Hi,
I'm trying to achieve the same with my FTG 40F on ipv6 which I can easily can do with the Telekom provided CPE (some kind of low end belkin router :)). So, if I connect directly to the Telekom router, I get a private IPv4 address and a delagated IPv6 address from the /64 they assign to me and it works perfectly. But not with FTG! Support told me ISP does not allow me to delegate a prefix (e.g. ::/56), so I have to use NAT66 from LAN to WAN. It works for a while, but it is very unstable and my favourite test site (Test your IPv6. (test-ipv6.com) reports this several times and my ipv6 also broken frequently
"Danger! IPv6 sorta works - however, large packets appear to fail, giving the appearance of a broken website. If a publisher publishes to IPv6, you will believe their web site to be broken. Ask your ISP about MTU issues; possibly with your tunnel. Check your firewall to make sure that ICMPv6 messages are allowed in particular, Type 2 or Packet Too Big)."
This is my config on WAN side
config system interface
edit "wan"
set vdom "root"
set mode pppoe
set allowaccess ping ftm
set type physical
set netflow-sampler both
set lldp-reception enable
set monitor-bandwidth enable
set role wan
set snmp-index 1
config ipv6
set ip6-allowaccess ping
set dhcp6-prefix-delegation enable
set autoconf enable
config dhcp6-iapd-list
edit 5
set prefix-hint ::/56
next
edit 1
set prefix-hint ::/64
next
edit 23
set prefix-hint ::/56
next
end
end
set username "xxxxxx"
set password
set dns-server-override disable
next
end
Any idea how to fix either the stability issue with NAT66 or even better enable delegating public IPv6 to the LAN?
Thanks
L:
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello L,
Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.
Thanks,
Hello L,
May I ask you which version is running your FortiGate, please?
It is 7.4. I also had to decrease ipv6 mtu on the LAN side to have a stable NAT66 connection
config ipv6
set ip6-address fd33:f1ba:9f3c:4c31:d676:a0ff:fe7b:5c03/64
set ip6-allowaccess ping https ssh snmp http fgfm fabric
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-other-flag enable
set ip6-link-mtu 1280
end
next
Thank you Vlad!
It will help in the investigation.
Regards,
Hello @vladxxx ,
Can you share the below config parts to check the PD issue.
WAN interface, Internal interface and config ipv6 part .
If you are currently using NAT66, you may need to revert the changes and collect these outputs.
Below article will be helpful in checking this issue.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DHCPv6-Prefix-Delegation/ta-p/207133
Hi,
Sure
Can you modify the LAN interface config and add DHCP6 server config on the Fortigate as suggested in the article. Modify the DNS IP and other range to match with your network.
config system interface
edit "vlan237"
set vdom "root"
set device-identification enable
set role lan
set snmp-index 14
config ipv6
set ip6-mode delegated
set ip6-allowaccess ping
set ip6-send-adv enable <----- FortiGate will send RA to end stations.
set ip6-manage-flag enable <-- Set flag "M"
set ip6-other-flag enable <-- Set flag "O"
set ip6-upstream-interface "vlan211"
set ip6-subnet ::1/64 <----- Set the 'Interface ID' used with the IPv6 prefix delegated.
config ip6-delegated-prefix-list
edit 1
set upstream-interface "vlan211"
set subnet 2001:db8:72b1:8caa::/64 <----- Prefix IPv6 delegated.
next
end
end
set interface "port2"
set vlanid 237
next
end
config system dhcp6 server
edit 1
set interface "vlan237"
set upstream-interface "vlan211"
set ip-mode delegated
set dns-server1 2804:14d:1:0:181:213:132:2 <----- DNS resolvers to use on LAN.
set dns-server2 2804:14d:1:0:181:213:132:3
next
end
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.