New Member

Question

IPV6 Configuration

Forum|Forum|11 years ago
September 9, 2015
6 replies
8297 views

Hi All,

One of our customer is having below requirement.

1) Currently customer is having IPV4 address configuration over WAN interface. 2) Customer is getting IPV6 IP stack over same Interface from ISP. 3) Customer want to map those IP over WAN Interface as well as he want to map those ip in End user system.

So please let me know how can we fulfill the same requirement over the Fortinet firewall. Regards, Shridhar

5.2

emnoc

New Member

You have a host of architect designs to contend with, but what is the ISP giving you for starters? Are they routing any prefixes to your ipv6 wan address?

Let's say they give you a /48, you could build dual-stack interfaces on a /64 prefixes and enable SLAAC or even dhcpv6 on these interfaces for the end-user. Than with the correct fw-policy6 you grant access to ipv6 end-users.

If they are giving you a single /64 prefix and you don't want to chop it up, than you could deploy a NAT66 and use a 2001:db8:: prefix internal. This would NOT be a global unicast routed prefix and should be treat like a rfc1918 networks in ipv4.

or

You could map the ipv4 address into ipv6 ( assuming static ) and then NAT these into the global unicast ipv6 network,

or

assign a unique local address and then NAT them into the Global Unicast Address

but in practical we shouldn't need todo any of the above and just assign global unicast-routed address from your assignment.

So back to the 1st question, "what is your provider giving you?"

Rede

New Member

Hello,

Friends received from my ISP a / 56 IPv6. I configured a network 9e00 / 64 in my FortiGate interface.

In my internal network station my ip network 9e0a / 64.

My problem is with the internet because I can only go out to the internet when habiliato the NAT66 on the rules.

Am I doing something wrong? Would not that work without NAT?

Thanks in advance.

emnoc

New Member

Okay 1st what is a "9e00"?

For diagnostic the diag debug flow is your friend for ipv6 it's similar as ipv4 with the added "6"

e.g

diag debug reset

diag debug enable

diag debug flow filter6 addr 2001:db8::1

diag debug flow filter6 port 443

diag debug flow show console enable

diag debug flow trace start6 100

and when your finished remember to reset and disable the diagnostic flow

Qs:

Now on too your question what did you do with the /56? Are you using SLAAC inside

Do you have router static6 or some dynamic routing protocol to reach the public ipv6

You mention NAT66 so I'm guessing your nating a non-global ipv6 address to your public ipv6 global address?

Please provide a topology map and diagnostic of what your problem(s).

Sign up

Login with SSO

Login to the community

Login with SSO