FIOS IPv6 issues

RouterOS Beginner Basics
1

I’ve been struggling with getting IPv6 working with my new RB4011 and could use some suggestions. IPv6 works correctly with my old router.

Current config:

/ipv6 dhcp-server
add address-pool=WAN6 interface=bridge lease-time=1d name=default \
    rapid-commit=no
/ipv6 pool
add name=WAN6 prefix=::/56 prefix-length=64

/ipv6 settings
set accept-router-advertisements=yes
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN

/ipv6 address
add address=::1 from-pool=WAN6 interface=bridge
/ipv6 dhcp-client
add add-default-route=yes interface=ether1 pool-name=WAN6 prefix-hint=::/56 \
    rapid-commit=no request=prefix use-interface-duid=yes use-peer-dns=no

/ipv6 nd
set [ find default=yes ] disabled=yes managed-address-configuration=yes \
    other-configuration=yes
add advertise-mac-address=no dns=2606:4700:4700::1111 hop-limit=64 interface=\
    bridge other-configuration=yes
add advertise-dns=no advertise-mac-address=no interface=ether1 \
    managed-address-configuration=yes other-configuration=yes
/ipv6 nd prefix
add autonomous=no interface=bridge

My testing currently shows:


[admin@MikroTik] > ipv6/dhcp-client/print 
Columns: INTERFACE, STATUS, REQUEST, PREFIX
# INTERFACE  STATUS  REQUEST  PREFIX                            
0 ether1     bound   prefix   2600:4040:xxxx:xxxx::/56, 1h50m36s

[admin@MikroTik] > ipv6/route/print 
Flags: D - DYNAMIC; A - ACTIVE; c, d, y - COPY
Columns: DST-ADDRESS, GATEWAY, DISTANCE
    DST-ADDRESS               GATEWAY                           DISTANCE
DAd ::/0                      fe80::cee1:7fff:fea9:5bc9%ether1         1
DAd 2600:4040:xxxx:xxxx::/56                                           1
DAc fde7:3e68:4330:4644::/64  bridge                                   0
DAc fe80::%ether1/64          ether1                                   0
DAc fe80::%bridge/64          bridge                                   0

[admin@MikroTik] > ipv6/route/print 
Flags: D - DYNAMIC; A - ACTIVE; c, d, y - COPY
Columns: DST-ADDRESS, GATEWAY, DISTANCE
    DST-ADDRESS               GATEWAY                           DISTANCE
DAd ::/0                      fe80::cee1:7fff:fea9:5bc9%ether1         1
DAd 2600:4040:xxxx:xxxx::/56                                           1
DAc fde7:3e68:4330:4644::/64  bridge                                   0
DAc fe80::%ether1/64          ether1                                   0
DAc fe80::%bridge/64          bridge                                   0

Any suggestions would be greatly appreciated.

2

Unless you need a DHCPv6 server to hand out prefixes and other information to your devices it is not necessary to create one under /ipv6 dhcp-server - specifically it does not provide individual addresses, clients must use SLAAC, static addresses or another DHCPv6 server on your network.

Do not set add-default-route=yes under /ipv6 dhcp-client - this is a hack as DHCPv6 has no mechanism to provide gateway information, and unnecessary if RAs are being received.

The /ipv6 nd entry for interface=ether1 is unnecessary as it is only receiving information. The other-configuration=yes for interface=bridge is only necessary if you wish client devices to request additional data from the DHCPv6 server. There should be no need to add any /ipv6 nd prefix entries.

It isn’t clear where the ULA address on the bridge interface is being generated.

3

The DHCPv6 server was there to hand out DNS servers.

I removed the add-default-route on the dhcp-client and deleted the extra nd entry for ether1. Still no luck obtaining IPv6 for my clients.

Current config:


/ipv6 dhcp-server
add address-pool=WAN6 interface=bridge lease-time=1d name=default \
    rapid-commit=no

/ipv6 pool
add name=WAN6 prefix=::/56 prefix-length=64

/ipv6 settings
set accept-router-advertisements=yes

/ipv6 address
add address=::1 from-pool=WAN6 interface=bridge
/ipv6 dhcp-client
add interface=ether1 pool-name=WAN6 prefix-hint=::/56 rapid-commit=no \
    request=prefix use-interface-duid=yes use-peer-dns=no

/ipv6 nd
set [ find default=yes ] disabled=yes managed-address-configuration=yes \
    other-configuration=yes
add advertise-mac-address=no dns=2606:4700:4700::1111 hop-limit=64 interface=\
    bridge other-configuration=yes
/ipv6 nd prefix
add autonomous=no interface=bridge

Still not sure what the problem might be.


[admin@MikroTik] > ipv6/address/print 
Flags: I, D - DYNAMIC; G, L - LINK-LOCAL
Columns: ADDRESS, FROM-POOL, INTERFACE, ADVERTISE
#    ADDRESS                       FROM-POOL  INTERFACE  ADVERTISE
0 DL fe80::4aa9:8aff:fe66:b837/64             bridge     no       
1 DL fe80::6662:66ff:fe21:1891/64             ether1     no       
2 IG ::1/64                        WAN6       bridge     yes      
[admin@MikroTik] > ipv6/route/print 
Flags: D - DYNAMIC; A - ACTIVE; c, d, y - COPY
Columns: DST-ADDRESS, GATEWAY, DISTANCE
    DST-ADDRESS               GATEWAY  DISTANCE
DAd 2600:4040:591b:7a00::/56                  1
DAc fe80::%ether1/64          ether1          0
DAc fe80::%bridge/64          bridge          0
[admin@MikroTik] > ipv6/dhcp-client/print 
Columns: INTERFACE, STATUS, REQUEST, PREFIX
# INTERFACE  STATUS  REQUEST  PREFIX                         
0 ether1     bound   prefix   2600:4040:591b:7a00::/56, 1h49m
4

Is the WAN connectivity working, i.e. can you ping or traceroute from the Mikrotik to external IPv6 hosts?

Something isn’t correct as the LAN address isn’t being assigned:
2 IG ::1/64 WAN6 bridge yes

If you are only using DHCPv6 to hand out DNS, and potentially other DHCP options, there is no need to for it to reference the pool or to specify a lease time. In v6 I use:
/ipv6 dhcp-server
add dhcp-option=XXXXX interface=bridge name=default

The newer versions of v7 support router advertisments including DNS, so if clients support that you may not need DHCPv6.

5

Ping fails from the router:


[admin@MikroTik] > ping 2607:f8b0:4006:822::200e
  SEQ HOST                                     SIZE TTL TIME       STATUS                          
    0                                                              no route to host                
    1                                                              no route to host                
    2                                                              no route to host                
    3                                                              no route to host                
    4                                                              no route to host                
    sent=5 received=0 packet-loss=100% 

[admin@MikroTik] > ipv6/route/print 
Flags: D - DYNAMIC; A - ACTIVE; c, d, y - COPY
Columns: DST-ADDRESS, GATEWAY, DISTANCE
    DST-ADDRESS               GATEWAY  DISTANCE
DAd 2600:4040:591b:7a00::/56                  1
DAc fde7:3e68:4330:4644::/64  bridge          0
DAc fe80::%ether1/64          ether1          0
DAc fe80::%bridge/64          bridge          0

The RB4011 is running v7.8 code. Verizon provides only a prefix (no WAN IP), but that works fine with my OPNSense firewall.

6

Remove
/ipv6 pool
add name=WAN6 prefix=::/56 prefix-length=64

this is likely creating a static pool with an address of zero giving rise to the invalid address being assigned to the bridge interface, the IPv6 DHCP client will dynamically create the pool when a prefix is acquired.

7

That was the cause of the problem. All is good now.

Thanks for the assistance!