IPv6 Prefix Delegation / Router Advertisement on 6400

[oa_munich]

Hi all,

I am very new to Check Point and this is my first post in this community. I'm trying to configure a PPPoE connection on a 6400 box (R81.20 JHF T84). IPv4 worked just fine, but I'm struggling with IPv6. Our provider delegates us a /56 prefix. On Cisco / Palo Alto / Juniper I can configure a stateful DHCPv6 client, request a prefix with a /64 length and delegate it to other interfaces. I haven't found a way to do it on Check Point / Gaia - could someone point me to an article on how to do this if this is supported?

[PhoneBoy · Accepted solution]

Refer to the following SK: https://support.checkpoint.com/results/sk/sk163313
Prefix Delegation is not supported.

[RamGuy239 · Accepted solution]

Looks to be arriving with R82?

Enhance Gaia OS with:
DHCPv6 server, DHCPv6 client, and DHCPv6 client for prefix-delegation.


According to R82 "Whats new".

[PhoneBoy]

Yes, this is a screenshot from the R82 EA
Note that I don't have IPv6 enabled on this system, which is why things are dimmed here.

[oa_munich]

Thank you both, this is very helpful!

[oa_munich]

As R82 was recently released, I upgraded and tried out the prefix delegation ASAP. To say the least, it is not super straight-forward to configure, and I ended up configuring via clish, as described here:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG...

I did not find how it's supposed to be, but I encountered that on the Interfaces page, the IPv6 address needs to be configured as "Use the following IPv6 address" and be empty, only then you can switch DHCPv6 mode to prefix delegation and actually receive a prefix. This seems a little counter-intuitive, as there clearly is an option "Obtain IPv6 address automatically via Prefix Delegation" on the interface page.

So after quite a few tries I ended up with a working config. The outbound interface receives the prefix and distributes it to a child interface.

I also noticed an issue with HTTPS inspection over IPv6, I will create a separate post about it.