Neighbor Discover Protocol

On some IPv6 networks, where prefix delegation is not supported, you can use the Neighbor Discover Protocol (ND proxy) to assign globally-routable IPv6 addresses to internal (LAN) interfaces and hosts.

Workflow:

  1. The Security GatewayClosed A dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. receives a globally-routable /64 IPv6 prefix from the ISP through a dynamic IPv6 internet-connection, using RA (Router Advertisement).

  2. Instead of assigning an IPv6 address to the internet-connection interface (using SLAAC), the address is assigned to one of the internal interfaces(LAN/DMZ/bridge/etc.).

  3. SLAAC is enabled automatically on the internal network/bridge. Hosts behind this internal network/bridge receive a globally-routable IPv6 address automatically.

  4. The internet-connection interface is not assigned with any global IPv6 address, but still has a link-local IPv6 address.

  5. A default-gateway route is created to the ISP's gateway link-local address (as with all IPv6 internet-connection).

  6. ND proxy is used to answer Neighbor Discovery requests from the ISP side to the internal network for hosts that were assigned addresses with IPv6 prefix received from the ISP.

For more information, seeConfiguring Internet Connectivity.