Multiple IPv6 addresses on LAN interface

Hi yes you can do that, I don't know how you could  deploy autoconf if you want a client to  take one prefixes over the other.
 
In your case, you need to  set the prefixes to be advertise
 
 
e.g
 
 
            config ip6-prefix-list
                        edit 2001:db8:1::/64
                            set autonomous-flag enable
                            set preferred-life-time 600
                            set valid-life-time 600
                        next
                      edit 2001:db8:2::/64
                            set autonomous-flag enable
                            set preferred-life-time 600
                            set valid-life-time 600
                        next
                        edit 2001:db8:3::/64
                            set autonomous-flag enable
                            set preferred-life-time 600
                            set valid-life-time 600
                        next
           end
 
http://socpuppet.blogspot.com/2015/08/just-how-many-ipv6-prefixes-can-be.html
 
 
Also for this;
 

 
Or where can i look else to check why i can't ping the LAN interface with this specific secondary address

 
 
try any all of the below
 
cli-cmd
 
diag debug flow filter6
diag sniffer packet <interfacename> icmp6
 

I don't get it... For a moment all was fine, WAN1 has the delegated prefix from the provider and i was able to access the internet. WAN2 has his delegated prefix too and i was also able to access the internet with a client in this network.
 
But now the delegated prefix from WAN1 changed to the prefix which is for WAN2.
 
How can this be?
 
I have only 2 firewall policy's for outgoing:
 
In Interface: LAN
Out Interface: WAN1
Source: Prefix WAN1
Destination: all
 
In Interface: LAN
Out Interface: WAN2
Source: Prefix WAN2
Destination: all
 
Now i removed at both "ALL_ICMP6". And i had ping enabled on the WAN interface, this i disabled too.
 
After disabling the WAN1 for a moment and enabling it again i got the correct prefix again.
 
Lets see how long the config is now stable...
 
Why WAN1 get the delegated prefix infos from WAN2? There is no connection between them...
 
Can i disable the prefix delegation and configure the prefix static?
 
Kind regards
Stefan

Hmmm... IPv6 seems to be under construction...
 
As i told, after a reboot i was able to use all IP addresses...
 
I wrote i removed the ALL_ICMP6 from the policy but let PING inside it. But i can't ping external sites. So the PING don't work for IPv6. In the Forward Traffic log i see that PING6 is blocked, but PING6 i can't select in the firewall policy... In the services list i saw, it is per default exluded from the list, not helpful...
 
And when i add the ALL_ICMP6 again i got problems with the wrong prefix again.
 
I will stop testing for today...
 
At the moment i rebootet and have a working outfoing IPv6 config... Let's see if this is stable now...

What's your  assignments for WAN1/WAN2 address?  Losing a cfg tells me these are "dynamic SLAAC enabled " ?
 
Ken

o.k. i removed all prefix automatics from the wan interfaces.
 
Both wan interfaces got an ip via dhcp.
 
When i enter (heise.de):
 
exec ping6 -I wan1 2a02:2e0:3fe:1001:7777:772e:2:85
 
or
 
exec ping6 -I wan2 2a02:2e0:3fe:1001:7777:772e:2:85
 
this works...
 
And i can ping any server on his static IPv6 ip address with:
 
exec ping6 2a02:xxxx:xxxx:5b00::22
 
or the 2nd prefix:
 
exec ping6 2a02:xxxx:xxxx:5500::18
 
But what must i configure that i can access the internet from the internal lan?
For IPv4 i must create a static route to the wan interface with the gateway address of the provider.
 
In the IPv6 routing table i have no default route, but i don't know the ip of the provider for the next hop to create a manual route.
 
When i enable the prefix delegation, the traffic goes automatically from lan to wan, but the prefix delegation is very unstable so i want to configure this static.
 
So what is missing to route from lan to wan? A route? Or something else?
 
A hint will be great.
 
Kind regards
Stefan

I'm using one of the both prefix for auto delegating in the lan, like you wrote in your first post.
 
But for my servers i disabled that and set a fixed IPv6.
 
For the two prefixes i made two policy routes:
 
source prefix1 -> wan1
source prefix2 -> wan2
 
And i have 2 Firewall policy's:
 
incoming lan / source prefix1 / outgoing wan1 / destination all / Protocols PING6,HTTP,HTTPS etc.
incoming lan / source prefix2 / outgoing wan2 / destination all / Protocols PING6,HTTP,HTTPS etc. 
 
When i had enabled the prefix delegation on both wan interfaces this worked.
 
Is it possible that the FG can't handle 2 wan side autodelegated prefixes? Why is the prefix for WAN2 active on WAN1?
 
Because this problems i disabled the autodelegation on WAN side and want to configure this static.
 
But how to configure the outgoing route, i think this is the part what is missing...
 
With that enabled:
 
diag debug flow filter6 addr 2a02:2e0:3fe:1001:7777:772e:2:85
 
i will get when pinging from a server in the lan the above IP:
 
id=20085 trace_id=1149 func=resolve_ip6_tuple_fast line=4018 msg="vd-root:0 received a packet(proto=58, 2a02:xxxx:xxxx:5500::18:1->2a02:2e0:3fe:1001:7777:772e:2:85:128) from lan."
id=20085 trace_id=1149 func=resolve_ip6_tuple_fast line=4054 msg="Find an existing session, id-0000485a, original direction"
id=20085 trace_id=1149 func=ipv6_fast_cb line=58 msg="enter fast path"
 
This will repeat for every ping...
 
And the routing table shows like that:
 
C       ::1/128 via ::, root, 1d10h38m
C       2a02:xxxx:xxxx:5500::/64 via ::, lan, 1d10h38m
C       2a02:xxxx:xxxx:5b00::/64 via ::, lan, 1d10h38m
C       2a02:xxxx:xxxx:98:5c:f52e:b993:f829/128 via ::, wan1, 11:21:21
C       2a02:xxxx:xxxx:98:6543:28b4:9fdc:dc1/128 via ::, wan2, 10:49:55
S       fd24:7ed4:3bd5:88::/64 [10/0] via fd24:7ed4:3bd5:99::1, lan, 1d10h38m
C       fd24:7ed4:3bd5:99::/64 via ::, lan, 1d10h38m
C       fe80::/64 via ::, wan2, 1d10h00m
K       ff00::/8 via ::, wan2, 1d10h01m
 
The IPv6 addresses for WAN1 and WAN2 are dynamic...
 
Gegards
Stefan
 

??? I wrote:
 
"I'm using one of the both prefix for auto delegating in the lan, like you wrote in your first post."
 
Shure 2 prefixes via auto delegation in the same lan will be problematic...
 
Support i must try, this is a old 100D with expired support i use here in my home office to replace a LANCOM 1781EF+, learning by playing with it.  Not my main competence, but many customers have that and i want to know that products better...
 
But perhaps as a partner and if this can be a bug, perhaps they take a look to it. I will ask our security specialist. (But he has no experience with IPv6.)
 
Thanks!
Stefan

Hello Ken,
 
this is almost exact what i configured before, i had WAN1 and WAN2 configured for auto delegation, so i got my prefix from the ISP:

config ipv6
      set ip6-mode dhcp
      set dhcp6-prefix-delegation enable
      set dhcp6-prefix-hint 2a02:xxxx:xxxx:5b00::/64
end

Then i configured the LAN interface to use the delegated prefix from WAN1, like you wrote above.
 
Yes this works, sometimes...
 
But sometimes the delegated prefix i got from the ISP on WAN1 changes to the prefix which is on WAN2, so the internet access stops working.
 
So i think, if the both WAN interfaces are not stable with the prefix, so i don't need to configure the LAN side.
 
Because this i was thinking about to configure this static.
 
At the moment i'm thinking about to configure only one WAN interface for IPv6, on the second i disable it completely. If this works a few days, i can enable it on WAN2 again. When i got again the problems with the prefix it mus be a BUG...
 
Regards
Stefan

So this is my current config with one WAN working:
 

config system interface
    edit "wan1"
        set vdom "root"
        set mode dhcp
        set allowaccess ping
        set type physical
        set estimated-upstream-bandwidth 400000
        set estimated-downstream-bandwidth 25000
        set role wan
        set snmp-index 1
        config ipv6
            set ip6-mode dhcp
            set dhcp6-prefix-delegation enable
            set dhcp6-prefix-hint 2a02:xxxx:xxxx:5b00::/64
        end
        set defaultgw disable
    next
    edit "wan2"
        set vdom "root"
        set mode dhcp
        set allowaccess ping
        set type physical
        set estimated-upstream-bandwidth 400000
        set estimated-downstream-bandwidth 25000
        set role wan
        set snmp-index 5
        config ipv6
        end
        set defaultgw disable
    next
    edit "lan"
        set vdom "root"
        set ip 192.168.99.250 255.255.255.0
        set allowaccess ping https ssh
        set type hard-switch
        set stp enable
        set role lan
        set snmp-index 9
        set secondary-IP enable
        config ipv6
            set ip6-address fd24:xxxx:xxxx:99::250/64
            set ip6-allowaccess ping https ssh
            set dhcp6-prefix-delegation enable
            config ip6-extra-addr
                edit 2a02:xxxx:xxxx:5b00::250/64
                next
                edit 2a02:xxxx:xxxx:5500::250/64
                next
            end
            set ip6-send-adv enable
            config ip6-delegated-prefix-list
                edit 1
                    set upstream-interface "wan1"
                    set autonomous-flag enable
                    set onlink-flag enable
                    set subnet ::/64
                next
            end
        end
    next
end
config router policy6
    edit 1
        set input-device "lan"
        set src 2a02:xxxx:xxxx:5b00::/64
        set output-device "wan1"
        set comments "IPv6 - 5b00 -> WAN1"
    next
    edit 2
        set input-device "lan"
        set src 2a02:xxxx:xxxx:5500::/64
        set output-device "wan2"
        set comments "IPv6 - 5500 -> WAN2"
    next
end

 
My Servers with fixed IP are able to communicate with the internet and my MAC Book gets a IP via autoconfig and goes into internet too.
 
Now i will test and see if this config is stable.

Don't think so but open a case. When you  enable wan2, the traffic is probably going to go out WAN2, unless you do some PBR6 routing.
 
you could do some   PBR6 rules
 
e.g
 
src prefixes from ISP1 go out WAN1
src prefixes from ISP2 go out WAN2
 
And see if that fixes the issues. I have a hunch dual PREFIXESdelegation is not  supported in a  FGT
 
 
Ken