This is a follow up to my PfSense blog.<\/p>\n\n\n\n
One thing that I mentioned in passing is that your ISP does not have to give you a global address on your WAN interface. Your LAN needs one if you want to access the Internet.<\/p>\n\n\n\n\n\n\n\n
There are two ways for a an ISP or you if you are using your own internal router, to give a device an IPv6 address.<\/p>\n\n\n\n
You a get a Unique Local IPv6 (ULA) address on the WAN interface.<\/p>\n\n\n\n
You do not get a prefix on the WAN interface.<\/p>\n\n\n\n
One way of doing this for example is to use the following snippet on you RADVD configuration.<\/p>\n\n\n\n
interface eth0 {\n AdvSendAdvert on;\n # No prefix blocks defined here\n};<\/pre>\n\n\n\nThis basically is just advertising a default route via the link-local address of the RAVD server. <\/p>\n\n\n\n
This brings me to another point, unlike a DHCPv6 server, a RADVD server needs to see all segments that need IPv6 routing information or SLAAC configuration.<\/p>\n\n\n\n
Thus, a RADVD server needs multiple interfaces (if you have 100 network segments or VLANS that would be quite a device!), or a L2\/L3 device that has all of those VLANS defined. The default route is the RADVD server itself. Thus, RADVD servers are always devices capable of routing.<\/p>\n\n\n\n
However there is a scenario in which you may have two network segments not directly connected, in that case we could use an NDPROXY sever. We will discuss this later on.<\/p>\n\n\n\n
I have not encountered yet an ISP that will give you ULA addresses, all of the ISPs that I have used and provided me with IPv6 prefixes (corporate or consumer wise) have always given me a link-local address on the WAN interface and the corresponding default route through it.<\/p>\n\n\n\n
This is in my opinion the more cleaner, logical and simpler way of implementing routing for IPv6 devices.<\/p>\n\n\n\n
Every vendor implements the above mechanism differently. On Linux the snippet stated is used.<\/p>\n\n\n\n
On Cisco routers:<\/p>\n\n\n\n
An NDPROXY server, is a server that allows you to connect different IPv6 segments that otherwise would not to be able to connect however, devices on those networks need to be on the same network.<\/p>\n\n\n\n
For more information you can check the following:<\/p>\n\n\n\n
One of the main points that you should get, is that NDPROXY does not allow you to subnet \/64 into smaller networks. This will break SLAAC.<\/p>\n\n\n\n
A couple of scenarios in which an NDPROXY is useful.<\/p>\n\n\n\n
You may asked that in the first example it makes sense since perhaps your ISP gave you a \/64 and you want to use WI-FI. <\/p>\n\n\n\n
On the second scenario however, if you have a \/56 for example why would you use an NDPROXY router.<\/p>\n\n\n\n
You could span your L2 domains into a bigger L2 domain, this could become un-manageable, you could have broadcast storms, etc.<\/p>\n\n\n\n
You are migrating to a new physical segment and you want to keep the same numbering scheme, using an NDPROXY makes sense.<\/p>\n\n\n\n
NDPROXY is similar to IPv4 proxy ARP, other than they work on different versions of the Internet Protocol of course. <\/p>\n\n\n\n
This note came about because I saw once again on forums confusion among others regarding this mechanism.<\/p>\n\n\n\n
I also read that some confuse NDPROXY as allowing them to subnet a \/64 segment, which it will not do.<\/p>\n\n\n\n
Hopefully, this will be informative.<\/p>\n\n\n\n