Have an account?

  •   Personalized content
  •   Your products and support

Need an account?

Create an account

Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Chapter Title

IP Version 6 Support for the Management Port

Results

Updated:
September 3, 2014

Chapter: IP Version 6 Support for the Management Port

IP Version 6 Support for the Management Port

This chapter describes IP Version 6 (IPv6) Support for the Management Port and procedures to configure IPv6 for the Management Port.

IP Version 6 Support for the Management Port

IP version 6 is a new IP protocol designed to replace IP version 4, the Internet protocol that is extensively used throughout the world.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see the Bug Toolkit and release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use the Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http:/​/​www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for IPv6

  • You must be familiar with IPv6 basics such as IPv6 addressing, IPv6 header information, ICMPv6, and the IPv6 Neighbor Discovery (ND) Protocol.
  • Ensure that you follow the memory and/or processing guidelines when you convert a device to a dual-stack device (IPv4/IPv6).

Restrictions for IPv6

  • IPv6 packets are transparent to Layer 2 LAN switches because the switches do not examine Layer 3 packet information before forwarding IPv6 frames. IPv6 hosts can be directly attached to Layer 2 LAN switches.
  • You can configure multiple IPv6 global addresses within the same prefix on an interface. However, multiple IPv6 link-local addresses on an interface are not supported.
  • Because RFC 3879 deprecates the use of site-local addresses, you should configure private IPv6 addresses according to the recommendations of unique local addressing (ULA) in RFC 4193.

Information About IPv6

IPv6 increases the number of network address bits from 32 bits (in IPv4) to 128 bits. IPv6 is based on IPv4 but it includes a much larger address space and other improvements such as a simplified main header and extension headers.

The larger IPv6 address space allows networks to scale and provide global reachability. The simplified IPv6 packet header format handles packets more efficiently. The flexibility of the IPv6 address space reduces the need for private addresses and the use of Network Address Translation (NAT), which translates private (not globally unique) addresses into a limited number of public addresses. IPv6 enables new application protocols that do not require special processing by border routers at the edge of networks.

IPv6 functionalities such as prefix aggregation, simplified network renumbering, and IPv6 site multihoming capabilities, enable more efficient routing. IPv6 supports Routing Information Protocol (RIP), Integrated Intermediate System-to-Intermediate System (IS-IS), Open Shortest Path First (OSPF) for IPv6, and multiprotocol Border Gateway Protocol (BGP).

IPv6-Enabled Commands

The following Cisco Firewall Services Module (FWSM) commands can accept and display IPv6 addresses:

  • capture
  • configure
  • copy
  • http
  • name
  • object-group
  • ping
  • show conn
  • show local-host
  • show tcpstat
  • ssh
  • telnet
  • tftp-server
  • who
  • write

Note

Failover does not support IPv6. The ipv6 address command does not support setting standby addresses for failover configurations. The failover interface ip command does not support using IPv6 addresses on the failover and stateful failover interfaces.

When entering IPv6 addresses in commands that support them, simply enter the IPv6 address using standard IPv6 notation; for example ping fe80::2e0:b6ff:fe01:3b7a or [fe80::2e0:b6ff:fe01:3b7a]. The Cisco ME 2600X device supports both notations (IPv6 addresses with or without the square brackets).

The following commands were modified to work for IPv6:
  • debug
  • fragment
  • ip
  • verify
  • mtu icmp (entered as ipv6 icmp)

The following inspection engines support IPv6:

  • FTP
  • HTTP
  • ICMP
  • SMTP
  • TCP
  • UDP

IPv6 Neighbor Discovery

The IPv6 neighbor discovery process uses ICMPv6 messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local link), verify the reachability of a neighbor, and keep track of neighboring devices.

These topics contain more information:

  • Neighbor Solicitation Messages
  • Router Advertisement Messages

Neighbor Solicitation Messages

Neighbor solicitation messages are sent on the local link when a node wants to determine the link-layer address of another node on the same local link (see the figure below). When a node wants to determine the link-layer address of another node, the source address in a neighbor solicitation message is the IPv6 address of the node sending the neighbor solicitation message. The destination address in the neighbor solicitation message is the solicited-node multicast address that corresponds to the IPv6 address of the destination node. The neighbor solicitation message also includes the link-layer address of the source node.

Figure 1. IPv6 Neighbor Discovery—Neighbor Solicitation Message

After receiving a neighbor solicitation message, the destination node replies by sending a neighbor advertisement message (ICPMv6 Type 136) on the local link. The source address in the neighbor advertisement message is the IPv6 address of the node sending the neighbor advertisement message; the destination address is the IPv6 address of the node that sent the neighbor solicitation message. The data portion of the neighbor advertisement message includes the link-layer address of the node sending the neighbor advertisement message.

After the source node receives the neighbor advertisement message, the source node communicates with the destination node. The figure above shows the neighbor solicitation and response process.

Neighbor solicitation messages are also used to verify the reachability of a neighbor after the link-layer address of a neighbor is identified. When a node wants to verify the reachability of a neighbor, the destination address in a neighbor solicitation message is the unicast address of the neighbor.

Neighbor advertisement messages are also sent when there is a change in the link-layer address of a node on a local link. When there is such a change, the destination address for the neighbor advertisement is the all-nodes multicast address.

You can configure the neighbor solicitation message interval and neighbor reachable time on a per-interface basis. These topics contain more information:

Router Advertisement Messages

Router advertisement messages (ICMPv6 Type 134) are periodically sent to each IPv6 configured interface of FWSM. The router advertisement messages are sent to the all-nodes multicast address.

Figure 2. IPv6 Neighbor Discovery—Router Advertisement Message

Router advertisement messages include the following information:
  • One or more IPv6 prefix that nodes on the local link can use to automatically configure their IPv6 addresses.
  • Lifetime information for each prefix included in the advertisement.
  • Sets of flags that indicate the type of autoconfiguration (stateless or stateful) that can be completed.
  • Default router information (whether the router sending the advertisement should be used as a default router and, if so, the amount of time (in seconds) the router should be used as a default router).
  • Additional information for hosts, such as the hop limit and MTU a host should use in packets that it originates.
  • The amount of time between neighbor solicitation message retransmissions on a given link.
  • The amount of time a node considers a neighbor reachable.

Router advertisements are also sent in response to router solicitation messages (ICMPv6 Type 133). Router solicitation messages are sent by hosts at system startup so that the host can immediately autoconfigure without waiting for the next scheduled router advertisement message. Because router solicitation messages are usually sent by hosts, and the host does not have a configured unicast address, the source address in router solicitation messages is usually the unspecified IPv6 address (0:0:0:0:0:0:0:0). If the host has a configured unicast address, the unicast address of the interface sending the router solicitation message is used as the source address in the message. The destination address in router solicitation messages is the all-routers multicast address with a scope of the link. When a router advertisement is sent in response to a router solicitation, the destination address in the router advertisement message is the unicast address of the source of the router solicitation message.

You can configure the following settings for router advertisement messages:
  • The time interval between periodic router advertisement messages.
  • The router lifetime value, which indicates the amount of time IPv6 nodes should consider for the FWSM to be the default router.
  • The IPv6 network prefixes in use on the link.
  • Whether or not an interface transmits router advertisement messages.

Unless otherwise noted, the router advertisement message settings are specific to an interface and are entered in interface configuration mode. These topics contain information about changing the router settings:

How to Configure IPv6

The following tasks describe how to configure IPv6 on the Cisco ME 2600X device:

Configuring IPv6 on an Interface

FWSM supports dual IP stack. You can configure both IPv6 and IPv4 on an interface. You do not need to enter any special commands to do so; simply enter the IPv4 configuration commands and IPv6 configuration commands as you normally would. Make sure you configure the default route for both IPv4 and IPv6.

Note

You cannot configure IPv6 on an interface that is used by more than one context (a shared VLAN).

To configure IPv6 on an interface, complete the following steps:

Before You Begin
At a minimum, each interface needs to be configured with an IPv6 link-local address. Additionally, you can add a site-local and global addresses to an interface.

Note

FWSM does not support IPv6 anycast addresses.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    interface type slot/port

    4.    ipv6 address autoconfig or ipv6 address ipv6-address link-local or ipv6 enable or ipv6 address ipv6-address [eui-64] or ipv6 nd suppress-ra

    5.    end


DETAILED STEPS
     Command or ActionPurpose
    Step 1enable


    Example: 
    Switch> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.
     
    Step 2configure terminal


    Example: 
    Switch# configure terminal
     

    Enters global configuration mode.

     
    Step 3interface type slot/port


    Example: 
    Switch(config)# interface GigabitEthernet 0/1
     

    Configures an IPv6 address for the interface. You can assign several IPv6 addresses to an interface, such as an IPv6 link-local, site-local, and global address. However, at a minimum, you must configure a link-local address.

    There are several methods for configuring IPv6 addresses for an interface. Pick the method that suits your needs from the next step.

     
    Step 4ipv6 address autoconfig or ipv6 address ipv6-address link-local or ipv6 enable or ipv6 address ipv6-address [eui-64] or ipv6 nd suppress-ra


    Example: 
    Switch(config-if)# ipv6 address autoconfig or

    Switch(config-if)# ipv6 address FE80::260:3EFF:FE11:6770 link-local or

    Switch(config-if)# ipv6 enable or

    Switch(config-if)# ipv6 address ipv6 address 2001:0DB8:0:1::/64 eui-64 or

    Switch(config-if)# ipv6 nd suppress-ra
     

    Configures the following:

    • Autoconfig: Enables stateless autoconfiguration on the interface. Enabling stateless autoconfiguration configures IPv6 addresses based on prefixes received in Router Advertisement messages. A link-local address, based on the Modified EUI-64 interface ID, is automatically generated for the interface when stateless autoconfiguration is enabled.
    • Link-local address: Configures a link-local address on the interface. If you do not assign any other IPv6 addresses to the interface, you can manually define the link-local address or generating one based on the interface MAC address (Modified EUI-64 format).
    • IPv6 on the interface:
      Enables IPv6 on the interface and automatically generate the link-local address using the Modified EUI-64 interface ID based on the interface MAC address.
      Note   

      You do not need to use the ipv6 enable command if you enter any other ipv6 address commands on an interface; IPv6 support is automatically enabled as soon as you assign an IPv6 address to the interface.

    • Site-local or global address: Assigns a site-local or global address to the interface. When you assign a site-local or global address, a link-local address is automatically created. Use the optional eui-64 keyword to use the Modified EUI-64 interface ID in the low order 64 bits of the address.
    • Suppress Router Advertisement messages: By default, router advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on interfaces for which you do not want FWSM to supply the IPv6 prefix (for example, the outside interface).
     
    Step 5end


    Example:
    Switch(config-if)# end
     

    Returns to privileged EXEC mode.

     

    Configuring IPv6 on a Bridge Domain Interface

    To configure IPv6 on a bridge domain interface, complete the following steps:

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    interface type slot/port

      4.    service instance id ethernet [evc-id]

      5.    encapsulation dot1q {any | vlan-id [vlan-id [-vlan-id]]}

      6.    bridge-domain bridge-id

      7.    exit

      8.    no shutdown

      9.    exit

      10.    interface BDI interface number

      11.    ipv6 address {X:X:X:X::X link-local | X:X:X:X::X/prefix [anycast | eui-64] | autoconfig [default]} or ip address ip-address mask

      12.    no shutdown

      13.    end


    DETAILED STEPS
       Command or ActionPurpose
      Step 1enable


      Example:
      Switch> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.
       
      Step 2configure terminal


      Example:
      Switch# configure terminal
       

      Enters global configuration mode.

       
      Step 3interface type slot/port


      Example:
      Switch(config)# interface gigabitethernet 0/1
       

      Specifies the port adapter type and the location of the interface to be configured. The slot is always 0 and the port is the number of the port.

       
      Step 4service instance id ethernet [evc-id]


      Example:
      Switch(config-if)# service instance 100 ethernet
       

      Configures an Ethernet service instance on an interface and enters service instance configuration mode.

       
      Step 5encapsulation dot1q {any | vlan-id [vlan-id [-vlan-id]]}

      Example:
      Switch(config-if-srv)# encapsulation dot1q 100
       

      Defines the matching criteria that maps the ingress dot1q, QinQ, or untagged frames on an interface to the appropriate service instance.

       
      Step 6bridge-domain bridge-id


      Example:
      Switch(config-if-srv)# bridge-domain 3000
       

      Binds the Ethernet service instance to a bridge domain instance where bridge-id is the identifier for the bridge domain instance.

      The valid values for bridge-id range from 1 to 4096.

       
      Step 7exit


      Example:
      Switch(config-if-srv)# exit
       

      Exits the service instance configuration mode.

       
      Step 8no shutdown


      Example:
      Switch(config-if)# no shutdown
       

      Enables an interface.

       
      Step 9exit


      Example:
      Switch(config-if)# exit
       

      Exits the interface configuration mode.

       
      Step 10interface BDI interface number


      Example:
      Switch(config)# interface bdi 3000
       
      Specifies a bridge domain interface.
      Note   

      The interface number must be same as the bridge-id.

       
      Step 11ipv6 address {X:X:X:X::X link-local | X:X:X:X::X/prefix [anycast | eui-64] | autoconfig [default]} or ip address ip-address mask

      Example:
      Switch(config-if)# ipv6 address 20::1/64
      Switch(config-if)# ip address 20.1.1.1 255.255.255.0
       

      Specifies the IPv6 or IPv4 address for the bridge domain interface.

       
      Step 12no shutdown


      Example:
      Switch(config-if)# no shutdown
       

      Enables an interface.

       
      Step 13end


      Example:
      Switch(config-if)# end
       

      Returns to privileged EXEC mode.

       

      Configuring IPv6 Duplicate Address Detection

      During the stateless autoconfiguration process, duplicate address detection verifies the uniqueness of new unicast IPv6 addresses before the addresses are assigned to interfaces (the new addresses remain in a tentative state while duplicate address detection is performed). Duplicate address detection is first performed on the new link-local address. And only when the link local address is verified as unique, duplicate address detection is performed on all the other IPv6 unicast addresses on the interface.

      Duplicate address detection is suspended on interfaces that are administratively down. While an interface is administratively down, the unicast IPv6 addresses assigned to the interface are set to a pending state. An interface returning to an administratively up state restarts duplicate address detection for all of the unicast IPv6 addresses on the interface.

      When a duplicate address is identified, the state of the address is set to DUPLICATE and the address is not used. If the duplicate address is the link-local address of the interface, the processing of IPv6 packets is disabled on the interface and an error message is issued. If the duplicate address is a global address of the interface, the address is not used and an error message is issued. However, all configuration commands associated with the duplicate address remain as configured while the state of the address is set to DUPLICATE.

      If the link-local address for an interface changes, duplicate address detection is performed on the new link-local address and all of the other IPv6 address associated with the interface are regenerated (duplicate address detection is performed only on the new link-local address).

      FWSM uses neighbor solicitation messages to perform duplicate address detection. By default, the number of times an interface performs duplicate address detection is 1.

      To change the number of duplicate address detection attempts and the neighbor solicitation message interval, complete the following steps:

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    interface type slot/port

        4.    ipv6 nd dad attempts value

        5.    ipv6 nd ns-interval value

        6.    end


      DETAILED STEPS
         Command or ActionPurpose
        Step 1enable


        Example: 
        Switch> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.
         
        Step 2configure terminal


        Example: 
        Switch# configure terminal
         

        Enters global configuration mode.

         
        Step 3interface type slot/port


        Example: 
        Switch(config)# interface GigabitEthernet 0/1
         

        Enters interface configuration mode.

         
        Step 4ipv6 nd dad attempts value


        Example: 
        Switch(config-if)# ipv6 nd dad attempts 50
         

        Changes the number of duplicate address detection attempts.

        The value argument can be any value from 0 to 600. Setting the value argument to 0 disables duplicate address detection on the interface.

         
        Step 5ipv6 nd ns-interval value


        Example: 
        Switch(config-if)# ipv6 nd ns-interval 1500
         

        Changes the neighbor solicitation message interval. When you configure an interface to send out more than one duplicate address detection attempt, you can also use the ipv6 nd ns-interval command to configure the interval at which the neighbor solicitation messages are sent out. By default, they are sent out once every 1000 milliseconds.

        The value argument can be from 1000 to 3600000 milliseconds.
        Note   

        Changing this value changes it for all neighbor solicitation messages sent out on the interface, and not just those used for duplicate address detection.

         
        Step 6end


        Example:
        Switch(config-if)# end
         

        Returns to privileged EXEC mode.

         

        Configuring IPv6 Default and Static Routes

        IPv6 unicast routing is always enabled. FWSM routes IPv6 traffic between interfaces as long as the interfaces are enabled for IPv6 and the IPv6 access lists allow the traffic. You can add a default route and static routes using the ipv6 route command.

        To configure an IPv6 default route and static routes, complete the following steps:

        SUMMARY STEPS

          1.    enable

          2.    configure terminal

          3.    ipv6 route interface_name ::/0 next_hop_ipv6_addr

          4.    ipv6 route if_name destination next_hop_ipv6_addr [admin_distance]

          5.    end


        DETAILED STEPS
           Command or ActionPurpose
          Step 1enable


          Example: 
          Switch> enable
           

          Enables privileged EXEC mode.

          • Enter your password if prompted.
           
          Step 2configure terminal


          Example: 
          Switch# configure terminal
           

          Enters global configuration mode.

           
          Step 3ipv6 route interface_name ::/0 next_hop_ipv6_addr


          Example: 
          Switch(config)# ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1
           

          Adds a default IPv6 route.

           
          Step 4ipv6 route if_name destination next_hop_ipv6_addr [admin_distance]


          Example: 
          Switch(config)# ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1 [110]
           

          (Optional) Adds an IPv6 static route to the IPv6 routing table.

           
          Step 5end


          Example:
          Switch(config-if)# end
           

          Returns to privileged EXEC mode.

           

          Configuring IPv6 Access Lists

          Configuring an IPv6 access list is similar configuring an IPv4 access, but with IPv6 addresses.

          To create an access list, use the ipv6 access-list command to create entries for the access list. There are two main forms of this command to choose from, one for creating access list entries specifically for ICMP traffic, and one to create access list entries for all other types of IP traffic.

          To configure an IPv6 access list, complete the following steps:

          SUMMARY STEPS

            1.    enable

            2.    configure terminal

            3.    ipv6 access-list id [line num] {permit | deny} icmp source destination [icmp_type]

            4.    ipv6 access-list id [line num] {permit | deny} protocol source [src_port] destination [dst_port]

            5.    access-group iaccess_list_name {in | out} interface if_name [icmp_type]

            6.    end


          DETAILED STEPS
             Command or ActionPurpose
            Step 1enable


            Example: 
            Switch> enable
             

            Enables privileged EXEC mode.

            • Enter your password if prompted.
             
            Step 2configure terminal


            Example: 
            Switch# configure terminal
             

            Enters global configuration mode.

            • To create an IPv6 access list entry specifically for ICMP traffic go to step 3.
            • To create an IPv6 access list entry for IP traffic other than ICMP go to step 4.
             
            Step 3ipv6 access-list id [line num] {permit | deny} icmp source destination [icmp_type]


            Example: 
            Switch(config)# ipv6 access-list acl_grp permit tcp any host 3001:1::203:A0FF:FED6:162D
             

            Creates an IPv6 access list entry specifically for ICMP traffic.

            The following describes the arguments for the ipv6 access-list command:
            • id—The name of the access list. Use the same id in each command when you are entering multiple entries for an access list.
            • line num—When adding an entry to an access list, you can specify the line number in the list where the entry should appear.
            • permit | deny—Determines whether the specified traffic is blocked or allowed to pass.
            • icmp—Indicates that the access list entry applies to ICMP traffic.
            • protocol—Specifies the traffic being controlled by the access list entry. The entry could be the name (ip, tcp, or udp) or number (1-254) of an IP protocol. Alternatively, you can specify a protocol object group using object-group grp_id.
            • source and destination—Specifies the source or destination of the traffic. The source or destination can be an IPv6 prefix, in the format prefix/length, to indicate a range of addresses, the keyword any, to specify any address, or a specific host designated by host host_ipv6_addr.
            • src_port and dst_port—The source and destination port (or service) argument. Enter an operator (lt for less than, gt for greater than, eq for equal to, neq for not equal to, or range for an inclusive range) followed by a space and a port number (or two port numbers separated by a space for the range keyword).
            • icmp_type—Specifies the ICMP message type being filtered by the access rule. The value can be a valid ICMP type number (from 0 to 155)or one of the ICMP type literals as shown in Appendix D, “Addresses, Protocols, and Ports”. Alternatively, you can specify an ICMP object group using object-group id.

            Skip step 4 (required only when creating an IPv6 access list entry for IP traffic other than ICMP) and go to step 5.

             
            Step 4ipv6 access-list id [line num] {permit | deny} protocol source [src_port] destination [dst_port]


            Example: 
            Switch(config)# ipv6 access-list acl_grp permit tcp any host 3001:1::203:A0FF:FED6:162D
             

            Creates an IPv6 access list entry.

             
            Step 5access-group iaccess_list_name {in | out} interface if_name [icmp_type]


            Example: 
            Switch(config-if)# ip access-group noncorp in
             

            Applies the specified access list to the incoming or outgoing interface.

            • When you are filtering on source addresses, you typically apply the access list to an incoming interface.
            • Filtering on source addresses is most efficient when applied near the destination.
             
            Step 6end


            Example:
            Switch(config-if)# end
             

            Returns to privileged EXEC mode.

             

            Configuring the Neighbor Solicitation Message Interval

            To configure the interval between IPv6 neighbor solicitation retransmissions on an interface, complete the following steps:

            SUMMARY STEPS

              1.    enable

              2.    configure terminal

              3.    interface type slot/port

              4.    ipv6 nd ns-interval value

              5.    end


            DETAILED STEPS
               Command or ActionPurpose
              Step 1enable


              Example: 
              Switch> enable
               

              Enables privileged EXEC mode.

              • Enter your password if prompted.
               
              Step 2configure terminal


              Example: 
              Switch# configure terminal
               

              Enters global configuration mode.

               
              Step 3interface type slot/port


              Example: 
              Switch(config)# interface GigabitEthernet 0/1
               

              Enters interface configuration mode.

               
              Step 4ipv6 nd ns-interval value


              Example: 
              Switch(config-if)# ipv6 nd ns-interval 1500
               

              Changes the neighbor solicitation message interval. When you configure an interface to send out more than one duplicate address detection attempt, you can also use the ipv6 nd ns-interval command to configure the interval at which the neighbor solicitation messages are sent out. By default, they are sent out once every 1000 milliseconds.

              The value argument can be from 1000 to 3600000 milliseconds.
              Note   

              This setting is also sent in router advertisement messages.

               
              Step 5end


              Example:
              Switch(config-if)# end
               

              Returns to privileged EXEC mode.

               

              Configuring the Neighbor Reachable Time

              The neighbor reachable time enables detecting unavailable neighbors. Shorter configured times enable detecting unavailable neighbors more quickly; however, shorter times consume more IPv6 network bandwidth and processing resources in all IPv6 network devices. Very short configured times are not recommended in normal IPv6 operation.

              To configure the amount of time that a remote IPv6 node is considered reachable after a reachability confirmation event has occurred, complete the following steps:

              SUMMARY STEPS

                1.    enable

                2.    configure terminal

                3.    interface type slot/port

                4.    ipv6 nd reachable-time value

                5.    end


              DETAILED STEPS
                 Command or ActionPurpose
                Step 1enable


                Example: 
                Switch> enable
                 

                Enables privileged EXEC mode.

                • Enter your password if prompted.
                 
                Step 2configure terminal


                Example: 
                Switch# configure terminal
                 

                Enters global configuration mode.

                 
                Step 3interface type slot/port


                Example: 
                Switch(config)# interface GigabitEthernet 0/1
                 

                Enters interface configuration mode.

                 
                Step 4ipv6 nd reachable-time value


                Example: 
                Switch(config-if)# ipv6 nd reachable-time 1000
                 

                Sets the amount of time that a remote IPv6 node is reachable.

                The value argument can be from 0 to 3600000 milliseconds. The default is 0.
                Note   

                This information is also sent in router advertisement messages.

                 
                Step 5end


                Example:
                Switch(config-if)# end
                 

                Returns to privileged EXEC mode.

                 

                Configuring the Router Advertisement Transmission Interval

                To change the interval between router advertisement transmissions on an interface, complete the following steps:

                SUMMARY STEPS

                  1.    enable

                  2.    configure terminal

                  3.    interface type slot/port

                  4.    ipv6 nd ra-interval [msec] value

                  5.    end


                DETAILED STEPS
                   Command or ActionPurpose
                  Step 1enable


                  Example: 
                  Switch> enable
                   

                  Enables privileged EXEC mode.

                  • Enter your password if prompted.
                   
                  Step 2configure terminal


                  Example: 
                  Switch# configure terminal
                   

                  Enters global configuration mode.

                   
                  Step 3interface type slot/port


                  Example: 
                  Switch(config)# interface GigabitEthernet 0/1
                   

                  Enters interface configuration mode.

                   
                  Step 4ipv6 nd ra-interval [msec] value


                  Example: 
                  Switch(config-if)# ipv6 nd ra-interval 1000
                   

                  Sets the interval between IPv6 router advertisement transmissions.

                  The optional msec keyword indicates that the value provided is in milliseconds. If this keyword is not present, the value provided is in seconds.

                  The value argument can be from 3 to 1800 seconds or from 500 to 1800000 milliseconds if the msec keyword is provided. The default is 200 seconds.
                  Note   

                  The interval between transmissions should be less than or equal to the IPv6 router advertisement lifetime if the FWSM is configured as a default router by using the ipv6 nd ra-lifetime command. To prevent synchronization with other IPv6 nodes, randomly adjust the actual value used to within 20 percent of the desired value.

                   
                  Step 5end


                  Example:
                  Switch(config-if)# end
                   

                  Returns to privileged EXEC mode.

                   

                  Configuring the Router Lifetime Value

                  The router lifetime value specifies how long nodes on the local link should consider FWSM as the default router on the link.

                  To configure the router lifetime value in IPv6 router advertisements on an interface, complete the following steps:

                  SUMMARY STEPS

                    1.    enable

                    2.    configure terminal

                    3.    interface type slot/port

                    4.    ipv6 nd ra-lifetime value

                    5.    end


                  DETAILED STEPS
                     Command or ActionPurpose
                    Step 1enable


                    Example: 
                    Switch> enable
                     

                    Enables privileged EXEC mode.

                    • Enter your password if prompted.
                     
                    Step 2configure terminal


                    Example: 
                    Switch# configure terminal
                     

                    Enters global configuration mode.

                     
                    Step 3interface type slot/port


                    Example: 
                    Switch(config)# interface GigabitEthernet 0/1
                     

                    Enters interface configuration mode.

                     
                    Step 4ipv6 nd ra-lifetime value


                    Example: 
                    Switch(config-if)# ipv6 nd ra-lifetime 5000
                     

                    Sets the interval between IPv6 router advertisement transmissions.

                    The value argument can be from 0 to 9000 seconds. The default is 1800 seconds.
                    Note    Entering 0 indicates that FWSM should not be considered a default router on the selected interface.
                     
                    Step 5end


                    Example:
                    Switch(config-if)# end
                     

                    Returns to privileged EXEC mode.

                     

                    Configuring the IPv6 Prefix

                    Stateless autoconfiguration uses IPv6 prefixes provided in router advertisement messages to create the global unicast address from the link-local address.

                    To configure which IPv6 prefixes are included in IPv6 router advertisements, complete the following steps:

                    SUMMARY STEPS

                      1.    enable

                      2.    configure terminal

                      3.    interface type slot/port

                      4.    ipv6 nd prefix ipv6-prefix/prefix-length

                      5.    end


                    DETAILED STEPS
                       Command or ActionPurpose
                      Step 1enable


                      Example: 
                      Switch> enable
                       

                      Enables privileged EXEC mode.

                      • Enter your password if prompted.
                       
                      Step 2configure terminal


                      Example: 
                      Switch# configure terminal
                       

                      Enters global configuration mode.

                       
                      Step 3interface type slot/port


                      Example: 
                      Switch(config)# interface GigabitEthernet 0/1
                       

                      Enters interface configuration mode.

                       
                      Step 4ipv6 nd prefix ipv6-prefix/prefix-length


                      Example: 
                      Switch(config-if)# ipv6 nd prefix 2001:200:200::/35 1000 900
                       
                      Configures which IPv6 prefixes are included in IPv6 router advertisements.
                      Note    For stateless autoconfiguration to work properly, the advertised prefix length in router advertisement messages must always be 64 bits.
                       
                      Step 5end


                      Example:
                      Switch(config-if)# end
                       

                      Returns to privileged EXEC mode.

                       

                      Suppressing Router Advertisement Messages

                      By default, Router Advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on any interface for which you do not want FWSM to supply the IPv6 prefix (for example, the outside interface).

                      To suppress IPv6 router advertisement transmissions on an interface, complete the following steps:

                      SUMMARY STEPS

                        1.    enable

                        2.    configure terminal

                        3.    interface type slot/port

                        4.    ipv6 nd suppress-ra

                        5.    end


                      DETAILED STEPS
                         Command or ActionPurpose
                        Step 1enable


                        Example: 
                        Switch> enable
                         

                        Enables privileged EXEC mode.

                        • Enter your password if prompted.
                         
                        Step 2configure terminal


                        Example: 
                        Switch# configure terminal
                         

                        Enters global configuration mode.

                         
                        Step 3interface type slot/port


                        Example: 
                        Switch(config)# interface GigabitEthernet 0/1
                         

                        Enters interface configuration mode.

                         
                        Step 4ipv6 nd suppress-ra


                        Example: 
                        Switch(config-if)# ipv6 nd suppress-ra
                         

                        Suppresses the router lifetime value.

                         
                        Step 5end


                        Example:
                        Switch(config-if)# end
                         

                        Returns to privileged EXEC mode.

                         

                        Configuring a Static IPv6 Neighbor

                        You can manually define a neighbor in the IPv6 neighbor cache. If an entry for the specified IPv6 address already exists in the neighbor discovery cache—learned through the IPv6 neighbor discovery process—the entry is automatically converted to a static entry. Static entries in the IPv6 neighbor discovery cache are not modified by the neighbor discovery process.

                        To configure a static entry in the IPv6 neighbor discovery cache, complete the following steps:

                        SUMMARY STEPS

                          1.    enable

                          2.    configure terminal

                          3.    interface type slot/port

                          4.    ipv6 neighbor ipv6_address if_name mac_address

                          5.    end


                        DETAILED STEPS
                           Command or ActionPurpose
                          Step 1enable


                          Example: 
                          Switch> enable
                           

                          Enables privileged EXEC mode.

                          • Enter your password if prompted.
                           
                          Step 2configure terminal


                          Example: 
                          Switch# configure terminal
                           

                          Enters global configuration mode.

                           
                          Step 3interface type slot/port


                          Example: 
                          Switch(config)# interface GigabitEthernet 0/1
                           

                          Enters interface configuration mode.

                           
                          Step 4ipv6 neighbor ipv6_address if_name mac_address


                          Example: 
                          Switch(config-if)# ipv6 neighbor 3001:1::45A inside 002.7D1A.9472
                           

                          Configures a static entry in the IPv6 neighbor discovery cache.

                          The ipv6_address argument is the link-local IPv6 address of the neighbor, the if_name argument is the interface through which the neighbor is available, and the mac_address argument is the MAC address of the neighbor interface.

                          Note   

                          The clear ipv6 neighbors command does not remove static entries from the IPv6 neighbor discovery cache.

                           
                          Step 5end


                          Example:
                          Switch(config-if)# end
                           

                          Returns to privileged EXEC mode.

                           

                          Troubleshooting Tips

                          Use these debug commands to troubleshoot IPv6:
                          • debug ipv6 pim—Helps discover whether the PIM protocol activities are working correctly.
                          • debug ipv6 mrib route—Displays update information related to the route database made by MRIB clients, which is then redistributed to the clients.
                          • debug ipv6 mfib pak—Enables debugging output for packet forwarding activity.
                          • debug ipv6 mld—Helps discover whether the MLD protocol activities are working correctly.
                          • debug ipv6 mld explicit—Displays information related to the explicit tracking of hosts.
                          • debug ipv6 mld interface <interface no> —Displays multicast-related information about an interface.
                          • debug ipv6 mld group < Hostname or X:X:X:X::X > —Displays the multicast groups that are directly connected to the router and that were learned through Multicast Listener Discovery (MLD).

                          Configuration Examples for IPv6

                          Configuring IPv6 Duplicate Address Detection

                          The following example shows how to configure an IPv6 duplicate address detection:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 address 2001:db8::/64 eui64
ipv6 nd reachable-time 10

                          Configuring IPv6 Default Route

                          The following example shows how to configure an IPv6 default route:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1

                          Configuring IPv6 Static Route

                          The following example shows how to configure an IPv6 static route:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1 [110]

                          Configuring IPv6 Access Lists

                          The following example shows how to configure an IPv6 access lists:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 access-list acl_grp permit tcp any host 3001:1::203:A0FF:FED6:162D
ip access-group noncorp in

                          Configuring the Neighbor Solicitation Message Interval

                          The following example shows how to configure the neighbor solicitation message interval:

                          configure terminal
interface GigabitEthernet 0/1
interface GigabitEthernet 0/1 ipv6 nd ns-interval 1500

                          Configuring the Neighbor Reachable Time

                          The following example shows how to configure the neighbor reachable time:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 nd reachable-time 1000

                          Configuring the Router Advertisement Transmission Interval

                          The following example shows how to configure the router advertisement transmission interval:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 nd ra-interval 1000

                          Configuring the Router Lifetime Value

                          The following example shows how to configure the router lifetime value:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 nd ra-lifetime 5000

                          Configuring the IPv6 Prefix

                          The following example shows how to configure the IPv6 prefix:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 nd prefix 2001:200:200::/35 1000 900

                          Suppressing Router Advertisement Messages

                          The following example shows how to suppress router advertisement messages:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 nd suppress-ra

                          Configuring a Static IPv6 Neighbor

                          The following example shows how to configure a static IPv6 neighbor:

                          configure terminal
interface GigabitEthernet 0/1
ipv6 neighbor 3001:1::45A inside 002.7D1A.9472

                          Verifying the IPv6 Configuration

                          Use the show ipv6 interface and show ipv6 route commands to display the various interfaces, multicast groups, protocol, and more for IPv6. This section contains examples of these commands and sample data.

                          IPv6 Interface Settings

                          To display the IPv6 interface settings, enter the following command:

                          Switch# show ipv6 interface [if_name]
                          Including the interface name, such as “outside”, displays the settings for the specified interface. Excluding the name from the command displays the setting for all interfaces that have IPv6 enabled on them. The output for the command shows the following:
                          • The name and status of the interface.
                          • The link-local and global unicast addresses.
                          • The multicast groups the interface belongs to.
                          • ICMP redirect and error message settings.
                          • Neighbor discovery settings. 
                          Switch# show ipv6 interface [if_name]
                          ipv6interface is down, line protocol is down
IPv6 is enabled, link-local address is fe80::20d:88ff:feee:6a82 [TENTATIVE]
No global unicast address is configured
Joined group address(es):
ff02::1
ff02::1:ffee:6a82
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds

                          Note

                          The show interface command displays only the IPv4 settings for an interface. To see the IPv6 configuration on an interface, use the show ipv6 interface command. The show ipv6 interface command does not display any IPv4 settings for the interface (if both are configured on the interface).

                          IPv6 Routes

                          To display the routes in the IPv6 routing table, use this command:

                          Switch# show ipv6 route
                          The output from the show ipv6 route command is similar to the IPv4 show route command. It displays the following information:
                          • The protocol that derived the route.
                          • The IPv6 prefix of the remote network.
                          • The administrative distance and metric for the route.
                          • The address of the next-hop router.
                          • The interface through which the next hop router to the specified network is reached. 
                          Switch# show ipv6 route
                          IPv6 Routing Table - 7 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
L fe80::/10 [0/0]
via ::, inside
L fec0::a:0:0:a0a:a70/128 [0/0]
via ::, inside
C fec0:0:0:a::/64 [0/0]
via ::, inside
L ff00::/8 [0/0]
via ::, inside

                          Additional References for IPv6

                          The following sections provide references related to the IPv6 feature.

                          Related Documents

                          Related Topic Document Title

                          IPv6 addressing and connectivity

                          IPv6 Configuration Guide

                          Cisco IOS commands

                          Cisco IOS Master Commands List, All Releases

                          IPv6 commands

                          Cisco IOS IPv6 Command Reference

                          Cisco IOS IPv6 features

                          Cisco IOS IPv6 Feature Mapping

                          RFCs for IPv6

                          IPv6 RFCs

                          Standards and RFCs

                          Standard/RFC Title

                          RFCs for IPv6

                          IPv6 RFCs

                          MIBs

                          MIB MIBs link
                          • CISCO-CONFIG-COPY-MIB
                          • CISCO-CONFIG-MAN-MIB
                          • CISCO-DATA-COLLECTION-MIB
                          • CISCO-FLASH-MIB
                          • CISCO-SNMP-TARGET-EXT-MIB
                          • ENTITY-MIB
                          • IP-FORWARD-MIB
                          • IP-MIB
                          • NOTIFICATION-LOG-MIB
                          • SNMP-TARGET-MIB

                          CISCO-CONFIG-COPY-MIB and CISCO-FLASH-MIB support IPv6 addressing when TFTP, remote copy protocol (rcp), or FTP is used.

                          To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use the Cisco MIB Locator found at the following URL:

                          http:/​/​tools.cisco.com/​ITDIT/​MIBS/​servlet/​index

                          RFCs

                          RFC Title

                          No new or modified RFCs are supported, and support for existing RFCs has not been modified.

                          		 —

                          Technical Assistance

                          Description Link

                          The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

                          To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

                          Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

                          		 http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

                          Was this Document Helpful?

                          FeedbackFeedback

                          Contact Cisco

                          Related Cisco Community Discussions

                          About Us
                          Contact Us
                          Work with Us