IPV6 and DHCP

[Deftone]

Last few days I was busy with configuring IPV6 DHCP on my Fortigate. On the net I found some examples of IPV6 DHCP configurations but for some reasons it's not working on my FTG.  The only way to get it working is to enable autonomous-flag enable. The configuration that I made is as follow:

 edit "VLAN10"         set vdom "root"         set ip 10.x.x.1 255.255.255.0         set allowaccess ping https ssh         set vlanforward enable         set device-identification enable         set fortiheartbeat enable         set role lan         set snmp-index 6         config ipv6             set ip6-allowaccess ping             set ip6-reachable-time 30000             set ip6-retrans-time 3000             set ip6-address 2a02:xx:xxx:100::1/64             set ip6-send-adv enable             set ip6-manage-flag enable disable             set ip6-other-flag enable         end         set interface "Trunk"         set vlanid 10     next end config system dhcp6 server     edit 1         set lease-time 10800         set subnet 2a02:xx:xxx:100::/64         set interface "VLAN10"         config ip-range             edit 1                 set start-ip 2a02:xx:xxx:100::100                 set end-ip 2a02:xx:xxx:100::500             next         end         set dns-server1 ::ffff:208.67.222.222         set dns-server2 ::ffff:208.67.220.220     next

Now I'm just wondering why this is not working. The clients are only getting the IPV6 DNS servers but not the IP

Any idea's what to change in above to et it work?

[Deftone]

This is what I see when I debug and the client connects to the FTG

[debug]server6_recv() called [debug]server6_recv() received information request from fe80::1456:5c07:a61a:6e3e%VLAN10 [debug]server6_recv() dhcp6 solicit: search ifp VLAN10's subnet against interface address=2a02:xx:xxx:100::1 [debug]server6_recv() found service id=1 interface VLAN10 [debug]dhcp6_get_options() get DHCP option client ID, len 14 [debug] DUID: 00:01:00:01:20:c7:12:52:18:65:90:7b:a1:61 [debug]dhcp6_get_options() get DHCP option option request, len 4 [debug] requested option: DNS [debug] requested option: domain search list [debug]dhcp6_get_options() get DHCP option elapsed time, len 2 [debug] elapsed time: 0 [debug]copy_option() set client ID (len 14) [debug]copy_option() set server ID (len 14) [debug]copy_option() set DNS (len 32) [debug]copy_option() set information refresh time (len 4) [debug]server6_send() transmit reply to fe80::1456:5c07:a61a:6e3e%VLAN10 [debug]dhcp6_check_timer() called [debug]dhcp6_check_timer() called [debug]binding_save_timo() called binding_changed=0

[sviusa]

hello,

i'm running with the same problem.

it's seems that the managed flag is not enabled even set in the configuration. Windows client don't issue a dhcpv6 request. What's funny is that ubuntu client send dhcprequest and get an IPv6...

Wireshark on the W10 client confirm it. Make a capture on ipv6 and look at router advertisement packet. you will see that enabled or disabled in the configuration file don't make any difference.

the statement in configuration :

[ul]

set ip6-manage-flag enable disable[/ul]

Make me think is a bug (was working previous version). previously it was only set ip6-manage-flag enable.

Maybe i'm missing something. For the moment SLAAC is working fine

Here is my ip6 conf:

config ipv6             set ip6-allowaccess ping             set ip6-retrans-time 3000             set dhcp6-information-request enable             set ip6-address 2001:41d0:xxxx:xxxx::1/64             set ip6-send-adv enable             set ip6-manage-flag enable disable             set dhcp6-relay-service enable             set dhcp6-relay-ip 2001:41d0:xxxx:xxxx::10

edit 20171023-1608CEST:# downgraded from 5.6.2 to 5.6.0 solved the issue with managed flag.

Regards,

[andrewbailey · Accepted solution]

This is indeed a bug- confirmed by Fortinet support.

I reported it back on the 8th of August after 5.6.1 came out.

The issue is still present in 5.6.2 and apparently will be resolved in 5.6.3.

Ticket reference is 2306843.

As suggested above "set ip6-manage-flag enable disable" makes no sense. It should be either enabled or disabled- not both.

Rolling back to 5.6.0 does resolve the problem.

Hope this is useful.

Kind Regards,

Andy.

[sviusa]

Well, if the issue might be solved on 5.6.3... I will wait for 5.6.4, just in case !

Thanks for sharing the status Andy.

[andrewbailey]

Just to confirm, this issue appears to be resolved in 5.6.3 and my original ticket has now been closed following my testing.

However, it doesn't seem to be covered in the Release Notes and there is still no "What's new" for 5.6.3 (which I guess could potentially cover it too).

5.6.3 seems to have also fixed LLDP for me (neighboring Cisco switches now showing correct LLDP neighbor info from the Fortigate).

Hope this helps.

ANdy.