IPv6 in FortiOS

> Chapter 9 - Firewall > Firewall concepts > IPv6 > IPv6 in FortiOS

IPv6 in FortiOS

From an administrative point of view IPv6 works almost the same as IPv4 in FortiOS. The primary difference is the use IPv6 format for addresses. There is also no need for NAT if the FortiGate firewall is the interface between IPv6 networks. If the subnets attached to the FortiGate firewall are IPv6 and IPv4 NAT can be configured between the 2 different formats. This will involve either configuring a dual stack routing or IPv4 tunneling configuration. The reason for this is simple. NAT was developed primarily for the purpose of extending the number of usable IPv4 addresses. IPv6’s addressing allows for enough available addresses so the NAT is no longer necessary.

When configuring IPv6 in FortiOS, you can create a dual stack route or IPv4-IPv6 tunnel. A dual stack routing configuration implements dual IP layers, supporting both IPv4 and IPv6, in both hosts and routers. An IPv4-IPv6 tunnel is essentially similar, creating a tunnel that encapsulates IPv6 packets within IPv4 headers that carry these IPv6 packets over IPv4 tunnels. The FortiGate unit can also be easily integrated into an IPv6 network. Connecting the FortiGate unit to an IPv6 network is exactly the same as connecting it to an IPv4 network, the only difference is that you are using IPv6 addresses.

By default the IPv6 settings are not displayed in the Web-based Manager. It is just a matter of enabling the display of these feature to use them through the web interface. To enable them just go to System > Admin > Settings and select IPv6 Support on GUI. Once enabled, you will be able to use IPv6 addresses as well as the IPv4 addressing for the following FortiGate firewall features:

Static routing
Policy Routing
Packet and network sniffing
Dynamic routing (RIPv6, BGP4+, and OSPFv3)
IPsec VPN
DNS
DHCP
SSL VPN
Network interface addressing
Security Profiles protection
Routing access lists and prefix lists
NAT/Route and Transparent mode
NAT 64 and NAT 66
IPv6 tunnel over IPv4 and IPv4 tunnel over IPv6
Logging and reporting
Security policies
SNMP
Authentication
Virtual IPs and groups
IPv6 over SCTP
IPv6-specific troubleshooting, such as ping6