Fortigate 7.6.4 - VPN IPsec SAML Dialup IPv4/IPv6

[fabs]

Hello everyone,

we are currently running a FortiGate on firmware 7.6.4 with an IPsec dialup VPN using SAML authentication over IPv4. This setup works without any issues.

However, more and more of our users are receiving IPv6-only connections from their ISPs (no public IPv4 available anymore), which causes the IPsec tunnel to fail. Because of this, we want to migrate the dialup VPN to IPv4/IPv6 (dual stack).

I have several questions regarding the required prerequisites:

1. Does the FortiGate WAN interface need a public IPv6 address from the ISP in order for IPv6-only clients to connect?

2. Does the FQDN used for the dialup VPN also need a AAAA DNS record, so clients can resolve the FortiGate over IPv6?

3. Is switching the Phase1/Phase2 interface to “IPv4/IPv6”, and adding IPv6 firewall policies enough? What about the DNS resolution of the internal hosts?

Thanks in advance, is there any migrating doc available? I can only see SSL VPN IPV6 docs.

[Jean-Philippe_P]

Hello fabs, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[fabs]

@Jean-Philippe_P 

Thank you for your feedback.
The reason I am considering enabling dual stack on the IPsec dialup VPN is because we have several employees who can connect to the VPN from their home office, but they cannot access any applications located on the routed local network.
This is because these employees only receive an IPv6 address from their ISP.

I have now received an IPv6 address range from my ISP and setup a static IPv6 on the WAN interface. I also created a static route to the IPv6 gateway.
I created an AAAA entry on the FQDN.
I can now resolve this FQDN from outside and ping when I activate it on the WAN interface.
I also configured dual stack on this VPN tunnel. The clients also receive an IPv4 + IPv6 address.

Is this now sufficient to grant connection to employees who only receive an IPv6 address from their ISP, or are further adjustments to the Fortigate required?

Best Regards
fabs

[Jean-Philippe_P]

Hello again fabs :)

I found this solution. Can you tell us if it helps, please?

To ensure that your FortiGate IPsec dial-up VPN can accommodate users with IPv6-only connections, follow these steps:

1. Public IPv6 Address on WAN Interface: Yes, the FortiGate WAN interface needs a public IPv6 address from your ISP. This allows IPv6-only clients to connect to the FortiGate.
   
   

2. FQDN with AAAA DNS Record: Yes, the FQDN used for the dialup VPN should have an AAAA DNS record. This ensures that clients can resolve the FortiGate's address over IPv6.
   
   

3. Phase1/Phase2 Interface Configuration: Switching the Phase1/Phase2 interface to "IPv4/IPv6" and adding IPv6 firewall policies is necessary. Ensure that both IPv4 and IPv6 selectors are configured in Phase 2.
   
   

4. DNS Resolution for Internal Hosts: Ensure that internal DNS servers can resolve both IPv4 and IPv6 addresses for internal hosts. If internal applications are accessible over IPv6, ensure that DNS records are updated accordingly.
   
   

5. Additional Considerations:

   • Verify that the FortiGate's security policies allow traffic over both IPv4 and IPv6.
   • Ensure that any NAT or routing configurations are updated to handle IPv6 traffic.
   • Test the connection from an IPv6-only client to ensure that all configurations are working as expected.
     
     

Since you have already configured a static IPv6 on the WAN interface, created a static route to the IPv6 gateway, and set up dual-stack on the VPN tunnel, these steps should be sufficient. However, thorough testing is recommended to confirm that all users can connect and access necessary resources.

Currently, there is no specific migration document for IPsec VPN dual-stack configuration, but the steps outlined should guide you through the process.