tunnel Interfaces" section on page 12 ­ "Accessing the SonicWALL User Interface Using IPv6" section on page 16 ­ "IPv6 Network Configuration" section on page 16 ­ "IPv6 Access Rules Configuration" section on page 19 ­ "IPv6 IPSec VPN Configuration" section on page 19 ­ "SSL VPN Configuration for IPv6" section on page 20 · "IPv6 Diagnostics and Monitoring" section on page 21 ­ "Packet Capture" on page 22 ­ "IPv6 Ping" on page 23 ­ "IPv6 DNS Lookup and Reverse Name Lookup" on page 24 ­ "Connection Monitor" on page 24 Feature Overview The following sections provide an overview of IPv6: · · · "IPv6 Technology Overview" section on page 2 "IPv6 Benefits" section on page 3 "IPv6 Feature Support" section on page 4 SonicOS 5. 5 - IPv6 1 Feature Overview IPv6 Technology Overview Around 1992, the IETF became aware of a global shortage of IPv4 addresses, and technical obstacles in deploying new protocols due to limitations imposed by IPv4. IPv6 base specification is specified in RFC2460. IPv6 dramatically increases the number of available addresses. [. . . ] Other Configuration - Sets the Other configuration flag in Router Advertisement message. If set, it indicates that other configuration information is available via Dynamic Host Configuration Protocol. Add Prefix - Adds an advertising prefix. 8 SonicOS 5. 5 - IPv6 Configuring IPv6 Click the Add Prefix button to configure a prefix. Prefix - The prefix advertised with the Router Advertisement message which provides hosts with prefixes for on-link determination and Address Autoconfiguration. Valid Lifetime - The length of time that the prefix is valid for the purpose of on-link determination. A value of "71582789" means the lifetime is infinite. Preferred Lifetime - The length of time that addresses generated from the prefix via stateless address autoconfiguration remain preferred. A value of "71582789 means the lifetime is infinite. On-link - Enables the on-link flag in Prefix Information option, which indicates that this prefix can be used for on-link determination. Autonomous - Enables the autonomous address-configuration flag in Prefix Information option, which indicates that this prefix can be used for stateless address configuration. Configuring an Interface for DHCPv6 Mode DHCPv6 (DHCP for IPv6) is a client/server protocol that provides stateful address configuration or stateless configuration setting for IPv6 hosts. DHCPv6 client is enabled to learn IPv6 address and network parameters when interface is configured to DHCPv6 mode. DHCPv6 defines two different configuration modes: · · DHCPv6 stateful mode: DHCPv6 clients require IPv6 address together with other network parameters (e. g. DHCPv6 stateless mode: DHCPv6 client only obtains network parameters other than IPv6 address. DHCPv6 Mode - Sets the DHCPv6 client mode. ­ Automatic: The interface configures IPv6 addresses using stateless/stateful autoconfiguration in accord with the M and O settings in the most recently received router advertisement message. ­ Manual: The configuration of the IPv6 address is managed by the interface settings. · Only Request Stateless Information - This option is only available for Manual mode. If enabled, DHCPv6 client only requests network parameter setting from DHCPv6 server. IPv6 address is assigned through stateless auto-configuration. Configuring an Interface for Auto Mode Auto mode is a new IP assignment for IPv6 interface. IPv6 interface is set to utilize IPv6 Stateless Address Autoconfiguration to assign IPv6 address. In this mode, user doesn't need to do any other manual configuration except setting IP Assignment type. Firewall listens to the network and prefix information from neighboring routers. IPv6 build-in Stateless Address Autoconfiguration feature handles all configuration details such as IPv6 address assignment, address deleting for address conflicting or lifetime expiration, default gateway selection, etc. , based on the information collected from on-link router. Note Auto mode can only be configured for the WAN zone. For security consideration, Auto mode is not available on LAN zone interface. The following diagram shows a sample topology for IPv6 configured in Auto mode. SonicOS 5. 5 - IPv6 11 Configuring IPv6 In this mode, 2 types of IPv6 address are possible to assign: · · Automatic Address - The interface default link-local address. [. . . ] The basic rule for IPv4 DAO is each IPv4 address corresponds to 2 address objects: Interface IP and Interface Subnet. There are also couples of AO groups for Zone Interface IP, Zone Subnets, All Interface IP, All Interface Management IP, etc. IPv6 interface prepares the same DAO set for each interface. Because multiple IPv6 can be assigned to one interface, all of those address can be added, edited, and deleted dynamically. [. . . ]