Solved: ipv6 dhcp request issue from isp

jkay18041 · ‎11-16-2016

Can someone tell me if I've got my ipv6 config setup correctly? I can't seem to get an ipv6 address from my isp. I was told they will give me a /60 and I can't seem to be able to pull one.

Here is my config

hostname Router2821
!
boot-start-marker
boot system flash c2800nm-adventerprisek9-mz.151-4.M10.bin
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
ip domain name Home
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool Cox
prefix-delegation pool Cox-ipv6
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
!
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-12109904
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-12109904
revocation-check none
rsakeypair TP-self-signed-12109904
!
!
crypto pki certificate chain TP-self-signed-12109904
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31323130 39393034 3535301E 170D3135 30323037 30343433
34365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32313039
39303435 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DEDD 726BDA99 E054D416 25F93046 BA91A4E0 56C8CA07 73097F64 CE01A6B0
82A6B25B 100A95D8 89EDB16C 48533CA0 B9FA8B94 E0B784E5 D3D6296D FBB1E657
CE65F44D 25E4A34C EAFC2083 722B9D6F 03944291 DF793346 50CF786B 9BC645CD
4934D862 D8142CD5 F04F35ED C5D49059 C33689FF 3B21A5EF 245FE4E2 81C65EE8
4C950203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 1445F1A7 19FEAD5F 65BFB327 5BFAE732 0644DF75 E5301D06
03551D0E 04160414 45F1A719 FEAD5F65 BFB3275B FAE73206 44DF75E5 300D0609
2A864886 F70D0101 05050003 81810061 A3041694 8D1BD946 E2417879 21D16C4C
7C14F25A 3C4E6379 D7EAF817 2BB689C3 FA53DF50 4E30B741 410401E9 C1AE8BAD
9B7CA010 4DEC3D9B 742B36A0 494B3657 25B7F117 706557B2 8B22C6BC 5F0E7E02
2AFA7C9D F7831580 D6A71AD9 7C0804E8 350CF09B 9CCAE9AE BFAD3716 AB45860C
AD7D4855 8FFFC121 37E1E5FC CFCCF3
quit
!
!
license udi pid CISCO2821 sn FTX1121A2NU
username admin privilege 15 password 7 13432E3A21272D723E
!
redundancy
!
!
ip ssh time-out 70
ip ssh authentication-retries 2
ip ssh version 2
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1/64
ipv6 address autoconfig
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface GigabitEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface GigabitEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 10.10.1.249 22 interface GigabitEthernet0/0 1022
ip nat inside source static tcp 192.168.2.7 80 interface GigabitEthernet0/0 1080
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 1081
ip nat inside source static tcp 10.10.1.247 42365 interface GigabitEthernet0/0 42365
ip nat inside source static tcp 10.10.1.247 5500 interface GigabitEthernet0/0 5500
ip nat inside source static tcp 10.10.1.247 5501 interface GigabitEthernet0/0 5501
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://*************/dynamic/update.php?YXRNRVgzN3B
frequency 120
ip sla schedule 1 life forever start-time now
access-list 122 deny tcp any eq 22 any
access-list 122 permit tcp 10.0.0.0 0.255.255.255 any
!
!
!
!
snmp-server community fast_ RO
snmp-server host 10.10.1.249 version 2c fast_
!
!
!
!
ipv6 access-list wan-in
permit icmp any any
permit udp any any eq 546
permit tcp any any established
sequence 100 deny ipv6 any any
!
ipv6 access-list wan-out
permit icmp any any
permit tcp any any
permit udp any any
sequence 100 deny ipv6 any any
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
access-class 122 in
privilege level 15
password 7 05D3F270B6
transport input ssh
!
scheduler allocate 20000 1000
end

any advice would be greatly appreciated. Thank you!

Georg Pauwen · ‎11-21-2016

Hello,

can you do the following:

1) take all the IPv6 config off your GigabitEthernet0/1.1 interface

2) turn on 'debug ipv6 dhcp'

3) enter the configuration as listed below and check for the debug output after entering each line

By the way, the parts marked in bold must match, your pd must also appear in the ipv6 address of GigabitEthernet0/0/1.

interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::/64 eui-64
ipv6 address autoconfig
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox

View solution in original post

Georg Pauwen · ‎11-16-2016

Hello,

try a 56, and/or add rapid commit to the config:

interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp rapid-commit
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/56
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out

Georg Pauwen · ‎11-16-2016

Or 'ipv6 dhcp client pd hint ::/64'

jkay18041 · ‎11-16-2016

Tried the rapid-commit and it didn't work, however when I changed it back to ipv6 address dhcp I did get an IPv6 address. I can see now it did give me a /60 on my WAN interface

Also on the my LAN side I still don't get an IP for ipv6, does that setting on int g0/1.1 look correct?

I get this when I view show ipv6 dhcp interface

GigabitEthernet0/1.1 is in server mode
Using pool: Cox
Preference value: 0
Hint from client: ignored
Rapid-Commit: disabled

Thank you for your help!

Georg Pauwen · ‎11-16-2016

Hello,

I am pulling this from a working config:

interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp rapid-commit
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/56
ipv6 dhcp client pd prefix-from-Cox rapid-commit
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::/64
ipv6 address autoconfig
ipv6 enable
ipv6 nd managed-config-flag
ipv6 dhcp server Cox

jkay18041 · ‎11-16-2016

I made a few changes, and still get an IPv6 address on WAN and it shows I pulled a /60. However I can't seem to get my client computers on VLAN 1 (haven't even messed with VLAN 2 yet) to pull a ipv6 address. I did check and it appears my ISP Cox doesn't support rapid-commit. I am also having issues with int g0/1.1 getting an address other than a FE80

Here is my config as of now with your help on some of the changes

boot-start-marker
boot system flash c2800nm-adventerprisek9-mz.151-4.M10.bin
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
ip domain name Home
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool Cox
prefix-delegation pool Cox-ipv6
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
!
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-12109904
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-12109904
revocation-check none
rsakeypair TP-self-signed-12109904
!
!
crypto pki certificate chain TP-self-signed-12109904
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31323130 39393034 3535301E 170D3135 30323037 30343433
34365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32313039
39303435 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DEDD 726BDA99 E054D416 25F93046 BA91A4E0 56C8CA07 73097F64
82A6B25B 100A95D8 89EDB16C 48533CA0 B9FA8B94 E0B784E5 D3D6296D FBB1E657
CE65F44D 25E4A34C EAFC2083 722B9D6F 03944291 DF793346 50CF786B 9BC645CD
4934D862 D8142CD5 F04F35ED C5D49059 C33689FF 3B21A5EF 245FE4E2
4C950203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 1445F1A7 19FEAD5F 65BFB327 5BFAE732 0644DF75 E5301D06
03551D0E 04160414 45F1A719 FEAD5F65 BFB3275B FAE73206 44DF75E5 300D0609
2A864886 F70D0101 05050003 81810061 A3041694 8D1BD946 E2417879 21D16C4C
7C14F25A 3C4E6379 D7EAF817 2BB689C3 FA53DF50 4E30B741 410401E9 C1AE8BAD
9B7CA010 4DEC3D9B 742B36A0 494B3657 25B7F117 706557B2 8B22C6BC 5F0E7E02
2AFA7C9D F7831580 D6A71AD9 7C0804E8 350CF09B 9CCAE9AE BFAD3716
AD7D4855 8FFFC121 37E1E5FC CFCCF3
quit
!
!
license udi pid CISCO2821 sn FTX1121A
username admin privilege 15 password 7 13432E3A21

redundancy
!
!
ip ssh time-out 70
ip ssh authentication-retries 2
ip ssh version 2
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1:0:0:0:1/64
ipv6 address autoconfig
ipv6 enable
ipv6 nd managed-config-flag
ipv6 dhcp server Cox
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface GigabitEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface GigabitEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 10.10.1.249 22 interface GigabitEthernet0/0 1022
ip nat inside source static tcp 192.168.2.7 80 interface GigabitEthernet0/0 1080
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 1081
ip nat inside source static tcp 10.10.1.247 42365 interface GigabitEthernet0/0 42365
ip nat inside source static tcp 10.10.1.247 5500 interface GigabitEthernet0/0 5500
ip nat inside source static tcp 10.10.1.247 5501 interface GigabitEthernet0/0 5501
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://***********/dynamic/update.php?YXRN
frequency 120
ip sla schedule 1 life forever start-time now
access-list 122 deny tcp any eq 22 any
access-list 122 permit tcp 10.0.0.0 0.255.255.255 any
!
!
!
!
snmp-server community fast_ RO
snmp-server host 10.10.1.249 version 2c fast_
!
!
!
!
ipv6 access-list wan-in
permit icmp any any
permit udp any any eq 546
permit tcp any any established
sequence 100 deny ipv6 any any
!
ipv6 access-list wan-out
permit icmp any any
permit tcp any any
permit udp any any
sequence 100 deny ipv6 any any
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
access-class 122 in
privilege level 15
password 7 054D3F270B
transport input ssh
!
scheduler allocate 20000 1000
end

Georg Pauwen · ‎11-16-2016

Hello,

config looks okay, but since it is not working, I am suggesting this (again, from a working config):

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::2:0:0:0:1/64
--> ipv6 address autoconfig remove this
ipv6 enable
ipv6 nd managed-config-flag
ipv6 dhcp server Cox

jkay18041 · ‎11-16-2016

Here is the config for that interface now

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::2:0:0:0:1/64
ipv6 enable
ipv6 nd managed-config-flag
ipv6 dhcp server Cox

I still only get a FE80 address when I do show ipv6 interface brief.

Not sure what's going on.

Thanks again for your help

Georg Pauwen · ‎11-16-2016

Can you post the output of 'show ipv6 interface GigabitEthernet0/0' (the interface you are getting an address on) ? I want to try and configure a static address on the LAN interface...

jkay18041 · ‎11-16-2016

GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::21B:D4FF:FEEE:A600
No Virtual link-local address(es):
Description: WAN
Stateless address autoconfig enabled
Global unicast address(es):
2600:8803:7F11:500:94D6:****:****:****, subnet is 2600:8803:7F11:500:94D6:****:****:****/128
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF4D:DE8B
FF02::1:FFEE:A600
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
Input features: Common pak subblock Access List Verify Unicast Reverse-Path
Output features: Access List Firewall Inspection
Inbound access list wan-in
IPv6 verify source reachable-via rx, allow default
0 verification drop(s) (process), 0 (CEF)
0 suppressed verification drop(s) (process), 0 (CEF)
Outgoing access list wan-out
Outbound Inspection Rule traffic
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
ND advertised default router preference is Medium
Hosts use stateless autoconfig for addresses.

Georg Pauwen · ‎11-16-2016

Hello,

I actually need the output of:

Global unicast address(es):
2600:8803:7F11:500:94D6:****:****:****, subnet is 2600:8803:7F11:500:94D6:****:****:****/128

You can also calculate the addresses derived from the subnet, using this calculator:

https://www.ultratools.com/tools/ipv6CIDRToRange

Type in the output of ' subnet is 2600:8803:7F11:500:94D6:****:****:****/128' and then configure one of the available addresses on the LAN interface, using the 'ipv6 address' interface command...

jkay18041 · ‎11-16-2016

I must not be understanding, sorry. When I go to the website and type it in I get this

Start Range: 2600:8803:7f11:500:94d6:****:d54d:de8b

End Range: 2600:8803:7f11:500:94d6:****:d54d:de8b

No. of host: 1

Georg Pauwen · ‎11-17-2016

Hello,

on second thought, assigning a static address wouldn't really be a solution, we need to get the DHCP to work.

I have done some research and come up with the three configs below. Can you try those ?

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1:0:0:0:1/64
ipv6 enable

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1/64
ipv6 enable

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address autoconfig
ipv6 enable

jkay18041 · ‎11-17-2016

I tried all 3 configs and still no DHCP address on that interface. I set the config back to the top one on your list of 3 in hopes maybe it takes more than a few minutes for it to grab an IP.

Thanks again for the help

jkay18041 · ‎11-17-2016

I've tried a few other things with no luck. Do you think I've configured the gigabit 0/0 interface wrong?