Troubleshooting Tip: After upgrading to FortiOS v7.6, FortiGate cannot obtain IPv6 address using DHCPv6 from some Comcast networks

Description

This article describes an issue affecting some environments, where acquiring an IP address using DHCPv6 from some ISPs, including Comcast, may fail after upgrading from FortiOS v7.4 to v7.6.

Scope

FortiOS v7.6.x using Comcast as ISP.

Solution

After upgrading to FortiOS v7.6, a FortiGate device will reconfigure a DHCPv6 interface if a routing change is detected. In environments where Router Advertisement messages containing multiple unicast addresses are common, the firewall may be unable to obtain a DHCPv6 client address from the ISP.

Confirming the issue:

Collect DHCPv6 client process debugs on FortiGate. If the 'netlink event is received' message occurs every few seconds and the firewall is running an affected firmware version, the FortiGate is in scope for this issue:

diagnose debug disable
diagnose debug reset
diagnose debug app dhcp6c -1
diagnose debug enable
dhcp6c_netlink_event_handler() netlink event is received

Workaround:

Use a static IPv6 address if available. If this is not an option, revert to FortiOS v7.4.

If reverting to the previous firmware and configuration, see Technical Tip: Selecting an alternate firmware for the next reboot for the recommended rollback method applicable to physical devices.

Resolution:

This issue is tracked internally with issue ID# 1238946. The issue is resolved in FortiOS v8.0.0, and a fix is being considered for inclusion in v7.6.

At the time of writing, the most recent FortiOS v7.6 release (v7.6.7) is affected by this issue.

Related documents:

GUI support for configuring IPv6
Technical Tip: How to analyze DHCPv6 issue