ipv6 pppoe Telekom but in Hungary

[vladxxx]

Hi,

I'm trying to achieve the same with my FTG 40F on ipv6 which I can easily can do with the Telekom provided CPE (some kind of low end belkin router :)). So, if I connect directly to the Telekom router, I get a private IPv4 address and a delagated IPv6 address from the /64 they assign to me and it works perfectly. But not with FTG! Support told me ISP does not allow me to delegate a prefix (e.g. ::/56), so I have to use NAT66 from LAN to WAN. It works for a while, but it is very unstable and my favourite test site (Test your IPv6. (test-ipv6.com) reports this several times and my ipv6 also broken frequently

"Danger! IPv6 sorta works - however, large packets appear to fail, giving the appearance of a broken website. If a publisher publishes to IPv6, you will believe their web site to be broken. Ask your ISP about MTU issues; possibly with your tunnel. Check your firewall to make sure that ICMPv6 messages are allowed in particular, Type 2 or Packet Too Big)."

This is my config on WAN side

config system interface
edit "wan"
set vdom "root"
set mode pppoe
set allowaccess ping ftm
set type physical
set netflow-sampler both
set lldp-reception enable
set monitor-bandwidth enable
set role wan
set snmp-index 1
config ipv6
set ip6-allowaccess ping
set dhcp6-prefix-delegation enable
set autoconf enable
config dhcp6-iapd-list
edit 5
set prefix-hint ::/56
next
edit 1
set prefix-hint ::/64
next
edit 23
set prefix-hint ::/56
next
end
end
set username "xxxxxx"
set password 
set dns-server-override disable
next
end

Any idea how to fix either the stability issue with NAT66 or even better enable delegating public IPv6 to the LAN?

Thanks

L:

[Anthony_E]

Hello L,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello L,

May I ask you which version is running your FortiGate, please?

[vladxxx]

It is 7.4. I also had to decrease ipv6 mtu on the LAN side to have a stable NAT66 connection

config ipv6
set ip6-address fd33:f1ba:9f3c:4c31:d676:a0ff:fe7b:5c03/64
set ip6-allowaccess ping https ssh snmp http fgfm fabric
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-other-flag enable
set ip6-link-mtu 1280
end
next

[Anthony_E]

Thank you Vlad!

It will help in the investigation.

Regards,

[srajeswaran]

Hello @vladxxx ,

Can you share the below config parts to check the PD issue.

WAN interface, Internal interface and config ipv6 part .

If you are currently using NAT66, you may need to revert the changes and collect these outputs.
Below article will be helpful in checking this issue.
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DHCPv6-Prefix-Delegation/ta-p/207133

[vladxxx]

Hi,

Sure

WAN

config system interface

    edit "wan"

        set vdom "root"

        set mode pppoe

        set allowaccess ftm

        set type physical

        set netflow-sampler both

        set lldp-reception enable

        set monitor-bandwidth enable

        set role wan

        set snmp-index 1

        config ipv6

            set ip6-allowaccess ping

            set autoconf enable

        end

        set username 

        set password

        set dns-server-override disable

    next

end

LAN

config system interface

    edit "lan"

        set vdom "root"

        set ip xxxxxxxxxxx

        set allowaccess ping https ssh snmp http fgfm radius-acct fabric ftm speed-test

        set broadcast-forward enable

        set type hard-switch

        set netflow-sampler both

        set stp enable

        set device-identification enable

        set lldp-reception enable

        set lldp-transmission enable

        set monitor-bandwidth enable

        set role lan

        set snmp-index 5

        set auto-auth-extension-device enable

        set ip-managed-by-fortiipam disable

        config ipv6

            set ip6-address fd33:xxxxxxx/64

            set ip6-allowaccess ping https ssh snmp http fgfm fabric

            set ip6-send-adv enable

            set ip6-manage-flag enable

            set ip6-other-flag enable

            set ip6-link-mtu 1280

        end

    next

As far as I know there is no dhcpv6 on the wan side, I only getting IPv6 address if I use autoconf enable

L:

[srajeswaran]

Can you modify the LAN interface config and add DHCP6 server config on the Fortigate as suggested in the article. Modify the DNS IP and other range to match with your network.

config system interface
    edit "vlan237"
        set vdom "root"
        set device-identification enable
        set role lan
        set snmp-index 14

        config ipv6
             set ip6-mode delegated
             set ip6-allowaccess ping
             set ip6-send-adv enable <----- FortiGate will send RA to end stations.
             set ip6-manage-flag enable <-- Set flag "M"
             set ip6-other-flag enable <-- Set flag "O"
             set ip6-upstream-interface "vlan211"
             set ip6-subnet ::1/64 <----- Set the 'Interface ID' used with the IPv6 prefix delegated.

             config ip6-delegated-prefix-list
                 edit 1
                     set upstream-interface "vlan211"
                     set subnet 2001:db8:72b1:8caa::/64 <----- Prefix IPv6 delegated.

                 next
             end
        end
        set interface "port2"
        set vlanid 237
    next
end

config system dhcp6 server
    edit 1
        set interface "vlan237"
        set upstream-interface "vlan211"
        set ip-mode delegated
        set dns-server1 2804:14d:1:0:181:213:132:2 <----- DNS resolvers to use on LAN.
        set dns-server2 2804:14d:1:0:181:213:132:3
    next
end