topic Re: Can a gateway be managed by SMS via IPv6 address? in General Topics

Can a gateway be managed by SMS via IPv6 address?

Maria_Pologova — Wed, 30 Sep 2020 10:58:15 GMT

Hello everyone.

Apparently a very basic question, but I am still confused after reading documentation and relevant SKs.
Can a gateway be managed by SMS via IPv6 address?

sk39374 states that it cannot.

Can I have a Security Gateway that only runs IPv6? Starting from R76, it is possible to operate a Security Gateway (regular or VS mode) entirely with IPv6, except of one IPv4 address on the interface used for management.

At the same time, the SK doesn't include information that Sync interface cannot have IPv6 address defined (as per IPv6_Support_for_ClusterXL).

sk160753 tells the following:

01622840,
PMTR-47313

IPv6 addresses for management interface are not supported on R80.x Security Management Server.

But this statement can be interpreted in a few ways:
1. It's talking about the Mgmt physical interface on the SMS
2. It's talking about physical Mgmt interfaces on gateways to SMS
3. It's talking about interfaces that are assigned as management (set management interface ...)

And also I see that Smart Console actually allows you to configure IPv6 address as main gateway IP.

Did anyone experiment with this?

Re: Can a gateway be managed by SMS via IPv6 address?

G_W_Albrecht — Wed, 30 Sep 2020 13:42:23 GMT

In the internal net you would go with non-routable IPv4 for GW to SMS. Sync is another topic, but if in doubt and really need such a config, ask TAC.

Re: Can a gateway be managed by SMS via IPv6 address?

PhoneBoy — Wed, 30 Sep 2020 16:15:07 GMT

The answer is: complicated.
Sync has never supported IPv6, though I would think with R80.40 and unicast sync this would be less complicated to implement now.
There are several legacy features that only support IPv4 (around legacy OPSEC APIs).
I believe most of the management/gateway configuration can happen over IPv6.
However, at best, the various components still require “dual stack” and cannot entirely operate in an IPv6 only environment.