NAT firewall for IPv6?

Edgar Carver dredgarcarver at gmail.com
Sat Jul 2 02:28:54 UTC 2016


Hello NANOG community. I was directed here by our network administrator
since she is on vacation. Luckily, I minored in Computer Science so I have
some familiarity.

We have a small satellite campus of around 170 devices that share one
external IPv4 and IPv6 address via NAT for internet traffic. Internal
traffic is over an MPLS.

We're having problems where viruses are getting through Firefox, and we
think it's because our Palo Alto firewall is set to bypass filtering for
IPv6. Unfortunately, the network admin couldn't give me the password since
a local consultant set it up, and it seems they went out of business. I
need to think outside the box.

Is there some kind of NAT-based IPv6 firewall I can setup on the router
that can help block viruses? I figure that's the right place to start since
all the traffic gets funneled there. We have a Cisco Catalyst as a
router. Or, ideally, is there an easy way to turn off IPv6 completely? I
really don't see a need for it, any legitimate service should have an IPv4
address.

I'd really appreciate your advice. I plan to drive out there tomorrow,
where I can get the exact model numbers and stuff.

Regards,
Dr. Edgar Carver



More information about the NANOG mailing list