Hello guys, I was wondering what are the options available for IPv6 to IPv6 NAT (nat66). It looks like it is not very common practice so there is not much information available. I am interested in setting up a nat pool to hide internal ipv6 addresses.   The reason for nat pool is that it still keeps the internal address anonymous. I have read a few things about NPTv6 but it seems like it does not allow for nat pool. I guess there are other options available for nat66 other than nptv6.    I also want to know if it is feasible and scalable to use ULA for internal network and do NAT66 for going out.    I also noticed that NPTv6 has a hardware limitation. It is only supported on CSR, ISR and ASR platforms. Is this also true for nat66?    cheers !! ... View more

We are looking for purchasing Cisco Anyconnect License for our new FTD 4110 devices in Active Standby mode. Our only requirement is Anyconnect VPN.   I am confused with the Anyconnect licenses. There is huge price difference between the first and second option (below). The First option is Anyconnect Plus 3-yrs term and the second option is Anyconnect VPN-Only pepetual. I may be missing something as this price difference cannot be real.    Option #1 L-AC-PLS-3Y-S2     Cisco AnyConnect Plus – 3-Year License   (100-249 users)   List Price   $12 Option #2 L-AC-VPNO-100=    Cisco AnyConnect VPN Only – Perpetual License/100 simultaneous connections   List Price  $13,995   Not sure why there is huge difference in price. May be I am getting it wrong?  ... View more

We are planning on enabling ipv6 First Hop Security. We are considering following options - SISF  based device tracking - RA Guard - IPv6 DHCP Guard   a. Are these sufficient for access switches? Is there anything else we should considering SISF is comprehensive? b. Does it requires DHCP snooping and ARP inspection to be enabled separately as well? I know DHCP snooping is part of SISF but I am not sure of ARP inspection.    Thanks ... View more

We are planning on enabling ipv6 First Hop Security. We are considering following options - SISF  based device tracking - RA Guard - IPv6 DHCP Guard   a. Are these sufficient for access switches? Is there anything else we should considering SISF is comprehensive? b. Does it requires DHCP snooping and ARP inspection to be enabled separately as well? I know DHCP snooping is part of SISF but I am not sure of ARP inspection.    Thanks   ... View more

I am planning for IPv6 address assignment for my enterprise network. I have read several documents and posts. I want to have some correlation between IPv4 and IPv6 addresses. So far example IPv4 address 88.72.52.0/24 will map to 2abc:def:72:52::/64.   My questions are following: 1. Is this a reasonable approach?  2. Is there any drawback in mapping ipv4 to ipv6? 3. Is there any alternate better approach?   thanks ... View more

I am having an issue with ipv6 communication over SVI interfaces. This is on Cisco Catalyst 6824 swiches.  The SVI has dual stack configuration. I can access on ipv4 but some reason ipv6 is broken. I can see the mac address but ping ipv6 is not responding.    The mac address is visible across the trunk but layer-3 ipv6 reachability is not there. Not sure if there is something missing...   sw-1# interface Vlan699 vrf forwarding WXZ ip address 10.66.39.2 255.255.255.240 no ip redirects no ip proxy-arp standby version 2 standby 1 ip 10.66.39.1 standby 1 timers msec 200 msec 750 standby 1 priority 110 standby 1 preempt delay minimum 60 standby 1 mac-address 0080.7fed.0699 standby 2 ipv6 autoconfig standby 2 priority 110 standby 2 preempt delay minimum 60 standby 2 mac-address 0086.7fed.0699 ipv6 address 2DDD:AB1:0:101::1/64 ipv6 enable no ipv6 redirects end sw-2# interface Vlan699 vrf forwarding WXZ ip address 10.66.39.3 255.255.255.240 no ip redirects no ip proxy-arp standby version 2 standby 1 ip 10.66.39.1 standby 1 timers msec 200 msec 750 standby 1 preempt delay minimum 60 standby 1 mac-address 0080.7fed.0699 standby 2 ipv6 autoconfig standby 2 preempt delay minimum 60 standby 2 mac-address 0086.7fed.0699 ipv6 address 2DDD:AB1:0:101::2/64 ipv6 enable no ipv6 redirects end sw-1#ping vrf WXZ 10.66.39.3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.66.39.3, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms   sw-1#ping vrf WXZ ipv6 2DDD:AB1:0:101::2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2DDD:AB1:0:101::2, timeout is 2 seconds: ..... Success rate is 0 percent (0/5)     ... View more

I am planning to setup dual-stack in my network. I am looking for standard prefix list and AS Path ACL for IPv6 just like we have in IPv4. For example, we block RFC 1918 addresses, Loopback address and auto-config addresses from ISP.   I am pretty sure there are IPv6 guidelines available. Can someone share a document or sample config?        ... View more

Hi, I am having trouble understanding the multiple IPv6 addresses on windows client setup for DHCP. I am seeing total of 6 IPv6 addresses. I was hoping to see only 3, one IPv6 address, one temporary address (if needed), and one link-local address. How do I get rid of them?   Please see attached for client IPv6 addresses and switch SVI config. It looks like I am missing eui-64 config. But still I am not sure why there are so many addresses.        ... View more

I am having power issue with my C3850-24XU-L  standalone switches. I have the Primary 1100 W power and an additional 715 W power. The total available power should be 1815 W but it is only showing 1265 W. When I remove the 1100 W power , it only leaves 165 W power and some of my PoE devices become powerless.    I do not have any power configuration (it is just default settings).    SW-W# show inventory   NAME: "Switch 1", DESCR: "WS-C3850-24XU-L" PID: WS-C3850-24XU-L   , VID: V01  , SN: FCW193xxx   NAME: "Switch 1 - Power Supply A", DESCR: "Switch 1 - Power Supply A" PID: PWR-C1-1100WAC    , VID: V01  , SN: LIT2038xxx   NAME: "Switch 1 - Power Supply B", DESCR: "Switch 1 - Power Supply B" PID: PWR-C1-715WAC     , VID: V01  , SN: DCA2036xxx   SW-W#sh power inline   Module   Available     Used     Remaining           (Watts)     (Watts)    (Watts) ------   ---------   --------   --------- 1          1265.0      275.3       989.7 Interface Admin  Oper       Power   Device              Class Max                             (Watts)                            --------- ------ ---------- ------- ------------------- ----- ---- Te1/0/1   auto   on         30.0    Ieee PD             4     60.0 Te1/0/2   auto   off        0.0     n/a                    n/a   60.0   ........   After removing the 1100 W power supply.    SW-W#sh power inline   Module   Available     Used     Remaining           (Watts)     (Watts)    (Watts) ------   ---------   --------   --------- 1           165.0      159.2         5.8 Interface Admin  Oper       Power   Device              Class Max                             (Watts)                            --------- ------ ---------- ------- ------------------- ----- ---- Te1/0/1   auto   on         30.0    Ieee PD             4     60.0 Te1/0/2   auto   off        0.0     n/a                 n/a   60.0 Te1/0/3   auto   on         23.8    Ieee PD             4     60.0 Te1/0/4   auto   on         30.0    Ieee PD             4     60.0 Te1/0/5   auto   on         30.0    Ieee PD             4     60.0 Te1/0/6   auto   on         30.0    Ieee PD             4     60.0 Te1/0/7   auto   power-deny 0.0     n/a                 n/a   60.0 Te1/0/8   auto   power-deny 0.0     n/a                 n/a   60.0 Te1/0/9   auto   power-deny 0.0     n/a                 n/a   60.0 ... View more

Hi, Our head office in US has a /32 IPv6 address and 4 byte ASN. Our branch office is in Asia.  Can we slice a /48 for the Asia office? Would it create a problem due to different regions? Also can we get a separate ASN for Asia branch office?    What would be the best approach? ... View more