Somebody ask me to look into if a fortigate has any issues with autconf and ipv6. So i did a quick test on a FGT60D and 5.2.3.
What I found was very interesting & if you have multiple advertised prefixes. Most devices like windows or macosx will install multiple prefixes for a interface, but there's a hardlimit of 12 or so prefixes and the same applies on the fortigate.
1st here's my interface configuration;
Now here's the ipv6 configuration for sending our prefixes;
config system interface
edit "internal2"
set vdom "custB"
set ip 10.200.10.1 255.255.255.0
set allowaccess ping https ssh
set vlanforward enable
set type physical
set alias "internal2-interface"
set snmp-index 9
config ipv6
set ip6-allowaccess ping https ssh
set ip6-address 2001:db8:2::/64
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-other-flag enable
config ip6-prefix-list
edit 2001:db8:2::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:288::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:289::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:290::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:291::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:292::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:293::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:294::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:295::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:296::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:297::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:298::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:299::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:190::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:191::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:192::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:193::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:194::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:195::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:196::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:197::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:198::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:199::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:130::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:131::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:132::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:133::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:134::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:135::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:136::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:137::/64
set autonomous-flag enable
set onlink-flag enable
next
edit 2001:db8:138::/64
set autonomous-flag enable
set onlink-flag enable
next
end
end
next
end
And here's what our autoconf enabled interface shows;
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
No comments:
Post a Comment