IPv6 Delegation, Follow Up, NDProxy, Oh My!

This is a follow up to my PfSense blog.

One thing that I mentioned in passing is that your ISP does not have to give you a global address on your WAN interface. Your LAN needs one if you want to access the Internet.

ULA vs Link-Local addresses

There are two ways for a an ISP or you if you are using your own internal router, to give a device an IPv6 address.

ULA addresses

You a get a Unique Local IPv6 (ULA) address on the WAN interface.

• These ULA addresses are of the form FC00::/7.
• This is not a routable prefix on the Internet.
• The prefix above is exactly similar to the old 10.0.0.0/8 super-net.
• They can be used for local communications within a site.

Link Local Addreses

You do not get a prefix on the WAN interface.

• You only receive a default route
• The default route is via the prefix fe80::/10.
• These prefixes are labeled as link local addresses.
• They are automatically configured on interfaces.
• They talk to neighbors via the Network Discovery Protocol (NDP).
• They can also talk to neighbors via routing protocols.
• Any routing protocol will work on them!
• Link-local addresses cannot be routed beyond the local link.

Configuration

One way of doing this for example is to use the following snippet on you RADVD configuration.

interface eth0 {
    AdvSendAdvert on;
    # No prefix blocks defined here
};

This basically is just advertising a default route via the link-local address of the RAVD server.

This brings me to another point, unlike a DHCPv6 server, a RADVD server needs to see all segments that need IPv6 routing information or SLAAC configuration.

Thus, a RADVD server needs multiple interfaces (if you have 100 network segments or VLANS that would be quite a device!), or a L2/L3 device that has all of those VLANS defined. The default route is the RADVD server itself. Thus, RADVD servers are always devices capable of routing.

However there is a scenario in which you may have two network segments not directly connected, in that case we could use an NDPROXY sever. We will discuss this later on.

I have not encountered yet an ISP that will give you ULA addresses, all of the ISPs that I have used and provided me with IPv6 prefixes (corporate or consumer wise) have always given me a link-local address on the WAN interface and the corresponding default route through it.

This is in my opinion the more cleaner, logical and simpler way of implementing routing for IPv6 devices.

Every vendor implements the above mechanism differently. On Linux the snippet stated is used.

On Cisco routers:

• On the router delegating prefixes, enable IPv6 on the interface but do not configure an IPv6 address.
  • The router will advertised a default route via ND (network discovery protocol).
  • Since it does not have an IPv6 address, ND will not advertised a prefix to the clients.
• On clients you have two ways of requesting the default route:
  • Enable IPv6 and let the client request a default route using “ipv6 address autoconfig default”.
  • By default the client will request a prefix and a default route. In our case since no prefix was configured none is given.
  • The command will also overwrite a default route learned by other means.
  • Or you can use “ipv6 nd autoconfig default-route”, this also requests a default route.
  • It uses the RAs advertisements via ND.
  • In this case it only requests a default route regardless if you configured a prefix or not.
  • This is used for example if you have a DHCPv6 server and it is handling pool of prefixes given to clients.

NDPROXY

An NDPROXY server, is a server that allows you to connect different IPv6 segments that otherwise would not to be able to connect however, devices on those networks need to be on the same network.

For more information you can check the following:

• Neighbor Discovery Proxy (Cisco)
• IPv6 Neighbor Discovery Proxy (Cisco)
• Fortinet
• NDP Proxy and DAD Proxy (Juniper)

One of the main points that you should get, is that NDPROXY does not allow you to subnet /64 into smaller networks. This will break SLAAC.

A couple of scenarios in which an NDPROXY is useful.

• You have WI-FI clients and you can only get /64 or you want to put them on a particular network that is secure by some means.
• You have two network segments that are connected to their own gateways. You want devices on those IPV6 network two be on the same IPv6 network.

You may asked that in the first example it makes sense since perhaps your ISP gave you a /64 and you want to use WI-FI.

On the second scenario however, if you have a /56 for example why would you use an NDPROXY router.

You could span your L2 domains into a bigger L2 domain, this could become un-manageable, you could have broadcast storms, etc.

You are migrating to a new physical segment and you want to keep the same numbering scheme, using an NDPROXY makes sense.

NDPROXY is similar to IPv4 proxy ARP, other than they work on different versions of the Internet Protocol of course.

SUMMARY

This note came about because I saw once again on forums confusion among others regarding this mechanism.

I also read that some confuse NDPROXY as allowing them to subnet a /64 segment, which it will not do.

Hopefully, this will be informative.

For additional information look at this blog article. Unlike some others is it useful and to the point.

There you have it.

Ciao.