Checklist and troubleshooting
Checklist
- A blackhole route for every prefix you're given (the /48 on R1, each handed-over /56 on the router that receives it).
- A default route to the ISP, or a
::/0from a routing protocol. - Every LAN is a /64, with Router Advertisements: the prefix, and a DNS server.
- Static handovers: a route on the upstream router and a default route plus blackhole on the downstream one.
- DHCPv6-PD: a pool on the upstream router,
dhcpv6-options pdon the downstream router, and an RA withprefix ::/64on its LANs. - A forward firewall that accepts established traffic and ICMPv6 and drops other inbound traffic, and ICMPv6 accepted on the input filter as well.
When it doesn't work
| Symptom | Look at | Usual cause |
|---|---|---|
Client has only an fe80:: address | rdisc6 <interface> on the client | No RA: service router-advert missing, or on the wrong interface |
| Client has an address but no default route | ip -6 route on the client; the RA's router lifetime | RA lifetime 0, or the host is ignoring RAs (for example, because forwarding is enabled on it) |
| Downstream LAN works locally but not to the internet | show ipv6 route <client address> on the upstream router | No route for the handed-over prefix: replies hit the blackhole |
| Traceroute shows two routers taking turns | Routes on the downstream router | No blackhole for unused space in its prefix |
| DHCPv6-PD gets no lease | show dhcpv6 server leases; the client's log | Client not running (check its DUID), or the server isn't listening on that interface |
| Some websites hang, others work | Is ICMPv6 dropped anywhere? | Path MTU discovery broken by a firewall |
vyos@R1:~$ show configuration commands | match "interfaces ethernet eth. (address|description|dhcpv6)|protocols static|router-advert|dhcpv6-server|host-name"
set interfaces ethernet eth0 address '2001:db8:ffff:1::2/64'
set interfaces ethernet eth0 description 'WAN'
set interfaces ethernet eth1 address '2001:db8:1000:1::1/64'
set interfaces ethernet eth1 description 'LAN1'
set interfaces ethernet eth2 address '2001:db8:1000:ff::1/64'
set interfaces ethernet eth2 description 'TRANSIT-R2'
set protocols static route6 2001:db8:1000:100::/56 next-hop 2001:db8:1000:ff::2
set protocols static route6 2001:db8:1000::/48 blackhole
set protocols static route6 ::/0 next-hop 2001:db8:ffff:1::1
set service dhcpv6-server shared-network-name TRANSIT interface 'eth2'
set service dhcpv6-server shared-network-name TRANSIT subnet 2001:db8:1000:ff::/64 prefix-delegation prefix 2001:db8:1000:200:: delegated-length '56'
set service dhcpv6-server shared-network-name TRANSIT subnet 2001:db8:1000:ff::/64 prefix-delegation prefix 2001:db8:1000:200:: prefix-length '55'
set service dhcpv6-server shared-network-name TRANSIT subnet 2001:db8:1000:ff::/64 subnet-id '1'
set service router-advert interface eth1 name-server '2001:db8:f000::53'
set service router-advert interface eth1 prefix 2001:db8:1000:1::/64
set system host-name 'R1'- Lines 8–10: Handover, blackhole and default.
- Lines 11–14: The PD server.
- Lines 15–16: RAs on LAN1.
vyos@R2:~$ show configuration commands | match "interfaces ethernet eth. (address|description|dhcpv6)|protocols static|router-advert|dhcpv6-server|host-name"
set interfaces ethernet eth0 address '2001:db8:1000:ff::2/64'
set interfaces ethernet eth0 description 'TRANSIT-R1'
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth1 address '1'
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth1 sla-id '0'
set interfaces ethernet eth0 dhcpv6-options pd 0 length '56'
set interfaces ethernet eth1 address '2001:db8:1000:100::1/64'
set interfaces ethernet eth1 description 'LAN2'
set protocols static route6 2001:db8:1000:100::/56 blackhole
set protocols static route6 ::/0 next-hop 2001:db8:1000:ff::1
set service router-advert interface eth1 name-server '2001:db8:f000::53'
set service router-advert interface eth1 prefix 2001:db8:1000:100::/64
set service router-advert interface eth1 prefix ::/64
set system host-name 'R2'- Lines 4–6: The PD client.
- Lines 9–10: Blackhole for the static /56, and the default route.
- Lines 12–13: RAs for the static prefix and whatever was delegated.