• SonicOS 7.0
• About Firewall
  • Firewall Workflow
• Advanced
  • Changing Between SonicOS
    • Changing From Classic to Policy Mode
    • Changing From Policy to Classic Mode
  • Detection Prevention
  • Dynamic Ports
  • Source Routed Packets
  • Internal VLAN
  • Access Rule Options
  • IP and UDP Checksum Enforcement
  • Jumbo Frame
  • Connections
  • Control Plane Flood Protection
  • IPv6 Advanced Configuration
  • TCP
    • TCP Settings
    • Layer 3 SYN Flood Protection- SYN Proxy
    • Layer 2 SYN/RST/FIN Flood Protection - MAC Blacklisting
    • WAN DDOS Protection (Non-TCP Floods)
    • TCP Traffic Statistics
  • UDP
    • UDP Settings
    • UDP Flood Protection
    • UDP Traffic Statistics
    • UDPV6 Traffic Statistics
  • ICMP
    • ICMP Flood Protection for IPv4 version
    • ICMP Traffic Statistics
    • ICMP Flood Protection for IPv6 version
    • ICMPv6 Traffic Statistics
• Flood Protection
• SSL Control
  • Key Features of SSL Control
  • Key Concepts to SSL Control
  • Caveats and Advisories
  • Configuring SSL Control
  • Custom List
  • Enabling SSL Control on Zones
  • SSL Control Events
• Cipher Control
  • TLS Ciphers
    • Blocking/Unblocking Ciphers
    • Filtering Ciphers
      • Selecting Display Options
      • Displaying Ciphers by Strength
      • Displaying Ciphers by Block/Unblock
      • Displaying Ciphers by CBC Mode
      • Displaying Ciphers by TLS Protocol Version
  • SSH Ciphers
• Real-Time Black List (RBL) Filter
  • Configuring the RBL Filter
    • Enabling RBL Blocking
    • Adding RBL Services
    • Configuring User-Defined SMTP Server Lists
      • Configuring a White List
      • Configuring a Black List
    • Testing SMTP IP Addresses

IPv6 Advanced Configuration

To configure advanced IPv6:

1. Navigate to Network > Firewall > Advanced.

2. Go to IPv6.

   

3. To disable IPv6 completely on the firewall, select Disable all IPv6 traffic processing on this firewall. When enabled, this option takes precedence over the other IPv6 options in this section. This option is not selected by default.
4. To prevent a potential DoS attack that exploits IPv6 Routing Header type 0 (RH0) packets, select Drop IPv6 Routing Header type 0 packets. When this setting is enabled, RH0 packets are dropped unless their destination is the SonicWall security appliance and their Segments Left value is 0. Segments Left specifies the number of route segments remaining before reaching the final destination. This option is selected by default. For more information, see http://tools.ietf.org/html/rfc5095
5. To drop a packet when the hop limit has been decremented to 0, select Decrement IPv6 hop limit for forwarded traffic; this is similar to IPv4 TTL. This option is not selected by default.
6. To reject and log network packets that have a source or destination address of the network packet defined as an address reserved for future definition and use as specified in RFC 4921 for IPv6, select Drop and log network packets whose source or destination address is reserved by RFC. This option is not selected by default.
7. By default, the SonicWall appliance generates IPv6 ICMP Time-Exceeded Packets that report when the appliance drops packets due to the hop limit decrementing to 0. To disable this function so the SonicWall appliance does not generate these packets, select Never generate IPv6 ICMP Time-Exceeded packets. This option is selected by default.
8. By default, the SonicWall appliance generates IPv6 ICMP destination unreachable packets. To disable this function so the SonicWall appliance does not generate these packets, select Never generate IPv6 ICMP destination unreachable packets. This option is selected by default.
9. By default, the SonicWall appliance generates redirect packets. To disable this function so the SonicWall appliance does not generate redirect packets, select Never generate IPv6 ICMP redirect packets. This option is selected by default.
10. By default, the SonicWall appliance generates IPv6 ICMP parameter problem packets. To disable this function; so the SonicWall appliance does not generate these packets, select Never generate IPv6 ICMP parameter problem packets. This option is selected by default.

11. To allow Site-Local Unicast (SLU) address, the default SonicWall appliance behavior, select Allow to use Site-Local-Unicast Address. This option is selected by default.

    As currently defined, SLU addresses are ambiguous and can represent multiple sites. The use of SLU addresses may adversely affect network security through leaks, ambiguity, and potential misrouting. To avoid the issue, deselect the option to prevent the appliance from using SLU addresses.

12. To have the SonicWall appliance check the validity of IPv6 extension headers, select Enforce IPv6 Extension Header Validation. This option is not selected by default.

    When this option is selected, the Enforce IPv6 Extension Header Order Check option becomes available. (You may need to refresh the page.)

    • To have the SonicWall appliance check the order of IPv6 Extension Headers, select Enforce IPv6 Extension Header Order Check. This option is not selected by default.

13. To have the SonicWall appliance generate a NetBIOS name in response to a broadcast ISATAP query, select Enable NetBIOS name query response for ISATAP. This option is not selected by default.

    Select this option only when one ISATAP tunnel interface is configured.

14. Click Accept.