Technical Tip: Using IPv6 and IPv4 ISDB objects in dual-stack SSL VPN firewall policy

vtsonev · ‎12-02-2024

Description

This article describes how to use IPv6 ISDB objects in a firewall policy for SSL VPN dual-stack and is valid when using SSL VPN with the 'set dual-stack-mode enable' option.

Scope

FortiGate up to v7.0.X, v7.2.10,v 7.4.5 and v7.6.0.

Solution

This feature was introduced first in FortiOS 7.0.0. Please keep in mind that dual-stack tunnel mode support requires a supported client. Check if the FortiClient version currently in use, supports the dual-stack feature.

The problem occurs when configuring IPv4+IPv6 policy, with source interface dual-stack SSL VPN.

When internet-service is enabled, dstaddr in the firewall policy will not be used. Dual-stack feature for SSL VPN originally does not support internet-service, so when trying to configure IPv4-IPv6 policy with ISDB objects for dual-stack it will result in the error message:

FW81FD-4 (451) # sh
config firewall policy
edit 451
set uuid e2a8d140-b0a2-51ef-878b-0f84c6bb03e8
set srcintf "ssl.root"
set dstintf "plan"
set action accept
set srcaddr "Range_for_SSLVPN_clients"
set srcaddr6 "SSLVPN_TUNNEL_IPv6_ADDR1"
set internet-service enable
set internet-service-name "Cisco-Webex"
set internet-service6 enable
set internet-service6-name "Fortinet-ICMP"
set schedule "always"
set utm-status enable
set av-profile "default"
set ips-sensor "protect_client"
set nat enable
set groups "SSO_Guest_Users"
next
end

FW81FD-4 (451) # end

To enable this policy, both IPv4 and IPv6 must be configured because dual-stack-mode is enabled.
object check operator error, -651, discard the setting
Command fail. Return code -651

A similar error is visible when trying to configure the same policy from the GUI:

If an SSL VPN firewall policy is set to either internet-service or internet-service6, then dual-stack-mode cannot be enabled in vpn.ssl.settings.

This behavior changed in v7.6.1+ and v7.4.6+ where ISDB is possible to be configured directly, without any errors.

For all firmware versions, it is possible to apply a workaround, where the firewall policy is first configured with a normal IPv6 destination address and saved. After that, the admin can edit the policy and add ISDB objects.

Configure IPv4+IPv6 as the destination address in the firewall policy and save:

Edit the same firewall policy, replace the destination addresses with ISDB objects as needed and save:

The ISDB support for dual-stack SSL VPN was added starting from v7.6.1 and v7.4.6.