Cannot add an IPv6 pool in a VPN group-policy in FMC

[Chess Norris]

Hi,

I was following this example on how to use split-tunneling for IPv6 - https://packetpushers.net/cisco-anyconnect-ipv6/

The problem is that there's no option to add an IPv6 pools in a group-policy in FMC - only IPv4 pools. Is this a bug or can it be added using flex-config? I am using FMC and FTD 6.6.4

Thanks

/Chess

[Josue Brenes · Accepted solution]

Hi Chess,

The only options for now is to assign the IPv6 pool on the tunnel-group/connection-profile instead.

Assigning it to the group-policy is not possible yet.

Rate if it helps.

Regards,

Josue Brenes

TAC - VPN Engineer.

[Chess_N]

Hi Josue,

Is it possible to mix and assign IPv4 addresses from the group-policy and IPv6 on the tunnel-group at the same time?

Best regards

/Jugge

[Milos_Jovanovic]

Hi @Chess_N,

Yes, it is possible to mix attributes from different sources. There is a list of priorities, if assigning same attribute from multiple sources, e.g. if you want to assign IP address to a user, and you define it under tunnel-group and group-policy, group-policy would have priority. But, if you assign it under group-policy and DAP, DAP would take precedence.

You can find this information under VPN config guide.

BR,

Milos

[rhugento@cisco.com]

Hi Josue, I have a customer requirement to have different IPv6 pools for two user groups for remote access VPN as described above. Therefore, I need as well IPv6 pools in the group-policy in FMC.

Can you please let me know if the below is still the case?

"The only options for now is to assign the IPv6 pool on the tunnel-group/connection-profile instead. Assigning it to the group-policy is not possible yet."

Is it a roadmap item or are there any workarounds possible? Many thanks!

[rhugento@cisco.com]

Hi Team, I have a customer requirement to have different IPv6 pools for two user groups for remote access VPN as described above. Therefore, I need as well IPv6 pools in the group-policy in FMC.

Can you please let me know if the below is still the case?

"The only options for now is to assign the IPv6 pool on the tunnel-group/connection-profile instead. Assigning it to the group-policy is not possible yet."

Is it a roadmap item or are there any workarounds possible? Many thanks!