ipv6 subnet-router anycast - how to disable?

RouterOS General
1

Our upstream ISP has asked us to use a /125 ipv6 subnet for the point-to-point link (ethernet) between our border router and their router.

However, I can’t get packets to flow from our network beyond their gateway IP on that /125.

A friend with more IPv6 experience suggests any ipv6 link less than a /64 needs to have subnet-router anycast disabled (e.g. http://packetlife.net/blog/2010/may/6/ipv6-127-prefixes/).

I can’t find anywhere to do that in RouterOS (or by googling or searching these forums) - does anyone know where this feature might be, or how to “hack” it to be so?

Some more background in case it is of interest:

Our router is assigned 2001:db8:db8::7/125*. Their router is 2001:db8:db8::1*/125

Two scenarios:

Link Local as Gateway:
If I use the upstream router’s link local address and the directly connected local interface as gateway (e.g. default-gateway=2001:db8:db8::1%vlan2012-ether11*), I can happily get out, and can traceroute back to a loopback interface on our router (2001:db8:db8:dead::2*) from the global internet.

IPv6 globally routable as Gateway:
No ipv6 packets flow from outside our network any further that the immediately upstream router, which has the first IP in our /48 configured. I have several v6IPs configured on our router, but can reach none of them. The upstream ISP says the rest of the /48 is pointed at our address (e.g. 2001:db8:db8::7/125*). We can’t get any further than 2001:db8:db8::1* from inside.

Router hardware our end is a RB1000AHx2 (ROS 5.20), hardware their end is a Cisco ASR 9006.

*not the real IP; we have a /48 and I’ve obfuscated that using the 2001:db8::/32 documentation range by adding another db8, e.g. pretend our network is 2001:db8:db8::/48. The same link and physical/logical interfaces are also used quite happily for IPv4 traffic.

[Feature Request] - Support RFC6164
2

bump ?

3

some notes:
for ipv6, you do not need to have router with ipv6 global addresses. so, use of link-local address is valid configuration option.

why use some weird /125 networks when /128 should be usable as well, similar to /32 for ipv4 addresses.

going to check what happens if this 125 bit mask is used. in the mean time use LL route.

4

Thanks janisk, I think we’ll get our ISP to change the router subnet, it seems the better option. :slight_smile: Having a /48, we’re not exactly short on space just yet…

5

Incidentally, the Best Current Operational Practices (according to IPBCOP) suggest that whilst /64 should be allocated to PtP links, masks should be /127 to avoid various issues (point B, page 4 of doc). This would suggest Mikrotik ought to look at implementing the option of disabling subnet-router anycast.

Vulnerabilities associated with using a /64 as an inter-router PtP link include:
Ping Pong and Neighbour Cache Exhaustion, as documented in Section 5 of RFC6164.

As routers in an increasingly IPv6 world, this should presumably be an important feature for RouterOS to support for inter-operability?

If a layer-3 forwarding device breaks down when having a prefix longer than /64 in its IPv6 routing table, throw it away. (> source> )

[Feature Request] - Support RFC6164
6

The relevant RFC is http://tools.ietf.org/html/rfc6164 is there an ETA on support for this?

It helps to mitigate significant attacks such as neighbour cache exhaustion (e.g.).

7

I have submitted a feature request in the RouterOS v6 forum.