PaloAltoNetworks/terraform-aws-swfw-modules

IPv6 support

kverstr opened this issue · 3 comments

Is your feature request related to a problem?

Hey,

We're looking into IPv6 in AWS to avoid IPv4 pool exhaustion and future proofing. Currently trying to get a setup to work, however without much success.
The modules are not IPv6 ready, this seems to be an easy fix at first sight though. It's a few resources like the GWLB, GWLBe, endpoint service, that need an extra variable to enable IPv6 or dualstack. And the rest is adding IPv6 CIDRs to the VPC and subnets. I'd create the MR myself if I would be able to get this setup to work but it seems I'm running into FW configuration issues. Right now I don't see any IPv6 traffic in the FW, yet I'm routing IPv6 from a spoke account through the GWLBe..

So, should this setup support IPv6 and will the modules support this in the future as well?
Secondly, can I maybe get some help with getting the configuration correct on the FW or should I create a support ticket at PaloAlto for this?

Kr

Kim

Describe the solution you'd like

IPv6 support for the modules with a working bootstrap configuration example.

Describe alternatives you've considered.

No response

Additional context

No response

migara commented

@kverstr Indeed, we are planning to extend support for IPv6 over the next few months 🚀 We can share a sample configuration snippet with you once we have set this up in the lab, or feel free to open a support case 🙌🏽

There is an example on how to use IPv6 now

Not everything seems to be covered though. We're using a GWLB setup, it seems the GWLB related modules are still lacking the IPv6 updates. The GWLB, VPCe service, VPCe,... all need to be configured as IPv6 / dualstack capable as well. I ended up doing all the IPv6 changes myself and we're going to start rolling it out to nprd soon. Maybe I can create some PR's here once I tested everything.

Kr