Hi,
i try to get IPv6 running in my Homelab with a FortiGate40F and Telekom Deutschland (FTTH).
My current config is that the Firewall is directly connected to the Provider Modem.
In the current WAN config.
May Anybody got this running with FortiOS 7.2.4
w6-fw-01 (Telekom_PPPoE) # show
config system interface
edit "Telekom_PPPoE"
set vdom "root"
set mode pppoe
set allowaccess ping
set alias "Telekom_PPPoE"
set role wan
set snmp-index 21
config ipv6
set ip6-mode pppoe
set ip6-allowaccess ping https http
set dhcp6-prefix-delegation enable
set autoconf enable
config dhcp6-iapd-list
edit 1
set prefix-hint 2003:yyyy:xxxx::/56
next
end
end
set username "00xxxxxxxxxxxxxxxxxxxxx0001@t-online.de"
set password ENC
set mtu-override enable
set mtu 1492
set interface "lan3"
set vlanid 7
next
end
w6-fw-01 # diagnose ipv6 address list
dev=18 devname=Telekom_PPPoE flag=P scope=253 prefix=64 addr=fe80::96ff:3cff:fed2:f467 preferred=4294967295 valid=4294967295 cstamp=7179 tstamp=7179
dev=28 devname=W6UH flag=P scope=0 prefix=64 addr=fd00:0:0:2::1 preferred=4294967295 valid=4294967295 cstamp=7179 tstamp=7179
dev=28 devname=W6UH flag=P scope=253 prefix=64 addr=fe80::96ff:3cff:fed2:f465 preferred=4294967295 valid=4294967295 cstamp=7179 tstamp=7179
dev=34 devname=vsys_ha flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295 cstamp=6546 tstamp=6546
dev=36 devname=vsys_fgfm flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295 cstamp=7182 tstamp=7182
dev=37 devname=ppp2 flag= scope=0 prefix=64 addr=2003:yy:xxx:aaaa:bbbb:cccc:dddd:eeef preferred=1729 valid=14329 cstamp=9673 tstamp=9673
dev=37 devname=ppp2 flag=P scope=253 prefix=10 addr=fe80::96ff:3cd2:fdss:eeef preferred=4294967295 valid=4294967295 cstamp=9673 tstamp=9673
w6-fw-01 # Timeout
w6-fw-01 # execute ping6 ipv6.google.com
PING ipv6.google.com(2a00:1450:4001:80f::200e) 56 data bytes
--- ipv6.google.com ping statistics ---
5 packets transmitted, 0 packets received, 100% packet loss, time 10054ms
Regards
n33dfull
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi n33dfull,
I looked at this sort of config sometime back. I'm not sure if the situation is the same for DT but this was the forum thread that referred to it at the time:-
Essentially you need to use the "config system interface pppoe-interface" command. The statement from support at the time was:-
PPPoE connections on a single interface that has been added to 5.6 we can now configure DHCPv6 client mode on a PPPoE interface.
I believe this config still works in 7.2.4. See this link which discusses the PPPoE system interface in 7.2.4:-
https://docs.fortinet.com/document/fortigate/7.2.4/cli-reference/98620/config-system-pppoe-interface
Here is a basic config:-
config system pppoe-interface
edit "wan pppoe"
set ipv6 enable -> comment: Enables IPv6CP
set device "wan" -> comment: "parent" port eg WAN, WAN1
set username "xxxxxxxxx"
set password ENC "whatever"
next
end
config system interface
edit "wan pppoe"
set mode pppoe
config ipv6
set ip6-mode dhcp
set dhcp6-prefix-delegation enable
end
set interface "wan"
next
end
I hope that helps steer you in the right direction.
Kind Regards,
Andy.
Hi,
thank you very much.
i git it working for now, problem was that i set a default static route to wan.
After i deleted i had public IPv6 Access.
My Firewall got a /64 address
w6-fw-01 (Telekom_PPPoE) # show
config system interface
edit "Telekom_PPPoE"
set vdom "root"
set mode pppoe
set allowaccess ping
set alias "Telekom_PPPoE"
set monitor-bandwidth enable
set role wan
set snmp-index 21
config ipv6
set ip6-mode pppoe
set ip6-allowaccess ping https http
set dhcp6-prefix-delegation enable
set autoconf enable
config dhcp6-iapd-list
edit 1
set prefix-hint 2003:yyyy:xxxx::/56
next
end
end
set username ""
set password =
set mtu-override enable
set mtu 1492
set interface "lan3"
set vlanid 7
next
end
Maybe you have some Info about the problem that the Firewall is not able to see assigned IP adress in interface options and this is causing that i cant reach the User Portal via IPv6.
Dual Stack enabled for SSL VPN portal.
Admin Access IPv6 from Wan is working fine.
Regards
n33dfull
Hi Brans, did you find a solution why the IPv6 is not shown in the SSL portal? We have exactly the same problem as you and have opened a ticket with Forti in the meantime.
If we enter on our Fortigate get router info6 interface then we see an IPv6 address which is also reachable from outside. e.g. with the admin interface.
But in the GUI we only see 0::/64https://community.fortinet.com/t5/Support-Forum/Fortigate-IPv6-GUI-Bug-for-SSL-VPN-Telekom-Deutschla...
Created on 05-31-2023 05:57 AM Edited on 05-31-2023 05:58 AM
Hi,
please try something like that in the VPN config.
But the SSL VPN Portal will still not showing up the IP, but it works.
As i used the FortiDDNS Service because of a dynamic IP i was able to use that IP Adresss assign to DNS Service and a fqdn.
VPN Config:
w6-fw-01 (settings) # show
config vpn ssl settings
set servercert "LE"
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set port 443
set source-interface "Telekom_PPPoE"
set source-address "all"
set source-address6 "all"
set default-portal "full-access"
config authentication-rule
edit 1
set users "vpn-group"
set portal "full-access"
next
end
set dual-stack-mode enable
end
w6-fw-01 (settings) #
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1547 | |
1031 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.