Cisco 1841 IPv6 Configuration

[trevorseward]

I have a Cisco 1841 running 12.4(24)T8 receiving a DHCPv6 address from Comcast.

Basic config is:

fa0/0 (WAN -> Comcast modem)

ipv6 address dhcp

ipv6 enable

ipv6 traffic-filter wan-in in

ipv6 traffic-filter wan-out out

ipv6 verify unicast reverse-path

ipv6 dhcp client pd comcast-ipv6

fa0/1 (LAN)

ipv6 address comcast-ipv6 ::1/64

ipv6 enable

IPv6 access lists:

ipv6 access-list wan-in

permit icmp any any

permit udp any any eq 546

!

ipv6 access-list wan-out

permit icmp any any

permit ipv6 any any

!

IPv6 globals:

ipv6 unicast-routing

ipv6 cef

ipv6 inspect name traffic tcp

ipv6 inspect name traffic udp

ipv6 inspect name traffic icmp

I see fa0/0 and fa0/1 receive addresses, as do my internal clients.  Couple of questions:

Windows does not support statelesss DNSv6 configuration, so my thought was to pass DHCPv6 responsibilities to my Windows Server 2012 R2 DHCP service, in addition to preserve the registration of AAAA records via Dynamic DNS for clients.  If this is possible (to hand off the range provided by Comcast to my router, back to my Server 2012 R2 DHCP service), how is that configured?

Is there anything else I might be missing for basic IPv6 connectivity?

[Harold Ritter]

Hi Trevor,

As far as I know, MS supports DHCPv6 starting with Windows 7. Are you still running Windows XP? I am not sure it would be possible to delegate an IPv6 sub block to your Windows server.

Regards

[trevorseward]

MS does support DHCPv6, but Windows (any version, including 8.1/2012 R2) does not support stateless autoconfig of DNSv6 addresses.

[trevorseward]

Another issue I'm facing is that I can ping -6 and tracert to ipv6.google.com (from both the 1841 and Windows), but I can't actually use a browser to navigate there, test-ipv6.com also indicates I don't have an IPv6 address and indicates IPv6 times out when connecting to a browser.

I'm not sure if this has to do with my configuration on the router or not at this point.  It would seem like if I have IPv6 connectivity, sites like test-ipv6.com should at least show that I have an IPv6 address.

[trevorseward]

I figured out the lack of connectivity, I did not apply the inspect name "traffic" to the fa0/0 interface.  So now I can reach sites like ipv6.google.com, but performance is agonizingly slow.  And given that IPv6 is preferred over IPv4 when using dual-stack, this leads to a good portion of major sites being extremely slow.  Ping times are not the best to ipv6.google.com, about 150 - 180ms, but the browser will load for 60+ seconds before completing rendering of http://ipv6.google.com.

Is there something in my configuration I'm missing?

[Harold Ritter]

Trevor,

This sounds like it could be related to the path MTU. Can you try with www.google.com instead. This site is dual stacked, so there here is no need to use ipv6.google.com anymore.

Regards

[Harold Ritter]

Hi Trevor,

According to this MS Blog, Stateless DHCPv6 has been supported starting from Vista. I am fairly sure I testes this with Windows 7 myself.

http://blogs.technet.com/b/teamdhcp/archive/2007/01/23/dhcpv6-behaviour-in-windows-vista.aspx

Regards

[trevorseward]

I'll try with the O flag set and see if I can pick up DNSv6 (I'm able to get all of the other information from the RA).  What is really strange is that during IPv6 renewal (ipconfig /renew6), I see the DNSv6 address appear for a very short period of time before disappearing.

Right now I'm leveraging IPv4 for name lookups, which works.

I also found out the issue I was having was due to a bug in 12.4(24)T8 (unsure as to when it was corrected as I don't have access to the bug, but T8 is the latest T-train release for the 1841):

http://www.internode.on.net/support/guides/internet_access/ipv6/cisco_routers/

NOTE:

There is currently a bug

(CSCtb10776)

with IPv6 CBAC on Cisco which breaks TCP Window Scaling. Hence the "tcp" inspect module has been omitted and substituted with "permit tcp any any established".

[Harold Ritter]

Hi Trevor,

You would definitely need the O flag to obtain the DNS address. As for the mentioned bug, it should be fixed in the version you run (it was fixed in 12.4(24)T6). I'm attaching the info from CCO.

Regards

[trevorseward]

That is really strange.  When I had inspect for http on, I got the slow performance over IPv6 only.  As soon as I implemented the work around, performance improved to IPv4-alike speeds.

To give you an idea I was getting 16Mbps down from IPv4 while getting 0.01 -> 0.03 Mbps down with inspect http on for IPv6 using Comcast's speed test site.