topic Re: IPv4 traffic over IPv6 IPSec tunnel in Firewall and Security Management

IPv4 traffic over IPv6 IPSec tunnel

Mithu — Tue, 16 Mar 2021 18:39:33 GMT

I am not sure this is the correct place to address this requirement..

Recently one of my customer had a requirement to create an IPSec tunnel with their partner company, peer side having only IPv6 public IP address and customer having IPv6 and IPv4 public address, and customer and partner side infrastructure network is utilizing IPv4 address scheme. Then we realized this requirement cannot be fulfilled by Checkpoint as of now. So I managed to terminate IPSec using an opensource firewall instance in VM environment and the help of NAT, somehow the solution is provided.

My concern is why checkpoint does not support this feature. Google quoted that 30% of the internet is using IPv6 at this point of time, so near future most of the ISP connection would be IPv6 only addresses. Big enterprises will adopt IPv6 for their environment but small and medium enterprises will continue with IPv4 addressing for their infrastructure. My prediction is IPv4 traffic inside an IPv6 IPSec tunnel will be the common use-case within a year or two not to mention some of the customers already started to utilize this technology.

I hope Checkpoint will release this functionality with upcoming releases.

Re: IPv4 traffic over IPv6 IPSec tunnel

PhoneBoy — Tue, 16 Mar 2021 20:04:03 GMT

We can do separate tunnels with IPv4 and IPv6, but currently can’t tunnel one in the other.
I recommend engaging with your local Check Point office around this requirement.

Re: IPv4 traffic over IPv6 IPSec tunnel

Wolfgang — Sun, 06 Mar 2022 17:11:40 GMT

@PhoneBoy are there any news about 4in6?

We had the similar use case, IPv6 IPSEC-tunnel between gateways and only IPv4 networks in the encryption domains of the gateways. Something new with R81.10 or R81.20 or something on the roadmap ?

Re: IPv4 traffic over IPv6 IPSec tunnel

PhoneBoy — Mon, 07 Mar 2022 04:04:39 GMT

Haven't seen/heard anything about this in the roadmap.
As I said above, best to engage with the local Check Point office around this requirement.

Re: IPv4 traffic over IPv6 IPSec tunnel

_Val_ — Mon, 07 Mar 2022 07:19:34 GMT

Open an RFE

Re: IPv4 traffic over IPv6 IPSec tunnel

Yasushi_Kono1 — Thu, 31 Oct 2024 11:26:16 GMT

Hi Daemon,

I have got a request for a migration of an old firewall environment to something new. I would love to get the opportunity to migrate to Check Point. This will be a multi-million Dollar project in the heart of Germany in an OT infrastructure. One requirement is that the IPv4 packets to be forwarded into an IPv6 IPSec Tunnel. I haven't tested this, but is there a special requirement for this? As even in R82, NAT64 is not supported. I haven't tested a configuration in which the external interface of a gateway is IPv6 only and the internal ones IPv4 only. Does this work? If not, you need to acquire programmers to code this as soon as possible.

Re: IPv4 traffic over IPv6 IPSec tunnel

PhoneBoy — Thu, 31 Oct 2024 17:38:22 GMT

NAT46 / NAT64 is supported from R81.10: https://support.checkpoint.com/results/sk/sk163313
If/how it works with VPN is a separate question.