有没有懂 Fortigate 防火墙 IPV6 配置的大佬帮忙看看

防火墙型号是 100F ，WAN1 口接联通光猫（ FTTR 拨号模式） IPV6 配置如下：
Firewall (wan1) # config ipv6

Firewall (ipv6) # show
config ipv6
set ip6-mode dhcp
set ip6-allowaccess ping
set dhcp6-prefix-delegation enable
config dhcp6-iapd-list
edit 1
set prefix-hint 2408:8256:5682:e011::/64
next
end
end
配置为 DHCP ，已经成功获取到 IP 地址 2408:8256:5682:e011:3ac0:eaff:feea:1111/128
光猫上看到的获取前缀是 2408:8256:5682:e011::/64
防火墙 LAN 口类型是 VLAN 交换，多个接口成员。
IPV6 配置如下：
Firewall (lan) # config ipv6

Firewall (ipv6) # show
config ipv6
set ip6-mode delegated
set ip6-allowaccess ping
set ip6-send-adv enable
set ip6-other-flag enable
set ip6-delegated-prefix-iaid 1
set ip6-upstream-interface "wan1"
set ip6-subnet ::1/64
config ip6-prefix-list
edit 2408:8256:5682:e011::/64
next
end
end

现在的问题是 lan 口死活获取不到公网 IPV6 地址
irewall # diagnose ipv6 address list | grep lan
dev=41 devname=lan flag=P scope=253 prefix=64 addr=fe80::3ac0:eaff:feea:37c4 preferred=4294967295 valid=4294967295 cstamp=77496481 tstamp=77496481 dev=41 devname=lan flag=P scope=253 prefix=64 addr=fe80::3ac0:eaff:feea:37c2 preferred=4294967295 valid=4294967295 cstamp=5896116 tstamp=5896116

在勾选 LAN 口的 SLAAC 之后，电脑可以获取 IPV6 地址，但是不能访问 IPV6 网站，PING 不通 wan1 口的 IPV6 地址。配置 DHCPV6 自定义 DNS ，也获取不到 IPV6 DNS 地址。

防火墙配置了 IPV6 的策略：
Firewall (3) # show
config firewall policy
edit 3
set name "to_IPv6_Intelnet"
set uuid 0c868e96-545d-51ef-70c8-44665ed87830
set srcintf "lan"
set dstintf "to_Interenet"
set action accept
set srcaddr6 "all"
set dstaddr6 "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection" set av-profile "default" set ips-sensor "default" next end

大佬们可有看是哪里的问题吗
教程参考的是这个： https://handbook.fortinet.com.cn/IPv6/DHCPv6/DHCPv6-PD.html

simplove

43 天前

@life90 思路很清晰，防火墙可以通过 IPV6 访问其它地址
execute ping6 www.qq.com
PING www.qq.com(2408:8756:f50:2::65) 56 data bytes
64 bytes from 2408:8756:f50:2::65: icmp_seq=1 ttl=54 time=5.09 ms
64 bytes from 2408:8756:f50:2::65: icmp_seq=2 ttl=54 time=5.41 ms
64 bytes from 2408:8756:f50:2::65: icmp_seq=3 ttl=54 time=5.25 ms

我验证了下，电脑获取的地址确实是防火墙分配的
发了工单，等明天官方来看看吧。
谢谢

diskerjtr

43 天前

WAN

config system interface
edit "wan1"
config ipv6
set ip6-mode pppoe
set ip6-allowaccess ping
set dhcp6-prefix-delegation enable
set dhcp6-prefix-hint ::/60
set autoconf enable
end
next
end

LAN

config system interface
edit "internal"
config ipv6
set ip6-mode delegated
set ip6-allowaccess ping
set ip6-send-adv enable
set ip6-manage-flag enable
set ip6-upstream-interface "wan1"
set ip6-subnet ::1/64
set ip6-other-flag enable
config ip6-delegated-prefix-list
edit 1
set upstream-interface "wan1"
set autonomous-flag enable
set onlink-flag enable
set subnet ::/64
next
end
end
next
end