IPv6 issue on WLAN with WLC2504

[jilse-iph]

Hello,

i have an issue with IPv6 on WLC2504 wlan controller. IPv6 is enabled globally, 1 WLAN which i want to run with IPv6 is connected to a Switch via VLAN666, and a router (C1841) with IPv6 enabled is also connected to VLAN666. When i connect a netbook via cable to an access-port in VLAN666 of that switch, i get an IPv6 prefix and a default gateway assigned via RA, but if i connect the same netbook via WLAN, i get no IPv6 prefix assigned and no IPv6 default-gateway. Seems, that RA packets do not reach my WLAN clients ... But if i connect the netbook via WLAN, i can ping the link local address from the C1841 router, and if i assign a global unique IPv6 address within the same prefix configured on the router, i can access also the IPv6 internet via that connection. The only thing missing is the router-advertisement, which gets lost between the switch and the WLAN-AP ...

The WLC2504 runs (unfortunately) with firmware 7.6 (which is not supported anymore) and the APs are connected via Flexconnect. All APs are local to this site, so there is no really need for Flexconnect / REAP / HREAP. Is Flexconnect the reason for this issue? If fFlexconnect is the reason for the issue, how can i change the connection to something else, that is supported in combination with IPv6? The "ipv6 ra-guard" is enabled for "wlc" and i can't disable that setting. I think, that is the problem with the router-advertisement, but how is it possible to change that setting? It seems not to be supported to disable this setting, i can only disable ra-gurad for APs:

(Cisco Controller) >config ipv6 ra-guard ?

ap             Configures filter for Router Advertisement packets originating from client on AP.

If i try to disable ra-guard for the wlc, i get an error message:

(Cisco Controller) >config ipv6 ra-guard wlc

Incorrect usage.  Use the '?' or <TAB> key to list commands.

The APs are Cisco AIR-CAP2600I-E-K9 APs.

Any suggestions how to solve that issue?

Thanks in advance.

[jilse-iph]

It seems, that IPv6 forwarding of router-advertisements from wired ethernet to wireless is not supported on WLC 2504, if the APs are in flexconnect mode. After i changed the mode from "flexconnect" to "local", the issue disappearde and i see router-advertisement packets on the WLAN clients (and WLAN clients get the IPv6 configuration from router-advertisement, including prefix and default-gateway). So don't use flexconnect mode for APs, if you need to forward IPv6 RA from ethernet to WLAN with a WLC 2504.

[jilse-iph]

After changing the connection between WLC and APs from "flexconnect" to "local", the issue with IPv6 was gone. Seems, that the WLC2504 used here don't support a combination of flexconnect and IPv6 RA forwarding from WLC to the APs ...

[kerstin-534]

I have the same problem with APs in local mode, RAs can be seen some time and disappear to work after some hours (WLC in 8.3.111 code) 

[jilse-iph]

That seems to be a different issue. Since i changed the configuration from "flexconnect" to "local", i never saw the issue again: RAs were visible to WLAN clients every time.

[Jun Zhou]

I have the same issue on WLC8540 with version 8.5.120.0, which clients send RS but cannot get RA so that it cannot get an ipv6 address.

[aidan.manning]

We've been having the same issues with IPv6 with Flexconnect on WLC 5520

When there is no one online the issue disappears. Once users come online and the network starts to get a bit busy the issue come's back.

Our symptoms:

IPv6 wifi client doesn't initally receive the IPv6 RA during business hours or to be more precise, receives the RA after a few minutes up to 10 minutes. When network is quiet the problem is not there. The IPv6 RA gets to the AP but the AP doesn't send it on over the air.

We're working though the issue with Cisco TAC. They have been able to reproduce the issue

[support]

Hi Aidan,

have you received any news on this? We are seeing a similar issue on WLC 5508 with software version 8.2.151.0.

Wireless clients sometime do not receive Router Advertisements when connecting to a Wireless LAN. In this case, I don't see any RAs being sent to the wireless client (looking with Wireshark on the client). The RAs are however definitely sent by the router as clients in the same VLAN that are connected by cable are not affected by the problem and receive the RAs.

In addition to that, the wireless clients sporadically loose all information configured by the RAs. That is, they lose default gateway and on-link prefix information. It just disappears magically from the client so the client is not reachable from different subnets anymore.

After this happens, I don't see any Router Advertisements on the wireless client anymore. They are just not being sent to the wireless client.

Any help is appreciated

Thanks
Michael

[aidan.manning]

Hi Michael,

We are currently running an interim release that fixes the issue.

The fix will be released in June 85MR3

Regards,

Aidan.

[support]

Hi Aidan,

thanks for your reply. Am I right in assuming that you are running WLC software version 8.5? I suppose 85MR3 relates to a version in the 8.5 train.

Are you also facing the issue that the wireless clients sporadically loose their default gateway and prefix information received by previous RAs?

In our case, we see the symptoms described by you: Wireless clients don't receive RAs when connecting to the WLAN. However, when clients receive an RA and are configured with default gateway and prefix, the clients also sporadically loose this information. If this happens, we don't see any RAs on the clients wireless interface anymore. It appears as if they are being filtered out by the WLC or access point.

What I currently don't unterstand is why the client (tested with Windows 10 1709) drops the information received by previous RAs and what action tiggers this. When tracing with Wireshark, I don't see any other Router Advertisements indicating such a change to the client.

The only indication - though not always reproducible - is the following event 1006 from DHCPv6-Client in Windows Event Log that is indicating a status change on the wireless interface and being logged shortly after the clients looses all its RA-configured settings:

Router Advertisement settings have been changed on the network adapter 13. The current M - Managed Address Configuration flag is false and the O - Other Stateful Configuration flag is false. User Action: If you are seeing this event frequently, then it could be due to frequent change in M and O flag settings on the router in the network. Please contact your network administrator to have it resolved.

However, looking at the Wireshark trace, I don't see any Router Advertisements with O and M flag set to 0.

Really strange!

Best Regards,
Michael

[support]

Hi all,

we have performed the upgrade to 8.3.141.0 and the issue is fixed since then - Router Advertisements are continuously transmitted to the client again.

Let's hope the issue doesn't come back after the WLC is up for a particular amount of time.

BR
Michael

[support]

Unfortunately the problem has come back - IPv6 Router Advertisements are not received by the client anymore after some time. So 8.3.141.0 does not fix the issue!

I will create a case with TAC then.

[aidan.manning]

Hi Again,

We had to get an interim release that fixes the problem and this will be released in 85mr3 (expected in June but gets pushed out a lot)

We tried all sorts of fixes on our epic journey :)

Some fixes would work for a while but once the network go busy the RAs would drop or time out.

Our interim version is working ans stable.

With our symptoms, clients would get on the network out of hours or early morning with no problem, once the network/air started to get busy, sometimes a client would get on the network after 10 minutes but would drop again after a while. All related to multicasts getting lost it would seem.

Good luck!

[support]

Hi Aidan,

thanks for your reply. Are you currently running a software version from the 8.5 train? I suppose 85mr3 relates to 8.5 of the Wireless LAN controller software.

Are you also seeing that clients with Windows are loosing their default gateway information when the problem occues? As written above, our Windows clients are loosing all information received by the RAs when it happens. We also can see a log entry in Windows event log (as written above) that indicates a status change with Router Advertisments. If this event ID is logged, I can see that no RAs are received by the client anymore.

What I currently not understand is why Windows discards the information received from the RA - the default router actually has a router lifetime of 3600 seconds. So the default gateway should remain active until its lifetime expires. I also cannot see any ICMPv6 package that indicates that status change. It's just that the client stops receiving Router Advertisements. The client then sends some Router Solicitations and receives no replies - maybe this is what indicates Windows to drop its default gateway received from the previous RAs. I however was not able to reproduce this in a test environment.

The question is: What exactly do you mean with stating that the clients were dropped from the network? Is the wireless connection actually disconnected or are they loosing their IPv6 default gateway and therefore cannot reach other subnets anymore?

BR
Michael

[aidan.manning]

Looks like the fix is released:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn85mr3.html