Support for IPv6

TRITON Enterprise, including the Content Gateway proxy component, provides support for IPv6.


	Important Prior to 7.8.4, IPv6 support is provided for explicit proxy deployments only. Beginning with 7.8.4, in transparent proxy deployments, IPv6 support requires WCCP v2.01. If you use a Cisco router, it must be version 15.4(1) or later.

Content Gateway support for IPv6 includes:

IPv6 on dual IP stack Ethernet interfaces

Support for these protocols: HTTP, HTTPS, FTP, DNS

IPv6 traffic to the Internet, clients, and PAC file servers

IPv6 virtual IP addresses (vaddrs.config)

Authentication rules by client IPv6 address ranges

Client IPv6 addresses and address ranges to allow or restrict access to the proxy (ip_allow.config)

Client IPv6 addresses and address ranges to allow or restrict access to the Content Gateway manager (mgmt_allow.config)

IPv6 Primary Destination value and Source IP values in proxy filtering rules (filter.config), cache rules (cache.config), and parent proxy servers in a chain (parent.config)

IPv6 addresses in the SSL Incident List

SNMP traps and counters for IPv6 data

Limits and restrictions:

IPv6-only internal networks are not supported

IPv4 must be used to communicate among all TRITON components, including other members of a Content Gateway cluster (multicast address)

With all user authentication, the Domain Controller(s) must be reachable on an IPv4 address

Prior to 7.8.4, the ARM does not support IPv6 addresses, including for redirection rules (ipnat.config) and static bypass rules (bypass.config)

The parent proxy in a chain cannot be IPv6

Prior to 7.8.4, IP spoofing is not supported. While IPv6 spoofing is available in 7.8.4 and later, range-based IP Spoofing is still not available for IPv6.

SOCKS proxy is not supported

IPv6 support, added in 7.8.4, is not available for FTP passive mode with the transparent proxy.

IPv6 only clients do not display a block page correctly. The user is blocked from the site as expected but will receive a browser error rather than a block page. Dual-stack IPv6 clients receive the normal block page.


	Warning When the operating system is Red Hat Enterprise Linux 6, update 3, or CentOS 6, update 3, do not specify an IPv6 nameserver in /etc/resolv.conf. If an entry is included, Content Gateway will reset every time it attempts to start. If your deployment requires an IPv6 nameserver, upgrade your operating system to Red Hat Enterprise Linux 6, update 4, or CentOS 6, update 4.

IPv6 proxy statistics:

Content Gateway tracks IPv6 traffic. View statistics on the Monitor > Networking > System page.

Effect of IPv6 on Event logs:

When IPv6 is enabled, Event log entries are normalized to IPv6 format. For example, "10.10.41.200" is logged as "::ffff:10.10.41.200".

To filter on a client at "10.10.41.200" in a custom log, requires the following filter:

</LogFilter>

IPv6 configuration summary

IPv6 support is disabled by default.

If Content Gateway is deployed on a Websense Appliance, first enable IPv6 in the Appliance Manager on the Configuration > Network Interfaces > IPv6 tab.

IPv6 is enabled in the Content Gateway manager in the Network section of the Configure > My Proxy > Basic page. When it is enabled, support is enabled for all functional areas as enumerated in the preceding section.

In any field that accepts an IPv6 address, the address can be entered in any format that conforms to the standard. For example:

Leading zeros within a 16-bit value may be omitted

One group of consecutive zeros may be replaced with a double colon

When IPv6 is disabled, IPv6 entry fields are hidden from view and IPv6 values are deleted from configuration files.

When the DNS Resolver is used, go to the Configure > Network > DNS Resolver page to set an IPv4 or IPv6 preference. IPv4 is the default.