Octet

Configure a dual-stack router LAN and WAN

Cisco IOSCore

Tasks

  1. Enable IPv6 routing on R1.
  2. Configure both address families on the LAN interface with an easy-to-read link-local address.
  3. Configure both address families on the WAN interface and stop R1 from sending RAs toward the ISP.
  4. Add an IPv4 and an IPv6 default route to ISP1.
  5. Verify the interfaces, the routes, and that PC1 has a global IPv6 address and a default route.

Solution

  1. 1Turn on IPv6 routingR1
    R1 on Cisco IOS
    ipv6 unicast-routing

    Without it IOS acts as an IPv6 host. It will not forward IPv6 or send Router Advertisements.

  2. 2Dual-stack LANR1
    R1 on Cisco IOS
    interface GigabitEthernet0/0/0
 description LAN users
 ip address 10.10.10.1 255.255.255.0
 ipv6 address fe80::1 link-local
 ipv6 address 2001:db8:acad:10::1/64
 no shutdown

    With routing on, the /64 is advertised in RAs with the A flag set, so hosts use SLAAC. Hosts see fe80::1 as their default gateway.

  3. 3Dual-stack WANR1
    R1 on Cisco IOS
    interface GigabitEthernet0/0/1
 description WAN to ISP1
 ip address 203.0.113.2 255.255.255.252
 ipv6 address 2001:db8:ffff:1::1/127
 ipv6 nd ra suppress all
 no shutdown

    A /127 on the link follows RFC 6164. ipv6 nd ra suppress all stops periodic and solicited RAs on this interface. The WAN link-local is left to EUI-64.

  4. 4Default routesR1
    R1 on Cisco IOS
    ip route 0.0.0.0 0.0.0.0 203.0.113.1
ipv6 route ::/0 2001:db8:ffff:1::

    The IPv6 next hop is ISP1's global address on the /127, so no exit interface is needed.

Verify

R1 output
R1# show ipv6 interface brief
GigabitEthernet0/0/0   [up/up]
    FE80::1
    2001:DB8:ACAD:10::1
GigabitEthernet0/0/1   [up/up]
    FE80::A2B4:3CFF:FE11:A02
    2001:DB8:FFFF:1::1

Both interfaces up/up, each with a link-local and a global address.

R1 output
R1# show ipv6 interface GigabitEthernet0/0/0
GigabitEthernet0/0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:ACAD:10::1, subnet is 2001:DB8:ACAD:10::/64
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:1
  MTU is 1500 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds (using 30000)
  ND advertised reachable time is 0 (unspecified)
  ND advertised retransmit interval is 0 (unspecified)
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  ND advertised default router preference is Medium
  Hosts use stateless autoconfig for addresses.

FF02::2 shows routing is on. Only one solicited-node group appears because FE80::1 and 2001:DB8:ACAD:10::1 share the last 24 bits. RAs are being sent and hosts are told to use SLAAC.

R1 output
R1# show ipv6 route ::/0
Routing entry for ::/0
  Known via "static", distance 1, metric 0
  Route count is 1/1, share count 0
  Routing paths:
    2001:DB8:FFFF:1::
      Last updated 00:03:12 ago

The IPv6 default route is installed toward ISP1.

PC1 output
PC1# ip -6 addr show dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
    inet6 2001:db8:acad:10:250:56ff:fe5d:e012/64 scope global dynamic
       valid_lft 2591990sec preferred_lft 604790sec
    inet6 fe80::250:56ff:fe5d:e012/64 scope link
       valid_lft forever preferred_lft forever

A global address from the LAN prefix. The lifetimes match the IOS defaults of 30 days valid and 7 days preferred, minus the seconds since the RA.

PC1 output
PC1# ip -6 route show default
default via fe80::1 dev eth0 proto ra metric 1024 expires 1795sec hoplimit 64 pref medium

The default route points at R1's link-local address and was learned from an RA.

PC1 output
PC1# ping -6 -c 2 2001:db8:ffff:1::
PING 2001:db8:ffff:1::(2001:db8:ffff:1::) 56 data bytes
64 bytes from 2001:db8:ffff:1::: icmp_seq=1 ttl=63 time=1.21 ms
64 bytes from 2001:db8:ffff:1::: icmp_seq=2 ttl=63 time=1.08 ms

ISP1 answers. A hop limit of 63 on the reply shows one router (R1) between them.

Mistakes people make

  • Forgetting ipv6 unicast-routing. The interfaces get addresses, but hosts never receive an RA and nothing is forwarded.
  • Leaving RAs on toward the ISP. They serve no purpose there and can make the provider's equipment treat R1 as a router to use.
  • Using a link-local next hop for the default route without the exit interface. IOS rejects it.
  • Building IPv6 without matching the IPv4 ACLs on the WAN. Add an ipv6 traffic-filter with the same intent.

On other platforms

Junos forwards IPv6 as soon as family inet6 is configured. RAs are enabled per interface under protocols.

Junos
set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.1/24
set interfaces ge-0/0/0 unit 0 family inet6 address 2001:db8:acad:10::1/64
set interfaces ge-0/0/1 unit 0 family inet address 203.0.113.2/30
set interfaces ge-0/0/1 unit 0 family inet6 address 2001:db8:ffff:1::1/127
set protocols router-advertisement interface ge-0/0/0.0 prefix 2001:db8:acad:10::/64
set routing-options static route 0.0.0.0/0 next-hop 203.0.113.1
set routing-options rib inet6.0 static route ::/0 next-hop 2001:db8:ffff:1::

A Linux router needs forwarding on and an RA daemon such as radvd for the LAN.

Linux
ip addr add 10.10.10.1/24 dev eth0
ip -6 addr add 2001:db8:acad:10::1/64 dev eth0
ip addr add 203.0.113.2/30 dev eth1
ip -6 addr add 2001:db8:ffff:1::1/127 dev eth1
ip route add default via 203.0.113.1
ip -6 route add default via 2001:db8:ffff:1::
sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv6.conf.all.forwarding=1

Say it in the interview

"First ipv6 unicast-routing, because without it IOS is an IPv6 host. On the LAN I put both families, a /64 and fe80::1 so the gateway is easy to read. On the WAN a /127 per RFC 6164 and RAs suppressed. Then a default route per family. I check FF02::2 is joined, RAs are going out, and a host has a SLAAC address and a default route via fe80::1."

Book 4.2 IP Version 6