Fortigate 6 DHCPv6-PD实验1
本文描述一个Fortigate 6 DHCPv6-PD实验。
DHCPv6-PD用于分发前缀。我只有FortiOS 6的设备，FortiOS 6官方已不再至此，于是我参照FortiOS 7 资料自己进行了一次FortiOS 6实验。
首先参考ForiOS 7的配置手册
https://handbook.fortinet.com.cn/IPv6/DHCPv6/DHCPv6-PD.html
以下实验基本都是参照上面的方案配置
上游路由器
下联接口
config system interface
edit "lan4"
set vdom "root"
set ip 10.0.3.1 255.255.255.0
set allowaccess ping https ssh http
set type physical
set device-identification enable
set lldp-transmission enable
set role lan
set snmp-index 7
config ipv6
set ip6-address 2100::1/64
set ip6-allowaccess ping https ssh http
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-other-flag enable
end
与7版相同
dhcpv6 server - 分发 2100:0:0:3::/64前缀和2100:0:0:4::/64前缀
config system dhcp6 server
edit 2
set subnet 2100::/60
set interface "lan4"
config prefix-range
edit 1
set start-prefix 2100:0:0:3::
set end-prefix 2100:0:0:4::
set prefix-length 64
next
end
config ip-range
edit 1
set start-ip 2100::2
set end-ip 2100::63
next
end
set dns-server1 2200::64
next
end
与7版相同
下游路由器
上联接口
config system interface
edit "wan1"
set vdom "root"
set mode dhcp
set allowaccess ping https ssh http fgfm
set type physical
set role wan
set snmp-index 2
config ipv6
set ip6-mode dhcp
set dhcp6-prefix-delegation enable
set dhcp6-prefix-hint 2100:0:0:3::/64
end
next
end
与7版不同
下联接口 - 接收 2100:0:0:3::/64前缀
config system interface
edit "internal"
set vdom "root"
set ip 192.168.1.99 255.255.255.0
set allowaccess ping https ssh http fgfm capwap
set type hard-switch
set stp enable
set role lan
set snmp-index 6
config ipv6
set ip6-mode delegated
set ip6-allowaccess ping https ssh http fgfm
set ip6-send-adv enable
set ip6-other-flag enable
set ip6-upstream-interface "wan1"
set ip6-subnet ::1/64
config ip6-delegated-prefix-list
edit 1
set upstream-interface "wan1"
set subnet ::/64
next
end
end
next
end
与7版不同
验证
上游路由器
执行
execute dhcp6 lease-list
得到
Interface DUID IAID IP/Prefix Expiry
lan4 00:03:00:01:08:5b:0e:7c:0f:e2 5 2100:0:0:3::/64 Wed Feb 28 21:05:29 2024
lan4 00:03:00:01:08:5b:0e:7c:0f:e2 5 2100::2 Wed Feb 28 21:05:29 2024
下游路由器
执行
diagnose ipv6 address list
显示
dev=18 devname=internal flag=P scope=0 prefix=64 addr=2100:0:0:3::1
dev=5 devname=wan1 flag=P scope=0 prefix=128 addr=2100::2
dev=5 devname=wan1 flag=P scope=253 prefix=10 addr=fe80::xx:xx:xx:xx
dev=18 devname=internal flag=P scope=253 prefix=10 addr=fe80::xx:xx:xx:xx
下游路由器 下联接口获取到 2100:0:0:3::1地址，说明获取前缀成功。
另以下命令可以看更多信息
config system interface
edit wan1
config ipv6
get
显示
ip6-mode : dhcp
nd-mode : basic
ip6-address : 2100::2/128
ip6-allowaccess :
ip6-reachable-time : 0
ip6-retrans-time : 0
ip6-hop-limit : 0
dhcp6-prefix-delegation: enable
delegated-prefix : 2100:0:0:3::/64
preferred-life-time : 604800
valid-life-time : 604800
delegated-DNS1 : 2200::64
delegated-DNS2 : ::
delegated-domain :
dhcp6-prefix-hint : 2100:0:0:3::/64
dhcp6-prefix-hint-plt: 604800
dhcp6-prefix-hint-vlt: 2592000
vrrp-virtual-mac6 : disable
vrip6_link_local : ::
vrrp6:
ip6-dns-server-override: enable
执行
config system interface
edit internal
config ipv6
get
显示
ip6-mode : delegated
nd-mode : basic
ip6-address : 2100:0:0:3::1/64
ip6-allowaccess : ping https ssh http fgfm
ip6-reachable-time : 0
ip6-retrans-time : 0
ip6-hop-limit : 0
dhcp6-prefix-delegation: disable
delegated-prefix : ::/0
preferred-life-time : 0
valid-life-time : 0
delegated-DNS1 : ::
delegated-DNS2 : ::
delegated-domain :
dhcp6-information-request: disable
ip6-send-adv : enable
ip6-manage-flag : disable
ip6-other-flag : enable
ip6-max-interval : 600
ip6-min-interval : 198
ip6-link-mtu : 0
ip6-default-life : 1800
ip6-upstream-interface: wan1
ip6-subnet : ::1/64
ip6-prefix-list:
ip6-delegated-prefix-list:
== [ 1 ]
prefix-id: 1 upstream-interface: wan1 autonomous-flag: disable onlink-flag: disable subnet: ::/64