Hi all!
Background, I need to deploy IPv6 in production pretty soon , so I have been trying to test in KVM since I have no site that actually has IPv6. I have spent days reading up on IPv6, and searching Fortigate specific tutorials etc, but I am at a loss at what I think should be a fairly simple thing to do. There seem to be a lot of similar posts, but nothing here seems to solve my problem (a lot of them have passed where I am!) I am probably missing something fundamental. Any help would be greatly appreciated! It may be something Fortigate or IPv6 related that I am overlooking!
I have two networks in my environment, the first has IPv4 and IPv6 configuration which routes to the host machine, which I connect the FGT_VM port1 "wan" interface to. I am able to communicate between host and FGT_VM over IPv4 and IPv6. (Note that I don't have IPv6 LAN in this office so it ends at the virtual network). This network has the below IPv6 config in libvirt. The second interface has no configuration, and is connected to port2 and a VM. If enable IPv4 on FGT and VM, then they connect fine.
<ip family='ipv6' address='fd9b:91bb:fd26:e188::1' prefix='64'>
<dhcp>
<range start='fd9b:91bb:fd26:e188::100' end='fd9b:91bb:fd26:e188::1ff'/>
</dhcp>
</ip>
Trying to get the delegated prefix configuration... from a factory reset, I configure only port1 (wan) and port2 (lan) on the FGT_VM
FortiGate-VM64-KVM # show system interface
config system interface
edit "port1"
set vdom "root"
set ip 192.168.122.30 255.255.255.0
set allowaccess ping https ssh http fgfm
set type physical
set snmp-index 1
config ipv6
set ip6-address fd9b:91bb:fd26:e188::4/64
set ip6-allowaccess ping ssh http
set dhcp6-prefix-delegation enable
end
next
edit "port2"
set vdom "root"
set type physical
set snmp-index 2
config ipv6
set ip6-mode delegated
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-upstream-interface "port1"
set ip6-subnet ::1/64
config ip6-delegated-prefix-list
edit 1
set upstream-interface "port1"
set autonomous-flag enable
set onlink-flag enable
set subnet ::/64
next
end
end
next
I have tweaked a lot of these settings a lot, based on various sources on the internet including https://docs.fortinet.com/document/fortigate/6.0.6/handbook/800956/dhcpv6, but at no point does port2 ever obtain an IP address. I thought the ip-subnet of ::1/64 was conflicting with the libvirt IP, so changed this to various values, and also the ip6-delegated-prefix-list subet, to not avail. Port2 just wont take.
FortiGate-VM64-KVM # diagnose ipv6 address list
dev=3 devname=port1 flag=P scope=0 prefix=64 addr=fd9b:91bb:fd26:e188::4 preferred=4294967295 valid=4294967295
dev=3 devname=port1 flag=P scope=253 prefix=64 addr=fe80::5054:ff:fef8:8ec2 preferred=4294967295 valid=4294967295
dev=5 devname=root flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295
dev=7 devname=vsys_ha flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295
dev=9 devname=vsys_fgfm flag=P scope=254 prefix=128 addr=::1 preferred=4294967295 valid=4294967295
Not that I think its required at this stage, but I have also set routes, configured DHCP6 server, and allow-all policies, all to no avail.
FortiGate-VM64-KVM # show system dhcp6 server
config system dhcp6 server
edit 1
set dns-service delegated
set subnet 0:0:0:102::/64
set interface "port2"
set upstream-interface "port1"
set ip-mode delegated
next
end
If anyone can point out what I'm missing, I would greatly appreciate this! :) Thanks!
UPDATE:
So I reckon I misunderstood a fundamental here. I'm still testing, but I believe the problem is that prefix delegation is used for PPPoE and/or DHCP WAN connections, not STATIC as I am using here. I am playing around with this now, seems to be working, will confirm...
So this appears to work now. I am not using delegated-prefix, only static, with the LAN using the next subnet id (4673 instead of 4672 on WAN). Full [relevant] config below. I am happy that this all works now, but my only remaining question is (if anyone has read this far) should the LAN devices have Global Unicast Address, should it also have a Unique Local?
I plan to share my experience here as a tutorial (full KVM IPv6 + Fortigate) as I have found it very difficult to make sense of the IPv6 world and apply it here! Hopefully this will help others.
The config, for reference.
config system interface
edit port1
config ipv6
set ip6-address fde3:896b:9288:4672::2/64
set ip6-allowaccess ping ssh http
end
next
edit port2
config ipv6
set ip6-mode static
set ip6-address fde3:896b:9288:4673::1/64
set ip6-allowaccess ping ssh http
set ip6-send-adv enable
config ip6-prefix-list
edit fde3:896b:9288:4673::/64
set autonomous-flag enable
set onlink-flag enable
next
end
next
end
config router static6
edit 1
set gateway fde3:896b:9288:4672::1
set device "port1"
next
end
config system dhcp6 server
edit 1
set interface "port2"
set dns-server1 2001:4860:4860::8888
set dns-server2 2001:4860:4860::4444
next
end
config router static6
edit 1
set gateway fde3:896b:9288:4672::1
set device "port1"
next
end
config firewall policy6
edit 1
set name "AllowAllOut6"
set srcintf "port2"
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
next
edit 2
set name "AllowAllIn6"
set srcintf "port1"
set dstintf "port2"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "PING6" "SSH"
next
end
. Good job.
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1735 | |
1107 | |
752 | |
447 | |
240 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.