Adding IPv6 ULA to interface already configured with Prefix Delegation

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

To add an IPv6 Unique Local Address (ULA) to an interface already configured with prefix delegation on a FortiGate:

1. Access the CLI: Log in to your FortiGate device using the CLI.
2. Edit the Interface: Enter the configuration mode for the specific interface where you want to add the ULA.

shell
config system interface
edit "port5" <----- Replace "port5" with your actual interface name.

3. Configure IPv6 ULA: Add the ULA to the interface configuration:

shell
config ipv6
set ip6-address fdxx:xxxx:xxxx::1/64 <----- Replace with your ULA.
end

4. Retain Existing Configuration: Ensure that the existing prefix delegation settings remain unchanged.
5. Save and Exit: Save the configuration and exit.

shell
end

Hello,

I really hope we will find an answer and fix your issue :)!

I will try to find an expert for your question, and will come back to you ASAP.

Regards,

Still no solution for the issue?

Hi, I believe I might have a solution for you. I have a FortiGate with /56 PD assigned by ISP, sliced and distributed using SLAAC to local networks through delegation. So my local interface would have configuration like this:

config sys interface
  edit lanXX
    config ipv6
      ip6-mode delegated
      ip6-send-adv enable
      ip6-delegated-prefix-iaid 2
      ip6-upstream-interface "isp1-intf"
      set ip6-subnet ::99:0:0:0:1/64
      config ip6-delegated-prefix-list
        edit 1
          set upstream-interface "isp1-intf"
          set delegated-prefix-iaid 2
          set subnet 0:0:0:99::/64
          set rdnss-service delegated
        next
      end
    end
  next
end

Now, as this whole network depends on working ISP configuration, addressing might change, or the whole ISP might change I want to have critical local services running over ULA rather than GUA. In my case I needed BGP peering with my k8s cluster in that network. Adding ULA to the setup comes in few steps. First - configure prefix and route for your lan:

config sys interface
  edit lanXX
    config ipv6
      config ip6-prefix-list
        edit fd00::/64
        next
      end
    end
  next
end

config route static6
  edit 1
    set dst fd00::/64
    set device lanXX
  next
end

At this point for FortiGate should advertise fd00::/64 as secondary prefix and devices in the network should configure both GUA and ULA addresses. You need a firewall rule with NAT for local addresses to access Internet, obviously.

Now to the most interesting part - local address on FortiGate itself. You already noticed that you cannot mix static and delegated addresses on the same interface. The question is WHY do you want a local address on interface. You don’t need it for routing (this goes through link local rather than ULA). If it’s: “I need static local address to run services on FGT”, your solution is loopback address. “BGP on loopback” is our standard approach in modern firmware versions and can be replicated here:

config system interface
   edit "bgp"
       set vdom "root"
       set type loopback
       config ipv6
           set ip6-address fdf0::/128
       end
   next
end

Add a firewall rule allowing traffic from lanXX to bgp interface and you should be good to go!