HTTPS Inspection over IPv6 on R82

[oa_munich]

Hello all,

As R82 was released, I tried it out on a test gateway. My goal was to try IPv6 prefix delegation, which was introduced in R82 - I successfully received and distributed a prefix.

While trying this out, I encountered a strange issue with HTTPS inspection, when the inspection occurs via IPv6. See attached screenshots.

A client (2001:a61:30b2:bb10:445a:95fe:caf:8ed5) initiates a connection to a website (2606:4700::6813:df4f).

In the screenshot, you can see that the firewall accepts the connection initiated by the firewall itself, i.e. the probe (first screenshot, lowest row). After a noticeable timeout (initial connection at 16:38:22, client connects at 16:38:38 - 15 seconds), the client is permitted to connect, and no inspection takes place.  The log shows that "The probe was unable to establish a TCP connection to the destination". I explicitly permitted the IPv6 address of the firewall to connect anywhere, cp2-ipv6-prefix (2001:a61:30b2:bb10:21c:7fff:fe88:996f).

If IPv6 is disabled, HTTPS inspection is working as expected, there is no generic configuration error, and the issue seems to be related to the way the probe initiates the connection via IPv6.

Any suggestions where to dig to understand why is this happening?

[PhoneBoy]

Do you see the gateway probe the destination via tcpdump or similar?
Guessing it's a bug and a TAC case will likely be necessary.

[oa_munich]

I ran a packet capture on an upstream router and saw probe packets. Will get TAC to take a look, thanks!

[Ilya_Yusupov]

Hi @oa_munich ,

Is it happen for all web sites or only for a specific one?

I tried in my lab and it looks fine, i am getting inspection with IPv6.

Thanks,

Ilya

[oa_munich]

It happens with a handful websites I've tested with, e.g. fast.com, whatismyip.com and a few more.

Are you assigning IPv6 address through prefix delegation?

[oa_munich]

Maybe a little more context here: I've got a bonded interface with 2 VLANs. VLAN 10 is a connection I am receiving the prefix on, VLAN 100 is the connection where I am distributing it.

Config:

set dhcp6 server enable
set dhcp6 client client-mode prefix-delegation
set dhcp6 prefix-delegation method dhcpv6
add dhcp6 prefix-delegation assign-to bond0.100
set dhcp6 prefix-delegation request-from bond0.10

The address (2001:a61:30b2:bb10:21c:7fff:fe88:996f) is the address seen on the bond0.100 interface, 

show interface bond0.100
...
ipv6-address 2001:a61:30b2:bb10:21c:7fff:fe88:996f/64
...

Clients get their IPv6 addresses on bond0.100.

I tested a little more, this happens on every website which does not get bypassed due to policy. Every "new" site - first time a client tries to open and waits for 15 seconds, then the site gets bypassed, subsequent attempts - the inspection is bypassed immediately.

[the_rock]

I find this super interesting...may test it some time this week in R82 lab.

Andy