Technical Tip: IPv6-neighbor-cache for neighbour discovery feature

Description

This article describes how to save neighbor cache entries for the VDOM.

Solution

The IPv6 neighbor discovery cache feature allows static entries to be made in the IPv6 neighbor cache.

The IPv6 neighbor discovery process uses ICMP messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local link), verify the reachability of a neighbor, and track neighboring devices.

The IPv6 static cache entry for neighbor discovery feature allows static entries to be made in the IPv6 neighbor cache. Static routing requires an administrator to manually enter IPv6 addresses, subnet masks, gateways, and corresponding Media Access Control (MAC) addresses for each interface of each device into a table.

Run the following commands:

config system ipv6-neighbor-cache
    edit {id}                                <-- Configure IPv6 neighbor cache table.
        set id {integer}                      <-- Unique integer ID of the entry. range[0-4294967295].
        set interface {string}                <-- Select the associated interface.
        set ipv6 {ipv6 address}               <-- IPv6 address (format: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx).
        set mac {mac address}                 <-- MAC address (format: xx:xx:xx:xx:xx:xx).
    next
end

Verification of the configuration and troubleshooting:
To check if the reachability of a neighbor IPv6 was successful use the following command:

diagnose ipv6 neighbor-cache list

Or:

diagnose ipv6 neighbor-cache list | grep -f MAC_ADDRESS

In this case, the device is being automatically recognized (state=00000002 - REACHABLE) and does not require an IPv6 static cache. When the configuration is done using IPv6 static cache, the status is "state=00000080 - PERMANENT".
Once it was registered on this list, the FortiGate recognizes the IPv6, the physical address, and most importantly the associated interface.
Here is a complete list of neighbor-cache states:

state=00000001 - INCOMPLETE
state=00000002 - REACHABLE
state=00000004 - STALE
state=00000008 - DELAY
state=00000010 - PROBE
state=00000020 - FAILED
state=00000040 - NOARP
state=00000080 - PERMANENT