Fortigate 7.6.4 - VPN IPsec SAML Dialup IPv4/IPv6

[fabs]

Hello everyone,

we are currently running a FortiGate on firmware 7.6.4 with an IPsec dialup VPN using SAML authentication over IPv4. This setup works without any issues.

However, more and more of our users are receiving IPv6-only connections from their ISPs (no public IPv4 available anymore), which causes the IPsec tunnel to fail. Because of this, we want to migrate the dialup VPN to IPv4/IPv6 (dual stack).

I have several questions regarding the required prerequisites:

1. Does the FortiGate WAN interface need a public IPv6 address from the ISP in order for IPv6-only clients to connect?

2. Does the FQDN used for the dialup VPN also need a AAAA DNS record, so clients can resolve the FortiGate over IPv6?

3. Is switching the Phase1/Phase2 interface to “IPv4/IPv6”, and adding IPv6 firewall policies enough? What about the DNS resolution of the internal hosts?

Thanks in advance, is there any migrating doc available? I can only see SSL VPN IPV6 docs.

[Jean-Philippe_P]

Hello fabs, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[fabs]

@Jean-Philippe_P 

Thank you for your feedback.
The reason I am considering enabling dual stack on the IPsec dialup VPN is because we have several employees who can connect to the VPN from their home office, but they cannot access any applications located on the routed local network.
This is because these employees only receive an IPv6 address from their ISP.

I have now received an IPv6 address range from my ISP and setup a static IPv6 on the WAN interface. I also created a static route to the IPv6 gateway.
I created an AAAA entry on the FQDN.
I can now resolve this FQDN from outside and ping when I activate it on the WAN interface.
I also configured dual stack on this VPN tunnel. The clients also receive an IPv4 + IPv6 address.

Is this now sufficient to grant connection to employees who only receive an IPv6 address from their ISP, or are further adjustments to the Fortigate required?

Best Regards
fabs