Combined IPv4 and IPv6 Policy

This feature introduces a new, consolidated policy mode. In this mode, IPv4 and IPv6 policies are combined into a single, consolidated policy. This means that a single policy can be defined that includes both IPv4 and IPv6, instead of defining separate policies.

In consolidated policy mode, there is a single policy table for the GUI. The same source interface, destination interface, service, user, and schedule are shared for both IPv4 and IPv6, while there are different IP addresses and IP pool settings.

Consolidated policy mode can be enabled with the following CLI command:

config system settings

set consolidated-firewall-mode enable

Enabling consolidated-firewall-mode will delete all firewall policy/policy6. Do you want to continue? (y/n) y

end

Enabling consolidated policy mode will delete all existing IPv4 and IPv6 policies.

To configure a consolidated policy in the CLI:

config firewall consolidated policy

edit 1

set uuid 754a86b6-2507-51e9-ef0d-13a6e4bf2e9d

set srcintf "port18"

set dstintf "port17"

set srcaddr4 "10-1-100-0" <-------- IPv4 srcaddr

set dstaddr4 "172-16-200-0" <-------- IPv4 dstaddr

set srcaddr6 "2000-10-1-100-0" <-------- IPv6 srcaddr

set dstaddr6 "2000-172-16-200-0" <-------- IPv6 dstaddr

set action accept

set schedule "always"

set service "ALL"

set logtraffic all

set ippool enable

set poolname4 "test-ippool4-1" <-------- IPv4 poolname

set poolname6 "test-ippool6-1" <-------- IPv6 poolname

set nat enable

next

end

Limitations

The following features are not currently supported by consolidated policy mode:

• Policy-learning mode
• Internet-services in policy
• Address-negate and service-negate
• DSCP-match/Tos
• Traffic shaper in policy
• Capture-packet in policy
• External IP list in policy
• schedule-timeout, block-notification, disclaimer, custom-log-fields, or reputation in policy
• timeout-send-rst, tcp-session-without-syn, or anti-replay in policy;
• Policy Interface Pair View
• Policy lookup function on page.

The session/iprope tables for IPv4 and IPv6 are still displayed separately.