Monday, July 20, 2015

Fortigate and SLACC

Somebody ask me to look into if a fortigate has any issues with  autconf and ipv6. So i did  a quick test on a FGT60D and 5.2.3.



What I found was very interesting &  if you have multiple advertised prefixes. Most devices like windows or macosx will install multiple prefixes for a interface,  but there's a hardlimit of 12 or so prefixes and the same applies on the  fortigate.

1st here's my  interface configuration;


Now here's the  ipv6 configuration for sending our prefixes;

config system interface
    edit "internal2"
        set vdom "custB"
        set ip 10.200.10.1 255.255.255.0
        set allowaccess ping https ssh
        set vlanforward enable
        set type physical
        set alias "internal2-interface"
        set snmp-index 9
            config ipv6
                set ip6-allowaccess ping https ssh
                set ip6-address 2001:db8:2::/64
                set ip6-send-adv enable
                set ip6-manage-flag enable
                set ip6-other-flag enable
                    config ip6-prefix-list
                        edit 2001:db8:2::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:288::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:289::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:290::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:291::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:292::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:293::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:294::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:295::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:296::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:297::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:298::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:299::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:190::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:191::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:192::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:193::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:194::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:195::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:196::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:197::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:198::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:199::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:130::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:131::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:132::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:133::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:134::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:135::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:136::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:137::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                        edit 2001:db8:138::/64
                            set autonomous-flag enable
                            set onlink-flag enable
                        next
                    end
            end
    next
end


And here's what our  autoconf   enabled interface shows;

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
       o 
      /  \

No comments:

Post a Comment