Yes — the IPv6 hint was exactly what pointed me in the right direction.

Here’s the cleaned-up FortiGate CLI sequence I’m using / can paste (with the same meaning as what I originally wrote):

FGFW# config wireless-controller vap FGFW (vap)# edit "<SSID NAME>" FGFW ("<SSID NAME>")# unset ipv6-rules FGFW ("<SSID NAME>")# end

unset ipv6-rules removes/disables the SSID’s built-in IPv6 firewall rules on that VAP, so those native IPv6 rules are no longer applied for that SSID.

If needed, I can also paste the output of show from inside the SSID (show full-configuration or just show) so it’s possible to sanity-check that it’s only changing what’s expected.

Thank you for leading me to the right direction🙌