> Source: [sk169913](https://support.checkpoint.com/results/sk/sk169913)
# sk169913 - How to enable IPv6 on existing CloudGuard Network Security IPv4 Single Gateway in AWS
| Property | Value |
|----------|-------|
| Solution ID | sk169913 |
| Date Created | 2020-10-25 |
| Last Modified | 2026-02-15 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81 (EOS), R81.10 (EOS), R81.20, R82 |
| OS | Gaia |
| Platform | AWS |
## Solution
Follow these instructions to configure IPv6 on a CloudGuard Network Security Gateway deployed in AWS.
### Part 1 - AWS Console Configuration
1. Open the Amazon **VPC console** at .
2. Select your VPC, and choose **Actions \> Edit CIDRs.**
3. Add new IPv6 CIDR.
4. From the VPC console, select **Subnets.**
5. Select the subnet from your VPC that is attached to the relevant network interface. Then go to **Actions \> Edit IPv6 CIDRs.**
6. Add Subnet IPv6 CIDR block.
7. From the VPC console, select **Route Tables.**
8. Select external route table from your VPC and go to **Actions \> Edit Routes.**
9. Add routes for the IPv6 network.
10. From the VPC console, select **Network ACLs** or**Security Groups.**
11. Select Network ACL or Security Group attached to your VPC. Then go to **Actions \> Edit inbound/outbound rules.**
12. Update Network ACL or Security Group with inbound/outbound rules for IPv6 subnets.
13. Open the Amazon **EC2** console at .
14. In the navigation pane, select **Instances**.
15. Select your instance, then go to **Actions \> Networking \> Manage IP Addresses** .
16. Assign IPv6 address to a network interface.
### Part 2 - Check Point CloudGuard Network Security Gateway Configuration
Login to the Security Gateway using SSH.
From **CLISH,** run these commands:
1. Enable IPv6:
`set ipv6-state on`
2. Add IPv6 address to the relevant interface (in this case, `eth0` is used):
`set interface eth0 ipv6-address mask-length `
For example:
`set interface eth0 ipv6-address 2001:0ba0::1 mask-length 64`
3. Save the changes:
`save config`
4. Reboot the VM:
`reboot`
5. Calculate and set the IPv6 default gateway. For that:
1. Find the IPv4 default gateway:
`netstat -nr |grep "^0.0.0.0"` Expected output:
`[Expert@aws-sgw:0]# netstat -nr |grep "^0.0.0.0"`
` 0.0.0.0 `1.2.3.1` 0.0.0.0 UG 0 0 0 eth0`
2. Find the MAC address of the default gateway interface:
`arp -n `1.2.3.1 Expected output:
`[Expert@romanka-sgw-2:0]# arp -n `1.2.3.1
` Address HWtype HWaddress Flags Mask Iface`
` `1.2.3.1` ether `01:23:45:67:89:01` C eth0`
3. Copy HWaddress and browse to any eui64 calculator (for example, [https://eui64-calc.princelle.org](https:/eui64-calc.princelle.org)).
4. In the eui64 calculator, define a start of the IPv6 address.
**Note:** The IPv6 address must start with **fe80:**.
5. Calculate the IPv6 address:
**For example:**
IPv6 address for the MAC: 01:23:45:67:89:01 is **fe80::32345ff:fe67:8901** .
6. Add the IPv6 default route:
`set ipv6 static-route default nexthop gateway fe80::32345ff:fe67:8901 interface eth0 on`
### Limitations
* IPv6 can be used only in addition to the IPv4 addresses on EC2 instances.
* Cloud Management Extension (CME) does not support IPv6 objects.
* For more information about limitations, see [sk163313 - IPv6 features and limitations](https://support.checkpoint.com/results/sk/sk163313).
### Additional Information
* [AWS documentation for assigning IPv6 address to an instances](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-migrate-ipv6.html#vpc-migrate-assign-ipv6-address)
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content