You’d think this would be an easy thing where perhaps a FortiGate unit would behave like a layer 3 switch; add an IPv6 address, it starts sending router advertisements. Nope. If it were just slightly more simple than I had hoped, this article would not have been warranted, but it wasn’t that simple.
So I want to enable IPv6 on a subnet that the FortiGate is acting as the router for. I add an address in the GUI. Anything exciting happen? Nope. Machines don’t seem to know it’s there, so I run tcpdump to look for router advertisements:
tcpdump -vvvv -ttt icmp6 and ‘ip6 = 134’
No RA’s being seen. Hmm okay, go back to FortiGate; nothing in GUI related to router advertisements; odd.
I ssh in and drill down to interface level:
config system interface edit "internal1" config ipv6 fw (ipv6) # set ? ip6-mode Addressing mode (static, DHCP, delegated). ip6-address Primary IPv6 address prefix of interface. ip6-allowaccess Allow management access to the interface. ip6-send-adv Enable/disable send advertisements flag. ip6-manage-flag Enable/disable managed flag. ip6-other-flag Enable/disable other flag. ip6-max-interval Maximum interval (sec; between 4 to 1800). ip6-min-interval Minimum interval (sec; between 3 to 1350). ip6-link-mtu Link MTU. ip6-reachable-time Reachable time (milliseconds; 0 means unspecified). ip6-retrans-time Retransmit time (milliseconds; 0 means unspecified). ip6-default-life Default life (sec). ip6-hop-limit Hop limit (0 means unspecified). dhcp6-relay-service Enable/disable use DHCPv6 relay service. dhcp6-prefix-delegation Enable/disable DHCPv6 prefix delegation.
Oooh, ip6-send-adv looks interesting, I turn it on. Nothing happens. I see some reference on FortiGate’s website in an article related to setting up DHCPv6 that the interface needs to be bounced, so I do that. Nothing happens.
Turns out you need a few more items. You also need ip6-other-flag enabled at the ipv6 level, and I can’t find any docs on what that actually does. Then you need to define the subnet you’re on by way of the ip6-prefix-list, then, within the relevant prefixes, turn on autonomous-flag and onlink-flag under it. Your config will look like this:
config system interface edit "internal1" set ip 192.0.2.1 255.255.255.0 set allowaccess ping https ssh config ipv6 set ip6 allowaccess ping https ssh set ip6-address 2001:db8:0:1::1/64 set ip6-send-adv enable set ip6-other-flag enable config ip6-prefix-list edit 2001:db8:0:1::/64 set autonomous-flag enable set onlink-flag enable next end end next end
Once that’s added, you should start sending RA’s so your devices can see the FortiGate and use SLAAC to add an IPv6 address.