Skip to main content
Meni
Meni
Visitor III
December 28, 2023
Solved

VPN SSL double stack IPV4 and IPV6

  • December 28, 2023
  • 2 replies
  • 9491 views

Hi i have a problem to ativate double stack for  vpn ssl

 

config vpn ssl settings     set dual-stack-mode enable end

Response in cli mode

 

set dual-stack-mode enable
To enable dual-stack-mode, all SSL-VPN policies must be configured with IPv4 and IPv6.
node_check_object fail! for dual-stack-mode enable 

 

I have only one vpn policie. do you have an idea ?

Regards

Best answer by Meni

where do you pu this argument ?

2 replies

dbu
Staff
dbu
Staff
December 28, 2023

Hi @Meni ,
Have you included IPv4 and IPv6 on the SSL VPN policy?

Have a look at the guide here:
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/766455/dual-stack-ipv4-and-ipv6-support-for-ssl-vpn

Meni
MeniAuthor
Visitor III
December 28, 2023

Hi @dbu 

 

Thanks for your response

I changed my policy. Before i have a policy for v4 and one for v6. I put all V4 and V6 and the same.

Now the dual stack is ok but when i connect vpn i only have v6 address and ip V4 is not forwarding

Regards

 

dbu
Staff
dbu
Staff
December 28, 2023

What do you mean ?
Do you have an IPv4 stack configured on your client ?

Check with ipconfig /all .


If yes, try to ping
execute ping www.bing.com

 

You can use this command and check if you see any traffic:
diagnose sniffer packet any icmp 4



Meni
MeniAuthor
Visitor III
December 28, 2023

I made some test. Its very strange

When i made connection to vpn SSL with IPV6 address i can access only on ipv6 devices

When i made connection to vpn SSL with IPV4 address i can access only on ipv4 devices

 

Really strange 

dbu
Staff
dbu
Staff
December 28, 2023

I have not tested this myself, but i think dual stack means that client can use either IPv4 or IPv6 to connect to the destination address. 
In your case when you connect with IPv6 you can reach only IPv6 destinations available . 
So you choose which stack to use.  You will get an IPv6 assigned and not an IPv4. 

Meni
MeniAuthor
Visitor III
December 28, 2023

I have the impression but it's still not very friendly
It will be difficult to choose the V4 or v6 connection depending on the servers to reach

Thansk for your help

 

I'm still looking

 

 

 

Terms & ConditionsAccessibility statement