Skip to main content
Ketanest
Ketanest
Explorer
September 9, 2025
Question

Fortigate anwers any DAD packet when using IPv6-PD

  • September 9, 2025
  • 3 replies
  • 688 views

Hi together,

 

we started to play a little bit with IPv6. For cost reasons we only use an internet connection with no static assigned address range on branch offices so we have to use prefix delegation. The provider delegates a /56 network which seems to be almost static but if it would change one time it would break IPv6 so we configured prefix delegation.

 

Linux clients don't configure an address via SLAAC. After some research (with wireshark) we figured out that linux does (RFC conform) duplicate address detection but Fortigate answers any of this neighbor solicitations even if the address is not configured or assigned to the Fortigate. Windows and iOS devices don't seem to to that and seem to configure their SLAAC without DAD. When disabling DAD on linux clients they configure their address via SLAAC.

Why does Forti answer any of these neighbor solicitations? We can't disable DAD on each client that would be a mess. Do we have to set any options additionally or unconfigure things to stop Fortigate doing this?

 

The following interface config is WAN on the one side and the guest network as an example for a LAN network. Hardware is a Fortigate 40F on Firmware 7.4.7. If you need more information please give an advise.

config system interface     edit "wan"         set vdom "root"         set mode dhcp         set allowaccess ping         set type physical         set alias "WAN"         set monitor-bandwidth enable         set snmp-index 1         config ipv6             set ip6-mode dhcp             set ip6-allowaccess ping             set dhcp6-prefix-delegation enable             config dhcp6-iapd-list                 edit 1                     set prefix-hint ::/56                 next             end         end         set dns-server-override disable     next 	edit "vlan.10"         set vdom "root"         set ip 192.168.112.1 255.255.255.0         set allowaccess ping         set alias "Guest"         set device-identification enable         set snmp-index 20         config ipv6             set ip6-mode delegated             set ip6-allowaccess ping             set ip6-send-adv enable             set ip6-other-flag enable             set ip6-delegated-prefix-iaid 1             set ip6-upstream-interface "wan"             set ip6-subnet ::70:0:0:0:1/64             config ip6-delegated-prefix-list                 edit 1                     set upstream-interface "wan"                     set delegated-prefix-iaid 1                     set subnet 0:0:0:70::/64                     set rdnss-service default                 next             end         end         set interface "lag.switch"         set vlanid 10     next end

 

Thanks already in advance!

3 replies

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
September 12, 2025

Hello Ketanest, 

 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

 

Thanks, 

Jean-Philippe - Fortinet Community Team
Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
September 15, 2025

Hello Ketanest,

 

I found this solution. Can you tell us if it helps, please?

 

The issue you're experiencing with the FortiGate responding to Neighbor Solicitations (NS) for addresses not assigned to it is likely related to the Neighbor Discovery Protocol (NDP) behavior. Here are some steps you can take to address this:

 

  1. Check ND Proxy Settings: Ensure that ND Proxy is not enabled on the FortiGate interfaces. ND Proxy can cause the FortiGate to respond to NS messages for addresses not assigned to it. You can check and disable ND Proxy with the following command: ```shell config system nd-proxy set status disable end ```

  2. Review Interface Configuration: Ensure that the interface configurations are correct and that there are no additional settings that might cause the FortiGate to respond to NS messages inappropriately.

  3. Update Firmware: Ensure that your FortiGate is running the latest firmware version. Sometimes, unexpected behavior can be resolved with firmware updates that address known issues.

  4. Consult Fortinet Support: If the issue persists after checking the above settings, consider reaching out to Fortinet Support for further assistance. They may have additional insights or patches for this specific behavior.

 

By following these steps, you should be able to mitigate the issue with the FortiGate responding to Neighbor Solicitations incorrectly.

Jean-Philippe - Fortinet Community Team
Ketanest
KetanestAuthor
Explorer
September 15, 2025

Hi Jean-Philippe,

 

Thanks for your reply!

Unfortunately this is not successful. ND-Proxy is already deactivated. The interface config is listed up in the first post and as far as I can see there should be no configurations causing the NS messages. Firmware is on the recommended version (7.4.8 - this was accidentally wrong in the first post).

 

So I will contact Fortinet Support for this issue.

 

Best regards,

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
September 15, 2025

Hello again,

 

I am sorry that it didn't work and before you contact the Support, can you try this:

 

If ND Proxy is already disabled and the issue persists, consider the following steps:

 

  1. Verify Configuration: Double-check the interface configurations to ensure there are no unintended settings that might cause the FortiGate to respond to NS messages.

  2. Check for Bugs: Review the release notes for FortiOS 7.4.8 to see if there are any known issues related to NDP or DAD that might affect your setup.

  3. Packet Capture: Use packet capture on the FortiGate to analyze the NS and NA messages. This can help identify if the FortiGate is indeed responding incorrectly and under what conditions.

  4. Review IPv6 Settings: Ensure that the IPv6 settings on the FortiGate are correctly configured for your network environment, particularly focusing on SLAAC and DHCPv6 settings.

  5. Contact Support: If the issue remains unresolved, consider reaching out to Fortinet Support with detailed logs and packet captures for further investigation.

 

These steps should help in diagnosing and potentially resolving the issue with NS message responses.

Jean-Philippe - Fortinet Community Team
Terms & ConditionsAccessibility statement