IPv6 SLAAC

Time: 30 min

Needs: two OL9 Router, two OL9 PC, two Ethernet switches

GNS3 project: w06-a3-slaac

Topology

Drag two OL9 PC nodes, two OL9 Router nodes and two Ethernet Switch nodes into GNS3 canvas.

Cable one PC node (H1) and one router node (R1) to one of the switches (SW1).

Cable one PC node (H2) and one router node (R2) to the other switch (SW2).

Run a direct point-to-point link between the two routers (R1.eth1 ←→ R2.eth1).

Start a capture on H1 cable.

Configure the routers

Start the two routers.

Log on to R1 as root, then:

nmcli con add type ethernet ifname eth0 con-name eth0
nmcli con add type ethernet ifname eth1 con-name eth1

nmcli con mod eth0 ipv4.method disabled ipv6.addresses fd00:10::1/64 ipv6.method manual
nmcli con up eth0

nmcli con mod eth1 ipv4.method disabled ipv6.addresses fd00:ffff::/127 ipv6.method manual
nmcli con up eth1

Log on to R2 as root, then:

nmcli con add type ethernet ifname eth0 con-name eth0
nmcli con add type ethernet ifname eth1 con-name eth1

nmcli con mod eth0 ipv4.method disabled ipv6.addresses fd00:20::1/64 ipv6.method manual
nmcli con up eth0

nmcli con mod eth1 ipv4.method disabled ipv6.addresses fd00:ffff::1/127 ipv6.method manual
nmcli con up eth1

Enable IPv6 forwarding

On both R1 and R2:

echo 'net.ipv6.conf.all.forwarding = 1' | tee -a /etc/sysctl.d/99-ipv6-forwarding.conf
sysctl --system

Enable router advertisement

On both R1 and R2:

nmcli con mod eth0 ipv6.method shared
nmcli con up eth0

Start the clients

Start H1 and H2. Prevent NetworkManager from taking the interface down due to missing IPv4 addresses:

nmcli con mod 'System eth0' ipv4.method disabled
nmcli con up 'System eth0'

Then check the addresses:

ip -6 a show dev eth0

ip -6 route show

Add routes

On R1:

nmcli con mod eth1 +ipv6.routes "fd00:20::/64 fd00:ffff::1"
nmcli con up eth1

ip -6 route show

On R2:

nmcli con mod eth1 +ipv6.routes "fd00:10::/64 fd00:ffff::"
nmcli con up eth1

ip -6 route show

Then, test end-to-end reachability.

On H1:

ping -c1 <H2's IPv6 site address>

What just happened

• Router addresses are assigned manually. SLAAC depends on an already existing address on the router
• The configuration itself is very much similar to how IPv4 is configured.
• ipv4.method disabled is needed to prevent NetworkManager taking the interface down due to missing IPv4 address. You could also prevent this by manually assigning an IPv4 address, but we didn't need it in this activity
• ipv6.method shared is the setting that tells the router to advertise its prefix, setting off SLAAC
• net.ipv6.conf.all.forwarding = 1 enables IPv6 forwarding
• Hosts on either segment, i.e. H1 and H2, build their site level addresses using the prefix advertised by the routers.
• The address fd00:ffff::/127 assigned to R1's eth1 interface is not a mistake. It is the first address in a range of two. 127 restricts that range to only two addresses, 0 and 1

Do this — read the SLAAC messages

Find the ICMPv6 messages in the capture:

Expand the Router Advertisement and find the Prefix Information option inside it.

What just happened

• The router announced a prefix — the first 64 bits — and its own presence.
• Compare the prefix in the capture with H1's new address. The first half is the router's prefix; the second half is the interface ID H1 already had. (compare both H1 IPv6 addresses; the interface IDs in both addresses should match.
• The default route came from the RA too. The source address in the advertisement — a link-local address — is what H1 installed as its gateway.
• Routers send these unsolicited, every few minutes. A host that has just booted sends the Router Solicitation instead of waiting for the next unsolicited RA.

Record