Issues with IPsec VPN and RTSP Access for IPv6 Cellular Clients on FortiGate Device

[zar_nckvn]

We’re currently using an IPsec VPN on a FortiGate device for remote access because SSL has reached EOL. Our entire network, including both internal and public IP addresses, is IPv4-only (no IPv6). Here’s a rough summary of our setup:

• Public IP: For security reasons, I'll use an incorrect IP example: 300.77.11.260
• Internal server: 10.0.0.4/24 (NVR system requiring remote access)
• FQDN: vpn-mycompany.com resolves to our IPv4 public IP (300.77.11.260)

Issue Summary:

The IPsec VPN is configured correctly; users on Wi-Fi can connect and access the internal NVR server (10.0.0.4) without issues. However, cellular clients using IPv6-enabled ISPs experience the following problems:

• They can connect to the VPN and ping the internal server, but RTSP fails to load live camera views.
• No internet access is available, as they lose all external connectivity - Internet traffic doesn't go thru VPN.
• Pinging vpn-mycompany.com while disconnected from the VPN (on cellular) resolves to an IPv6 address that we haven’t configured: 2001:XYZ.XYZ.XYZ::2042

Troubleshooting Steps Taken:

1. Enabled IPv6 Mode Config:

   • Even though we don’t have any IPv6 setup on our public-facing interface or internal network, I enabled IPv6 mode configuration on the IPsec VPN, setting the client addressing range to fdff:172:16:16::1 - fdff:172:16:16::30, with a prefix of 128.
   • Enabled IPv6 Split Tunneling set to "ALL".

2. Result of IPv6 Mode Config:

   • On cellular, users were able to connect, ping the internal server (10.0.0.4), and view live feeds, but there was no internet access. Pinging external sites like Google returned a “Can't resolve host” error; indicating a DNS issue. When I tried pining the (2001:XYZ.XYZ.XYZ::2042/128) it said, 'No route to host'.

3. Adjusted IPv6 Split Tunnel to Match Resolved IPv6 Address:

   • I set the IPv6 Split Tunnel Accessible Networks to the unexpected IPv6 address (2001:XYZ.XYZ.XYZ::2042/128).
   • This allowed users to ping the internal server, access the internet. However, RTSP live streaming stopped working again. Also when I tried pinging (2001:XYZ.XYZ.XYZ::2042/128) it said 'Request time-out'. Pinging the FQDN would now resolve to the IPv4 address: 300.77.11.260

4. DNS Configuration Changes

   • I disabled “Use System DNS in Mode Config” and set DNS manually to 8.8.8.8 for IPv4 and 2001:4860:4860::8888 for IPv6.
   • This allowed users to ping both the FQDN (resolving to IPv4) and Google (resolving to IPv6) , but live views still failed to load. Pinging the IPv6 address would say 'Request time-out'.

Current Situation:

In summary, we have no native IPv6 configuration on our public-facing interface or internal network. Despite this, when cellular clients connect via the IPsec VPN, they can’t access the internet and can’t stream RTSP live views unless IPv6 mode config is set to “All.” However, setting this to “All” blocks internet traffic entirely.

My Questions:

1. Why is an IPv6 address resolving for our FQDN (vpn-mycompany.com) when we haven’t configured IPv6?
2. Is there a better way to configure the IPsec VPN to handle IPv6 ISP clients, so they can access both RTSP streams and the internet simultaneously?
3. Any advice on maintaining RTSP functionality while allowing internet access on IPv6-enabled cellular clients?

Hopefully someone can help me, this issue is driving us (me) crazy.

PS: We have tried chancing NAT Transversal from [Enable] to [Disable] to [Forced], did not resolve the issue. 

[sjoshi]

Hi,

1. Why is an IPv6 address resolving for our FQDN (vpn-mycompany.com) when we haven’t configured IPv6? ?? >> depends on your dns server.. you can take a pcap with the dns server IP
2. Is there a better way to configure the IPsec VPN to handle IPv6 ISP clients, so they can access both RTSP streams and the internet simultaneously?https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/946314/site-to-site-ipv6-ove...https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/946314/site-to-site-ipv6-ove...