Skip to main content
Shridhar
Shridhar
New Member
September 9, 2015
Question

IPV6 Configuration

  • September 9, 2015
  • 6 replies
  • 8305 views

Hi All,

One of our customer is having below requirement.

 

1) Currently customer is having IPV4 address configuration over WAN interface. 2) Customer is getting IPV6 IP stack over same Interface from ISP. 3) Customer want to map those IP over WAN Interface as well as he want to map those ip in End user system.

 

So please let me know how can we fulfill the same requirement over the Fortinet firewall. Regards, Shridhar

6 replies

emnoc
emnoc
New Member
September 9, 2015

You have a host of architect designs to contend with, but what is the ISP giving you for starters? Are they routing any prefixes to your ipv6 wan address?

 

Let's say they give you a /48, you could build dual-stack interfaces on a /64 prefixes and enable SLAAC or even dhcpv6 on these interfaces for the end-user. Than with the correct  fw-policy6 you grant access to ipv6 end-users.

 

If they are giving you a single /64 prefix and you don't want to chop it up, than you could deploy a NAT66  and use a 2001:db8:: prefix internal. This would NOT be a global unicast routed prefix and should be treat like a  rfc1918 networks in ipv4.

 

or

 

You could map  the ipv4 address into ipv6 ( assuming static ) and then NAT these into the global unicast ipv6 network,

 

or

 

assign a unique local address  and then NAT them into the Global Unicast Address

 

but in practical we shouldn't need todo any of the above and just assign  global unicast-routed address from your assignment.

 

So back to the 1st question, "what is your provider giving you?"

 

 

 

 

 

Rede
Rede
New Member
October 19, 2015

Hello,

Friends received from my ISP a / 56 IPv6. I configured a network 9e00 / 64 in my FortiGate interface.

In my internal network station my ip network 9e0a / 64.

My problem is with the internet because I can only go out to the internet when habiliato the NAT66 on the rules.

Am I doing something wrong? Would not that work without NAT?

Thanks in advance.

emnoc
emnoc
New Member
October 19, 2015

Okay 1st what is a "9e00"?

 

For diagnostic the diag debug flow is your friend for ipv6 it's similar as ipv4 with the added "6"

 

e.g

 

diag debug reset

diag debug enable

diag debug flow filter6 addr 2001:db8::1

diag debug flow filter6 port 443

diag debug flow show console enable

diag debug flow trace start6 100

 

 

and when your finished remember to reset and disable the diagnostic flow

 

Qs:

 

Now on too your question what did you do with the /56? Are you using SLAAC inside

 

Do you have router static6 or some dynamic routing protocol to reach the public ipv6

 

You mention NAT66 so I'm guessing your nating a non-global ipv6 address to your public  ipv6  global address?

 

 

Please provide a topology map and diagnostic  of what your problem(s).

 

 

Terms & ConditionsAccessibility statement