OSPFv3 to Juniper

Getting stuck on connecting a ROS 7.15.3 router to a Juniper via OSPFv3. We have OSPFv2 working fine and lots of OSPFv3 connections between Mikrotik routers, but when trying Mikrotik to Juniper, it is failing at INIT state. A packet capture is just showing hello packets to and from the two routers via link local addresses.

Mikrotik OSPF (some v2 left in):

/routing ospf instance
add disabled=no in-filter-chain=OSPF-IN-V6 name=default-v3 originate-default=if-installed out-filter-chain=OSPF-OUT-V6 redistribute=connected,static,dhcp router-id=\
    xxx.212.54.35 routing-table=main version=3
/routing ospf area
add disabled=no instance=default-v2 name=backbone-v2
add disabled=no instance=default-v3 name=ospf-area-v3
/routing ospf interface-template
add area=backbone-v2 auth-id=1 auth-key="" dead-interval=12s disabled=no hello-interval=3s interfaces=qsfp28-1-1 networks=xxx.212.54.80/30 priority=1 type=ptp
add area=backbone-v2 auth-id=1 auth-key="" dead-interval=12s disabled=no hello-interval=3s interfaces=qsfp28-2-1 networks=xxx.212.54.84/30 priority=1 type=ptp
add area=ospf-area-v3 cost=10 disabled=no interfaces="Router Loopback" networks=xxxx:9fc0:100:35::/128 passive priority=1
add area=ospf-area-v3 cost=10 disabled=no interfaces=qsfp28-1-1 networks=xxxx:9fc0:100:35:10::/126 priority=1 type=ptp
add area=ospf-area-v3 cost=11 disabled=no interfaces=qsfp28-2-1 networks=xxxx:9fc0:101:35:10::/126 priority=1 type=ptp

Juniper:

{master}[edit interfaces ae0 unit 3200 family inet6]
    mtu 1500;
    address xxxx:9fc0:100:35:10::1/126;

{master}[edit protocols ospf3 area 0.0.0.0 interface ae0.3200]
xxxxx@J-0# show
interface-type p2p;
metric 10;
priority 2;
retransmit-interval 5;
transit-delay 1;
hello-interval 10;
dead-interval 40;

We can ping across the interfaces on IPv6 just fine to the transit IP addresses on each side. I don’t think we really need the loopback IPv6 address but it’s there to remain consistent with our OSPFv2 settings.

No firewall is active for IPv6 at the moment.

If anyone else finds this in a search, here is what we are finding…

Juniper builds an OSPF allow list based on IP subnets you put on interfaces. OSPF uses link local for IPv6. The juniper allow list was not allowing link local addresses to establish an OSPFv3 connection. Worked fine for OSPFv2 but needed to create a link local allow list on the juniper and add that language to the inet6 firewall. My brain was still working in OSPFv2 so not until I studied the pcap again did I see all communication was to/from link local addresses, not IPv6 addresses.