|
There might be some scenarios where the amount of IPv6 neighbor cache limit is reached. By default, FortiGate allows 65536 cache entries.
When this limit is reached, route look-up will fail when the RA (Router Advertisement) is received because FortiGate is not able to create a new neighbor cache entry.As a result, RA will be dropped by the kernel.
FortiGate is able to remove automatically the entries that are not in use, however, due to the number of neighbors in some environments this mechanism is not enough.
1) The neighbor cache limit is controlled by 'ndp-max-entry' parameter:
# config system global
set ndp-max-entry 0
end
2) The default value is zero, which means that 65536 entries are allowed.
To increase the limit, just set a new value:
# config system global
set ndp-max-entry 131072
end
3) To see the IPv6 neighbor cache list run the command below:
# diagnose ipv6 neighbor-cache list
4) To show the number of entries, add 'grep ifindex -c':
# diagnose ipv6 neighbor-cache list | grep ifindex -c
|
