IPv6 Configuration RB4011

raphaps · Sat Nov 16, 2024 7:16 am

Hello friends,

I am having trouble configuring an IPv6 pool provided by my ISP. They assigned me a /56 pool, and I want to break it into /64 networks. However, I am facing an issue: when I add the addresses to interfaces, I do not have external access. I have done similar configurations with another provider and also via a Hurricane Electric tunnel without any issues. From what I can tell, the addresses I add only work on the interface where the ISP connection arrives, which is ether1. On other interfaces, the addresses I assign do not work. If I take a new /64 pool that I defined and add it to ether1, it works; but if I assign it to ether4 or ether6, it stops working.

All configurations are being done statically since this is how the ISP provides the addresses. I plan to pass the addresses to my internal network via SLAAC after getting everything working. I also tried assigning an IPv6 address from the /64 prefix of ether4 to another device on the network statically, but it did not work.

The configurations provided by my ISP are as follows:
(Fictitious addresses used for documentation purposes)

Prefix: 2001:db8

:/56
WAN IP: 2001:db8

:2/64 (ether1)
Gateway: 2001:db8

:1/64

With this configuration, my router is remotely accessible via SSH and Winbox, and I can ping various IPv6 sites from it.

When I try to configure the LAN and define new prefixes, I simply have no connection, as if there were no routing from the ISP for them through other interfaces or as if the IPv6 forward option in RouterOS was not working. For example:

LAN1: 2001:db8

a1::5/64 (ether4)
LAN2: 2001:db8

b1::5/64 (ether6)

These prefixes work perfectly when assigned to my WAN interface directly connected to the ISP's router but not on other interfaces. Since this is a simple configuration, I don’t understand why it doesn’t work on other interfaces. I even disabled the firewall, but I still couldn’t make this configuration work.

Below are my interface and IPv6 configurations.

/ipv6 settings
set accept-redirects=yes-if-forwarding-disabled accept-router-advertisements=yes-if-forwarding-disabled disable-ipv6=no forward=yes max-neighbor-entries=8192 multipath-hash-policy=l3

/ipv6 nd
set [ find default=yes ] advertise-dns=yes advertise-mac-address=yes disabled=yes hop-limit=unspecified interface=ether4 managed-address-configuration=no mtu=unspecified other-configuration=yes ra-delay=3s ra-interval=3m20s-10m ra-lifetime=\
    30m ra-preference=medium reachable-time=unspecified retransmit-interval=unspecified

/ipv6 nd prefix default
set autonomous=yes preferred-lifetime=1w valid-lifetime=4w2d

/ipv6 address
add address=2001:db8:20a0::2/64 advertise=no disabled=no eui-64=no from-pool="" interface=ether1 no-dad=no
add address=2001:db8:20a0:a1::5/64 advertise=no disabled=no eui-64=no from-pool="" interface=ether4 no-dad=no
add address=2001:db8:20a0:b1::5/64 advertise=no disabled=no eui-64=no from-pool="" interface=ether6 no-dad=no

/ipv6 route
add disabled=no distance=1 dst-address=::/0 gateway=2001:db8:20a0::1 routing-table=main scope=30 suppress-hw-offload=no target-scope=10

/interface ethernet
set [ find default-name=ether1 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
    "ISP 01" disabled=no l2mtu=1592 loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=DC:2C:6E:37:6F:67 mtu=1500 name=ether1 orig-mac-address=\
    DC:2C:6E:37:6F:67 rx-flow-control=off tx-flow-control=off
set [ find default-name=ether4 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited comment="LAN 01" disabled=no \
    l2mtu=1592 loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=DC:2C:6E:37:6F:6A mtu=1500 name=ether4 orig-mac-address=DC:2C:6E:37:6F:6A rx-flow-control=off tx-flow-control=off
set [ find default-name=ether6 ] advertise=10M-baseT-half,10M-baseT-full,100M-baseT-half,100M-baseT-full,1G-baseT-half,1G-baseT-full arp=enabled arp-timeout=auto auto-negotiation=yes bandwidth=unlimited/unlimited comment=\
    "LAN 02" disabled=no l2mtu=1592 loop-protect=default loop-protect-disable-time=5m loop-protect-send-interval=5s mac-address=DC:2C:6E:37:6F:6C mtu=1500 name=ether6 orig-mac-address=DC:2C:6E:37:6F:6C \
    rx-flow-control=off tx-flow-control=off

RouterOS Version: 7.16.1
Modelo: RB4011

Thank you in advance for your assistance.

Sat Nov 16, 2024 9:05 am

accept-router-advertisements=yes

raphaps · Sat Nov 16, 2024 9:19 am

I had already tested it this way, but without success as well.

tdw · Sat Nov 16, 2024 1:39 pm

There doesn't appear to be any active entries under /ipv6 nd so devices attached to ether4 or ether6 will not be sent router advertisments telling them what the network prefix or gateway address is.

mantouboji · Sat Nov 16, 2024 5:12 pm

Add the /56 prefix to a /ipv6/pool then add ipv6 address from that pool.

raphaps · Sat Nov 16, 2024 11:43 pm

@tdw, as I mentioned in my initial post, my primary intention is to configure it statically. I’m simply assigning addresses to the ether4 and ether6 interfaces. Once I manage to achieve external access through the global address I defined for them, I’ll move on to configuring the devices behind those interfaces. I already have external access through ether1; it allows me to ping various websites using IPv6 and also successfully access Winbox and SSH from outside the network using its IPv6 address.

@mantouboji, as I mentioned above, I’m configuring it statically. The prefixes I assigned to the interfaces are part of the /56 I received from my ISP. However, they only work on ether1, which is connected to my ISP. If I configure them on ether4 or ether6, they stop working. These interfaces (ether4 and ether6) each have an unmanaged switch connected to them.

It’s as if IPv6 forwarding between the interfaces isn’t working. I have similar configurations for prefixes received via PPPoE or through a tunnel broker, and I can successfully perform the static configuration for each interface, define a global address, and achieve external access for them shortly after.

tdw · Tue Nov 19, 2024 9:06 pm

@tdw, as I mentioned in my initial post, my primary intention is to configure it statically. I’m simply assigning addresses to the ether4 and ether6 interfaces. Once I manage to achieve external access through the global address I defined for them, I’ll move on to configuring the devices behind those interfaces. I already have external access through ether1; it allows me to ping various websites using IPv6 and also successfully access Winbox and SSH from outside the network using its IPv6 address.

So at the moment you are not attempting to communicate with devices attached to ether4 or ether6, having added LAN1: 2001:db8

a1::5/64 (ether4) and LAN2: 2001:db8

b1::5/64 (ether6) you are unable to ping those addresses from outside? Note the interface must be connected to something so it is in the running state for any attached IPv4 or IPv6 addresses to be active.

raphaps · Wed Nov 20, 2024 5:09 am

I am unable to ping the addresses on ether4 and ether6 from outside. On ether4, there is an RB450 connected, and on ether6, there is a switch. Based on the tests, it seems there is no routing for the network addresses on ether4 (2001:db8

a1::5/64) and ether6 (2001:db8

b1::5/64) to the ISP router's gateway 2001:db8

:1/64. I think I’m missing something somewhere. It's as if the route is not propagating between the interfaces.

Wed Nov 20, 2024 6:23 am

That can happen due to overzealous multicast filtering, IGMP bugs…

The simplest path is to allow unknown multicast on ports toward the NDP source, same as you’d mark those links “trusted” to get DHCPv4 answers.

raphaps · Wed Nov 20, 2024 6:55 am

In this case, would I have to create a rule in the RouterOS firewall? Could you help me with this solution?

Wed Nov 20, 2024 7:27 am

This:

/interface bridge port
interface=ether4 unknown-multicast-flood=yes

Do that for every port along the NDP multicast path, from ISP ingress.

raphaps · Wed Nov 20, 2024 8:02 am

So your suggestion is for me to create a bridge between the interfaces ether1 (ISP), ether4 (LAN), and ether6 (LAN)? After that, add the addresses to the interfaces as in the first post?

Wed Nov 20, 2024 8:33 am

That's getting beyond the scope of the question and into local network design principles, which you are the best authority on.

That said, how else did you expect these SLAAC messages to get from the ISP to the individual internal LAN router interfaces?

(Serious question! Did you have a different plan?)

raphaps · Wed Nov 20, 2024 8:40 am

My ISP provides me with a /56 pool statically, using manual configuration, without SLAAC or DHCP. Once I start distributing IP addresses on the LAN, I will then configure SLAAC on my Mikrotik. The starting point here is that I need to make these interfaces accessible from outside the network. The only way I managed to do this was by creating a bridge between the ether1 (ISP) interface and the LAN interfaces (ether4 and ether6). After completing these adjustments, I will move on to configuring the devices behind the LAN interfaces.

Wed Nov 20, 2024 8:51 am

Yes; those NDP packets have to transit some type of medium to get from ether1 to ether4/6. If not a bridge, then you say what, but a bridge is one of the more sensible options.

raphaps · Wed Nov 20, 2024 8:56 am

Understood, I’ll explore the options here. Either way, with a bridge, I can access the addresses of other prefixes, but I’ll test other configurations to achieve what I want.

Maybe I misunderstood the concept of IPv6 on Mikrotik, but for me, the IPv6 forward option enabled would allow packets arriving on one interface to be routed to another interface. That way, there would be no need to create a bridge—at least, this has been my understanding from the beginning. In fact, this is how I configured Hurricane Electric tunnels, as well as other ISPs that deliver via DHCP.

Wed Nov 20, 2024 9:04 am

In evaluating my replies, realize that I've only ever done a single /64 at a time. I have this loony idea that having eighteen bazillion IPv6 addresses on a single LAN is enough. If you want someone who actually understands IPv6 at a carrier scale, you want to talk to people like @tdw.

Y'all have fun with your /60s and /56es and whatever.

Weirdos.

raphaps · Wed Nov 20, 2024 9:18 am

But the issue is that I need to use addresses in different networks (there are actually 4), which is why a larger prefix is needed, since we can't divide a /64 as it doesn't allow subnetting (at least, it's not recommended). In fact, there is RFC 6177, which provides some guidelines for ISPs to deliver /56 to home users and /48 to businesses. Therefore, the concern with IPv6 is no longer about the number of IP addresses, but rather the number of networks you can create with your prefix.

Wed Nov 20, 2024 9:23 am

Not really arguing. Just pointing out that while I’m trying to help, there are people with actual clues here, and you might have cause to give their advice more weight than mine.

raphaps · Wed Nov 20, 2024 9:28 am

Yes, I understand that you weren't arguing, thank you for the help. A technical conversation is always welcome, especially in the early hours (in my case).

tdw · Wed Nov 20, 2024 1:44 pm

With no firewall rules the Mikrotik will forward packets unless explicitly disabled. What does /ipv6 route print show?

And is the ISP routing the additional prefix to the Mikrotik WAN address, or just presenting it on the WAN link? The latter requires the somewhat hacky ND proxy, which Mikrotik doesn't implement. You may have to use the packet sniffer to see if packets for the additional prefix just arrive at the WAN interface (this is what should happen), or if discovery requests arrive instead.

raphaps · Fri Nov 29, 2024 8:03 am

Hello, sorry for the delayed response. As far as the ISP informed me, they are routing the prefix to my router, but I captured packets and noticed that the RS and RA advertisements only occur between the ISP's Cisco router and the Mikrotik's ether1 interface, where the Cisco router is connected. I tested changing the prefix on ether1, and it works normally. In fact, any /64 network I create within the /56 prefix they provided works fine, but only on ether1. However, prefixes configured on ether4 or ether6 (which work on ether1) do not have RS and RA communication with the Cisco router, meaning the addresses don’t function on those interfaces.

As for the route, it is as follows:

/ipv6 route
add disabled=no distance=1 dst-address=::/0 gateway=2001:db8:20a0::1 routing-table=main scope=30 suppress-hw-offload=no target-scope=10

I believed the IPv6 forward option on the Mikrotik would resolve this type of situation by forwarding packets between interfaces, but in this case, it doesn’t work. If I place ether4 and ether6 in a bridge with ether1, then I can define the prefixes on them, but that’s not the intended setup. The ISP even sent me the configuration of their Cisco router, and I’ll attach it here in case it helps with anything. (The actual addresses in the document have been removed.)

mkx · Fri Nov 29, 2024 8:14 am

Can you post configuration from your MT router, at least the /ipv6 part? You can omit firewall part, it probably isn't important in the context of problems you're seeing.

raphaps · Fri Nov 29, 2024 8:39 am

Below are the configurations for interfaces, firewall, and IPv6.

mkx · Fri Nov 29, 2024 8:51 am

You actually need to set advertise=yes on addresses on interfaces where there are devices which should use your router as their gateway ... without it, router will not send out RAs and SLAAC then doesn't work.

In your opening post, you write "When I try to configure the LAN and define new prefixes, I simply have no connection" ... how in particular are you testing this? Did you try to connect at router's other addresses (e.g. 2001:db8

a1::2) from internet side and it didn't work? Or?

BTW, when you export config to be read by humans next time, don't use "verbose" property, it includes too much noise to be comprehensive.

raphaps · Fri Nov 29, 2024 9:07 am

So, as I mentioned at the beginning of the post, I have not configured address distribution for LAN devices through the ether4 and ether6 interfaces, which is why the advertise option is unchecked. The test I’m conducting involves assigning addresses to the ether4 and ether6 interfaces and trying to access them externally, but I am not succeeding. If I assign these same addresses to the ether1 interface, I can access them. The tests I am performing are ping and SSH access from another external router.

I captured packets and noticed that there are no Neighbor Solicitation and Neighbor Advertisement messages being sent from the ether4 and ether6 interfaces to the ISP's Cisco router. However, with the ether1 interface, the messages are exchanged normally. As I mentioned before, if I add the ether4 and ether6 interfaces to a bridge together with ether1, I can access the addresses. I will only proceed with configuring the LAN devices once I finish this setup; otherwise, I’ll have to pass everything through the bridge, which is not the ideal scenario.

P.S.: Sorry for the verbose config, it won’t happen again.

mkx · Fri Nov 29, 2024 10:57 am

Looked at cisco config and I think the problem lies there:

interface GigabitEthernet0/1
description ** LAN **
ip address 201.201.201.201 255.255.255.240
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
ipv6 address 2001:db8:1/56 anycast
no cdp enable

It effectively says that all IPv6 addresses from /56 prefix should be directly available through interface GigabitEthernet0/1. Rather you should set IPv6 address as "2001:db8

:1/64" and set static route (via 2001:db8

:2) for the rest of prefix. So ideally you'd use a /127 (or /126) addresses as "link subnet" between cisco and MT and route whole /56 through MT's IP address in the "link subnet".

raphaps · Tue Dec 03, 2024 6:08 am

But this configuration should be done by the ISP on the Cisco, right?

mkx · Tue Dec 03, 2024 8:42 am

By whoever manages cisco ... Or, if it's really ISP (I'm surprised you can see config of your upstream router), let them explain to you how you're supposed to use the /56 they are assigning to you. I suspect that they expect your router to do proxy ARP thingie on WAN port ... which is, IMO, wrong.

raphaps · Tue Dec 03, 2024 9:03 am

I don’t have access to my ISP’s router; this configuration was sent to me by an ISP technician at the time of installation. I have spoken with the ISP multiple times to resolve this situation, but without success. Unfortunately, I have come to the same conclusion: they want me to enable proxy-ARP (which would be the ND Proxy for IPv6, which is not implemented in Mikrotik, as mentioned above by @tdw) on my mikrotik, which is connected to the Cisco router. I have several IPv6 configurations receiving /56 prefixes via DHCP or PPPoE, and I’ve never had any issues. This static configuration from this specific provider (one of the largest in the country) is what has caused me headaches. I will try to reach out to my ISP consultant to see if I can find a more knowledgeable technician to help me with this issue. I appreciate everyone’s assistance.

Kentzo · Tue Dec 03, 2024 7:29 pm

Could you attach the dissection (e.g. via Wireshark) of the RA packet as received by the Mikrotik router interface connected to the upstream Cisco router?

IPv6 Configuration RB4011

IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Re: IPv6 Configuration RB4011

Who is online