IPv6 Routing a /54 -> /56 -> /64 issue..

killersoft · Tue Nov 28, 2023 8:14 am

Hi. I have a scenario where I have a few business units who look after their own gear, and do their own thing..

[ISP]-----v4(/28)--+-v6/(/54)---(VLAN200)--[CORE ROUTER-rb5009 v7.12.1]===(VLAN205)===>VLAN SWITCH===> Other routers(MT RB5009's v7.12.1) (/56)

That said, I gatekeep the core router where my ISP has given me a /28 IPv4 + /54 IPv6 address.
Now I have IPv4 well in hand, so no issues there.

As for IPv6, my ISP gave me (ip changed to protect the innocent!) 2401:d000:5001::/54
Notably its static( no dhcp from the ISP ), they state for me to connect I need to gateway to 2401:d000:5001::1 and suggested I use 2401:d000:5001::2 when I was initially testing. Now from my core router using this basic config, I have no issue pinging out, e.g ipv6.google.com. I can even set my core IP address to say 2401:d000:5001:300::2/54 and I can still get out to the internet( which using that address let me test they gave me a /54, going to say :500:2 of course breaks, and no connectivity which is correct looking at the /54 subnet overall ).

Now here comes my issue. I am struggling to work out how to set up routing ( ideally a /56 ( works out nicely to :0000:,

,

subnets!!) to hand off to the next set of routers.

I have done some testing, but I fail to get out off the 2nd set out routers. E.g if I ping say the ISP gateway address from my next hop router I get nothing... Yet I can ping my core router IP I set e.g ::2..just not the ::1(isp gw addr ). I'm clearing not doing something right.

So here's what I got cfg wise
CORE RTR

/ipv6 dhcp-server
add address-pool="IPV6 POOL /56" interface="vlan205-TO INTERNAL RTS" lease-time=10m name="DHCP SERVER"
/ipv6 pool
add name="IPV6 POOL /56" prefix=2401:d000:5001::/54 prefix-length=56
/ipv6 address
add address=2401:d000:5001::2/54 advertise=no interface=vlan200-INTERNET-IN-FROM-ISP
/ipv6 route
add disabled=no distance=1 dst-address=::/0 gateway=2401:d000:5001::1 routing-table=main scope=30 suppress-hw-offload=no target-scope=10
[admin@core] /ipv6> route
[admin@core] /ipv6/route> print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, s - STATIC, d - DHCP
Columns: DST-ADDRESS, GATEWAY, DISTANCE
#     DST-ADDRESS                                         GATEWAY                                            DISTANCE
0  As ::/0                                                2401:d000:5001::1                                         1
  DAc 2401:d000:5001::/54                                 vlan200-INTERNET-IN-FROM-ISP                              0
  DAd 2401:d000:5001:100::/56                             fe80::1836:88ff:fe8a:755a%vlan205-TO INTERNAL RTS         1
  DAd 2401:d000:5001:300::/56                             fe80::7683:c2ff:fe76:8617%vlan205-TO INTERNAL RTS         1
  DAc fe80::%bridge1/64                                   bridge1                                                   0
  DAc fe80::%vlan200-INTERNET-IN-FROM-ISP/64              vlan200-INTERNET-IN-FROM-ISP                              0
  DAc fe80::%vlan205-TO INTERNAL RTS/64                   vlan205-TO INTERNAL RTS                                   0

[admin@core] /ipv6/route> /ping [:resolve ipv6.google.com] 
  SEQ HOST                                     SIZE TTL TIME       STATUS                                                                                                      
    0 2404:6800:4015:800::200e                   56  60 4ms402us   echo reply                                                                                                  
    1 2404:6800:4015:800::200e                   56  60 4ms492us   echo reply                                                                                                  
    2 2404:6800:4015:800::200e                   56  60 4ms435us   echo reply                                                                                                  
    3 2404:6800:4015:800::200e                   56  60 4ms462us   echo reply                                                                                                  
    4 2404:6800:4015:800::200e                   56  60 4ms454us   echo reply                                                                                                  
    sent=5 received=5 packet-loss=0% min-rtt=4ms402us avg-rtt=4ms449us max-rtt=4ms492us

Other Router

/ipv6 address
add address=::1 from-pool=ipv6 interface=bridge1
/ipv6 dhcp-client
add add-default-route=yes interface=vlan205 pool-name=ipv6 pool-prefix-length=54 request=prefix


[admin@RTR2] /ipv6> route
[admin@RTR2] /ipv6/route> print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, d - DHCP
Columns: DST-ADDRESS, GATEWAY, DISTANCE
    DST-ADDRESS              GATEWAY                            DISTANCE
DAd ::/0                     fe80::5c85:b3ff:feeb:dd5e%vlan205         1
DAd 2401:d000:5001:100::/56                                            1
DAc 2401:d000:5001:100::/64  bridge1                                   0
DAc fe80::%bridge1/64        bridge1                                   0
DAc fe80::%vlan205/64        vlan205                                   0



[admin@RTR2] /ipv6/route> /tool/traceroute [:resolve ipv6.google.com]]     
Columns: ADDRESS, LOSS, SENT, LAST, AVG, BEST, WORST, STD-DEV
#  ADDRESS            LOSS  SENT  LAST     AVG  BEST  WORST  STD-DEV
1  2401:d000:5001::2  0%       1  0.6ms    0.6  0.6   0.6          0
2                     100%     1  timeout                           
3                     0%       1  0ms                               

[admin@RTR2] /ipv6/route> /ping  [:resolve ipv6.google.com]]                
  SEQ HOST                                     SIZE TTL TIME       STATUS                                                                                                                                                              
    0 2404:6800:4015:803::200e                                     timeout                                                                                                                                                             
    1 2404:6800:4015:803::200e                                     timeout                                                                                                                                                             
    sent=2 received=0 packet-loss=100%

So you can see doing a traceroute on one of the end routers seems to get as far as the core router, but no further...
What have I missed ! ?

mkx · Tue Nov 28, 2023 2:30 pm

In my working case, ISP is giving out (dynamic, but doesn't matter much) /56 prefixes via DHCPv6 prefix delegation. The I'm using /64 address for LAN interface and none for WAN interface (routing is done using link-local addresses). DHCPv6 client automatically adds route such as this:

Flags: X - disabled, A - active, D - dynamic, 
C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable 
 0 ADSU dst-address=aaaa:bbbb:cccc:dd00::/56 type=unreachable distance=1

which helps with blackholing the unused part of delegated prefix. I recommend you to do similar for your whole prefix after you make IPv6 work ... it's a security feature. Your router will use default gateway for parts of your prefix not assigned to any other interface while ISP will route it back to you because those addresses are supposed to be behind your router. By adding unreachable route this ping-pong will not happen, your router will break the circle.

What you probably have to do is assign a /64 address to your WAN interface and add routing (gateway) like this:

/ipv6/address
add address=2401:d000:5001::2/64 interface=WAN
/ipv6/route
add dst-address=::/0 gateway=2401:d000:5001::1

It then remains to be seen if this will be enough or you'll have to ask ISP to route your /54 subnet via 2401:d000:5001::2.

The basic thing is: if you assign an interface with /54 address, then router will assume it can reach all of /54 via that interface. Setting specific interfaces with /64 (parts of bigger /54 subnet) will not fix the problem, addresses on different interfaces of same router have to be from non-overlapping subnets.

IPv6 Routing a /54 -> /56 -> /64 issue..

IPv6 Routing a /54 -> /56 -> /64 issue..

Re: IPv6 Routing a /54 -> /56 -> /64 issue..