0

I have a Fortigate router and my ISP support ipv6. I'm getting a public ipv6 on the Fortigate and also on the computers on the lan (2a02:a18:9041....)

I have not to much understanding of ipv6, but by my understanding the Fortigate and local addresses are configured from SLAAC (something like DHCP?)

I have enabled firewall policies allowing traffic from local network and out..

But still I'm not able to do any ipv6 connections. I have also enabled "ping" for ipv6 for the wan interface, but I'mnot able to ping the address Fortigate gets from the outside world and if I trace the route from outside, it stops at some ip at my ISP.

If i try a trace from a computer on the lan

 C:\WINDOWS\system32>tracert /6 /d /w 500 www.google.com

Tracing route to www.google.com [2a00:1450:400f:808::2004]
over a maximum of 30 hops:

  1     *     Destination net unreachable.

Trace complete.

If i look a the routing table on my Fortigate it does'nt look like there is an ipv6 default gateway (I dont really know if this is needed in the same way as ipv4)

if i look at the routing table on the Fortigate, it looks like this

get router info6 routing-table
IPv6 Routing Table
Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,
       IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, B - BGP
       * - candidate default

Timers: Uptime

C       ::1/128 via ::, root, 2d17h28m
C       2a02:a18:....../128 via ::, wan1, 2d17h27m
C       2a02:a18:....../64 via ::, VLAN-30, 2d17h27m
C       fe80::/10 via ::, VLAN-30, 2d17h27m

Any idea why I'm not getting any ipv6 connectivity? My ISP answer is only "We dont give any support for any other devices than the one we supplied" - which is some crap.

after adding a static, default route (::/0) on wan1 interface I can route one hop with traceoute

C:\WINDOWS\system32>tracert /6 /d /w 500 www.google.com

Tracing route to www.google.com [2a00:1450:400f:80d::2004]
over a maximum of 30 hops:

  1    27 ms     1 ms     2 ms  2a02:.....::1
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4  Destination host unreachable.

Trace complete.
  • You probably want to research IPv6 prefix delegation for your device. It appears that is something new for Fortigate, so it may take an OS upgrade. Also, IPv6 can use a default route (::/0) the same way IPv4 can have a default route (0.0.0.0/0). – Ron Maupin Dec 1 at 19:13
  • @RonMaupin IPv6 prefix delegation is enabled on the device. if i add ::/0 as a static route on the device using wan1 I'm able to route from the lan with one hop – Mr Zach Dec 2 at 8:02
0

You have to add a default route. Try ping6 ff02::2%wan1 to determine the link-local addresses of your ISP router. Beware that other routers on the link might respond as well if your ISP doesn’t have proper filtering.

  • This gives me only "unknown host" – Mr Zach Dec 2 at 8:07
  • Then I think that you will have to ask your ISP for the default route they use. I don’t know fortigate specifically, but do you have an option to accept RAs? – Alarig Dec 2 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.