Network objects (hosts, networks and IP address ranges) may have addresses in IPv6, or in a hybrid mode (IPv4 and IPv6). Filter policies can therefore be applied to IPv6 objects and can use the security inspection feature (customizable inspection profiles).
However, application inspection (Antivirus, Antispam and URL, SMTP, FTP and SSL filtering) and address translation (NAT) features are not available for IPv6 objects in this version (the NAT tab is renamed “NAT IPv4” when IPv6 is enabled).
Filtering consists of two parts. The strip at the top of the screen allows choosing the filter policy, activating it, editing it and seeing its last modification. The filter table is dedicated to the creation and configuration of rules.
Actions on filter policy rules
The available actions are the same as those for rules including IPv4 or IPv6 objects.
NDP (Neighbour Discovery Protocol) traffic will never be blocked, even in the case of a “block all” filter policy. This concerns NS (Neighbour Solicitation) and NA (Neighbour Advertisement) messages.
In Stormshield Network 1.0, certain actions that can only apply to IPv4 traffic will generate warnings ( icon) or errors ( icon) in the field “Checking the policy” if IPv6 objects are included in the filter rules.
|Standard rule including objects with different IP versions in the source and destination||
|Authentication rule including IPv6 objects||
|Inspection SSL rule including IPv6 objects||
|Explicit HTTP proxy rule including IPv6 objects|
|Rule with NAT on the destination including IPv6 objects|
|Rule including IPv6 objects and using application inspections (Antivirus, Antispam, HTTP cache, URL filtering, SMTP filtering, FTP filtering or SSL filtering)||