IPv6 LAN issue

[phanxdung]

Hi all, I deployed IPv4/IPv6 in my network but I have a problem with my IPv6 LAN. I have FWSM in 6509 to divide VLAN use trunking on switch to extention my network. From client I cannot ping to IPv6 address of FWSM, sometime ping ok, sometime cannot ping but ping IPv4 address is good . Connection from client to FWSM  as follows: client-SW1-SW2-6509. I test connection client connect to SW1 to client connect to 6509, it has the same problem. But on SW1 ping is good. Anyone saw this issue? Thanks in advance.

[phanxdung]

I verifiy that FWSM didn't received ND  the host send to the FW ( I did test and debug on the spare FWSM on the other 6509). 

Result of the command

sh mac-address-table address 3333.ff00.0001

SW6509-1>sh mac-address-table address 3333.ff00.0001

Legend: * - primary entry

        age - seconds since last seen

        n/a - not available

  vlan   mac address     type    learn     age              ports

------+----------------+--------+-----+----------+--------------------------

Module 2:

*   11  3333.ff00.0001    static  Yes          -  

*    2  3333.ff00.0001    static  Yes          -   Gi5/2

*    5  3333.ff00.0001    static  Yes          -  

Active Supervisor:

*   11  3333.ff00.0001    static  Yes          -  

*    2  3333.ff00.0001    static  Yes          -   Gi5/2

*    5  3333.ff00.0001    static  Yes          -  

Standby Supervisor:

*   11  3333.ff00.0001    static  Yes          -  

*    2  3333.ff00.0001    static  Yes          -   Gi5/2

*    5  3333.ff00.0001    static  Yes          -  

SW6509-2>sh mac-address-table address 3333.ff00.0001

Legend: * - primary entry

        age - seconds since last seen

        n/a - not available

  vlan   mac address     type    learn     age              ports

------+----------------+--------+-----+----------+--------------------------

No entries present.

SW6509-2 - the switch was connected to PC

SW6509-1 : the switch was connected to the FW switch

Regards

[Harold Ritter]

Hi Phanxdung,

Interesting that SW6509-2 does not have any entries for that mac address. Do you run the same level of IOS on both SW6509-1 and SW6509-2? Which IOS release is it?

Regards

[phanxdung]

Hi, Ritter

They run diferent IOS, Interesting that SW6509-2 support IPv6, and SW6509-1 doesn't support IPv6

SW-6509-2: s72033-ipservicesk9_wan-mz.122-33.SXJ1.bin

SW-6509-1: s72033-ipservicesk9_wan-mz.122-33.SXH1.bin

Regards,

[Harold Ritter]

Hi Phanxdung,

The issue should not have anything to do with whether these two devices support IPv6 or not as they are use purely as L2 devices. Would it be possible for you to provide me the full configs for both SW6509-1 and SW6509-2.

Regards

[phanxdung]

Dear Ritter

Here is full configuration of the both switch in attachment files.

Regards,

[Harold Ritter]

Hi phanxdung,

Could you please let me know which physical ports the PC and FW are connected to respectively.

Regards

[phanxdung]

Dear Ritter,

Sorry reply to you late,

Physical port of PC is Gi2/32 - SW6509-2, Physical port of FW connection is Gi9/15- SW6509-1, trunking port between 2 switch is Port channel 22.

Regards,

Phan

[Harold Ritter]

Hi Phan,

You previously mentioned something that I have questions about.

"I test it another VLAN, It's the same. I think it maybe the issue is at  layer 2. Note that I configured IPv6 address on SW that connected to PC.  I tried pinging, it is good. but PC is not. I use wireshark for capture  packet, It seem problem with NDP packet from PC to FWSM. PC send  Neighbor Sociltation to FWSM, but FWSM cannot received this message."

What did you mean by "I tried pinging, it is good. but PC is not.". In the first part of this statement, you say that it works but then you say "but PC is not". Could you please clarify?

Regards

[phanxdung]

It mean I tried pinging IPv6 from PC to SW-6509-2 ( PC connect to it), It was good, Both PC and the switch ping FW is the same result.

Regards

[Harold Ritter]

Hi Phan,

Just to further troubleshoot the issue, could you keep SW-6509-2 as L2 switch, enable IPv6 on SW-6509-1 and try to ping from PC to SW-6509-1. If that works, configure SW-6509-2 and SW-6509-1 as L2 switch and configure ipv6 on the 3rd 6509 but not on the FW module, ping from PC and 3rd 6509 and see if that works. If it does, it will clearly tell us that the issue is with the FW.

Regards

[phanxdung]

We don't have plan for upgrade IOS at the moment. So I tried checking on PC connected to SW-6509-1 on the below topology. PC1-----SW6509-1------SW-6509-2--------PC2. The result is the same error. I used a router to replace PC2, the result's not different.

Regards

[Harold Ritter]

Hi Phan,

I think it would be worth in this new topology to run wireshark (or other sniffer software) on the receiving PC to capture packets while pinging from the other.

Regards

[phanxdung]

Hi Ritter,

I decided upgarde IOS SW6509-1, And It is good. I tried to capture packets as you said. It lost on the switch SW6509-1.

Thank you for your support, Hope you find a correct answer.

Regards

Phan

[Harold Ritter]

Hi Phan,

I am glad to hear that it is now working.

Regard