A security recommendation to FortiGate admins re VPN users and IPv6

[ispcolohost]

Hey all, just wanted to point out for anyone interested that if you have FortiClient users talking to a FortiGate device, and your intent is to prevent the end users from becoming a transit point for unauthorized traffic, you MUST give your connecting users an IPv6 address.  If you do not, FortiClient will happily let the user's computer keep talking IPv6 to whoever it wants even while their IPv4 tunnel to your protected environment is up, whether you have split tunneling disabled or not.  This is accurate with current versions (5.4.3 fortigate, 5.4.1.0840 forticlient on win).

So, if I'm connected to an ISP like Comcast, or Verizon cellular, and I have both v4 and v6 addresses on my computer, I connect with FortiClient to a FortiGate that is enforcing no split tunneling and intentionally blocks internet access to VPN users, I can still talk to the internet directly via IPv6, letting any malware or other conduit on my computer continue to pass traffic through to the protected network if they're controlling me via IPv6, and then jumping inside over IPv4.

The workaround to this is give your users an IPv6 address along with the IPv4 address from the FortiGate, and disable split tunnel for IPv6 in addition to IPv4.  Now they'll only be able to talk to your firewall while connected; if FortiClient works as intended.  You don't use IPv6, no big deal, give them an address anyway; you've already got an implicit v6 deny, and with no interfaces even having a v6 address, the traffic is contained.

Also, just FYI, I was unable to find any working configuration to accomplish the above without using 'mode config' on the VPN definition.  If you're statically assigning remote addresses in the FortiClient software, or using DHCP over tunnel, there appears to be no provision to allow IPv6 to work in those scenarios.  If you're using mode config, via the GUI, you must intentionally switch off mode config after defining and saving your VPN profile, that gives you back the add button in the phase 2 selector area, add a v6 to v6 subnet ::/0 to ::/0, save, then turn mode config back on and you'll be able to assign v4 and v6 addresses while also keeping both sets of phase 2 selectors.