Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Additional Proxy Configuration > Content Gateway support for IPv6
Content Gateway support for IPv6
Help | Content Gateway | v8.5.x
Forcepoint security solutions, including Content Gateway, provide support for IPv6.
 
* 
Important 
In transparent proxy deployments, support requires WCCP v2.01. If you use a Cisco router, it must be version 15.4(1) or later.
Content Gateway support for IPv6 includes:
*
IPv6 on dual IP stack Ethernet interfaces
*
Support for these protocols: HTTP, HTTPS, FTP, DNS
*
IPv6 traffic to the Internet, clients, and PAC file servers
*
IPv6 virtual IP addresses (vaddrs.config)
*
Authentication rules by client IPv6 address ranges
*
Client IPv6 addresses and address ranges to allow or restrict access to the proxy (ip_allow.config)
*
Client IPv6 addresses and address ranges to allow or restrict access to the Content Gateway manager (mgmt_allow.config)
*
IPv6 Primary Destination value and Source IP values in proxy filtering rules (filter.config), cache rules (cache.config), and parent proxy servers in a chain (parent.config)
*
IPv6 addresses in the SSL Incident List
*
SNMP traps and counters for IPv6 data
Limits and restrictions:
*
IPv6-only internal networks are not supported
*
IPv4 must be used to communicate among all Forcepoint components, including other members of a Content Gateway cluster (multicast address)
*
With all user authentication, the domain controllers must be reachable on an IPv4 address
*
Range-based IP Spoofing is not available for IPv6.
*
SOCKS proxy is not supported
*
IPv6 support is not available for FTP passive mode with the transparent proxy.
*
IPv6 only clients do not display a block page correctly. The user is blocked from the site as expected but will receive a browser error rather than a block page. Dual-stack IPv6 clients receive the normal block page.
IPv6 proxy statistics:
Content Gateway tracks IPv6 traffic. View statistics on the Monitor > Networking > System page.
Effect of IPv6 on Event logs:
When IPv6 is enabled, Event log entries are normalized to IPv6 format. For example, "10.10.41.200" is logged as "::ffff:10.10.41.200".
To filter on a client at "10.10.41.200" in a custom log, requires the following filter:
<LogFilter>
<Name = "IPv6_Test_Machine"/>
<Condition = "chi MATCH ::ffff:10.10.41.200"/>
<Action = "ACCEPT"/>
</LogFilter>
IPv6 configuration summary
IPv6 support is disabled by default.
If Content Gateway is deployed on an appliance, first enable IPv6 on the appliance, then enable it for Content Gateway. See your Forcepoint appliance documentation.
To enable IPv6 support:
1.
Log on to the Content Gateway manager.
2.
Navigate to the Configure > My Proxy > Basic > General tab.
3.
Under Networking, locate the IPv6 row and select On.
Once IPv6 support is enabled, in any field that accepts an IPv6 address, the address can be entered in any format that conforms to the standard. For example:
*
Leading zeros within a 16-bit value may be omitted
*
One group of consecutive zeros may be replaced with a double colon
When IPv6 is disabled, IPv6 entry fields are hidden from view and IPv6 values are deleted from configuration files.
When the DNS Resolver is used, go to the Configure > Networking > DNS Resolver page to set an IPv4 or IPv6 preference. IPv4 is the default.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Additional Proxy Configuration > Content Gateway support for IPv6
Copyright 2023 Forcepoint. All rights reserved.