Information About IPv6 Neighbor Discovery
The IPv6 neighbor discovery process uses ICMPv6 messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local link), verify the readability of a neighbor, and keep track of neighboring routers.
Nodes (hosts) use neighbor discovery to determine the link-layer addresses for neighbors known to reside on attached links and to quickly purge cashed values that become invalid. Hosts also use neighbor discovery to find neighboring routers that are willing to forward packets on their behalf. In addition, nodes use the protocol to actively keep track of which neighbors are reachable and which are not, and to detect changed link-layer addresses. When a router or the path to a router fails, a host actively searches for functioning alternates.
This section includes the following topics:
Neighbor Solicitation Messages
Neighbor solicitation messages (ICMPv6 Type 135) are sent on the local link by nodes attempting to discover the link-layer addresses of other nodes on the local link. The neighbor solicitation message is sent to the solicited-node multicast address. The source address in the neighbor solicitation message is the IPv6 address of the node sending the neighbor solicitation message. The neighbor solicitation message also includes the link-layer address of the source node.
After receiving a neighbor solicitation message, the destination node replies by sending a neighbor advertisement message (ICPMv6 Type 136) on the local link. The source address in the neighbor advertisement message is the IPv6 address of the node sending the neighbor advertisement message; the destination address is the IPv6 address of the node that sent the neighbor solicitation message. The data portion of the neighbor advertisement message includes the link-layer address of the node sending the neighbor advertisement message.
After the source node receives the neighbor advertisement, the source node and destination node can communicate.
Neighbor solicitation messages are also used to verify the reachability of a neighbor after the link-layer address of a neighbor is identified. When a node wants to verifying the reachability of a neighbor, the destination address in a neighbor solicitation message is the unicast address of the neighbor.
Neighbor advertisement messages are also sent when there is a change in the link-layer address of a node on a local link. When there is such a change, the destination address for the neighbor advertisement is the all-nodes multicast address.
Neighbor Reachable Time
The neighbor reachable time enables detecting unavailable neighbors. Shorter configured times enable detecting unavailable neighbors more quickly, however, shorter times consume more IPv6 network bandwidth and processing resources in all IPv6 network devices. Very short configured times are not recommended in normal IPv6 operation.
Duplicate Address Detection
During the stateless autoconfiguration process, Duplicate Address Detection verifies the uniqueness of new unicast IPv6 addresses before the addresses are assigned to interfaces (the new addresses remain in a tentative state while Duplicate Address Detection is performed). Duplicate Address Detection is performed first on the new link-local address. When the link-local address is verified as unique, then Duplicate Address Detection is performed all the other IPv6 unicast addresses on the interface.
Duplicate Address Detection is suspended on interfaces that are administratively down. While an interface is administratively down, the unicast IPv6 addresses assigned to the interface are set to a pending state. An interface returning to an administratively up state restarts Duplicate Address Detection for all of the unicast IPv6 addresses on the interface.
When a duplicate address is identified, the state of the address is set to DUPLICATE, the address is not used, and the following error message is generated:
%ASA-4-325002: Duplicate address ipv6_address/MAC_address on interface
If the duplicate address is the link-local address of the interface, the processing of IPv6 packets is disabled on the interface. If the duplicate address is a global address, the address is not used. However, all configuration commands associated with the duplicate address remain as configured while the state of the address is set to DUPLICATE.
If the link-local address for an interface changes, Duplicate Address Detection is performed on the new link-local address and all of the other IPv6 address associated with the interface are regenerated (Duplicate Address Detection is performed only on the new link-local address).
The ASA uses neighbor solicitation messages to perform Duplicate Address Detection. By default, the number of times an interface performs Duplicate Address Detection is 1.
Router Advertisement Messages
An ASA can participate in router advertisements so that neighboring devices can dynamically learn a default router address. Router advertisement messages (ICMPv6 Type 134) are periodically sent out each IPv6 configured interface of the ASA. The router advertisement messages are sent to the all-nodes multicast address.
Router advertisement messages typically include the following information:
- One or more IPv6 prefix that nodes on the local link can use to automatically configure their IPv6 addresses.
- Lifetime information for each prefix included in the advertisement.
- Sets of flags that indicate the type of autoconfiguration (stateless or stateful) that can be completed.
- Default router information (whether the router sending the advertisement should be used as a default router and, if so, the amount of time (in seconds) the router should be used as a default router).
- Additional information for hosts, such as the hop limit and MTU a host should use in packets that it originates.
- The amount of time between neighbor solicitation message retransmissions on a given link.
- The amount of time a node considers a neighbor reachable.
Router advertisements are also sent in response to router solicitation messages (ICMPv6 Type 133). Router solicitation messages are sent by hosts at system startup so that the host can immediately autoconfigure without needing to wait for the next scheduled router advertisement message. Because router solicitation messages are usually sent by hosts at system startup, and the host does not have a configured unicast address, the source address in router solicitation messages is usually the unspecified IPv6 address (0:0:0:0:0:0:0:0). If the host has a configured unicast address, the unicast address of the interface sending the router solicitation message is used as the source address in the message. The destination address in router solicitation messages is the all-routers multicast address with a scope of the link. When a router advertisement is sent in response to a router solicitation, the destination address in the router advertisement message is the unicast address of the source of the router solicitation message.
You can configure the following settings for router advertisement messages:
- The time interval between periodic router advertisement messages.
- The router lifetime value, which indicates the amount of time IPv6 nodes should consider the ASA to be the default router.
- The IPv6 network prefixes in use on the link.
- Whether or not an interface transmits router advertisement messages.
Unless otherwise noted, the router advertisement message settings are specific to an interface and are entered in interface configuration mode.
Static IPv6 Neighbors
You can manually define a neighbor in the IPv6 neighbor cache. If an entry for the specified IPv6 address already exists in the neighbor discovery cache—learned through the IPv6 neighbor discovery process—the entry is automatically converted to a static entry. Static entries in the IPv6 neighbor discovery cache are not modified by the neighbor discovery process.
Configuring the Router Advertisement Transmission Interval
To configure the interval between IPv6 router advertisement transmissions on an interface, enter the following command.
Detailed Steps
|
|
ipv6 nd ra-interval [
msec ]
value
hostname (config-if)# ipv6 nd ra-interval 201
|
Sets the interval between IPv6 router advertisement transmissions. The optional msec keyword indicates that the value provided is in milliseconds. If this keyword is not present, the value provided is in seconds. Valid values for the value argument range from 3 to 1800 seconds or from 500 to 1800000 milliseconds if the msec keyword is provided. The interval between transmissions should be less than or equal to the IPv6 router advertisement lifetime if the ASA is configured as a default router. For more information, see the “Configuring the Router Lifetime Value” section. To prevent synchronization with other IPv6 nodes, randomly adjust the actual value used to within 20 percent of the desired value. |
Examples
The following example configures an IPv6 router advertisement interval of 201 seconds for the selected interface, GigabitEthernet 0/0:
hostname (config)# interface gigabitethernet 0/0
hostname (config-if)# ipv6 nd ra-interval 201
Configuring the Router Lifetime Value
To configure the router lifetime value in IPv6 router advertisements on an interface, enter the following command.
Detailed Steps
|
|
ipv6 nd ra-lifetime [
msec ]
value
hostname (config-if)# ipv6 nd ra-lifetime 2000
|
Specifies the length of time that nodes on the local link should consider the ASA as the default router on the link. The optional msec keyword indicates that the value provided is in milliseconds. If this keyword is not present, the value provided is in seconds. Valid values for the value argument range from 0 to 9000 seconds. Entering 0 indicates that the ASA should not be considered a default router on the selected interface. |
Examples
The following example configures an IPv6 router lifetime value of 2000 seconds for the selected interface, GigabitEthernet 0/0:
hostname (config)# interface gigabitethernet 0/0
hostname (config-if)# ipv6 nd ra-lifetime 2000
Configuring DAD Settings
To specify DAD settings on the interface, enter the following command.
Detailed Steps
|
|
ipv6 nd dad attempts
value
hostname (config-if)# ipv6 nd dad attempts 20
|
Specifies the uniqueness of new unicast IPv6 addresses before they are assigned and ensures that duplicate IPv6 addresses are detected in the network on a link basis. Valid values for the value argument range from 0 to 600. A zero value disables DAD processing on the specified interface. |
Examples
The following example configures a DAD attempt value of 20 for the selected interface, GigabitEthernet 0/0:
hostname (config)# interface gigabitethernet 0/0
hostname (config-if)# ipv6 nd dad attempts 20
Suppressing Router Advertisement Messages
Router advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on any interface for which you do not want the ASA to supply the IPv6 prefix (for example, the outside interface).
To suppress the router lifetime value in IPv6 router advertisements on an interface, enter the following command.
Detailed Steps
|
|
hostname (config-if)# ipv6 nd suppress-ra
|
Suppresses IPv6 router advertisement transmissions on a LAN interface. Entering this command causes the ASA to appear as a regular IPv6 neighbor on the link and not as an IPv6 router. |
Examples
The following example suppresses an IPv6 router advertisement transmission for the specified interface, which is GigabitEthernet 0/0:
hostname (config)# interface gigabitethernet 0/0
hostname (config-if)# ipv6 nd suppress-ra
Configuring Address Config Flags for IPv6 DHCP Relay
You can add a flag to IPv6 router advertisements to inform IPv6 autoconfiguration clients to use DHCPv6 to obtain an IPv6 address and/or additional information such as the DNS server address.
Detailed Steps
|
|
ipv6 nd managed-config-flag
hostname (config-if)# ipv6 nd managed-config-flag
|
Sets the Managed Address Config flag in the IPv6 router advertisement packet. This flag informs IPv6 autoconfiguration clients that they should use DHCPv6 to obtain addresses, in addition to the derived stateless autoconfiguration address. |
ipv6 nd other-config-flag
hostname (config-if)# ipv6 nd other-config-flag
|
Sets the Other Address Config flag in the IPv6 router advertisement packet. This flag informs IPv6 autoconfiguration clients that they should use DHCPv6 to obtain additional information from DHCPv6, such as the DNS server address. |
Configuring the IPv6 Prefix in Router Advertisements
To configure the which IPv6 prefixes are included in IPv6 router advertisements, enter the following command.
Detailed Steps
|
|
ipv6 nd prefix
ipv6-prefix /
prefix-length |
default
[[
valid-lifetime preferred-lifetime ] | [
at
valid-date preferred-date ] |
infinite |
no-advertise |
off-link |
no-autoconfig ]
hostname (config-if)# ipv6 nd prefix 2001:DB8::/32 1000 900
|
Configures which IPv6 prefixes are included in IPv6 router advertisements. The prefix advertisement can be used by neighboring devices to autoconfigure their interface addresses. Stateless autoconfiguration uses IPv6 prefixes provided in router advertisement messages to create the global unicast address from the link-local address. The at valid-date preferred-date syntax indicates the date and time at which the lifetime and preference expire. The prefix is valid until this specified date and time are reached. Dates are expressed in the form date-valid-expire month-valid-expire hh:mm-valid-expire date-prefer-expire month-prefer-expire hh:mm-prefer-expire . The default keyword indicates that default values are used. The optional infinite keyword specifies that the valid lifetime does not expire. The ipv6-prefix argument specifies the IPv6 network number to include in router advertisements. This argument must be in the form documented in RFC 2373 where the address is specified in hexadecimal using 16-bit values between colons. The optional no-advertise keyword indicates to hosts on the local link that the specified prefix is not to be used for IPv6 autoconfiguration. The optional no-autoconfig keyword indicates to hosts on the local link that the specified prefix cannot be used for IPv6 autoconfiguration. The optional off-link keyword indicates that the specified prefix is not used for on-link determination. The preferred-lifetime argument specifies the amount of time (in seconds) that the specified IPv6 prefix is advertised as being preferred. Valid values range from 0 to 4294967295 seconds. The maximum value represents infinity, which can also be specified with infinite. The default is 604800 (7 days). The prefix-length argument specifies the length of the IPv6 prefix. This value indicates how many of the high-order, contiguous bits of the address comprise the network portion of the prefix. The slash (/) must precede the prefix length. The valid-lifetime argument specifies the amount of time that the specified IPv6 prefix is advertised as being valid. Valid values range from 0 to 4294967295 seconds. The maximum value represents infinity, which can also be specified with infinite. The default is 2592000 (30 days). |
Examples
The following example includes the IPv6 prefix 2001:DB8::/32, with a valid lifetime of 1000 seconds and a preferred lifetime of 900 seconds, in router advertisements sent out on the specified interface, which is GigabitEthernet 0/0:
hostname (config)# interface gigabitethernet 0/0
hostname (config-if)# ipv6 nd prefix 2001:DB8::/32 1000 900
Configuring a Static IPv6 Neighbor
To configure a static entry in the IPv6 neighbor discovery cache, enter the following command.
Detailed Steps
|
|
ipv6 neighbor
ipv6_address if_name mac_address
hostname(config-if)# ipv6 neighbor 3001:1::45A inside 002.7D1A.9472
|
Configures a static entry in the IPv6 neighbor discovery cache. The ipv6_address argument is the link-local IPv6 address of the neighbor, the if_name argument is the interface through which the neighbor is available, and the mac_address argument is the MAC address of the neighbor interface. |
Examples
The following example adds a static entry for an inside host with an IPv6 address of 3001:1::45A and a MAC address of 002.7D1a.9472 to the neighbor discovery cache:
hostname(config-if)# ipv6 neighbor 3001:1::45A inside 002.7D1A.9472