topic Re: R80.40 - ipv6 in Firewall and Security Management

R80.40 - ipv6

Daniel_Kavan — Wed, 28 Oct 2020 20:41:47 GMT

Hi, I have 2 interfaces dedicated to ipv6. One external, and one DMZ.

My external interface is configured correctly in the web ui, and with a 'get topology' my dashboard is correct as well.

However, the clish command shows eth7's configuration on eth6 in the virtual cluster interfaces section. And the eth7 configuration isn't even reported.

tcpdump shows nothing is getting to the VIPs. As you might guess, outbound traffic is working internal and externally (the VIP isn't used). But inbound ... nothing even shows up in tcpdump.

gate04> show cluster members interfaces secured

CCP mode: Manual (Unicast)

Interface Name: Status:

eth1 UP
eth5 UP
eth2 UP
eth6 UP
eth7 UP
eth8 UP
Sync UP
Mgmt Non-Monitored
eth1-01 UP
eth1-01 UP

Re: R80.40 - ipv6

PhoneBoy — Fri, 30 Oct 2020 23:54:09 GMT

Do your two interfaces with IPv6 on them also have IPv4 addresses on them?

Re: R80.40 - ipv6

Daniel_Kavan — Wed, 04 Nov 2020 17:15:11 GMT

Yes, that was the issue.

With clusterXL you need to have ipv4 and ipv6 addresses defined for the cluster to see it.

Re: R80.40 - ipv6

Scott_Paisley — Fri, 21 Apr 2023 14:22:54 GMT

Following up with this as we just tried something similar. If you want to use IPv6 on any interface that participates in ClusterXL, that interface must also have an IPv4 address assigned to it? Is that right?

Thanks

Re: R80.40 - ipv6

PhoneBoy — Fri, 21 Apr 2023 16:11:48 GMT

Yes, ClusterXL only supports IPv6 "dual stack" with IPv4.
It cannot be run with IPv6 alone.

Re: R80.40 - ipv6

Scott_Paisley — Fri, 21 Apr 2023 16:39:04 GMT

Thanks

Is that on the roadmap?

Re: R80.40 - ipv6

PhoneBoy — Fri, 21 Apr 2023 21:08:05 GMT

Probably not with ClusterXL, but possibly with ElasticXL in future releases.
To ensure this requirement has the correct visibility, I recommend contacting your local Check Point office.