Looks a lot like only standard static proto-41 tunnels. You then of course have the option to run an AICCU/heartbeat client on a host behind the Fortigate and only let that client send out the heartbeats. But as you are behind a NAT you would require protocol-forwarding (typically dubbed DMZ mode) to make this work. If you have no control over the NAT then your only real way is AYIYA. As the NAT is controlled by someone else though it is likely their network and you should ask them if you are allowed to make a tunnel. As a side-note, running a firewall box behind a NAT is not extremely useful IMHO ;)

It's using a standard SIT tunnel if you configure the Fortigate. I have it working with Hurricane Electric and it's the exact same thing with Sixxs. Right now, I downloaded the AICCU client for Linux and have it running behind my firewall. Once I have enough credits, I'll move the tunnel to a static one and create new SIT tunnel. You don't really need to fool around with NAT. When you create the SIT tunnel, it will appear as a new network interface and you can then route IPv6 traffic through that interface as your default gateway. The only thing stopping me from doing it right now is I don't have enough credits to create a static tunnel. Once I do, I'll be using the Fortigate as the endpoint.