Technical Tip: Configure multiple RDNSS IPv6 addresses on the FortiGate

As a primer, RFC 8106 specifies a method of advertising DNS servers within an IPv6 Router Advertisement (RA) that is called RDNSS. This allows administrators to serve both dynamic IPv6 addressing (via SLAAC) and DNS server addresses within an IPv6 RA, rather than needing to also enable stateless DHCPv6 support (though RDNSS can work in tandem with DHCPv6).

On the FortiGate currently, setting RDNSS address entries may only be done in the CLI. Multiple entries may be specified, though the method has changed before and after FortiOS v7.6.1 and Change #1042078:

FortiOS v7.6.0 and earlier:

Multiple RDNSS IPv6 addresses may be added in a space-delimited list in the network interface configuration under the config ip6-prefix-list sub-section. No commas or quotation marks are required:

config system interface

    edit <name>

        config ipv6

            config ip6-prefix-list

                edit <ipv6_prefix/mask>

                    set rdnss <dns_address1> <dns_address2> <...>

                next

            end

        end

    next

end

Example:

config system interface

    edit "port1"

        config ipv6

            config ip6-prefix-list

                edit 2001:db8:abcd:1::/64

                    set rdnss 2001:db8:d0c:1001::1 2001:db8:d0c:1001::2 2001:db8:d0c:1001::3

                next

            end

        end

    next

end

FortiOS v7.6.1 and later:

RDNSS addresses are now configured under a new dedicated sub-section (config ip6-rdnss-list), and each server address is added as a new 'edit' entry. Notably, this change also adds support for specifying the rdnss-life-time for each DNS address entry:

config system interface

    edit <name>

        config ipv6

            config ip6-rdnss-list

                edit <ipv6_prefix/mask>

                    set rdnss-life-time <0-4294967295, default = 1800 seconds>

                next

            end

        end

    next

end

Example:

config system interface

    edit "port1"

        config ipv6

            config ip6-rdnss-list

                edit 2001:db8:d0c:1001::1

                    set rdnss-life-time 300

                next

                edit 2001:db8:d0c:1001::2

                next

                edit 2001:db8:d0c:1001::3

                next

            end

        end

    next

end

Related documents:

• IPv6 address assignment
• Technical Tip: How to setup the FortiGate to assign IPv6 addresses