IPv6 VPN Configuration

Site to Site VPNs can be configured for IPv6 in a similar manner to IPv4 VPNs on the IPv6 tab on the NETWORK | IPSec VPN > Rules and Settings page.

There are certain VPN features that are currently not supported for IPv6, including:

• IKEv1 is not supported.
• GroupVPN is not supported.
• Tunnel Interface route-based VPN is not supported.
• DHCP Over VPN is not supported.
• L2TP Server is not supported.

When configuring an IPv6 VPN policy:

• On the General screen:
  • The Gateways must be configured using IPv6 addresses. FQDN is not supported.
  • Under IKE Authentication, IPV6 addresses can be used for the local and peer IKE IDs.
• On the Network screen:
  • IPV6 address objects (or address groups that contain only IPv6 address objects) must be selected for the Local Network and Remote Network.
  • DHCP Over VPN is not supported, thus the DHCP options for protected network are not available.
  • The Any address option for Local Networks and the Tunnel All option for Remote Networks are removed, but you can select an all zero IPv6 Network address object for the same functionality and behavior.
• On the Proposals screen, only IKEv2 mode is supported.
• On the Advanced screen, several options are disabled for IPv6 VPN policies:
  • Suppress automatic Access Rules creation for VPN Policy is disabled.
  • Enable Windows Networking (NetBIOS) Broadcast is disabled.
  • Enable Multicast is disabled.
  • Apply NAT Policies is disabled.

Because an interface might have multiple IPv6 address, sometimes the local address of the tunnel might vary periodically. If the user needs a consistent IP address, configure the VPN policy bound to option as an interface instead of a zone, and specify the address manually. The address must be one of the IPv6 addresses for that interface.