Fortigate 6.0.1 IPv6 with Prefix Delegation

One of our techs had their first taste of IPv6 with a dual stack network at home. Of course this dual stack network ended at the edge device, the firewall, but their passion for IPv6 did not. After years of waiting SixXS started their tunnel broken service in 2000, shortly after Hurricane Electric starting their service tunnelbroker.net. Both of these service provided IPv6 through 6to4, by tunneling your IPv6 network through IPv4 to one of their PoP, point of presence, to connect to the IPv6 network.

Hurricane Electric is a backbone provider, with a direct connection to the Internet they provide a ::/56 to all of their tunnels with the ability to request a ::/48. They also provide global ISPs IPv6 Internet access through their tunnel brokering service, and without a direct peer any ISP can use the tunnel broker service to provide to their clients.

SixXS is backed by many public Internet exchanges, with PoPs globally dispersed. Using their service for 6to4, they are able to provide all tunnels with a ::/56 subnet also with the ability to request a ::/48. By using AYIYA if your router or firewall did not support 6to4 you could create a tunnel just for your workstation that would always dial in using a local agent. Unfortunately, with more and more ISPs providing native IPv6 the leaders of the SixXS project and decided to shut it down on June 30th of 2017. But, fear not, with more and more ISPs providing IPv6 connectivity you may already have the ability to connect to the IPv6 Internet!

The french ISP free worked at using IPv6 Rapid Deployment, or 6rd, to push IPv6 throughout their network. 6rd is built off of 6to4, but allowing the use of native IPv6 addresses instead of those prepended with 2002::. While some ISPs like Comcast and Swisscom have opted to use 6rd, others have went with native IPv6 for a true dual stack end-to-end. In both cases it is possible to use statefull, stateless and SLAAC for providing IPv6 addresses to the Internal infrastructure. The following hammer uses SLAAC in combination with Prefix Delegation on a Fortigate using 6.0.1 firmware. The scripting portion has been tested extensively in 5.4 and 5.6, with some differences in the GUI.

To enable IPv6 in the GUI

First we’ll start with telling the WAN port that it will be using prefix-delegation, the size of subnet to request, and length of request.

Next, the Internal interface, in this case is a software switch.

If you test IPv6 with ping you should now see IPv6 working on your WAN interface. Once prefix delegation is setup on the inside of the network, this will no longer work as the WAN interface will stop getting an IPv6 address.

Now that IPv6 is working, it is time to set some routes. As with our ISP the prefix delegation can come from many connections and may route our traffic internally depending on the PD we get, it would be safe to assume that all IPv6 should go out of this interface.

For SLAAC we still require the DHCPv6 service to hand out the prefix delegation to internal devices.

Last configuration change will be the policies. As we do not know the prefix delegation, and to minimize future administration tasks, we are going with the assumption that the delegation could change at any time so the policies are not limiting the address spaces that are allowed to communicate. As ICMPv6 is essential for IPv6 we are allowing ICMP to come back in as some packets come from the network unsolicited which would be stopped by the stateful firewall.

Now, if you perform some testing from any of your internal machines you should see that IPv6 is now working as intended.