• titlepage
• table-of-contents
• SonicOS 8
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• IPSec VPN Overview
  • About Virtual Private Networks
  • VPN Types
    • IPsec VPN
    • DHCP over VPN
    • L2TP with IPsec
    • SSL VPN
  • VPN Security
    • About IKEv1
    • About IKEv2
    • Mobility and Multi-homing Protocol for IKEv2 (MOBIKE)
    • About IPsec (Phase 2) Proposal
    • About Suite B Cryptography
  • VPN Base Settings and Displays
    • Policies
    • Active Tunnels
    • Down Tunnels
    • Settings
  • IPv6 VPN Configuration
• Site to Site VPNs
  • Planning Site to Site Configurations
  • General VPN Configuration
    • Configuring Settings on the General Tab
    • Configuring Settings on the Network Tab
    • Configuring Settings on the Proposals Tab
    • Configuring Settings on the Advanced Tab
  • Managing GroupVPN Policies
    • Configuring IKE Using a Preshared Secret Key
    • Configuring IKE Using 3rd Party Certificates
    • Downloading a GroupVPN Client Policy
  • Creating Site to Site VPN Policies
    • Configuring with a Preshared Secret Key
    • Configuring with a Manual Key
    • Configuring with a Third-Party Certificate
    • Configuring the Remote SonicWall Network Security Appliance
• VPN Auto Provisioning
  • About VPN Auto Provisioning
    • Defining VPN Auto Provisioning
    • Benefits of VPN Auto Provisioning
    • How VPN Auto Provisioning Works
      • About Establishing the IKE Phase 1 Security Association
      • About Establishing IKE Phase 2 using a Provisioned Policy
  • Configuring a VPN AP Server
    • Starting the VPN AP Server Configuration
    • Configuring VPN AP Server Settings on General
    • Configuring VPN AP Server Settings on Network
    • Configuring Advanced Settings on Proposals
    • Configuring Advanced Settings on Advanced
  • Configuring a VPN AP Client
• Rules and Settings
  • Adding a Tunnel Interface
    • Creating a Static Route for the Tunnel Interface
  • Route Entries for Different Network Segments
  • Redundant Static Routes for a Network
• Advanced
  • Configuring Advanced VPN Settings
  • Configuring IKEv2 Settings
  • Using OCSP with SonicWall Network Security Appliances
    • OpenCA OCSP Responder
    • Loading Certificates to Use with OCSP
    • Using OCSP with VPN Policies
• DHCP over VPN
  • DHCP Relay Mode
  • Configuring the Central Gateway for DHCP Over VPN
  • Configuring DHCP over VPN Remote Gateway
  • Current DHCP over VPN Leases
• L2TP Servers and VPN Client Access
  • Configuring the L2TP Server
  • Viewing Currently Active L2TP Sessions
  • Configuring Microsoft Windows L2TP VPN Client Access
  • Configuring Google Android L2TP VPN Client Access
• AWS VPN
  • Overview
  • Creating a New VPN Connection
  • Reviewing the VPN Connection
    • Configuration on the Firewall
    • Configuration on Amazon Web Services
  • Route Propagation
  • AWS Regions
  • Deleting VPN Connections
• SonicWall Support
  • About This Document

IPv6 VPN Configuration

Site to Site VPNs can be configured for IPv6 in a similar manner to IPv4 VPNs on the IPv6 tab on the NETWORK | IPSec VPN > Rules and Settings page.

There are certain VPN features that are currently not supported for IPv6, including:

• IKEv1 is not supported.
• GroupVPN is not supported.
• Tunnel Interface route-based VPN is not supported.
• DHCP Over VPN is not supported.
• L2TP Server is not supported.

When configuring an IPv6 VPN policy:

• On the General screen:
  • The Gateways must be configured using IPv6 addresses. FQDN is not supported.
  • Under IKE Authentication, IPV6 addresses can be used for the local and peer IKE IDs.
• On the Network screen:
  • IPV6 address objects (or address groups that contain only IPv6 address objects) must be selected for the Local Network and Remote Network.
  • DHCP Over VPN is not supported, thus the DHCP options for protected network are not available.
  • The Any address option for Local Networks and the Tunnel All option for Remote Networks are removed, but you can select an all zero IPv6 Network address object for the same functionality and behavior.
• On the Proposals screen, only IKEv2 mode is supported.
• On the Advanced screen, several options are disabled for IPv6 VPN policies:
  • Suppress automatic Access Rules creation for VPN Policy is disabled.
  • Enable Windows Networking (NetBIOS) Broadcast is disabled.
  • Enable Multicast is disabled.
  • Apply NAT Policies is disabled.

Because an interface might have multiple IPv6 address, sometimes the local address of the tunnel might vary periodically. If the user needs a consistent IP address, configure the VPN policy bound to option as an interface instead of a zone, and specify the address manually. The address must be one of the IPv6 addresses for that interface.