Most of the times, there are many enterprises that ignore the role of IPv6 on their computer systems in case of the risk of distant users, that such computer can make use of the restricted websites using VPNs to restrict the information they can access.
This drawback comes due to the design of some remote-access VPNs, which can inspect and implement the security controls just for the traffic of IPv4 because it goes via a VPN concentrator by not letting the safeguards of similar IPv6 traffic.
Now, this allows direct access for the internet in case of IPv6 traffic having no need of some precise controls. It is known as IPv6 VPN’s breakdown, which is very common, but ignored at the same time. There are solutions available for IPv6 VPN breakout, but at first, it is necessary to get its significance.
Reasons for IPv6 VPN breakout’s ignorance
There are a lot of organisations who don’t know the usage of IPv6 on the devices accessing their corporate networks through the VPN. They might use broadband or different cellular devices in order to access the internet just like they use it for laptops, phones and tablets to remote access the corporate networks that support IPv6.
The result is, companies, now also deny taking IPv6 a serious security concern. They design their VPNs only to monitor the IPv4 traffic, but this lets IPv6 sites free access to remote devices, which might be hazardous for business networks as well as data.
Its security functions work like this- when VPN is developed, internet traffic is identified by VPN concentrator and automatically, the traffic from out the boundaries has blocked the way companies have configured it.
Hence, the companies must accept that in case of their IPv6-capable applications, which mobile workers look after must be gone through a strict action if they want to eliminate this security concern.
Tricks to avoid breakout of IPv6 VPN
In order to avoid the breakout, IPv6 on VPN should be incorporated and allowed in the corporate periphery. First, they should initiate this and then, create connectivity for IPv6. The present firewalls of the corporate periphery can readily use VPN by just enabling its configuration.
The second option here is using a VPN client to control IPv6 leakage. Here is an example to understand this- A combination of Cisco AnyConnent and ASA security appliance is able to monitor the split-tunnelling configuration for IPv6 enabled clients. Similarly, the combo of Palo Alto GlobalProtect VPN network and Fortinet SSL VPN FortiClient is also IPv6-friendly.
Many companies, unfortunately, adopt an approach of breaking IPv6 connection when VPN tunnel is developed. Here, VPN server allows the default route of IPv6 (/0) to the VPN client’s routing table that heads all connections via VPN tunnel. However the corporate internet networks, as well as VPN, are IPv4 only, all these IPv6 links are mislaid. Also, the companies must not direct the default route of IPv6 if they don’t have IPv6 connectivity because then, they can raise the issues related to app connectivity to VPN clients trying to access IPv6 apps. Primarily, such clients would face encountered connections, while accessing such apps followed by a delay as they involve in the quick IPv4 fallback.