IPv6 on Cisco 2800 and 3750

[mchance]

I have a Cisco 2821 connected OSPF to a Cisco 3750. I configured my outside port 

interface GigabitEthernet0/0
description OUTSIDE
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig
ipv6 enable

I am receiving an IPv6 address of 

2600:8807:9F02:1:90B8:CB64:58A9:2307, subnet is 2600:8807:9F02:1:90B8:CB64:58A9:2307/128

My question is; Now what? How do I get my other devices to get an IPv6 address? Everything I have found on it starts with the assumption of static IP's from my provider. Cox doesn't do static for anything unless you pay for the commercial account.

[Rich Uline]

McChance,

Although IPv6 doesn't have the concept of NAT, it does have a feature called prefix delegation that enables hosts on the inside of your network to obtain IP addresses from your ISP. You'll have to find out if and to what extent your ISP allows this, though. Take a look at this example configuration here, and this other example here.

[Harold Ritter]

Hi Rich,

Just a small correction. Although I would prefer not to use it, the concept of NAT is also present in IPv6. Here's some NAT66 example from the ASA configuration guide:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/firewall/asa-94-firewall-config/nat-reference.html#task_55C5A24F53604C018B377DC48A1115FA

Regards,

[Harold Ritter]

Hi Mike,

I'm glad you could get an ipv6 address through dhcp. The next step would be to try to get a prefix delegation prefix though dhcp as well. this would look somethink like this on the WAN interface:

int e0/0

 description WAN Interface

 ipv6 dhcp client pd PD_prefix

If your service provider implements prefix delegation, you will receive a PD prefix and you can then use the generic prefix (PD_prefix or whatever name you choose) to assign prefixes to you LAN interfaces.

int e0/1

 description LAN Interface 1

 ipv6 address PD_prefix ::1:0:0:1/64

int e0/2

 description LAN Interface 2

 ipv6 address PD_prefix ::2:0:0:1/64

int e0/3

 description LAN Interface 3

 ipv6 address PD_prefix ::3:0:0:1/64

...

The prefix size that will be received depends on your service provider ipv6 deployment.

Refer to the following document for more information on prefix delegation implementation in IOS.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6/configuration/15-2mt/ipv6-15-2mt-book/ip6-dhcp.html

Regards,

[mchance]

I must be doing something wrong. How do I know was the prefix delegation is? Calling Cox is out. They are dumb as a box of rock. They told me that IPv6 will cause problems with Windows....

[Harold Ritter]

You should be able to get an ipv6 PD prefix from Cox, according to some information I found on the net. You should be able to determine the PD prefix you received by using the following command:

show ipv6 dhcp interface

If you don't get anything, try adding the following command to the configuration I already provided:

ipv6 dhcp client pd hint ::/60

Regards,

[mchance]

This is the interface config

interface GigabitEthernet0/0
description OUTSIDE
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out

This is the output of sho ipv6 int

GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::21B:D4FF:FE80:A650
No Virtual link-local address(es):
Description: OUTSIDE
Stateless address autoconfig enabled
Global unicast address(es):
2600:8807:9F02:1:90B8:CB64:58A9:2307, subnet is 2600:8807:9F02:1:90B8:CB64:58A9:2307/128
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF80:A650
FF02::1:FFA9:2307
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
Input features: Access List Verify Unicast Reverse-Path
Output features: Access List
Inbound access list wan-in
IPv6 verify source reachable-via rx, allow default
0 verification drop(s) (process), 0 (CEF)
0 suppressed verification drop(s) (process), 0 (CEF)
Outgoing access list wan-out
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
ND advertised default router preference is Medium
Hosts use stateless autoconfig for addresses.

[Harold Ritter]

Can you please provide a "show ipv6 dhcp interface".

Regards,

[mchance]

Yes sir.

GigabitEthernet0/0 is in client mode
Prefix State is IDLE (0)
Information refresh timer expires in 23:27:09
Address State is OPEN
Renew for address will be sent in 07:39:42
List of known servers:
Reachable via address: FE80::A64C:11FF:FE8A:DADA
DUID: 000100015567324DF8BC123EDDA4
Preference: 0
Configuration parameters:
IA NA: IA ID 0x00030001, T1 43200, T2 69120
Address: 2600:8807:9F02:1:90B8:CB64:58A9:2307/128
preferred lifetime 86400, valid lifetime 86400
expires at Mar 02 2018 02:57 PM (76654 seconds)
DNS server: 2001:578:3F::30
DNS server: 2001:578:3F:1::30
Information refresh time: 0
Prefix Rapid-Commit: disabled
Address Rapid-Commit: disabled
Prefixes sent as hint:
::/60

[Harold Ritter]

Can you add "ipv6 address dhcp rapid-commit" to the wan interface and run "debug ipv6 dhcp".

Regards,

[mchance]

Ok. So what am I looking for?

[Harold Ritter]

Any clue that could explain why you are not receiving a prefix delegation. We might be able to help if you post the output.

Regards

[mchance]

Here is the debug output. It just keeps rolling and doesn't stop.

[mchance]

Looking through the output I see "IPV6_ND-4-DUPLICATE: Duplicate address". I wonder if this is the problem.

[mchance]

Any ideas based on that log?