I'm trying to achieve the same with my FTG 40F on ipv6 which I can easily can do with the Telekom provided CPE (some kind of low end belkin router :)). So, if I connect directly to the Telekom router, I get a private IPv4 address and a delagated IPv6 address from the /64 they assign to me and it works perfectly. But not with FTG! Support told me ISP does not allow me to delegate a prefix (e.g. ::/56), so I have to use NAT66 from LAN to WAN. It works for a while, but it is very unstable and my favourite test site (Test your IPv6. (test-ipv6.com) reports this several times and my ipv6 also broken frequently
"Danger! IPv6 sorta works - however, large packets appear to fail, giving the appearance of a broken website. If a publisher publishes to IPv6, you will believe their web site to be broken. Ask your ISP about MTU issues; possibly with your tunnel. Check your firewall to make sure that ICMPv6 messages are allowed in particular, Type 2 or Packet Too Big)."
This is my config on WAN side
config system interface edit "wan" set vdom "root" set mode pppoe set allowaccess ping ftm set type physical set netflow-sampler both set lldp-reception enable set monitor-bandwidth enable set role wan set snmp-index 1 config ipv6 set ip6-allowaccess ping set dhcp6-prefix-delegation enable set autoconf enable config dhcp6-iapd-list edit 5 set prefix-hint ::/56 next edit 1 set prefix-hint ::/64 next edit 23 set prefix-hint ::/56 next end end set username "xxxxxx" set password set dns-server-override disable next end
Any idea how to fix either the stability issue with NAT66 or even better enable delegating public IPv6 to the LAN?
It is 7.4. I also had to decrease ipv6 mtu on the LAN side to have a stable NAT66 connection
config ipv6 set ip6-address fd33:f1ba:9f3c:4c31:d676:a0ff:fe7b:5c03/64 set ip6-allowaccess ping https ssh snmp http fgfm fabric set ip6-send-adv enable set ip6-manage-flag enable set ip6-other-flag enable set ip6-link-mtu 1280 end next
Can you modify the LAN interface config and add DHCP6 server config on the Fortigate as suggested in the article. Modify the DNS IP and other range to match with your network.
config system interface edit "vlan237" set vdom "root" set device-identification enable set role lan set snmp-index 14
config ipv6 set ip6-mode delegated set ip6-allowaccess ping set ip6-send-adv enable <----- FortiGate will send RA to end stations. set ip6-manage-flag enable <-- Set flag "M" set ip6-other-flag enable <-- Set flag "O" set ip6-upstream-interface "vlan211" set ip6-subnet ::1/64 <----- Set the 'Interface ID' used with the IPv6 prefix delegated.
config ip6-delegated-prefix-list edit 1 set upstream-interface "vlan211" set subnet 2001:db8:72b1:8caa::/64 <----- Prefix IPv6 delegated.
next end end set interface "port2" set vlanid 237 next end
config system dhcp6 server edit 1 set interface "vlan237" set upstream-interface "vlan211" set ip-mode delegated set dns-server1 2804:14d:1:0:181:213:132:2 <----- DNS resolvers to use on LAN. set dns-server2 2804:14d:1:0:181:213:132:3 next end
- Have you found a solution? Then give your helper a "Kudos" and mark the solution.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.