Notifications; Unsupported Features; General Points - Stormshield SN series Configuration Manual

Notifications

Syslog
Logs can be sent to syslog servers in IPv6.
SNMP server
The SNMP server embeds the MIB-2 in IPv6. It can also generate traps in IPv6.

Unsupported features

In version 1.0, the following are features that will not be available for IPv6 traffic:
- IPv6 address translation (NATv6),
l
Application inspections (Antivirus, Antispam, HTTP cache, URL filtering, SMTP filtering, FTP
l
filtering and SSL filtering),
Use of the explicit proxy,
l
- DNS cache,
l
SSL VPN portal tunnels,
l
SSL VPN tunnels,
l
Radius or Kerberos authentication,
l
- Vulnerability management.
l

General points

Active Update
The firewall's Active Update service can now be used with update servers configured in IPv6. In
this case, a mirror server needs to be installed for updates configured in double stack (IPv4 /
IPv6): this server will be able to synchronize in IPv4 with Stormshield Active Update servers, and
provision its updates to firewalls in IPv6.
High availability
In cases where the firewall is in high availability and IPv6 has been enabled on it, the MAC
addresses of interfaces using IPv6 (other than those in the HA link) must be defined in the
advanced properties. Indeed, as local IPv6 link addresses are derived from the MAC address,
these addresses will be different, causing routing problems during a switch.
Protocols
Enabling IPv6 support does not modify the IP configuration elements (Application protection >
Protocols module).
Implicit rules
Implicit rules specific to the use of IPv6 services have been added and can be enabled or
disabled. These rules are as follows:
Allow router solicitations (RS) in multicast mode or to the firewall,
l
Allow requests to the DHCPv6 server and DHCPv6 multicast solicitations.
l
Page 370/448
SNS - USER CONFIGURATION MANUAL V.3
sns-en-user_configuration_manual-v3 - Copyright © Stormshield 2016
IPV6 SUPPORT