> Source: [sk184620](https://support.checkpoint.com/results/sk/sk184620)

# sk184620 - IPv6 support for CloudGuard Network Security in GCP

| Property | Value |
|----------|-------|
| Solution ID | sk184620 |
| Date Created | 2026-02-09 |
| Last Modified | 2026-02-11 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.10 (EOS), R81.20, R82 |

## Solution

**Table of Contents**

* Overview
* Architecture (Dual-Stack)
* Part 1 - IPv6 Configuration
* Part 2 - SmartConsole Object Configuration
* Part 3 - Inbound IPv6 Traffic
* Part 4 - Outbound IPv6 Traffic and GCP Routing

Overview {#Overview}
--------------------

CloudGuard Network Security supports IPv6 in dual-stack mode (IPv4 + IPv6) for the following deployment types:

* Security Gateway
* Management-only
* Stand-alone

This article explains how to configure IPv6 on a single CloudGuard Gateway in GCP, including IPv6 addressing, routing, SmartConsole objects, and inbound and outbound traffic handling.  

Architecture (Dual-Stack) {#Architecture}
-----------------------------------------

|-----------------|-------------------|-----------------------------|
| Interface       | Role              | Addressing                  |
| eth0 (External) | Public-facing NIC | Public IPv4 + Public IPv6   |
| eth1 (Internal) | Internal NIC      | Private IPv4 + Private IPv6 |

<br />

Notes:  

* Depending on the deployment, eth0 can be configured with either a public or private IPv6 address.
* Additional internal interfaces (eth2, eth3, ...) are supported. Each interface can have its own IPv4 and IPv6 subnets and must be configured using the same IPv6 procedure described below.

Part 1 -- IPv6 Configuration {#Part1}
-------------------------------------

### Step 1 -- Enable IPv6 and Assign Addresses

From CLISH:

`set ipv6-state on`  

`set interface eth0 ipv6-address <EXT_PREFIX::1> mask-length 96`  
`set interface eth1 ipv6-address <INT_PREFIX::1> mask-length 96`  

`# Repeat for additional internal interfaces`  

`save config`  

Example:  

If the GCP Console displays the following IPv6 value:  

`2600:1900:4000:a081:0:1:0:0`  

Configure the interface with a valid IPv6 address from the same /96 prefix:  

`set interface eth0 ipv6-address 2600:1900:4000:a081:0:1:0:1 mask-length 96`  

### Step 2 -- Retrieve Link-Local Next-Hop Addresses

Each GCP NIC has an automatically assigned link-local IPv6 gateway address, which must be used as the next hop for IPv6 static routes.

From Expert mode:  

`curl_cli -s -H "Metadata-Flavor: Google" \`  
`http://169.254.169.254/computeMetadata/v1/instance/network-interfaces/0/gateway-ipv6 # eth0`  

`curl_cli -s -H "Metadata-Flavor: Google" \`  
`http://169.254.169.254/computeMetadata/v1/instance/network-interfaces/1/gateway-ipv6 # eth1`  

Repeat for each network interface index (0, 1, 2, ...).  

Example output:  

`fe80::4001:aff:fe6b:cd01`  

### Step 3 -- Configure IPv6 Static Routes

From CLISH:

`set ipv6 static-route default nexthop gateway <fe80::eth0-LL> interface eth0 on`  
`set ipv6 static-route <ULA_PREFIX::/48> nexthop gateway <fe80::eth1-LL> interface eth1 on`  
`# Repeat for each additional internal interface (eth2, eth3, ...),`  
`# using the corresponding ULA /48 prefix and link-local gateway address.`  

`save config`  

Where:

* \<`fe80::ethX-LL`\> is the link-local IPv6 gateway address retrieved in Step 2
* \<`ULA_PREFIX::/48`\> is the internal IPv6 Unique Local Address (ULA) prefix routed behind eth1.  

  The prefix is derived from the IPv6 address configured on eth1 and represents  
  the first /48 of that address space.  

  For example, if eth1 uses:  

  `fd12:3456:789a:1::/96`  

  Use:  

  `fd12:3456:789a::/48`

<br />

For **Management-only** deployments, configure IPv6 only on eth0, as no internal interface (eth1) is present.  

### Step 4 -- Reboot the Gateway

Reboot the system to apply the IPv6 configuration (from CLISH):  
reboot

<br />

### IPv6 Prefix vs Host Address Note

The IPv6 address ending in ::0 represents the prefix as shown in the GCP Console.

Management access (SSH, Gaia Portal, SIC, etc.) must use the host IPv6 address configured on the interface (::1).

Part 2 -- SmartConsole Object Configuration {#Part2}
----------------------------------------------------

Verify the following objects in SmartConsole:

* **Gateway Object**
  * Assign the IPv6 address exactly as shown in the GCP Console for the interface  
    (for example: 2600:1900:4000:a081:0:1:0:0).
* **Protected Host Objects**
  * Create Host objects for internal applications.
  * Assign their internal IPv6 addresses and use them in access control and NAT rules.
* **All_Internet Object**   
  * Extend the object definition to include the full IPv6 address range:  
    :: -- ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff  
    in addition to IPv4.

Part 3 - Inbound IPv6 Traffic {#Part3}
--------------------------------------

**Inbound traffic flow**

**Internet ? Gateway (eth0, public v4/v6) ? (policy / DNAT) ? Internal server (via eth1)** ? Gateway ? Internet

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1769938876297/inbound202602011215532.png)

NAT rule:

|-----------------|-----------------------|--------------------------|-------------------|-----------------------------|--------------------|
| Original Source | Original Destination  | Original Services        | Translated Source | Translated Destination      | Translated Service |
| All_Internet    | Gateway-External-IPv6 | http/https (or app port) | = Original        | Internal Host (internal IP) | = Original         |

<br />

Part 4 - Outbound IPv6 Traffic and GCP Routing {#Part4}
-------------------------------------------------------

**Outbound traffic flow**   
**Web server ? Gateway (eth1) ? (Hide NAT on eth0) ? Internet**

**![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1769938876297/outbound202602011216203.png)**

|-------------------------------|----------------------|-------------------|-----------------------|------------------------|--------------------|
| Original Source               | Original Destination | Original Services | Translated Source     | Translated Destination | Translated Service |
| WebServers / internal subnets | All_Internet         | Any               | Gateway-External-IPv6 | = Original             | = Original         |

### GCP Internal VPC Routes

In the GCP Console: ****VPC network ? Routes ? Create route****

|-------------|-----------------------|
| Destination | Next Hop              |
| ::/0        | Gateway VM (instance) |
| 0.0.0.0/0   | Gateway VM (instance) |

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content