Fortigate anwers any DAD packet when using IPv6-PD

[Ketanest]

Hi together,

we started to play a little bit with IPv6. For cost reasons we only use an internet connection with no static assigned address range on branch offices so we have to use prefix delegation. The provider delegates a /56 network which seems to be almost static but if it would change one time it would break IPv6 so we configured prefix delegation.

Linux clients don't configure an address via SLAAC. After some research (with wireshark) we figured out that linux does (RFC conform) duplicate address detection but Fortigate answers any of this neighbor solicitations even if the address is not configured or assigned to the Fortigate. Windows and iOS devices don't seem to to that and seem to configure their SLAAC without DAD. When disabling DAD on linux clients they configure their address via SLAAC.

Why does Forti answer any of these neighbor solicitations? We can't disable DAD on each client that would be a mess. Do we have to set any options additionally or unconfigure things to stop Fortigate doing this?

The following interface config is WAN on the one side and the guest network as an example for a LAN network. Hardware is a Fortigate 40F on Firmware 7.4.7. If you need more information please give an advise.

config system interface
    edit "wan"
        set vdom "root"
        set mode dhcp
        set allowaccess ping
        set type physical
        set alias "WAN"
        set monitor-bandwidth enable
        set snmp-index 1
        config ipv6
            set ip6-mode dhcp
            set ip6-allowaccess ping
            set dhcp6-prefix-delegation enable
            config dhcp6-iapd-list
                edit 1
                    set prefix-hint ::/56
                next
            end
        end
        set dns-server-override disable
    next
	edit "vlan.10"
        set vdom "root"
        set ip 192.168.112.1 255.255.255.0
        set allowaccess ping
        set alias "Guest"
        set device-identification enable
        set snmp-index 20
        config ipv6
            set ip6-mode delegated
            set ip6-allowaccess ping
            set ip6-send-adv enable
            set ip6-other-flag enable
            set ip6-delegated-prefix-iaid 1
            set ip6-upstream-interface "wan"
            set ip6-subnet ::70:0:0:0:1/64
            config ip6-delegated-prefix-list
                edit 1
                    set upstream-interface "wan"
                    set delegated-prefix-iaid 1
                    set subnet 0:0:0:70::/64
                    set rdnss-service default
                next
            end
        end
        set interface "lag.switch"
        set vlanid 10
    next
end

Thanks already in advance!

[Jean-Philippe_P]

Hello Ketanest, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks,