SLAAC with DHCPv6 stateless server

Using Stateless Address Auto Configuration (SLAAC) with a stateless DHCPv6 server provides a solution for obtaining other host configurations, such as DNS server addresses, while retaining the auto-configuration aspect of SLAAC. This approach also provides failover protection in the event that the DHCPv6 server fails. In addition to obtaining host configurations through the stateless DHCPv6 server, interfaces can also obtain gateway information through Router Advertisements (RAs). This allows for a robust and flexible IPv6 network configuration.

In this example, the Enterprise Core FortiGate is connected to the First Floor FortiGate. The Enterprise Core FortiGate has both SLAAC and stateless DHCPv6 server enabled. This allows the First Floor FortiGate to automatically obtain an IPv6 address using the Auto configure IPv6 address option and to acquire a DNS server address using the dhcp6-information-request option.

To enable IPv6 auto-configuration with DHCPv6 stateless server in the GUI:

1. Configure SLAAC on the Enterprise Core FortiGate:

   1. Go to Network > Interfaces and edit port5.

   2. Configure the following settings:

      IPv6 addressing mode	Manual
      IPv6 Address/Prefix	2001:db8:d0c:1::1/64
      Stateless Address Auto-configuration (SLAAC)	Enable
      IPv6 prefix list	Enable
      IPv6 prefix	2001:db8:d0c:1::/64

   3. Click OK.

   4. Input the following commands from the CLI:

      config system interface
          edit "port5"
              config ipv6
                  set ip6-other-flag enable
              end
          next
      end
      

2. Configure DHCPv6 stateless server on the Enterprise Core FortiGate:

   1. Go to Network > Interfaces and edit port5.

   2. Configure the following settings:

      DHCPv6 Server	Enable
      DNS service	Same as System DNS
      Stateful server	Disable

   3. Click OK.

3. Configure the First Floor FortiGate to automatically obtain an IPv6 address and DNS server address from the DHCPv6 server:

   1. Go to Network > Interfaces and edit port5.

   2. Enable Auto configure IPv6 address. The First Floor FortiGate uses the prefix obtained from the Enterprise Core FortiGate interface to automatically generate an IPv6 address.

   3. Input the following commands from the CLI:

      config system interface
          edit "port5"
              config ipv6
                  set dhcp6-information-request enable
              end
          next
      end
      

   4. Click OK.

4. Verify that the First Floor FortiGate automatically generated an IPv6 address and obtained the DNS server address from the DHCPv6 server:

   1. Go to Network > Interfaces and edit port5. The IPv6 Address/Prefix field is populated with an IPv6 address

   2. Use the below CLI command to verify the DNS server address:

      #dia test application dnsproxy 3
      worker idx: 0
      VDOM: root, index=0, is primary, vdom dns is enabled, pip-0.0.0.0 dns_log=1
      dns64 is disabled
      DNS servers:
      2001:db8:d0c:1::1:53 vrf=0 tz=0 encrypt=none req=1 to=1 res=0 rt=0 ready=1 timer=0 probe=0 failure=1 last_failed=46738
      ...
      
      

To enable IPv6 auto-configuration with DHCPv6 stateless server in the CLI:

1. Configure SLAAC on the Enterprise Core FortiGate:

   config system interface
       edit "port5"
           config ipv6
               set ip6-address 2001:db8:d0c:1::1/64
               set ip6-send-adv enable 
               set ip6-other-flag enable
               config ip6-prefix-list
                   edit 2001:db8:d0c:1::/64
               next
           end
       next
   end
   

2. Configure DHCPv6 stateless server on the Enterprise Core FortiGate:

   config system dhcp6 server
       edit 1
           set dns-service default
           set interface "port5"
       next
   end
   

3. Configure the First Floor FortiGate to obtain an IPv6 address automatically:

   config system interface
       edit "port5"
           config ipv6
               set autoconf enable
               set dhcp6-information-request enable
           end
       next
   end
   

4. Verify that the First Floor FortiGate automatically generated an IPv6 address and obtained the DNS server address from the DHCPv6 server:

   # diagnose ipv6 address list | grep port5
   dev=4 devname=port5 flag= scope=0 prefix=64 addr=2001:db8:d0c:1:20c:29ff:fe4d:f83d preferred=604681 valid=2591881 cstamp=1675487 tstamp=1772919
   # dia test application dnsproxy 3
   worker idx: 0
   VDOM: root, index=0, is primary, vdom dns is enabled, pip-0.0.0.0 dns_log=1
   dns64 is disabled
   DNS servers:
   2001:db8:d0c:1::1:53 vrf=0 tz=0 encrypt=none req=1 to=1 res=0 rt=0 ready=1 timer=0 probe=0 failure=1 last_failed=46738
   …