0

I have a Fortigate router and my ISP support ipv6. I'm getting a public ipv6 on the Fortigate and also on the computers on the lan (2a02:a18:9041....)

I have not to much understanding of ipv6, but by my understanding the Fortigate and local addresses are configured from SLAAC (something like DHCP?)

I have enabled firewall policies allowing traffic from local network and out..

But still I'm not able to do any ipv6 connections. I have also enabled "ping" for ipv6 for the wan interface, but I'mnot able to ping the address Fortigate gets from the outside world and if I trace the route from outside, it stops at some ip at my ISP.

If i try a trace from a computer on the lan

 C:\WINDOWS\system32>tracert /6 /d /w 500 www.google.com

Tracing route to www.google.com [2a00:1450:400f:808::2004]
over a maximum of 30 hops:

  1     *     Destination net unreachable.

Trace complete.

If i look a the routing table on my Fortigate it does'nt look like there is an ipv6 default gateway (I dont really know if this is needed in the same way as ipv4)

if i look at the routing table on the Fortigate, it looks like this

get router info6 routing-table
IPv6 Routing Table
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
       IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, B - BGP
       * - candidate default

Timers: Uptime

C       ::1/128 via ::, root, 2d17h28m
C       2a02:a18:....../128 via ::, wan1, 2d17h27m
C       2a02:a18:....../64 via ::, VLAN-30, 2d17h27m
C       fe80::/10 via ::, VLAN-30, 2d17h27m

Any idea why I'm not getting any ipv6 connectivity? My ISP answer is only "We dont give any support for any other devices than the one we supplied" - which is some crap.

after adding a static, default route (::/0) on wan1 interface I can route one hop with traceoute

C:\WINDOWS\system32>tracert /6 /d /w 500 www.google.com

Tracing route to www.google.com [2a00:1450:400f:80d::2004]
over a maximum of 30 hops:

  1    27 ms     1 ms     2 ms  2a02:.....::1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4  Destination host unreachable.

Trace complete.
4
  • You probably want to research IPv6 prefix delegation for your device. It appears that is something new for Fortigate, so it may take an OS upgrade. Also, IPv6 can use a default route (::/0) the same way IPv4 can have a default route (0.0.0.0/0).
    – Ron Maupin
    Dec 1, 2019 at 19:13
  • @RonMaupin IPv6 prefix delegation is enabled on the device. if i add ::/0 as a static route on the device using wan1 I'm able to route from the lan with one hop
    – Mr Zach
    Dec 2, 2019 at 8:02
  • I have the same issue. Check out my nonsense on this one... I did a packet capture on my outside interface, and I was seeing ICMP type 131 which I misinterpreted as router advertisements... so I tried setting up a static route to send there (fe80:<cut>:9639). It worked for several packets, then just stopped and wouldn't work again (weird). Anyway, in the course of that interaction, I saw a neighbor advertisement from something else (fe80:<cut>::6422) telling me who fe80:<cut>::9639 was above. I figured I'd try that address then. So I changed my static route (default for IPv6) to that address (
    – RG759
    May 23, 2020 at 13:31
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Nov 19, 2022 at 23:50

1 Answer 1

1

You have to add a default route. Try ping6 ff02::2%wan1 to determine the link-local addresses of your ISP router. Beware that other routers on the link might respond as well if your ISP doesn’t have proper filtering.

2
  • This gives me only "unknown host"
    – Mr Zach
    Dec 2, 2019 at 8:07
  • Then I think that you will have to ask your ISP for the default route they use. I don’t know fortigate specifically, but do you have an option to accept RAs?
    – Alarig
    Dec 2, 2019 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.