I am trying to configure the Mikrotik (hap ac and RB3011 on 6.35.4) to use SLAAC, but both systems seem to ignore the Router Advertisements sent out by an external router.
The hap ac is connected via ether1 to the external router.
Even though the external router sends out Router Advertisements (tested with a linux box and a Ubiquiti ER-Lite which configure fine), I can see only the link-local IPs on the Mikrotik:
[admin@lab-hapac-01] /ipv6> address print
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local
ADDRESS FROM-POOL INTERFACE ADVERTISE
0 DL fe80::6e3b:6bff:fe12:1891/64 bridge no
1 DL fe80::6e3b:6bff:fe12:1890/64 ether1 no
IPv6 package is installed and enabled:
[admin@lab-hapac-01] /ipv6> /system package print
Flags: X - disabled
NAME VERSION SCHEDULED
0 routeros-mipsbe 6.35.4
1 system 6.35.4
2 wireless-cm2 6.35.4
3 ipv6 6.35.4
4 X wireless-fp 6.35.4
5 X hotspot 6.35.4
6 dhcp 6.35.4
7 X mpls 6.35.4
8 X routing 6.35.4
9 X ppp 6.35.4 c
10 security 6.35.4
11 advanced-tools 6.35.4
There is no IPv6 firewall active, and in the settings I set it explicitly to acceppt RAs:
[admin@lab-hapac-01] /ipv6> export
jul/14/2016 21:45:28 by RouterOS 6.35.4
software id = HDWI-N9F6
/ipv6 settings
set accept-router-advertisements=yes
[admin@lab-hapac-01] /ipv6>
Is there anything else I have to configure in order to force the hap ac to configure a global IP based on the announced prefix?
I’ve done this on a 951G which I’m using as a wireless-to-wired bridge at my house. The unit does indeed obtain a public IPv6 address using SLAAC in the methods described in the thread, but you never see the aquired address anywhere in the UI. It’s “just there” in the background somewhere.
Once obtained, I was able to IPv6-ping the Internet from the 951G, but I feel the usefulness of this feature is quite limited because it never shows up anywhere, even in the routing table. Attempting to access the device using IPv6 would be quite a “shot in the dark” unless you knew exactly what address it gets, and make an entry in DNS or something.
This is 100% un-usable as a way of obtaining an interface address useful in IPv6 forwarding, so don’t try to follow the post in the hopes that you can then use the device as an IPv6 router.
“ain’t happnin”
Thanks for the information and the forum reference. This is really weird.
The device DOES accept the RAs, and it DOES configure a global unicast IP accordingly and even utilizes the default route to the advertising router, but
it just DOES NOT SHOW ANYTHING:
[admin@lab-hapac-01] > /ipv6 address print
Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local
ADDRESS FROM-POOL INTERFACE ADVERTISE
0 DL fe80::6e3b:6bff:fe12:1891/64 bridge no
1 DL fe80::6e3b:6bff:fe12:1890/64 ether1 no
[admin@lab-hapac-01] > /ipv6 route print
Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, o - ospf, b - bgp, U - unreachable
DST-ADDRESS GATEWAY DISTANCE
[admin@lab-hapac-01] >
But it DOES work and pings out of the local subnet:
[admin@lab-hapac-01] > ping 2a02:168:2000:13::1
SEQ HOST SIZE TTL TIME STATUS
0 2a02:168:2000:13::1 56 62 1ms echo reply
1 2a02:168:2000:13::1 56 62 1ms echo reply
Can I increase the debug level in order to get the corresponding messages?
Is there any chance to get this fixed somehow by Mikrotik?
Guess I have to keep my Ubiquiti stuff a little longer
What are you trying to do? Does the ISP support DHCP-PD for prefix delegation?
I don’t know how they can expect a router to function requiring that it use SLAAC to obtain an address. Routers must have an entire prefix (at least one) allocated to them in order to do their job.
SLAAC does not allocate prefixes - only single host addresses.
The ISP does provide DHCPv6-PD, and it works fine, assigning a /48, but there is no IP address provided by DHCPv6 on the WAN interface.
Currently I am working with Ubiquiti ER-Lite routers and wanted to migrate to the RB3011, but a 1:1 config migration does not seem feasible due to the SLAAC issue on Mikrotik,
The external global unicast IP on the WAN interface is used to track connectivity and latency from root servers and ssh in via ipv6, but I guess I will change this to an IP from the assigned prefix.
During testing I also noticed that the IPv6 connectivity seems to break down every now and then, even though other clients in the local lab network do not have this issue.
The default route is provided via Router Advertisement as well, so this issue might be related, It is just hard to tell, given the fact that RouterOS does not provide details here.
I will continue with my testing and probably keep the Ubiquiti ER-Lites a little longer…
You don’t need a public address on the WAN interface in IPv6.
IPv6 routers are more than happy (and in fact PREFER) to forward packets to each other using their link-local addresses.
If you really do want a routable address on your WAN interface, then feel free to take one of the prefixes from the amazingly-generous /48 you’re receiving. You’ll still have well over 65000 prefixes left to use on other interfaces.
I get a /48 from my provider as well. I think it once was the recommended one-size-fits-all prefix to assign to any customer, no matter if it is grandma with her laptop or Shell corporation.
However, I have tried to do what you mention there when I first setup my router, and it does not work. The router does not assign a routable address to the outside interface even when directed to do so (setting an address from the pool obtained via DHCPv6-PD).
it is easy to send to read the documentation, however here are some bits to take away:
Network nodes in IPv6 networks do not require or need IPv6 global address to do its work. RouterOS is capable receiving the address from the RA, however, once again, routers (network nodes) do not need the address. That is kind of a hack, that you can allow RouterOS to get the address from the RA.
There is DHCP-PD to get the prefix for the router to redistribute to end user hosts. In this case, DHCP-PD server should assign the route to the prefix via your routers Link-Local address.
There is DHCPv6 client to get the address if you are inclined to do that.
IPv6 and IPv4 do look similar, just with the different length of the address and bit different notation. Some of the ideas are different, like separation of network nodes and user hosts., where user hosts are entitled to have the IPv6 global address. And network nodes have a global address just for the purposes of RA and SLAAC or DHCP as that affects user hosts directly.
SLAAC address on the router (at least for now) will not be shown anywhere, as there is no reason to have it on the router in the first place.
Thanks for the update, but I do not agree on everything. For the routers this is fine, and forwarding will be done via link-local IPs.
However, under certain circumstances the Mikrotik devices do act as clients. One example is the proxy functionality I use on my mobile “hotel deployment”.
I use a Mikrotik in order to connect to hotel networks and open up my local wireless network, so I do not have to configure all my devices each time.
In this case is makes perfect sense to support SLAAC and proxy requests out via IPv6.
Is it so really so difficult to implements SLAAC transparently?
The router doesn’t need a routable address on the WAN interface to do what you want. It will use a routable address from one of its LAN interfaces. That interface is equally reachable in the IPv6 routing space as if it were on the WAN interface. It doesn’t even look any different in the ROS firewall because the INPUT chain doesn’t care which interface a packet arrives on, unless you specify in-interface=X in some rule or other.
If ether1 is your WAN interface and you have a rule on ether1 to accept connection-state=established,related - then it doesn’t matter that the packet’s destination IP happens to be one of the LAN interfaces. It will work.
That is how my home router is configured - I receive a /60 from Comcast using DHCP-PD. Currently, I only assign one /64 prefix to my LAN bridge interface.
Everything works perfectly.
This is literally my entire IPv6 configuration with my port-knocking routines removed from the firewall section for security/clarity (they’re irrelevant to the general functionality anyway)
# jul/15/2016 08:30:29 by RouterOS 6.35.1
# software id = F3LA-T902
#
/ipv6 address
add from-pool=Comcast interface=LAN
/ipv6 dhcp-client
add add-default-route=yes interface=ether6 pool-name=Comcast prefix-hint=::/60 request=prefix use-peer-dns=no
/ipv6 firewall address-list
add address=xxxx:xxxx::/32 list=Whitelist
add address=yyyy:yyyy:yyyy::/48 list=Whitelist
/ipv6 firewall filter
add chain=forward comment="Allow existing connections" connection-state=established,related
add chain=forward protocol=icmpv6
add chain=forward comment="Allow whitelisted hosts and networks" src-address-list=Whitelist
add action=drop chain=forward comment="Block Internet from new inbound connections." in-interface=ether6
add chain=input comment="Allow Existing Connections" connection-state=established,related
add chain=input comment="Permit ICMP" protocol=icmpv6
add chain=input comment="Trust Whitelisted Hosts" src-address-list=Whitelist
add chain=input comment="Allow DHCPv6 replies on WAN from link-local" dst-address=fe80::/16 dst-port=546 in-interface=ether6 protocol=udp src-address=fe80::/16
add action=drop chain=input comment="Block New Connections from Internet" in-interface=ether6
add action=drop chain=input comment="Block New Connections from Internet" in-interface=6to4relay
add action=drop chain=forward comment="Block Internet from new inbound connections." in-interface=6to4relay
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/interface 6to4
add !keepalive local-address=X.X.X.X mtu=1480 name=6to4relay
/ipv6 route
add distance=1 dst-address=2002::/16 gateway=6to4relay scope=10
The 6to4 relay interface isn’t required - I just have it there as an expedient - if I’m ever communicating with a host which is using the 6to4 relay space, I’d rather go ahead and have my router encapsulate the v6 into an IPv4 packet which will go directly to the remote host’s IPv4 address (speeding things up by not wasting time routing to a public 6to4 relay)
