Skip to main content
ameif56hgt
ameif56hgt
New Member
May 5, 2025
Question

IPv6 delegation frustration

  • May 5, 2025
  • 1 reply
  • 1341 views

I've been attempting get IPv6 prefix delegation for longer than I want to admit. And I'm close, but no cigar.

So I request a /56 prefix from ISP.

Got: delegated-prefix iaid 1 : 2600:8800:ab81:a100::/56

YES, it works. So on the LAN I have SLAAC and DHCP Stateful server running. 

I have a network IP checker, and it looks like Macs, Android, and others are getting it. For this Mac:

fe80::10e9:87a:620c:eeda

2600:8800:ab81:a101:edf6:9551:c99f:6228 

So it LOOKS like its working, but its not.  So if I look at the IPv6 addresses my Mac has it has several with this prefix, but it also has several others.  See attached below.  But I have no idea where those ab81:4a00 are coming from, but all my computers are using those addresses and they are not externally routable.  So no external web site can see my IPv6 address.  Does anyone know where these other IPv6 addresses are coming from, or maybe more important, how can I get rid of them.  I've come so far, but no cigar, and all my devices have these IPv6 addresses so they must be coming from the Fortigate. I'm on 7.4.7 THANKS IN ADVANCE.

Screenshot 2025-05-04 at 5.38.15 PM.png

1 reply

Atul_S
Staff & Editor
Atul_S
Staff & Editor
May 5, 2025

Hi There,

 

I am uncertain how those specific devices are connected to the Internet and what the DNS settings are in your upstream devices, but I can confirm that both the network range ab81:4a00 and ab81:a100 belong to the same ISP. I would suggest raising this with your service provider.

 

Thanks,

    ameif56hgt
    ameif56hgtAuthor
    New Member
    May 5, 2025

    Thanks. I did figure it out, I'm not sure how, but I did.  I think some flags not in the GUI had to be set different. I think your suggestion on talking to the ISP is a good one, in theory, but not too good in real life. COX only supports their own equipment, but they have this EXTRA cost program where for some price, per month, they provide support on any device.  I had it back several months ago.  Let me just say, their support people know VERY limited IPv6 knowledge, and "prefix delegation" is WAY over their head.

     

    While I'm ranting :) I will say I think Fortinet could do better also.  The WAN side is straight forward. The LAN side, not so much.  The GUI sometimes seems as an afterthought. 

    Anyway, thanks for your tips.

     

    Atul_S
    Staff & Editor
    Atul_S
    Staff & Editor
    May 5, 2025

    Hi,

    If your FGT is acting as a DHCP server and only 2600:8800:ab81:a100::/56 subnet is configured, I don't see any reason why FGT will issue an address outside the configured range unless the add 2600:8800:ab81:4a00:: is coming from another upstream into DHCP RA advertisement. 

     

    Thanks,

      Terms & ConditionsAccessibility statement