| Description | This article describes how to use ND Proxy for bridging Layer 2 segments. |
| Scope | FortiGate. |
| Solution |
The Neighbor Discovery Protocol (NDP) consists of five different ICMPv6 message types that support various functions in IPv6, similar to IPv4 protocols ICMP, ARP, Router Discovery, and Router Redirect. Some of its functions include Stateless Address Auto-Configuration (SLAAC), address resolution, Neighbor Unreachability Detection (NUD), and Duplicate Address Detection (DAD).
In NDP, the message types Neighbor Solicitation (NS) and Neighbor Advertisement (NA) are used for address resolution, performing a similar function to ARP in IPv4. A host uses the Neighbor Solicitation (NS) message type to determine the Layer 2 address (MAC address) of another host or to verify if the host is still reachable. The Neighbor Advertisement (NA) message type is used by hosts to reply to the NS message and provide the Layer 2 address of the host or to notify of a network change.
ND Proxy is similar to Proxy ARP. It provides bridging network segments within a subnet prefix when bridging cannot be done at Layer 2.
To configure ND Proxy the syntax is as follows:
config system nd-proxy
Example:
In IPv6 it is common to use Global Unicast addresses (similar to IPv4 public addresses) on internal networks, which means NAT is not required for Internet traffic.
The subnet 2001:db8:abcd:1234::/64 is contained in the subnet 2001:db8:abcd::/48. Normally the NDP NS message would not reach the client as it is in a different Layer 2 segment. ND Proxy can be used to bridge the networks.
In this example, if the ISP router at IP address 2001:db8:abcd::1/48 sends out a Neighbor Solicitation (NS) message to resolve the Layer 2 address of the client at IP address 2001:db8:abcd:1234::2/64, with ND Proxy configured the FortiGate will reply to the message on Port1 substituting the MAC address of Port1 in the Neighbor Advertisement (NA). This will allow the ISP router to communicate with the client by forwarding the traffic to the FortiGate.
config system nd-proxy |
