IPv6 routing issue (resolved)

[Sebastian_Pesman]

Hi all, I recently switched from a Juniper SSG firewall cluster to a Fortigate 111c cluster and now my IPv6 routing is broke and can' t get it to work. In our data-center we have a native IPv6 connection (dual stack) and a transparent link to our headquarters. In the previous setup the firewall cluster had an interface in the same VLAN (transparent) as the core switch on the headquarters. In this VLAN most servers are present. I configured the firewall cluster as a router, but not to send router advertisements. The core switch had the IPv6 address of the cluster as it' s gateway. This was working fine. Now with the fortigate, no traffic is routed by the firewall cluster. The core switch and firewall can ping each other. When I set the ip6-send-adv my servers get 2 gateways, resulting in some servers to be able to reach the systems in the data-center and the public internet, but not the computers at the headquarters (other VLAN). And servers that can access all on the headquarters but nothing in the data-center. It appears to me that when ip6-send-av is not set, the interface does not route ipv6 traffic. I can' t really change it to another VLAN so only the core switch and the firewall cluster see eachother, because of the IPv4 config that uses the same setup. I can' t disable IPv6 routing for that VLAN on the core-switch in the headquarters because then all client to server traffic would first go to the data-center firewall cluster for routing. Any suggestions on this? Thanks,

[Matthijs]

There is a bug with IPv6 and you might just have run into it. What you can do is remove the ipv6 addresses from all interfaces on the firewall and remove all static routes. Then add the ipv6 routes and addresses again. In some cases the IPv6 routing information is not correctly send to the slave fortigate and after failover IPv6 will stop working. So if you tested failover after you did some configuration it will not work ;)

[Sebastian_Pesman]

That is exactly what I did, I configured the cluster, took it into production and did a failover test. I also see (gui) in the routing monitor that for some servers that reside in the data-center (routed by the cluster) that their network (ip/128) is the same as their gateway instead of the IP from the cluster for that interface/vlan.

[Matthijs]

You can also try to failover back to the initial unit but i don' t know if this will solve anything ;)

[Sebastian_Pesman]

It is on it master. Maybe this is also causing my tunneled IPv6 over IPv4 VPN' s to fail. So I think I will create a support request with fortinet to keep track on any bugfixes this might solve.

[Matthijs]

Bug ID 165400 merge ipv6 route sync among HA members Fix Schedule => 5.0.0 ;)

[Sebastian_Pesman]

Just deleted all ipv6 routes and the IP' s on the interface. The added the IP' s back to the interfaces and added the routes. Still not working :(

[Sebastian_Pesman]

I configured 1 server to use the IPv6 address from the cluster as gateway. Though i can ping the address i cannot ping any address behind the router. It appears that the interface is not routing traffic when the ip6-send-adv is not set. So basically the issue is that interface should route, but not send RA' s (like the juniper did). Or skip the autoconfiguration part.

[Sebastian_Pesman]

With the help of my ISP we traced down the issue, they converted a firewall trace to a wireshark format which show the problem. Somewhere in the chain an incorrect MAC was used (mac of the old firewall cluster). As i could not locate it on the device that was in the packet i just changed the IPv6 address on the firewall cluster and updated my default ipv6 route entry on the headquarters Some learnings from this - If the ip6-send-adv is not set, the interface can/does still route traffic

[emnoc]

FWIW the send RA adv has nothing to do per se of the interface capability for routing. It' s used for any host attempting to acquire their local-router and prefix for that lan. You can enable or disable that adv, and still routed traffic. note: obviously if your disable the sending RA, you will need to manual configuration on the client side.