ipv6 dhcp request issue from isp

[jkay18041]

Can someone tell me if I've got my ipv6 config setup correctly? I can't seem to get an ipv6 address from my isp. I was told they will give me a /60 and I can't seem to be able to pull one.

Here is my config

hostname Router2821
!
boot-start-marker
boot system flash c2800nm-adventerprisek9-mz.151-4.M10.bin
boot-end-marker
!
!
no logging console
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
ip domain name Home
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool Cox
prefix-delegation pool Cox-ipv6
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
!
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-12109904
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-12109904
revocation-check none
rsakeypair TP-self-signed-12109904
!
!
crypto pki certificate chain TP-self-signed-12109904
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31323130 39393034 3535301E 170D3135 30323037 30343433
34365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 32313039
39303435 3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100DEDD 726BDA99 E054D416 25F93046 BA91A4E0 56C8CA07 73097F64 CE01A6B0
82A6B25B 100A95D8 89EDB16C 48533CA0 B9FA8B94 E0B784E5 D3D6296D FBB1E657
CE65F44D 25E4A34C EAFC2083 722B9D6F 03944291 DF793346 50CF786B 9BC645CD
4934D862 D8142CD5 F04F35ED C5D49059 C33689FF 3B21A5EF 245FE4E2 81C65EE8
4C950203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 1445F1A7 19FEAD5F 65BFB327 5BFAE732 0644DF75 E5301D06
03551D0E 04160414 45F1A719 FEAD5F65 BFB3275B FAE73206 44DF75E5 300D0609
2A864886 F70D0101 05050003 81810061 A3041694 8D1BD946 E2417879 21D16C4C
7C14F25A 3C4E6379 D7EAF817 2BB689C3 FA53DF50 4E30B741 410401E9 C1AE8BAD
9B7CA010 4DEC3D9B 742B36A0 494B3657 25B7F117 706557B2 8B22C6BC 5F0E7E02
2AFA7C9D F7831580 D6A71AD9 7C0804E8 350CF09B 9CCAE9AE BFAD3716 AB45860C
AD7D4855 8FFFC121 37E1E5FC CFCCF3
quit
!
!
license udi pid CISCO2821 sn FTX1121A2NU
username admin privilege 15 password 7 13432E3A21272D723E
!
redundancy
!
!
ip ssh time-out 70
ip ssh authentication-retries 2
ip ssh version 2
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::1/64
ipv6 address autoconfig
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface GigabitEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface GigabitEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 10.10.1.249 22 interface GigabitEthernet0/0 1022
ip nat inside source static tcp 192.168.2.7 80 interface GigabitEthernet0/0 1080
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 1081
ip nat inside source static tcp 10.10.1.247 42365 interface GigabitEthernet0/0 42365
ip nat inside source static tcp 10.10.1.247 5500 interface GigabitEthernet0/0 5500
ip nat inside source static tcp 10.10.1.247 5501 interface GigabitEthernet0/0 5501
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://*************/dynamic/update.php?YXRNRVgzN3B
frequency 120
ip sla schedule 1 life forever start-time now
access-list 122 deny tcp any eq 22 any
access-list 122 permit tcp 10.0.0.0 0.255.255.255 any
!
!
!
!
snmp-server community fast_ RO
snmp-server host 10.10.1.249 version 2c fast_
!
!
!
!
ipv6 access-list wan-in
permit icmp any any
permit udp any any eq 546
permit tcp any any established
sequence 100 deny ipv6 any any
!
ipv6 access-list wan-out
permit icmp any any
permit tcp any any
permit udp any any
sequence 100 deny ipv6 any any
!
control-plane
!
!
!
!
mgcp profile default
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
access-class 122 in
privilege level 15
password 7 05D3F270B6
transport input ssh
!
scheduler allocate 20000 1000
end

any advice would be greatly appreciated. Thank you!

[jkay18041]

I might be a little confused now. I deleted the ipv6 dhcp client pd Cox-ipv6 then added ipv6 dhcp client pd prefix-from-Cox and on the Lan interface and got this message

Invalid PD name. Already configured on gigabitehternet0/0

[Georg Pauwen]

Hello,

ok, I was just wondering if the router edited that pd name or if it was actually configured. Never mind.

I have put out a couple of posts on other forums, hopefully I'll get an answer...

[jkay18041]

oh ok, yeah I just put that in as a description.

Thank you for all your help. I did some google searches yesterday and found how a few people using comcast set it up and didn't have any luck on that working either.

[Georg Pauwen · Accepted solution]

Hello,

can you do the following:

1) take all the IPv6 config off your GigabitEthernet0/1.1 interface

2) turn on 'debug ipv6 dhcp'

3) enter the configuration as listed below and check for the debug output after entering each line

By the way, the parts marked in bold must match, your pd must also appear in the ipv6 address of GigabitEthernet0/0/1.

interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd prefix-from-Cox
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out

interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::/64 eui-64
ipv6 address autoconfig
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox

[jkay18041]

I will give this a try and let you know how it works.

Thank you!

[jkay18041]

I got the config fixed and still no IPv6 address on LAN side. Maybe it takes a bit to grab one? No errors on dhcp logging either.

Here is the config. I'll report back after lunch and see if maybe by then if it grabbed an IP

UPDATE: still no lan ipv6 address

*Nov 21 19:28:19.231: IPv6 DHCP: Received INFORMATION-REQUEST from FE80::A64C:11FF:FE84:72A9 on GigabitEthernet0/1.1
*Nov 21 19:28:19.231: IPv6 DHCP: Received SOLICIT from FE80::A64C:11FF:FE84:72A9 on GigabitEthernet0/1.1
*Nov 21 19:28:19.231: IPv6 DHCP: Using interface pool Cox
*Nov 21 19:28:19.231: IPv6 DHCP: Source Address from SAS FE80::21B:D4FF:FEEE:A601

*Nov 21 19:28:19.231: IPv6 DHCP: Sending REPLY to FE80::A64C:11FF:FE84:72A9 on GigabitEthernet0/1.1
*Nov 21 19:28:19.231: IPv6 DHCP: Using interface pool Cox
*Nov 21 19:28:19.231: IPv6 DHCP: Creating binding for FE80::A64C:11FF:FE84:72A9 in pool Cox
*Nov 21 19:28:19.231: IPv6 DHCP: Binding for IA_NA 00090001 not found
*Nov 21 19:28:19.231: IPv6 DHCP: Allocating IA_NA 00090001 in binding for FE80::A64C:11FF:FE84:72A9
*Nov 21 19:28:19.231: IPv6 DHCP: Freeing IA_NA 00090001 from binding for FE80::A64C:11FF:FE84:72A9
*Nov 21 19:28:19.231: IPv6 DHCP: Freeing binding for FE80::A64C:11FF:FE84:72A9 from pool Cox
*Nov 21 19:28:19.231: IPv6 DHCP: Source Address from SAS FE80::21B:D4FF:FEEE:A601

*Nov 21 19:28:19.231: IPv6 DH

UPDATE 2: After rebooting the router I now get an IPv6 address on the Lan and my desktop pc gets one as well....however I now do not have an IPv6 address on my WAN for some reason. I can also not ping out using IPv6 from desktop or router.

with this error *Nov 21 20:42:47.439: %IPV6_ND-4-DUPLICATE: Duplicate address 2600:8803:7F11:500:****:****:****:**** on GigabitEthernet0/0

.



! Last configuration change at 17:50:35 UTC Mon Nov 21 2016 by admin
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname Router2821
!
boot-start-marker
boot system flash c2800nm-adventerprisek9-mz.151-4.M10.bin
boot-end-marker
!
!
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
!
!
dot11 syslog
ip source-route
!
!
ip cef
!
!
!
ip domain name Home
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ipv6 unicast-routing
ipv6 cef
ipv6 cef accounting per-prefix
ipv6 dhcp pool Cox
prefix-delegation pool Cox-ipv6
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
!
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
!
!
voice-card 0
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-1
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1
revocation-check none
rsakeypair TP-self-signed
!
crypto pki certificate chain TP-self-signed-1

quit
!
!
license udi pid CISCO2821 sn 
username admin privilege 15 password 7 
!
redundancy
!
!
ip ssh time-out 70
ip ssh authentication-retries 2
ip ssh version 2
!
class-map type inspect match-any All_Protocols
match protocol tcp
match protocol udp
match protocol icmp
!
!
policy-map type inspect Trusted_to_Internet
class type inspect All_Protocols
inspect
class class-default
drop
!
zone security Trusted
zone security Internet
zone-pair security Trusted->Internet source Trusted destination Internet
service-policy type inspect Trusted_to_Internet
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
description WAN
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
ipv6 address dhcp
ipv6 address autoconfig default
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 verify unicast reverse-path
ipv6 dhcp client pd hint ::/60
ipv6 dhcp client pd Cox-ipv6
ipv6 inspect traffic out
ipv6 traffic-filter wan-in in
ipv6 traffic-filter wan-out out
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.10.1.253 255.255.255.0
ip nat inside
ip virtual-reassembly in
ipv6 address Cox-ipv6 ::/64 eui-64
ipv6 address autoconfig
ipv6 enable
ipv6 nd other-config-flag
ipv6 dhcp server Cox
!
interface GigabitEthernet0/1.2
description Wireless
encapsulation dot1Q 2
ip address 192.168.2.254 255.255.255.0
ip access-group wifi_block in
ip access-group wifi_block out
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip dns server
ip nat inside source list NAT interface GigabitEthernet0/0 overload
ip nat inside source static udp 10.10.1.249 1194 interface GigabitEthernet0/0 1194
ip nat inside source static udp 10.10.1.249 1195 interface GigabitEthernet0/0 1195
ip nat inside source static tcp 10.10.1.249 443 interface GigabitEthernet0/0 443
ip nat inside source static tcp 10.10.1.249 22 interface GigabitEthernet0/0 1022
ip nat inside source static tcp 192.168.2.7 80 interface GigabitEthernet0/0 1080
ip nat inside source static tcp 192.168.2.8 80 interface GigabitEthernet0/0 1081
ip nat inside source static tcp 10.10.1.247 42365 interface GigabitEthernet0/0 42365
ip nat inside source static tcp 10.10.1.247 5500 interface GigabitEthernet0/0 5500
ip nat inside source static tcp 10.10.1.247 5501 interface GigabitEthernet0/0 5501
ip route 10.28.0.0 255.255.255.0 10.10.1.249
ip route 10.29.0.0 255.255.255.0 10.10.1.249
ip route 10.30.0.0 255.255.255.0 10.10.1.249
!
ip access-list extended NAT
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
permit ip any any
ip access-list extended wifi_block
deny ip 192.168.2.0 0.0.0.255 10.10.1.0 0.0.0.255
deny ip 10.10.1.0 0.0.0.255 192.168.2.0 0.0.0.255
permit ip any any
!
ip sla 1
http get http://f
ip sla schedule 1 life forever start-time now
access-list 122 deny tcp any eq 22 any
access-list 122 permit tcp 10.0.0.0 0.255.255.255 any
!
!
!
!
snmp-server community fast_RO
snmp-server host 10.10.1.249 version 2c fast
!
!
!
!
ipv6 access-list wan-in
permit icmp any any
permit udp any any eq 546
permit tcp any any established
sequence 100 deny ipv6 any any
!
ipv6 access-list wan-out
permit icmp any any
permit tcp any any
permit udp any any
sequence 100 deny ipv6 any any

[jkay18041]

It works now, I don't know what happened but a few hours later the WAN pulled an IP.

Thank you so much for your help!

[Georg Pauwen]

Good stuff ! Can you do me a favor and post the output of:

show ipv6 interfaces

I'll keep that as a reference...

[jkay18041]

Router2821#show ipv6 interface
GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::21B:D4FF:FEEE:A600
No Virtual link-local address(es):
Description: WAN
Stateless address autoconfig enabled
Global unicast address(es):
2600:8803:7F11:500:*****:9217:42AB:B397, subnet is 2600:8803:7F11:500:*****:9217:42AB:B397/128
Joined group address(es):
FF02::1
FF02::2
FF02::1:FFAB:B397
FF02::1:FFEE:A600
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
Input features: Common pak subblock Access List Verify Unicast Reverse-Path
Output features: Access List Firewall Inspection
Inbound access list wan-in
IPv6 verify source reachable-via rx, allow default
0 verification drop(s) (process), 0 (CEF)
0 suppressed verification drop(s) (process), 0 (CEF)
Outgoing access list wan-out
Outbound Inspection Rule traffic
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
ND advertised default router preference is Medium
Hosts use stateless autoconfig for addresses.
GigabitEthernet0/1.1 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::21B:D4FF:FEEE:A601
No Virtual link-local address(es):
Description: LAN
Stateless address autoconfig enabled
General-prefix in use for addressing
Global unicast address(es):
2600:8803:7A80:*****:21B:D4FF:FEEE:A601, subnet is 2600:8803:7A80:****::/64 [EUI/CAL/PRE]
valid lifetime 67032 preferred lifetime 67032
Joined group address(es):
FF02::1
FF02::2
FF02::1:2
FF02::1:FFEE:A601
FF05::1:3
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
Input features: Common pak subblock
Output features: Firewall Inspection
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
ND advertised default router preference is Medium
Hosts use stateless autoconfig for addresses.
Hosts use DHCP to obtain other configuration.
Router2821#

[Georg Pauwen]

Hello,

I am wondering: on your GigabitEthernet0/0, you have this:

ipv6 dhcp client pd prefix-from-Cox

Did you edit that pd, or is that what is actually configured ?

On the LAN side (GigabitEthernet0/1.1) the pd should match:

ipv6 address dhcp
ipv6 enable
ipv6 nd reachable-time 3600000
ipv6 nd ra suppress all
ipv6 dhcp client pd prefix-from-Cox