IPSEC Tunnel Side2Side with IPV6 is not working with an IPV6 Tunnelbroker

[ipranger]

Hello, 

i would like to generate an IPV6 side2side. It is available for all Interfaces but not for the HE Inerface. It is not available in the configuration. Is there a other way to do IPV6 Side2Side? (Fortigate 60C Wifi, actually OS)

edit "vl_3115_VPN"
set interface "wan1"
set ip-version 6
set ike-version 2
set mode-cfg enable
set comments "Connection to Corenet"
set remote-gw6 2001:470:729a:ac1::1
set mode-cfg-ip-version 6
set psksecret ENC secret
next
end

Thanks a lot

[emnoc]

when you say side2side, do you mean LAN-2-LAN or SITE-2-SITE? Fortinet has numerous cookbook examples of ipv6  vpns  for  lan2lan.

[ipranger]

Hmm, ok... i mean:

VPN from ein local IPV6 Network to another network in an other town. So i think this is lan2lan? What are the differences between lan2lan and side2side? Is this not the same?

Best Regards

[emnoc]

Never heard of lan2lan called side2side and  be 100% sure  I under stood you.

Okay you will be surprised to know that configuring ipv6 lan2lan vpns are no different than ipv4 lan2lan. You will be best served imho to use a route-base vpn if your looking for easy at diagnose, qos, packet capturing,etc...

just define the type as ip6 which you already did under phase1 and then define the proposal, psk, and last define the phase2-interface using the earlier defined  phase1 name

e.g

config vpn ipsec phase1-interface     edit "FGT90-FGTHQ"         set interface "OUT01"         set ip-version 6         set proposal aes128-sha1         set dhgrp 14         set remote-gw6 2001xxxxxxxxxxxxxxxxxxxxxxxxx         set psksecret ENC IHRvbzct6k1FSarFl6TAe9E50/+9cEyTkYwyeevSGMavc5+OWtLG/hGG6O3/Q9gGmm0wCLhO2pI5f02c3g95DuwBBYOqtbKYJpEJPWgh/TjEbFP/qcIt3SSVAdi4XROHopBQSZ6YuN/KbgCvfrhFjO8QtXe5G0oZyJGiTm/DbTR3HoideykaoHIrG6aXcbTUJloGUg==     next end

config vpn ipsec phase2-interface     edit "FGT90-FGTHQp2"         set phase1name "FGT90-FGTHQ"         set proposal aes128-sha1         set dhgrp 14         set auto-negotiate enable         set keylifeseconds 2600     next end

The above is a ipv6 ipsec vpn over ipv6. You can also use ipv4 on the end-points. The above works for a Fortigate to Fortigate/Juniper SRX, but with your setup you will probably need to set specific "src-subnet  dst-subnet " entries for the local and remote subnets

And lastly, if your doing a route-based vpn you need a  config router static6  entry for the remote subnet(s) and lastly your firewall policies for ipv6