3

enter image description hereI am using a fortigate 60f firewall. I have configured it for both ipv4 and ipv6. I have used the SD wan (by adding wan1 and wan2) for load-balancing. Moreover, I have configure a default static route for both ipv4 and ipv6 (for the SD-wan). Further more I have configured ipvr4 and ipv6 policies too. This network works perfectly fine for the ipv4 configurations. Only my wan2 has ipv6 connectivity and the gateway is fe80::1. As I mentioned above I have configure a default static route(gateway fe80::1), policies(from internal => sdwan) and sd wan rules(To send all the v6 traffic through wan2) for ipv6. More over I have configured my internal interface ipv6 address as fd00:1/64 and host(PC) connected to the internal as fd00::2/64. My wan2 interface ipv6 address is fe80::2/64. ***

Still I can't ping the gateway (fe80::1). Why is that? Where have I made the mistake?**

Thank you :)

Improve this question
1
  • Have you set the source IP address in ping-options?
    – Zac67 ♦
    May 11, 2021 at 16:43

1 Answer 1

Reset to default
2

First, your ISP will simply drop any packets with ULA addresses (fc00::/7, which includes packets your fd00::/64 network), so you cannot ping to your ISP from your ULA network.

Next, you are misusing the ULA addressing. You can locally assign addresses in the fd00::/8 range, but the next 40 bits after the fd must be randomly chosen to give you a /48 prefix from which you can get 65,536 /64 networks for your use. Obviously, your fd00::/64 is not using the required random 40-bit Global ID.

Also, you can only ping a Link-Local address in the Link-Local range (fe80::/10) from the same link of the address you are trying to ping Traffic to and from Link-Local addresses cannot leave the link (be routed). All IPv6 interfaces use the same Link-Local network, so you must use a Zone ID (host OS-specific) when using Link-Local addresses. For example, on a Windows PC, you would ping fe80::1%2 or something like ping fe80::1%eth0 on a Linux host.

I can't ping the gateway IP (fe80::1) from the internal port in my fortigate 60f firewall

That would be correct because you are trying to ping a Link-Local address from a different Link, and you cannot do that. You are also wanting your ISP to respond to a ULA addressed host, but the ISP should properly drop any packets with ULA addresses.

Still I can't ping the gateway (fe80::1). Why is that? Where have I made the mistake?

I explained why, and I have pointed out your mistakes. You will never be able to ping a Link-Local address from a different link, and your ISP would drop any ULA traffic, anyway.

Improve this answer
4
  • Thanks :) So theres no way I can ping the gateway in this scenario right?
    – Ecstasy Entertainment
    May 11, 2021 at 17:14
  • Not the way you want. You could ping the fe80::1 gateway address from the Fortigate interface connected on the same link (assuming the ISP has not disabled ICMP echo responses), but Link-Local addresses cannot be reached from a different link. Notice that the Fortigate and all other hosts on your LAN also use the same Link-Local network.
    – Ron Maupin ♦
    May 11, 2021 at 17:19
  • @EcstasyEntertainment, as I wrote in my comment to your Stack Overflow question, "Link-Local addresses are designed to be used for addressing on a single link for purposes such as automatic address configuration, neighbor discovery, or when no routers are present. Routers must not forward any packets with Link-Local source or destination addresses to other links."
    – Ron Maupin ♦
    May 11, 2021 at 17:20
  • 1
    Hey Thanks Ron. I was working on this for like 10days. Well you helped me to figure out that I was working on something which will never happen :) Thanks alot :)
    – Ecstasy Entertainment
    May 11, 2021 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.