IPv6 routing loop?
Hi,
I got IPv6 mostly working on my network, to the point where I can reach the IPv6 Internet from workstations connected without any problems. However I'm unable to reach the FortiGate _itself_ on any service (ping, ssh, HTTPS) from those stations. I suspect this something to do with the following oddity.
Setup:
FortiGate (FG) unit at 2001:db8::1/64, LL is fe80::926c:acff:fe02:b848
My workstation (WS) gets 2001:db8::62a4:4cff:fe61:3170/64 obtained via SLAAC, LL is fe80::62a4:4cff:fe61:3170
(I'm not actually 2001:db8, but and actual routable block obviously).
Now if I try to ping WS->FG using LL, no problem:
matt@vishna:~$ ping6 -I enp10s0 fe80::926c:acff:fe02:b848
PING fe80::926c:acff:fe02:b848(fe80::926c:acff:fe02:b848) from fe80::62a4:4cff:fe61:3170 enp10s0: 56 data bytes
64 bytes from fe80::926c:acff:fe02:b848: icmp_seq=1 ttl=64 time=0.363 ms
64 bytes from fe80::926c:acff:fe02:b848: icmp_seq=2 ttl=64 time=0.305 ms
^C
--- fe80::926c:acff:fe02:b848 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.305/0.334/0.363/0.029 ms
However if I try to ping WS->FW with the actual IPs, it fails, and the "tcpdump icmp6" shows this:
18:25:43.611437 IP6 2001:db8::62a4:4cff:fe61:3170 > 2001:db8::1: ICMP6, echo request, seq 1, length 64
18:25:43.611734 IP6 fe80::926c:acff:fe02:b848 > 2001:db8::62a4:4cff:fe61:3170: ICMP6, redirect, 2001:db8::1 to 2001:db8::1, length 152
18:25:44.619229 IP6 2001:db8::62a4:4cff:fe61:3170 > 2001db8::1: ICMP6, echo request, seq 2, length 64
18:25:44.619602 IP6 fe80::926c:acff:fe02:b848 > 2001:db8::62a4:4cff:fe61:3170: ICMP6, redirect, 2001:db8::1 to 2001:db8::1, length 152
Strangely, but consistently, if I try FG->WS with "exec ping6 2001:db8::62a4:4cff:fe61:3170", the tcpdump on the WS shows this:
18:29:43.735328 IP6 2001:db8::1 > 2001:db8::62a4:4cff:fe61:3170: ICMP6, echo request, seq 1, length 64
18:29:43.735378 IP6 2001:db8::62a4:4cff:fe61:3170 > 2001:db8::1: ICMP6, echo reply, seq 1, length 64
18:29:43.735768 IP6 fe80::926c:acff:fe02:b848 > 2001:db8::62a4:4cff:fe61:3170: ICMP6, redirect, 2001:db8::1 to 2001:db8::1, length 152
18:29:43.745656 IP6 fe80::926c:acff:fe02:b848 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2001:db8::1, length 32
18:29:44.745666 IP6 fe80::926c:acff:fe02:b848 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2001:db8::1, length 32
Those ICMP redirect look pretty bogus/loopy to me, I'm fairly knowledgeable about v6 in general, but maybe there's one of its idiosyncracies I'm missing here?
This is the relevant config block for that interface:
config ipv6
set ip6-allowaccess ping https ssh snmp fgfm capwap
set ip6-address 2001:db8::1/64
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-other-flag enable
config ip6-prefix-list
edit 2001:db8::/64
set autonomous-flag enable
set onlink-flag enable
next
end
end
Any advice would be much appreciated!
Thanks,
- Matt