IPv6 and RPF

[paulism]

I have a somewhat working setup on a 91G running 7.4.8, that I am struggling with. Sometimes it works fine, now it doesn't. I have IA-PD from my ISP, and it seems to be correct. I have three interfaces on LAN side that gets each their own /64:

lan (shortened)

    ip6-mode            : 

    nd-mode             : basic 

    ip6-address         : 2a01:xxxx:161f:670a::1/64

    ip6-allowaccess     : ping https ssh 

    ip6-prefix-mode     : dhcp6 

    dhcp6-prefix-delegation: disable

    dhcp6-information-request: disable 

    ip6-delegated-prefix-iaid: 1

    ip6-upstream-interface: Vlan102 

    ip6-subnet          : ::a:0:0:0:1/64

The other interfaces have :b: and :c: respectively. Now, when it doesn't work I see that the FortiGate claims there be an RPF check error:

id=65308 trace_id=1 func=resolve_ip6_tuple_fast line=5109 msg="vd-root:0 received a packet(proto=58, 2a01:xxxx:161f:6700:4d1d:8bf:981b:5e94:1423->2a01:xxxx:161f:670a::1:128) from lan. type=128, code=0, id=1423, seq=0."

id=65308 trace_id=1 func=resolve_ip6_tuple line=5260 msg="allocate a new session-00000290"

id=65308 trace_id=1 func=ip6_route_input line=2197 msg="reverse path check failed, drop"

I do see that it lists /128 as mask. Is this correct? The interface itself is /64. I've tried to enable asymroute without any luck. The FortiGate can ping fine.

fortigate # execute ping6 google.com

PING google.com(2a00:1450:400f:803::200e) 56 data bytes

64 bytes from 2a00:1450:400f:803::200e: icmp_seq=1 ttl=120 time=8.85 ms

64 bytes from 2a00:1450:400f:803::200e: icmp_seq=2 ttl=120 time=8.85 ms

^C

[knaveenkumar]

Hi ,

Could you please check the FortiGate the traffic is receiving which interface  and check the reverse for that destination network route is present or not
reverse path will occurs when the route is not present when the traffic is receiving in initial interface 
please refer this document:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Details-about-FortiOS-RPF-Reverse-Path-For...

Also, provide the below output to the ticket

======================================
dia ipv6 address list

dia sniffer packet any "host  <ipv6 addrs>" 4 0 a

then provide the debug flow out to the ticket

[paulism]

fortigate # diagnose ipv6 address list | grep =lan

dev=31 devname=lan flag= scope=0 prefix=64 addr=2a01:799:161f:670a::1 preferred=25205 valid=25205 cstamp=11901 tstamp=1231606

dev=31 devname=lan flag=P scope=253 prefix=64 addr=fe80::3ac0:eaff:fea9:b37f preferred=4294967295 valid=4294967295 cstamp=5552 tstamp=5552

fortigate # di sniffer packet lan 'host 2a01:799:161f:670a::1' 4 0 l

interfaces=[lan]

filters=[host 2a01:799:161f:670a::1]

2025-06-19 20:38:11.683192 lan -- 2a01:799:161f:6700:4d1d:8bf:981b:5e94 -> 2a01:799:161f:670a::1: icmp6: echo request seq 0 [flowlabel 0xd0a00]

2025-06-19 20:38:12.683371 lan -- 2a01:799:161f:6700:4d1d:8bf:981b:5e94 -> 2a01:799:161f:670a::1: icmp6: echo request seq 1 [flowlabel 0xd0a00]

2025-06-19 20:38:13.688726 lan -- 2a01:799:161f:6700:4d1d:8bf:981b:5e94 -> 2a01:799:161f:670a::1: icmp6: echo request seq 2 [flowlabel 0xd0a00]

2025-06-19 20:38:14.691310 lan -- 2a01:799:161f:6700:4d1d:8bf:981b:5e94 -> 2a01:799:161f:670a::1: icmp6: echo request seq 3 [flowlabel 0xd0a00]

^C

4 packets received by filter

0 packets dropped by kernel

fortigate # get router info6 routing-table database

IPv6 Routing Table

Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,

       IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, B - BGP, V - BGP VPNv6

       > - selected route, * - FIB route, p - stale info

Timers: Uptime

Routing table for VRF=0

S       ::/0 [10/0] via ::, Vlan102, 04:27:24, [1024/0]

K    *> ::/0 via fe80::201:2ff:fe61:1, Vlan102, 04:27:24

C    *> ::1/128 via ::, root, 04:27:24

C    *> 2a01:798:100:5800:4543:311b:756a:459/128 via ::, Vlan102, 04:27:02

C    *> 2a01:799:161f:670a::/64 via ::, lan, 04:27:02

fortigate # di de flow filter6 daddr 2a01:799:161f:670a::1

fortigate # di de en

fortigate # di de flow trace start6 4

fortigate # id=65308 trace_id=11 func=resolve_ip6_tuple_fast line=5109 msg="vd-root:0 received a packet(proto=58, 2a01:799:161f:6700:4d1d:8bf:981b:5e94:7266->2a01:799:161f:670a::1:128) from lan. type=128, code=0, id=7266, seq=0."

id=65308 trace_id=11 func=resolve_ip6_tuple line=5260 msg="allocate a new session-0000293b"

id=65308 trace_id=11 func=ip6_route_input line=2197 msg="reverse path check failed, drop"

[paulism]

I see that the DHCP server might not do what it should;

The interface IP is 2a01:xxx:161f:670a::1/64, but the client got 

2a01:xxx:161f:6700:...

The server is quite straight-forward

config system dhcp6 server

    edit 1

        set subnet ::/64

        set interface "lan"

        set upstream-interface "Vlan102"

        set delegated-prefix-iaid 1

        set ip-mode delegated

        set dns-server1 2001:4860:4860::8888

        set dns-server2 2001:4860:4860::8844

    next

and for the upstream interface I got

ipv6:

    ip6-mode            : dhcp

DHCPv6 Lease Expires :Fri Jun 20 15:36:45 2025

    nd-mode             : basic

    ip6-address         : 2a01:xxx:100:5800:4543:311b:756a:459/128

    ip6-allowaccess     : ping

    icmp6-send-redirect : enable

    ra-send-mtu         : enable

    ip6-reachable-time  : 0

    ip6-retrans-time    : 0

    ip6-hop-limit       : 0

    dhcp6-prefix-delegation: enable

delegated-prefix iaid 1     : 2a01:xxx:161f:6700::/56

so the server doesn't consider the interface IP?

[paulism]

Output from the dhcp6s process

fortigate # di de app dhcp6s -1
Debug messages will be on for 20 minutes.
fortigate # di de en
fortigate # execute dhcp6 lease-clear all

[debug]dhcp6_check_timer() called
[debug]dhcp6_check_timer() called
[debug]dhcp6_check_timer() timer func=0x5572669f78
[debug]binding_save_timo() called binding_changed=0
[debug]server6_recv() called
[debug]server6_recv() received solicit from fe80::1cc7:14b5:5302:f5d8%lan
[debug]server6_recv() dhcp6 solicit: search ifp lan's subnet against interface address=2a01:xxx:161f:670a::1
[debug]dhcp6_check_timer() called
[debug]server6_recv() called
[debug]server6_recv() received solicit from fe80::1cc7:14b5:5302:f5d8%lan
[debug]server6_recv() dhcp6 solicit: search ifp lan's subnet against interface address=2a01:xxx:161f:670a::1
[debug]dhcp6_check_timer() called
[debug]server6_recv() called
[debug]server6_recv() received solicit from fe80::1cc7:14b5:5302:f5d8%lan
[debug]server6_recv() dhcp6 solicit: search ifp lan's subnet against interface address=2a01:xxx:161f:670a::1
[debug]dhcp6_check_timer() called
[debug]server6_recv() called
[debug]server6_recv() received solicit from fe80::1cc7:14b5:5302:f5d8%lan
[debug]server6_recv() dhcp6 solicit: search ifp lan's subnet against interface address=2a01:xxx:161f:670a::1
[debug]dhcp6_check_timer() called
[debug]dhcp6_check_timer() called
[debug]dhcp6_check_timer() timer func=0x5572671fc8
[debug]dhcp6s_ha_dump_timeo() called
[debug]dhcp6_check_timer() called
[debug]dhcp6_check_timer() timer func=0x5572669f78
[debug]binding_save_timo() called binding_changed=0
[debug]server6_recv() called
[debug]server6_recv() received solicit from fe80::1cc7:14b5:5302:f5d8%lan
[debug]server6_recv() dhcp6 solicit: search ifp lan's subnet against interface address=2a01:xxx:161f:670a::1
[debug]dhcp6_check_timer() called
[debug]server6_recv() called
[debug]server6_recv() received solicit from fe80::1cc7:14b5:5302:f5d8%lan
[debug]server6_recv() dhcp6 solicit: search ifp lan's subnet against interface address=2a01:xxx:161f:670a::1
[debug]dhcp6_check_timer() called

The client still gets an IP outside the interface subnet:

en4: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=6464<VLAN_MTU,TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
	ether 64:4b:f0:37:54:f8
	inet6 fe80::1cc7:14b5:5302:f5d8%en4 prefixlen 64 secured scopeid 0x10 
	inet 192.168.1.110 netmask 0xffffff00 broadcast 192.168.1.255
	inet6 2a01:xxx:161f:6700:101b:9552:2fbf:5a6d prefixlen 64 autoconf secured 
	inet6 2a01:xxx:161f:6700:15fa:a47e:30f6:8d53 prefixlen 64 autoconf temporary 
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect (1000baseT <full-duplex,flow-control>)
	status: active