Sophos XG behind Cable Fritzbox 6490 and IPV6

Mario,

did you create the proper Firewall rule from LAN to WAN? Is the pc obtaining an IP form XG or did you setup a static IP?

Thanks

Hi thanks for your quick reply.

I get an ip over dhcp for ipv4 and for ipv6 but in windows it show me no internet connection for ipv6. Ipv4 works.

I tried static dns at pc but it doesnt helped.

I need a step by step config fir ipv6 please.

Thanks

If i enable dhcp ipv6 on lan interface only i can not ping google.de from sophos webinterface. i have to enable it at wan, too.

ping from sophos is ok ipv4/6.

ipv6 rule added with any services.

lan zone is correct configured for dns, ping6, everything is enabled.

but still no connection at pc.

i get a dual stack lite tunnel from my isp.

What are the IPv6 address ranges on WAN and LAN side of the Sophos?
On the Fritzbox, a static route for LAN range , pointing to Sophos WAN IP is required

do you have ipv6 running at sophos xg?

prefix 2a02:908:xxx:780::/59

i did it static at wan and lan. i have a ds lite tunnel. maybe thats the problem..sophis can ping google via ipv6 but my pc has bo ipv6 connection.

ipv4 works.

You can't have the same /64 on both interfaces, that's never going to work.  Same rules apply as in IPv4, use a different /64.

Or, use the XG in bridge mode.  I use it that way and works fine for v4 and v6.

could you post some screenshots of your config?

DavidWilliams1 wrote:   "Same rules apply as in IPv4"
Big change, there's no NAT!  This requires full routing, so fritzbox requires a route to your LAN.

could you post an example please. i am stuck with this for 4 days ;(

Mario Ostwald said:

could you post some screenshots of your config?

 

Mario Ostwald said:

could you post some screenshots of your config?

 

got it working in bridge mode..

why is gateway not working?

any disadvantages in bridge mode?

Mario Ostwald said:

why is gateway not working?

I suspect there is something wrong on how you sliced the /59.   In some of the screenshots, I see :780: on both WAN an LAN.  If you were to try it again, I would suggest going to an online IPv6 subnet calculator and put in your /59 and double check that you are using unique /64's on the WAN and LAN ... with the appropriate default route and route back from Fritz.

Mario Ostwald said:

any disadvantages in bridge mode?

See here:  bridge-mode-limitations

Glad it's working!!!

Now its working thank you for all people here!

Short summary:

- enable ipv6 over dhcp at wan interface, DHCP Rapid Commit on

- wait for the prefix under inferfaces

- take this prefix and subnet it for lan interface (static at lan)

- wan link manager shows green status

- add router advertisement for your new prefix on lan interface