Fortigate anwers any DAD packet when using IPv6-PD

[Ketanest]

Hi together,

we started to play a little bit with IPv6. For cost reasons we only use an internet connection with no static assigned address range on branch offices so we have to use prefix delegation. The provider delegates a /56 network which seems to be almost static but if it would change one time it would break IPv6 so we configured prefix delegation.

Linux clients don't configure an address via SLAAC. After some research (with wireshark) we figured out that linux does (RFC conform) duplicate address detection but Fortigate answers any of this neighbor solicitations even if the address is not configured or assigned to the Fortigate. Windows and iOS devices don't seem to to that and seem to configure their SLAAC without DAD. When disabling DAD on linux clients they configure their address via SLAAC.

Why does Forti answer any of these neighbor solicitations? We can't disable DAD on each client that would be a mess. Do we have to set any options additionally or unconfigure things to stop Fortigate doing this?

The following interface config is WAN on the one side and the guest network as an example for a LAN network. Hardware is a Fortigate 40F on Firmware 7.4.7. If you need more information please give an advise.

config system interface
    edit "wan"
        set vdom "root"
        set mode dhcp
        set allowaccess ping
        set type physical
        set alias "WAN"
        set monitor-bandwidth enable
        set snmp-index 1
        config ipv6
            set ip6-mode dhcp
            set ip6-allowaccess ping
            set dhcp6-prefix-delegation enable
            config dhcp6-iapd-list
                edit 1
                    set prefix-hint ::/56
                next
            end
        end
        set dns-server-override disable
    next
	edit "vlan.10"
        set vdom "root"
        set ip 192.168.112.1 255.255.255.0
        set allowaccess ping
        set alias "Guest"
        set device-identification enable
        set snmp-index 20
        config ipv6
            set ip6-mode delegated
            set ip6-allowaccess ping
            set ip6-send-adv enable
            set ip6-other-flag enable
            set ip6-delegated-prefix-iaid 1
            set ip6-upstream-interface "wan"
            set ip6-subnet ::70:0:0:0:1/64
            config ip6-delegated-prefix-list
                edit 1
                    set upstream-interface "wan"
                    set delegated-prefix-iaid 1
                    set subnet 0:0:0:70::/64
                    set rdnss-service default
                next
            end
        end
        set interface "lag.switch"
        set vlanid 10
    next
end

Thanks already in advance!

[Jean-Philippe_P]

Hello Ketanest, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello Ketanest,

I found this solution. Can you tell us if it helps, please?

The issue you're experiencing with the FortiGate responding to Neighbor Solicitations (NS) for addresses not assigned to it is likely related to the Neighbor Discovery Protocol (NDP) behavior. Here are some steps you can take to address this:

1. Check ND Proxy Settings: Ensure that ND Proxy is not enabled on the FortiGate interfaces. ND Proxy can cause the FortiGate to respond to NS messages for addresses not assigned to it. You can check and disable ND Proxy with the following command: ```shell config system nd-proxy set status disable end ```
   
   
2. Review Interface Configuration: Ensure that the interface configurations are correct and that there are no additional settings that might cause the FortiGate to respond to NS messages inappropriately.
   
   
3. Update Firmware: Ensure that your FortiGate is running the latest firmware version. Sometimes, unexpected behavior can be resolved with firmware updates that address known issues.
   
   
4. Consult Fortinet Support: If the issue persists after checking the above settings, consider reaching out to Fortinet Support for further assistance. They may have additional insights or patches for this specific behavior.

By following these steps, you should be able to mitigate the issue with the FortiGate responding to Neighbor Solicitations incorrectly.

[Ketanest]

Hi Jean-Philippe,

Thanks for your reply!

Unfortunately this is not successful. ND-Proxy is already deactivated. The interface config is listed up in the first post and as far as I can see there should be no configurations causing the NS messages. Firmware is on the recommended version (7.4.8 - this was accidentally wrong in the first post).

So I will contact Fortinet Support for this issue.

Best regards,

[Jean-Philippe_P]

Hello again,

I am sorry that it didn't work and before you contact the Support, can you try this:

If ND Proxy is already disabled and the issue persists, consider the following steps:

1. Verify Configuration: Double-check the interface configurations to ensure there are no unintended settings that might cause the FortiGate to respond to NS messages.
   
   
2. Check for Bugs: Review the release notes for FortiOS 7.4.8 to see if there are any known issues related to NDP or DAD that might affect your setup.
   
   
3. Packet Capture: Use packet capture on the FortiGate to analyze the NS and NA messages. This can help identify if the FortiGate is indeed responding incorrectly and under what conditions.
   
   
4. Review IPv6 Settings: Ensure that the IPv6 settings on the FortiGate are correctly configured for your network environment, particularly focusing on SLAAC and DHCPv6 settings.
   
   
5. Contact Support: If the issue remains unresolved, consider reaching out to Fortinet Support with detailed logs and packet captures for further investigation.

These steps should help in diagnosing and potentially resolving the issue with NS message responses.