Fortigate IPv6 over IPv4 VPN Tunnel

Configure FortiGate A interfaces

 

config system interface

edit port2

set 10.0.0.1/24

next

edit port3

config ipv6

set ip6-address fec0::0001:209:0fff:fe83:25f3/64

end

 

Configure FortiGate A IPsec settings

config vpn ipsec phase1-interface

edit toB

set interface port2

set remote-gw 10.0.1.1

set dpd enable

set psksecret maryhadalittlelamb

set proposal 3des-md5 3des-sha1

end

 

config vpn ipsec phase2-interface

edit toB2

set phase1name toB

set proposal 3des-md5 3des-sha1

set pfs enable

set replay enable

set src-addr-type subnet6

set dst-addr-type subnet6

end

 

Configure FortiGate A security policies

 

config firewall policy6

edit 1

set srcintf port3

set dstintf toB

set srcaddr all6

set dstaddr all6

set action accept

set service ANY

set schedule always

next

 

edit 2

set srcintf toB

set dstintf port3

set srcaddr all6

set dstaddr all6

set action accept

set service ANY

set schedule always

end

Configure FortiGate A routing

 

edit 1

set device toB

set dst fec0:0000:0000:0004::/64

end

config router static

edit 1

set device port2

set dst 0.0.0.0/0

set gateway 10.0.0.254

end

 

Configure FortiGate B

 

config system interface

edit port2

set 10.0.1.1/24

next

edit port3

config ipv6

set ip6-address fec0::0004:209:0fff:fe83:2569/64

end

config vpn ipsec phase1-interface

edit toA

set interface port2

set remote-gw 10.0.0.1

set dpd enable

set psksecret maryhadalittlelamb

set proposal 3des-md5 3des-sha1

end

config vpn ipsec phase2-interface

edit toA2

set phase1name toA

set proposal 3des-md5 3des-sha1

set pfs enable

set replay enable

set src-addr-type subnet6

set dst-addr-type subnet6

end

config firewall policy6

edit 1

set srcintf port3

set dstintf toA

set srcaddr all6

set dstaddr all6

set action accept

set service ANY

set schedule always

next

edit 2

set srcintf toA

set dstintf port3

set srcaddr all6

set dstaddr all6

set action accept

set service ANY

set schedule always

end

config router static6

edit 1

set device toA

set dst fec0:0000:0000:0000::/64

end

config router static

edit 1

set device port2

set gateway 10.0.1.254

end