IPV6 Configuration

[Shridhar]

Hi All,

One of our customer is having below requirement.

1) Currently customer is having IPV4 address configuration over WAN interface. 2) Customer is getting IPV6 IP stack over same Interface from ISP. 3) Customer want to map those IP over WAN Interface as well as he want to map those ip in End user system.

So please let me know how can we fulfill the same requirement over the Fortinet firewall. Regards, Shridhar

[emnoc]

You have a host of architect designs to contend with, but what is the ISP giving you for starters? Are they routing any prefixes to your ipv6 wan address?

Let's say they give you a /48, you could build dual-stack interfaces on a /64 prefixes and enable SLAAC or even dhcpv6 on these interfaces for the end-user. Than with the correct  fw-policy6 you grant access to ipv6 end-users.

If they are giving you a single /64 prefix and you don't want to chop it up, than you could deploy a NAT66  and use a 2001:db8:: prefix internal. This would NOT be a global unicast routed prefix and should be treat like a  rfc1918 networks in ipv4.

or

You could map  the ipv4 address into ipv6 ( assuming static ) and then NAT these into the global unicast ipv6 network,

or

assign a unique local address  and then NAT them into the Global Unicast Address

but in practical we shouldn't need todo any of the above and just assign  global unicast-routed address from your assignment.

So back to the 1st question, "what is your provider giving you?"

[Rede]

Hello,

Friends received from my ISP a / 56 IPv6. I configured a network 9e00 / 64 in my FortiGate interface.

In my internal network station my ip network 9e0a / 64.

My problem is with the internet because I can only go out to the internet when habiliato the NAT66 on the rules.

Am I doing something wrong? Would not that work without NAT?

Thanks in advance.

[emnoc]

Okay 1st what is a "9e00"?

For diagnostic the diag debug flow is your friend for ipv6 it's similar as ipv4 with the added "6"

e.g

diag debug reset

diag debug enable

diag debug flow filter6 addr 2001:db8::1

diag debug flow filter6 port 443

diag debug flow show console enable

diag debug flow trace start6 100

and when your finished remember to reset and disable the diagnostic flow

Qs:

Now on too your question what did you do with the /56? Are you using SLAAC inside

Do you have router static6 or some dynamic routing protocol to reach the public ipv6

You mention NAT66 so I'm guessing your nating a non-global ipv6 address to your public  ipv6  global address?

Please provide a topology map and diagnostic  of what your problem(s).

[Rede]

Hello,

see if this information help?

For example the external network interface configured in the FGT 2804: 150: 11: 9e00 / 64.

On my machine I have the ip 2804: 150: 11: 9e0a :: 2/64

I divide the / 56 in /64 networks.

I'm not using SLAAC. The addresses were configured manually.

On my machine I have the ip 2804: 150: 11: 9999 :: 2/64, but when I go out to the internet go out with ip 2804: 150: 11: 9999:a2d3: c1ff: fe6a: 9acf.

I'm not using dhcp at the time

FGT Flow => Src> 2804:150:11:9999::/64 =>> DST> ::/0  Service ALL

I got two static routes ::/0 e another to network 9e0a::/64

Result of debug:

emnoc wrote:

Okay 1st what is a "9e00"?

 It's my network 

For diagnostic the diag debug flow is your friend for ipv6 it's similar as ipv4 with the added "6"

e.g

diag debug reset

diag debug enable

diag debug flow filter6 addr 2001:db8::1

diag debug flow filter6 port 443

diag debug flow show console enable

diag debug flow trace start6 100

and when your finished remember to reset and disable the diagnostic flow

Qs:

Now on too your question what did you do with the /56? Are you using SLAAC inside

Do you have router static6 or some dynamic routing protocol to reach the public ipv6

You mention NAT66 so I'm guessing your nating a non-global ipv6 address to your public  ipv6  global address?

Please provide a topology map and diagnostic  of what your problem(s).

Thank you

[emnoc]

I'm not using SLAAC. The addresses were configured manually. On my machine I have the ip 2804: 150: 11: 9e0a :: 2/64, but when I go out to the internet go out with ip 2804: 150: 11: 9e0a: a2d3: c1ff: fe6a: 9acf. I'm not using dhcp at the time

You might have configure the static  ipv6 address  on the machine, but it looks like this is a "ipv6 privacy extension address". If you pull  the  ipv6 interface configuration you will see that. If you don't want to use ipv6 privacy, just disable it.

MACOSX has it enabled by default;

 You can use sysctl and toogle bit ! to 0

        net.inet6.ip6.use_tempaddr: 1

On windows, you will need to research your window-version and find the correct means.

http://andatche.com/blog/2012/02/disabling-rfc4941-ipv6-privacy-extensions-in-windows/

Most other unixes are a hit/miss but once again sysctl -a help or defining the enable/dsiable via network init.d files could be used.

On a positive note, it look like your golden within your ipv6 routing and networking. A word advice the address should be written with no space. it make it easier on the eyes & looks better;

e.g

2804:150:11:9e0a::2/64

2804:150:11:9e0a:a2d3:c1ff:fe6a:9acf.

As far if you should enable or disable iv6 privacy extension, varies but  masking the real ipv6 address is good from a security standpoint.

Also it makes finding ipv6  hosts during external scan next to impossible or  reduce your appearance since the address is temporal.

A ipv6 privacy extension used today could be different tomorrow or next or the next hour,etc.... depending on lifetime.

Now for ipv6 tracking it's almost a requirement to disable privacy extensions.

It hard to tracking something if it's always change it's address ;)

YMMV

BTW; I'm  consulting with a provider on a new /32 block and hope to have it done in the next few weeks after the submit payment ;) Did you get your assignment directly or via a provider?

[Rede]

Hello Emnoc,

Thank you for your help. Worked here when i disabled the "ipv6 address privacy extension" as you suggested. Thanks again.