2

I found this weird address formatting in Palo Alto firewall. Normally this section contains IP Address. This is definitely not an IPv4 Address.

admin@PaloAltoFW vsys3(active)> test security-policy-match source 10.1.1.1 destination 192.168.1.1 protocol 6 destination-port 80

"Test Rule" {
        from any;
        source any;
        source-region none;
        to outside;
        destination [ 0:0:0:0:0:0:0:0/10 ];
        destination-region none;
        user any;
        category coinhive;
        application/service [ any/tcp/any/443 any/tcp/any/80 ];
        action deny;
        icmp-unreachable: no
        terminal no;
}

admin@PaloAltoFW vsys3(active)> 
2
  • 2
    Based on the "Test Rule", I think this is a garbage IPv6 entry signifying nothing. Unless you sanitized this output in some way hiding other factors, I believe you could safely delete this rule. Likely someone was playing with IPv6 rules and forgot to clean up after themselves.
    – YLearn
    Dec 6, 2017 at 4:02
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 17, 2019 at 21:51

2 Answers 2

2

That appears to be a very strange IPv6 prefix. The IPv6 address 0:0:0:0:0:0:0:0 (canonically represented by ::) is the Unspecified Address. I have no idea about the mask length of 10 that is associated with it.

Valid Global IPv6 addresses are in the range 2000::/3, ULA addresses are in the range fc00::/7 (with restrictions), Link-Local addresses are in the range fe80::/10, and multicast addresses are in the range ff00::/8.

1

0000::/8 is reserved by IETF, so 0:0:0:0:0:0:0:0/10 is not a valid address/prefix currently - see RFC 4291.

0000::/96 had previously been defined as the IPv4-compatible IPv6 address prefix, so that config entry might be related to that. It's also possible that that entry had used a valid subnet prefix earlier and was put out of order by changing the prefix to something invalid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.