SLAAC with DHCPv6 stateless server

Using Stateless Address Auto Configuration (SLAAC) with a stateless DHCPv6 server provides a solution for obtaining other host configurations, such as DNS server addresses, while retaining the auto-configuration aspect of SLAAC. This approach also provides failover protection in the event that the DHCPv6 server fails. In addition to obtaining host configurations through the stateless DHCPv6 server, interfaces can also obtain gateway information through Router Advertisements (RAs). This allows for a robust and flexible IPv6 network configuration.

In this example, the Enterprise Core FortiGate is connected to the First Floor FortiGate. The Enterprise Core FortiGate has both SLAAC and stateless DHCPv6 server enabled. This allows the First Floor FortiGate to automatically obtain an IPv6 address using the autoconf option and to acquire a DNS server address using the dhcp6-information-request option.

To enable IPv6 auto-configuration with a DHCPv6 stateless server:

1. Configure SLAAC on the Enterprise Core FortiGate:

   config system interface
       edit "port5"
           config ipv6
               set ip6-address 2001:db8:d0c:1::1/64
               set ip6-send-adv enable 
               set ip6-other-flag enable
               config ip6-prefix-list
                   edit 2001:db8:d0c:1::/64
               next
           end
       next
   end
   

2. Configure DHCPv6 stateless server on the Enterprise Core FortiGate:

   config system dhcp6 server
       edit 1
           set dns-service default
           set interface "port5"
       next
   end
   

3. Configure the First Floor FortiGate to obtain an IPv6 address automatically:

   config system interface
       edit "port5"
           config ipv6
               set autoconf enable
               set dhcp6-information-request enable
           end
       next
   end
   

4. Verify that the First Floor FortiGate automatically generated an IPv6 address and obtained the DNS server address from the DHCPv6 server:

   # diagnose ipv6 address list | grep port5
   dev=4 devname=port5 flag= scope=0 prefix=64 addr=2001:db8:d0c:1:20c:29ff:fe4d:f83d preferred=604681 valid=2591881 cstamp=1675487 tstamp=1772919
   # dia test application dnsproxy 3
   worker idx: 0
   VDOM: root, index=0, is primary, vdom dns is enabled, pip-0.0.0.0 dns_log=1
   dns64 is disabled
   DNS servers:
   2001:db8:d0c:1::1:53 vrf=0 tz=0 encrypt=none req=1 to=1 res=0 rt=0 ready=1 timer=0 probe=0 failure=1 last_failed=46738
   …