Fortigate FTTH PPPoE IPv6- Telekom Deutschland

[n33dfull]

Hi,

i try to get IPv6 running in my Homelab with a FortiGate40F and Telekom Deutschland (FTTH).

My current config is that the Firewall is directly connected to the Provider Modem. 

In the current WAN config. 

May Anybody got this running with FortiOS 7.2.4

w6-fw-01 (Telekom_PPPoE) # show
config system interface
edit "Telekom_PPPoE"
set vdom "root"
set mode pppoe
set allowaccess ping
set alias "Telekom_PPPoE"
set role wan
set snmp-index 21
config ipv6
set ip6-mode pppoe
set ip6-allowaccess ping https http
set dhcp6-prefix-delegation enable
set autoconf enable
config dhcp6-iapd-list
edit 1
set prefix-hint 2003:yyyy:xxxx::/56
next
end
end
set username "00xxxxxxxxxxxxxxxxxxxxx0001@t-online.de"
set password ENC 
set mtu-override enable
set mtu 1492
set interface "lan3"
set vlanid 7
next
end

w6-fw-01 # diagnose ipv6 address list
dev=18 devname=Telekom_PPPoE flag=P scope=253 prefix=64 addr=fe80::96ff:3cff:fed2:f467 preferred=4294967295 valid=4294967295 cstamp=7179 tstamp=7179
dev=28 devname=W6UH flag=P scope=0 prefix=64 addr=fd00:0:0:2::1 preferred=4294967295 valid=4294967295 cstamp=7179 tstamp=7179
dev=28 devname=W6UH flag=P scope=253 prefix=64 addr=fe80::96ff:3cff:fed2:f465 preferred=4294967295 valid=4294967295 cstamp=7179 tstamp=7179
dev=34 devname=vsys_ha flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295 cstamp=6546 tstamp=6546
dev=36 devname=vsys_fgfm flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295 cstamp=7182 tstamp=7182
dev=37 devname=ppp2 flag= scope=0 prefix=64 addr=2003:yy:xxx:aaaa:bbbb:cccc:dddd:eeef preferred=1729 valid=14329 cstamp=9673 tstamp=9673
dev=37 devname=ppp2 flag=P scope=253 prefix=10 addr=fe80::96ff:3cd2:fdss:eeef preferred=4294967295 valid=4294967295 cstamp=9673 tstamp=9673

w6-fw-01 # Timeout

w6-fw-01 # execute ping6 ipv6.google.com
PING ipv6.google.com(2a00:1450:4001:80f::200e) 56 data bytes

--- ipv6.google.com ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss, time 10054ms

Regards

n33dfull

FortiGate 

[AndyNZ]

Hi n33dfull,

I looked at this sort of config sometime back. I'm not sure if the situation is the same for DT but this was the forum thread that referred to it at the time:-

https://community.fortinet.com/t5/Support-Forum/IPv6-CPE-Enhancements-IPv6CP-DHCPv6-PD/m-p/51090#M51...

Essentially you need to use the "config system interface pppoe-interface" command. The statement from support at the time was:-

PPPoE connections on a single interface that has been added to 5.6 we can now configure DHCPv6 client mode on a PPPoE interface.

I believe this config still works in 7.2.4. See this link which discusses the PPPoE system interface in 7.2.4:-

https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/98620/config-system-pppoe-interface

Here is a basic config:-

config system pppoe-interface
edit "wan pppoe"
  set ipv6 enable   -> comment: Enables IPv6CP
  set device "wan"  -> comment: "parent" port eg WAN, WAN1
  set username "xxxxxxxxx"
  set password ENC "whatever"
next
end

config system interface

edit "wan pppoe"
set mode pppoe
config ipv6
  set ip6-mode dhcp
  set dhcp6-prefix-delegation enable
end
set interface "wan"
next

end

I hope that helps steer you in the right direction.

Kind Regards,

Andy.

[n33dfull]

Hi, 

thank you very much. 

i git it working for now, problem was that i set a default static route to wan.
After i deleted i had public IPv6 Access. 

My Firewall got a /64 address

w6-fw-01 (Telekom_PPPoE) # show
config system interface
    edit "Telekom_PPPoE"
        set vdom "root"
        set mode pppoe
        set allowaccess ping
        set alias "Telekom_PPPoE"
        set monitor-bandwidth enable
        set role wan
        set snmp-index 21
        config ipv6
            set ip6-mode pppoe
            set ip6-allowaccess ping https http
            set dhcp6-prefix-delegation enable
            set autoconf enable
            config dhcp6-iapd-list
                edit 1
                    set prefix-hint 2003:yyyy:xxxx::/56
                next
            end
        end
        set username ""
        set password =
        set mtu-override enable
        set mtu 1492
        set interface "lan3"
        set vlanid 7
    next
end

Maybe you have some Info about the problem that the Firewall is not able to see assigned IP adress in interface options and this is causing that i cant reach the User Portal via IPv6. 

Dual Stack enabled for SSL VPN portal. 

Admin Access IPv6 from Wan is working fine. 

Regards
n33dfull

[Chris_SIT-Germany]

Hi Brans, did you find a solution why the IPv6 is not shown in the SSL portal? We have exactly the same problem as you and have opened a ticket with Forti in the meantime.

If we enter on our Fortigate get router info6 interface then we see an IPv6 address which is also reachable from outside. e.g. with the admin interface.
But in the GUI we only see 0::/64https://community.fortinet.com/t5/Support-Forum/Fortigate-IPv6-GUI-Bug-for-SSL-VPN-Telekom-Deutschla... 

[n33dfull]

Hi,

please try something like that in the VPN config. 

But the SSL VPN Portal will still not showing up the IP, but it works. 

As i used the FortiDDNS Service because of a dynamic IP i was able to use that IP Adresss assign to DNS Service and a fqdn.

VPN Config:

w6-fw-01 (settings) # show
config vpn ssl settings
    set servercert "LE"
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
    set port 443
    set source-interface "Telekom_PPPoE"
    set source-address "all"
    set source-address6 "all"
    set default-portal "full-access"
    config authentication-rule
        edit 1
            set users "vpn-group"
            set portal "full-access"
        next
    end
    set dual-stack-mode enable
end

w6-fw-01 (settings) #