Solved: I tried it as of now I don't - Page 2

jkay18041 · ‎11-16-2016

Can someone tell me if I've got my ipv6 config setup correctly? I can't seem to get an ipv6 address from my isp. I was told they will give me a /60 and I can't seem to be able to pull one.

Here is my config

hostname Router2821
!
boot-start-marker
boot system flash c2800nm-adventerprisek9-mz.151-4.M10.bin
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
ip domain name Home
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool Cox
prefix-delegation pool Cox-ipv6
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
!
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-12109904
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-12109904
revocation-check none
rsakeypair TP-self-signed-12109904
!
!
crypto pki certificate chain TP-self-signed-12109904
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31323130 39393034 3535301E 170D3135 30323037 30343433
34365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32313039
39303435 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DEDD 726BDA99 E054D416 25F93046 BA91A4E0 56C8CA07 73097F64 CE01A6B0
82A6B25B 100A95D8 89EDB16C 48533CA0 B9FA8B94 E0B784E5 D3D6296D FBB1E657
CE65F44D 25E4A34C EAFC2083 722B9D6F 03944291 DF793346 50CF786B 9BC645CD
4934D862 D8142CD5 F04F35ED C5D49059 C33689FF 3B21A5EF 245FE4E2 81C65EE8
4C950203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 1445F1A7 19FEAD5F 65BFB327 5BFAE732 0644DF75 E5301D06
03551D0E 04160414 45F1A719 FEAD5F65 BFB3275B FAE73206 44DF75E5 300D0609
2A864886 F70D0101 05050003 81810061 A3041694 8D1BD946 E2417879 21D16C4C
7C14F25A 3C4E6379 D7EAF817 2BB689C3 FA53DF50 4E30B741 410401E9 C1AE8BAD
9B7CA010 4DEC3D9B 742B36A0 494B3657 25B7F117 706557B2 8B22C6BC 5F0E7E02
2AFA7C9D F7831580 D6A71AD9 7C0804E8 350CF09B 9CCAE9AE BFAD3716 AB45860C
AD7D4855 8FFFC121 37E1E5FC CFCCF3
quit
!
!
license udi pid CISCO2821 sn FTX1121A2NU
username admin privilege 15 password 7 13432E3A21272D723E
!
redundancy
!
!
ip ssh time-out 70
ip ssh authentication-retries 2
ip ssh version 2
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1/64
ipv6 address autoconfig
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface GigabitEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface GigabitEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 10.10.1.249 22 interface GigabitEthernet0/0 1022
ip nat inside source static tcp 192.168.2.7 80 interface GigabitEthernet0/0 1080
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 1081
ip nat inside source static tcp 10.10.1.247 42365 interface GigabitEthernet0/0 42365
ip nat inside source static tcp 10.10.1.247 5500 interface GigabitEthernet0/0 5500
ip nat inside source static tcp 10.10.1.247 5501 interface GigabitEthernet0/0 5501
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://*************/dynamic/update.php?YXRNRVgzN3B
frequency 120
ip sla schedule 1 life forever start-time now
access-list 122 deny tcp any eq 22 any
access-list 122 permit tcp 10.0.0.0 0.255.255.255 any
!
!
!
!
snmp-server community fast_ RO
snmp-server host 10.10.1.249 version 2c fast_
!
!
!
!
ipv6 access-list wan-in
permit icmp any any
permit udp any any eq 546
permit tcp any any established
sequence 100 deny ipv6 any any
!
ipv6 access-list wan-out
permit icmp any any
permit tcp any any
permit udp any any
sequence 100 deny ipv6 any any
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
access-class 122 in
privilege level 15
password 7 05D3F270B6
transport input ssh
!
scheduler allocate 20000 1000
end

any advice would be greatly appreciated. Thank you!

Georg Pauwen · ‎11-17-2016

Hello,

your Gig0/0 is getting an IPv6 address, right ? I am thinking the problem might be with the subinterfaces on the LAN side. Can you put the configuration of interface GigabitEthernet0/1.1 on the physical interface, GigabitEthernet0/1 ? And make GigabitEthernet0/1 a simple layer 3 interface, with no subinterfaces ?

jkay18041 · ‎11-17-2016

Yes I'm getting a /60 on the WAN interface. The problem is if I take away the sub interfaces I don't have a 3rd physical interface to use for my guest network since I use the router to route the vlans

Georg Pauwen · ‎11-17-2016

I am going to lab this in GNS3, hopefully I'll come up with something.

By the way, I am in Europe, so you are 7 hours behind me, which explains my silence starting at 5PM your local time...:)

jkay18041 · ‎11-17-2016

No problem. I am going to try the config on a 2911 router with a newer version of IOS and see if it does the same thing.

Georg Pauwen · ‎11-18-2016

Hello,

I have a config like this working in a lab environment:

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1/64
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox

jkay18041 · ‎11-18-2016

I will give that a try right now. I did try on a 2921 last night and had same results.

I will let you know if this config works.

Thank you!

jkay18041 · ‎11-18-2016

I tried it as of now I don't have an IPv6 address on the g0/1.1 interface except a FE80, however I'll give it some time as the WAN interface took quite some time to get an IPv6 address that wasn't FE80 as well.

Here is my config as it is now.

Current configuration : 6217 bytes
!
! Last configuration change at 16:44:20 UTC Fri Nov 18 2016 by admin
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router2821
!
boot-start-marker
boot system flash c2800nm-adventerprisek9-mz.151-4.M10.bin
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
ip domain name Home
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ipv6 unicast-routing
ipv6 cef
ipv6 cef accounting per-prefix
ipv6 dhcp pool Cox
prefix-delegation pool Cox-ipv6
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
!
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-12109
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-12109
revocation-check none
rsakeypair TP-self-signed-1210990455
!
!
crypto pki certificate chain TP-self-signed-12109
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101
quit
!
!
license udi pid CISCO2821 sn
username admin privilege 15 password 7
!
redundancy
!
!
ip ssh time-out 70
ip ssh authentication-retries 2
ip ssh version 2
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1/64
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface GigabitEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface GigabitEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 10.10.1.249 22 interface GigabitEthernet0/0 1022
ip nat inside source static tcp 192.168.2.7 80 interface GigabitEthernet0/0 1080
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 1081
ip nat inside source static tcp 10.10.1.247 42365 interface GigabitEthernet0/0 42365
ip nat inside source static tcp 10.10.1.247 5500 interface GigabitEthernet0/0 5500
ip nat inside source static tcp 10.10.1.247 5501 interface GigabitEthernet0/0 5501
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://?
frequency 120
ip sla schedule 1 life forever start-time now
access-list 122 deny tcp any eq 22 any
access-list 122 permit tcp 10.0.0.0 0.255.255.255 any
!
!
!
!
snmp-server community fast_stats RO
snmp-server host 10.10.1.249 version 2c fast_stats
!
!
!
!
ipv6 access-list wan-in
permit icmp any any
permit udp any any eq 546
permit tcp any any established
sequence 100 deny ipv6 any any
!
ipv6 access-list wan-out
permit icmp any any
permit tcp any any
permit udp any any
sequence 100 deny ipv6 any any
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
access-class 122 in
privilege level 15
password 7
transport input ssh
!
scheduler allocate 20000 1000
end

Georg Pauwen · ‎11-18-2016

Hello,

can you do a 'debug ipv6 dhcp' to see if at least a dhcp request goes out ?

jkay18041 · ‎11-18-2016

Here is what I get

*Nov 18 19:08:28.786: IPv6 DHCP: Received INFORMATION-REQUEST from FE80::A64C:11FF:FE84:7425 on GigabitEthernet0/1.1
*Nov 18 19:08:28.786: IPv6 DHCP: Received SOLICIT from FE80::A64C:11FF:FE84:7425 on GigabitEthernet0/1.1
*Nov 18 19:08:28.786: IPv6 DHCP: Using interface pool Cox
*Nov 18 19:08:28.786: IPv6 DHCP: Source Address from SAS FE80::21B:D4FF:FEEE:A601

*Nov 18 19:08:28.786: IPv6 DHCP: Sending REPLY to FE80::A64C:11FF:FE84:7425 on GigabitEthernet0/1.1
*Nov 18 19:08:28.790: IPv6 DHCP: Using interface pool Cox
*Nov 18 19:08:28.790: IPv6 DHCP: Creating binding for FE80::A64C:11FF:FE84:7425 in pool Cox
*Nov 18 19:08:28.790: IPv6 DHCP: Binding for IA_NA 000B0001 not found
*Nov 18 19:08:28.790: IPv6 DHCP: Allocating IA_NA 000B0001 in binding for FE80::A64C:11FF:FE84:7425
*Nov 18 19:08:28.790: IPv6 DHCP: Freeing IA_NA 000B0001 from binding for FE80::A64C:11FF:FE84:7425
*Nov 18 19:08:28.790: IPv6 DHCP: Freeing binding for FE80::A64C:11FF:FE84:7425 from pool Cox
*Nov 18 19:08:28.790: IPv6 DHCP: Source Address from SAS FE80::21B:D4FF:FEEE:A601

*Nov 18 19:08:28.790: IPv6 DHCP: Sending ADVERTISE to FE80::A64C:11FF:FE84:7425 on GigabitEthernet0/1.1

Georg Pauwen · ‎11-18-2016

Hello,

can you check if interface GigabitEthernet0/0.1 supports the command 'ipv6 address dhcp' ? And if so, configure it ?

jkay18041 · ‎11-18-2016

This is what I get

Router2821(config-subif)#ipv6 address dhcp
% Interface is in DHCP server mode

I tried removing "ipv6 dhcp server cox" and tried adding "ipv6 address dhcp" then I tried adding "ipv6 address autoconfig" still no IPv6 address on that interface.

Georg Pauwen · ‎11-18-2016

I think you have to take out the 'ipv6 dhcp server Cox' line first...then you can add that command.

I would leave debugging on and see what happens when you enter that command...

jkay18041 · ‎11-18-2016

Here is my current config for those interfaces and the debugging

interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address dhcp
ipv6 address Cox-ipv6 ::1/64
ipv6 enable
ipv6 nd other-config-flag
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in

*Nov 18 21:16:18.126: IPv6 DHCP: Sending SOLICIT to FF02::1:2 on GigabitEthernet0/1.1

Georg Pauwen · ‎11-18-2016

Hello,

I am looking around in other forums...hard to find what seems to me a fairly straight forward config, especially since Cox is not really a small ISP...

Either way, I have found this, you might as well give it a try:

ipv6 address dhcp
ipv6 enable
ipv6 nd reachable-time 3600000
ipv6 nd ra suppress all
ipv6 dhcp client pd Cox-ipv6

jkay18041 · ‎11-18-2016

This is what I have now

interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address dhcp
ipv6 enable
ipv6 nd reachable-time 3600000
ipv6 nd ra suppress all
ipv6 dhcp client pd Cox-ipv6

when I do "show ipv6 interface brief" I get this

GigabitEthernet0/0 [up/up]
FE80::21B:D4FF:FEEE:A600
2600:8803:7F11:500:DE6:DB19:19B0:B3BF
GigabitEthernet0/1 [up/up]
unassigned
GigabitEthernet0/1.1 [up/up]
FE80::21B:D4FF:FEEE:A601
GigabitEthernet0/1.2 [up/up]
unassigned
NVI0 [administratively down/down]

ipv6 dhcp request issue from isp