Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
vladxxx
New Contributor II

ipv6 pppoe Telekom but in Hungary

Hi,

I'm trying to achieve the same with my FTG 40F on ipv6 which I can easily can do with the Telekom provided CPE (some kind of low end belkin router :)). So, if I connect directly to the Telekom router, I get a private IPv4 address and a delagated IPv6 address from the /64 they assign to me and it works perfectly. But not with FTG! Support told me ISP does not allow me to delegate a prefix (e.g. ::/56), so I have to use NAT66 from LAN to WAN. It works for a while, but it is very unstable and my favourite test site (Test your IPv6. (test-ipv6.com) reports this several times and my ipv6 also broken frequently

"Danger! IPv6 sorta works - however, large packets appear to fail, giving the appearance of a broken website. If a publisher publishes to IPv6, you will believe their web site to be broken. Ask your ISP about MTU issues; possibly with your tunnel. Check your firewall to make sure that ICMPv6 messages are allowed in particular, Type 2 or Packet Too Big)."


This is my config on WAN side

config system interface
edit "wan"
set vdom "root"
set mode pppoe
set allowaccess ping ftm
set type physical
set netflow-sampler both
set lldp-reception enable
set monitor-bandwidth enable
set role wan
set snmp-index 1
config ipv6
set ip6-allowaccess ping
set dhcp6-prefix-delegation enable
set autoconf enable
config dhcp6-iapd-list
edit 5
set prefix-hint ::/56
next
edit 1
set prefix-hint ::/64
next
edit 23
set prefix-hint ::/56
next
end
end
set username "xxxxxx"
set password 
set dns-server-override disable
next
end

 

Any idea how to fix either the stability issue with NAT66 or even better enable delegating public IPv6 to the LAN?

 

Thanks

L:

 

7 REPLIES 7
Anthony_E
Community Manager
Community Manager

Hello L,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Anthony-Fortinet Community Team.
Anthony_E
Community Manager
Community Manager

Hello L,

 

May I ask you which version is running your FortiGate, please?

Anthony-Fortinet Community Team.
vladxxx
New Contributor II

It is 7.4. I also had to decrease ipv6 mtu on the LAN side to have a stable NAT66 connection

 

config ipv6
set ip6-address fd33:f1ba:9f3c:4c31:d676:a0ff:fe7b:5c03/64
set ip6-allowaccess ping https ssh snmp http fgfm fabric
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-other-flag enable
set ip6-link-mtu 1280
end
next

 

 

Anthony_E
Community Manager
Community Manager

Thank you Vlad!

It will help in the investigation.

 

Regards,

Anthony-Fortinet Community Team.
srajeswaran
Staff
Staff

Hello @vladxxx ,

Can you share the below config parts to check the PD issue.

WAN interface, Internal interface and config ipv6 part .

If you are currently using NAT66, you may need to revert the changes and collect these outputs.
Below article will be helpful in checking this issue.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DHCPv6-Prefix-Delegation/ta-p/207133

Regards,
Suraj
- Have you found a solution? Then give your helper a "Kudos" and mark the solution.
vladxxx
New Contributor II

Hi,

 

Sure

 
WAN
 
config system interface
    edit "wan"
        set vdom "root"
        set mode pppoe
        set allowaccess ftm
        set type physical
        set netflow-sampler both
        set lldp-reception enable
        set monitor-bandwidth enable
        set role wan
        set snmp-index 1
        config ipv6
            set ip6-allowaccess ping
            set autoconf enable
        end
        set username 
        set password
        set dns-server-override disable
    next
end
 
LAN
 
config system interface
    edit "lan"
        set vdom "root"
        set ip xxxxxxxxxxx
        set allowaccess ping https ssh snmp http fgfm radius-acct fabric ftm speed-test
        set broadcast-forward enable
        set type hard-switch
        set netflow-sampler both
        set stp enable
        set device-identification enable
        set lldp-reception enable
        set lldp-transmission enable
        set monitor-bandwidth enable
        set role lan
        set snmp-index 5
        set auto-auth-extension-device enable
        set ip-managed-by-fortiipam disable
        config ipv6
            set ip6-address fd33:xxxxxxx/64
            set ip6-allowaccess ping https ssh snmp http fgfm fabric
            set ip6-send-adv enable
            set ip6-manage-flag enable
            set ip6-other-flag enable
            set ip6-link-mtu 1280
        end
    next
 
As far as I know there is no dhcpv6 on the wan side, I only getting IPv6 address if I use autoconf enable
 
L:
 
srajeswaran

Can you modify the LAN interface config and add DHCP6 server config on the Fortigate as suggested in the article. Modify the DNS IP and other range to match with your network.

 

config system interface
    edit "vlan237"
        set vdom "root"
        set device-identification enable
        set role lan
        set snmp-index 14

 

        config ipv6
             set ip6-mode delegated
             set ip6-allowaccess ping
             set ip6-send-adv enable <----- FortiGate will send RA to end stations.
             set ip6-manage-flag enable <-- Set flag "M"
             set ip6-other-flag enable <-- Set flag "O"
             set ip6-upstream-interface "vlan211"
             set ip6-subnet ::1/64 <----- Set the 'Interface ID' used with the IPv6 prefix delegated.

 

             config ip6-delegated-prefix-list
                 edit 1
                     set upstream-interface "vlan211"
                     set subnet 2001:db8:72b1:8caa::/64 <----- Prefix IPv6 delegated.

                 next
             end
        end
        set interface "port2"
        set vlanid 237
    next
end

 

config system dhcp6 server
    edit 1
        set interface "vlan237"
        set upstream-interface "vlan211"
        set ip-mode delegated
        set dns-server1 2804:14d:1:0:181:213:132:2 <----- DNS resolvers to use on LAN.
        set dns-server2 2804:14d:1:0:181:213:132:3
    next
end

 

 

Regards,
Suraj
- Have you found a solution? Then give your helper a "Kudos" and mark the solution.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors