How to handle IPSec VPN and Endpoints using Dual Stack Lite (DS-Lite) behind CGNAT?

[bluemerle]

I've set up an IPsec VPN with certificate-based authentication and started migrating away from SSL-VPN.

Unfortunately, around 10% of our remote users are on DS-Lite. This means they have a public IPv6 address but share a single IPv4 address via Carrier Grade NAT. SSL-VPN works in this setup, but IPsec does not.

To address this, I:

Added an IPv6 address to our WAN interface via Router Advertisement (ping6 works in both directions).

Created a AAAA DNS record for the FQDN vpn.companyname.com.

Added the subnet fd00:abcd::10 - fd00:abcd::100 /64 to the IPsec tunnel, along with 172.16.25.x IPv4 addresses.

Enabled split tunneling for IPv6: Split to Tunnel → none (we don’t use IPv6 internally elsewhere).

Added an IPsec Phase 2 entry via CLI with:

set src-addr-type subnet6

set dst-addr-type subnet6

Now, FortiClient 7.4.3 connects but freezes after clicking "Connect". It does not fail, it just hangs indefinitely.

The idea is to establish the IPsec tunnel over IPv6 and route all private IPv4 traffic through it.

The setup is working fine for IPv4 only.

Target is a FG200F on v7.4.7.  vs.  FortiClient v7.4.3

<block_ipv6>0</block_ipv6> is set in the FortiClient config.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

[Anthony_E]

Hi,

Handling IPsec VPN and endpoints using Dual Stack Lite (DS-Lite) behind CGNAT involves several considerations:

1. Enable NAT Traversal (NAT-T): Ensure that NAT-T is enabled on both ends of the IPsec VPN. This encapsulates ESP packets within UDP, typically using port 4500, which helps traverse NAT devices.
2. Configure DS-Lite: DS-Lite allows IPv4 traffic to be tunneled over an IPv6 network. Ensure that your network devices support DS-Lite and are properly configured to handle IPv4 over IPv6 tunneling.
3. Use IPv6 for VPN Endpoints: If possible, configure the VPN endpoints to use IPv6 addresses. This can help bypass some of the limitations imposed by CGNAT on IPv4 traffic.
4. Test Connectivity: Use diagnostic tools to test the connectivity and ensure that the VPN tunnel is established correctly. Commands like `ping` and `traceroute` can help verify the path and connectivity.
5. Monitor and Troubleshoot: Use logging and monitoring tools to keep track of the VPN performance and troubleshoot any issues that arise. Debugging commands specific to IPsec and IKE can be useful for this purpose.
6. Consult Vendor Documentation: Refer to the documentation provided by your VPN and network equipment vendors for specific configurations and best practices related to DS-Lite and CGNAT.

[bluemerle]

I got it working by splitting the DNS into separate A and AAAA records and adding two profiles in FortiClient, respectively.

ipv4.company.com → VPN via IPv4

ipv6.company.com → VPN via IPv6

I've seen this bug before, but I thought FortiClient v7.4.3 had it fixed.