Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents

Find Matches in This Book

Available Languages

Download Options

Book Title

Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Chapter Title

IP Version 6 Support for the Management Port

PDF - Complete Book (6.38 MB) PDF - This Chapter (1.53 MB)
View with Adobe Reader on a variety of devices

Results

Updated:: September 3, 2014

Chapter: IP Version 6 Support for the Management Port

IP Version 6 Support for the Management Port
Prerequisites for IPv6
Restrictions for IPv6
Information About IPv6
- IPv6 Neighbor Discovery
  - Neighbor Solicitation Messages
  - Router Advertisement Messages
How to Configure IPv6
Troubleshooting Tips
Configuration Examples for IPv6
Verifying the IPv6 Configuration
Additional References for IPv6

IP Version 6 Support for the Management Port

This chapter describes IP Version 6 (IPv6) Support for the Management Port and procedures to configure IPv6 for the Management Port.

IP Version 6 Support for the Management Port
Prerequisites for IPv6
Restrictions for IPv6
Information About IPv6
How to Configure IPv6
Troubleshooting Tips
Configuration Examples for IPv6
Verifying the IPv6 Configuration
Additional References for IPv6

IP Version 6 Support for the Management Port

IP version 6 is a new IP protocol designed to replace IP version 4, the Internet protocol that is extensively used throughout the world.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see the Bug Toolkit and release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use the Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for IPv6

You must be familiar with IPv6 basics such as IPv6 addressing, IPv6 header information, ICMPv6, and the IPv6 Neighbor Discovery (ND) Protocol.
Ensure that you follow the memory and/or processing guidelines when you convert a device to a dual-stack device (IPv4/IPv6).

Restrictions for IPv6

IPv6 packets are transparent to Layer 2 LAN switches because the switches do not examine Layer 3 packet information before forwarding IPv6 frames. IPv6 hosts can be directly attached to Layer 2 LAN switches.
You can configure multiple IPv6 global addresses within the same prefix on an interface. However, multiple IPv6 link-local addresses on an interface are not supported.
Because RFC 3879 deprecates the use of site-local addresses, you should configure private IPv6 addresses according to the recommendations of unique local addressing (ULA) in RFC 4193.

Information About IPv6

IPv6 increases the number of network address bits from 32 bits (in IPv4) to 128 bits. IPv6 is based on IPv4 but it includes a much larger address space and other improvements such as a simplified main header and extension headers.

The larger IPv6 address space allows networks to scale and provide global reachability. The simplified IPv6 packet header format handles packets more efficiently. The flexibility of the IPv6 address space reduces the need for private addresses and the use of Network Address Translation (NAT), which translates private (not globally unique) addresses into a limited number of public addresses. IPv6 enables new application protocols that do not require special processing by border routers at the edge of networks.

IPv6 functionalities such as prefix aggregation, simplified network renumbering, and IPv6 site multihoming capabilities, enable more efficient routing. IPv6 supports Routing Information Protocol (RIP), Integrated Intermediate System-to-Intermediate System (IS-IS), Open Shortest Path First (OSPF) for IPv6, and multiprotocol Border Gateway Protocol (BGP).

IPv6-Enabled Commands

The following Cisco Firewall Services Module (FWSM) commands can accept and display IPv6 addresses:

capture
configure
copy
http
name
object-group
ping
show conn
show local-host
show tcpstat
ssh
telnet
tftp-server
who
write

Note

Failover does not support IPv6. The ipv6 address command does not support setting standby addresses for failover configurations. The failover interface ip command does not support using IPv6 addresses on the failover and stateful failover interfaces.

When entering IPv6 addresses in commands that support them, simply enter the IPv6 address using standard IPv6 notation; for example ping fe80::2e0:b6ff:fe01:3b7a or [fe80::2e0:b6ff:fe01:3b7a]. The Cisco ME 2600X device supports both notations (IPv6 addresses with or without the square brackets).

The following commands were modified to work for IPv6:

debug
fragment
ip
verify
mtu icmp (entered as ipv6 icmp)

The following inspection engines support IPv6:

FTP
HTTP
ICMP
SMTP
TCP
UDP

IPv6 Neighbor Discovery

IPv6 Neighbor Discovery

The IPv6 neighbor discovery process uses ICMPv6 messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local link), verify the reachability of a neighbor, and keep track of neighboring devices.

These topics contain more information:

Neighbor Solicitation Messages
Router Advertisement Messages

Neighbor Solicitation Messages
Router Advertisement Messages

Neighbor Solicitation Messages

Neighbor solicitation messages are sent on the local link when a node wants to determine the link-layer address of another node on the same local link (see the figure below). When a node wants to determine the link-layer address of another node, the source address in a neighbor solicitation message is the IPv6 address of the node sending the neighbor solicitation message. The destination address in the neighbor solicitation message is the solicited-node multicast address that corresponds to the IPv6 address of the destination node. The neighbor solicitation message also includes the link-layer address of the source node.

Figure 1. IPv6 Neighbor Discovery—Neighbor Solicitation Message

After receiving a neighbor solicitation message, the destination node replies by sending a neighbor advertisement message (ICPMv6 Type 136) on the local link. The source address in the neighbor advertisement message is the IPv6 address of the node sending the neighbor advertisement message; the destination address is the IPv6 address of the node that sent the neighbor solicitation message. The data portion of the neighbor advertisement message includes the link-layer address of the node sending the neighbor advertisement message.

After the source node receives the neighbor advertisement message, the source node communicates with the destination node. The figure above shows the neighbor solicitation and response process.

Neighbor solicitation messages are also used to verify the reachability of a neighbor after the link-layer address of a neighbor is identified. When a node wants to verify the reachability of a neighbor, the destination address in a neighbor solicitation message is the unicast address of the neighbor.

Neighbor advertisement messages are also sent when there is a change in the link-layer address of a node on a local link. When there is such a change, the destination address for the neighbor advertisement is the all-nodes multicast address.

You can configure the neighbor solicitation message interval and neighbor reachable time on a per-interface basis. These topics contain more information:

Configuring the Neighbor Solicitation Message Interval
Configuring the Neighbor Reachable Time

Router Advertisement Messages

Router advertisement messages (ICMPv6 Type 134) are periodically sent to each IPv6 configured interface of FWSM. The router advertisement messages are sent to the all-nodes multicast address.

Figure 2. IPv6 Neighbor Discovery—Router Advertisement Message

Router advertisement messages include the following information:

One or more IPv6 prefix that nodes on the local link can use to automatically configure their IPv6 addresses.
Lifetime information for each prefix included in the advertisement.
Sets of flags that indicate the type of autoconfiguration (stateless or stateful) that can be completed.
Default router information (whether the router sending the advertisement should be used as a default router and, if so, the amount of time (in seconds) the router should be used as a default router).
Additional information for hosts, such as the hop limit and MTU a host should use in packets that it originates.
The amount of time between neighbor solicitation message retransmissions on a given link.
The amount of time a node considers a neighbor reachable.

Router advertisements are also sent in response to router solicitation messages (ICMPv6 Type 133). Router solicitation messages are sent by hosts at system startup so that the host can immediately autoconfigure without waiting for the next scheduled router advertisement message. Because router solicitation messages are usually sent by hosts, and the host does not have a configured unicast address, the source address in router solicitation messages is usually the unspecified IPv6 address (0:0:0:0:0:0:0:0). If the host has a configured unicast address, the unicast address of the interface sending the router solicitation message is used as the source address in the message. The destination address in router solicitation messages is the all-routers multicast address with a scope of the link. When a router advertisement is sent in response to a router solicitation, the destination address in the router advertisement message is the unicast address of the source of the router solicitation message.

You can configure the following settings for router advertisement messages:

The time interval between periodic router advertisement messages.
The router lifetime value, which indicates the amount of time IPv6 nodes should consider for the FWSM to be the default router.
The IPv6 network prefixes in use on the link.
Whether or not an interface transmits router advertisement messages.

Unless otherwise noted, the router advertisement message settings are specific to an interface and are entered in interface configuration mode. These topics contain information about changing the router settings:

Configuring the Router Advertisement Transmission Interval
Configuring the Router Lifetime Value
Configuring the IPv6 Prefix
Suppressing Router Advertisement Messages

How to Configure IPv6

The following tasks describe how to configure IPv6 on the Cisco ME 2600X device:

Configuring IPv6 on an Interface
Configuring IPv6 Duplicate Address Detection
Configuring IPv6 Default and Static Routes
Configuring IPv6 Access Lists
Configuring the Neighbor Solicitation Message Interval
Configuring the Neighbor Reachable Time
Configuring the Router Advertisement Transmission Interval
Configuring the Router Lifetime Value
Configuring the IPv6 Prefix
Suppressing Router Advertisement Messages
Configuring a Static IPv6 Neighbor

Configuring IPv6 on an Interface
Configuring IPv6 on a Bridge Domain Interface
Configuring IPv6 Duplicate Address Detection
Configuring IPv6 Default and Static Routes
Configuring IPv6 Access Lists
Configuring the Neighbor Solicitation Message Interval
Configuring the Neighbor Reachable Time
Configuring the Router Advertisement Transmission Interval
Configuring the Router Lifetime Value
Configuring the IPv6 Prefix
Suppressing Router Advertisement Messages
Configuring a Static IPv6 Neighbor

Configuring IPv6 on an Interface

FWSM supports dual IP stack. You can configure both IPv6 and IPv4 on an interface. You do not need to enter any special commands to do so; simply enter the IPv4 configuration commands and IPv6 configuration commands as you normally would. Make sure you configure the default route for both IPv4 and IPv6.

Note

You cannot configure IPv6 on an interface that is used by more than one context (a shared VLAN).

To configure IPv6 on an interface, complete the following steps:

Before You Begin

At a minimum, each interface needs to be configured with an IPv6 link-local address. Additionally, you can add a site-local and global addresses to an interface.

Note

FWSM does not support IPv6 anycast addresses.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 address autoconfig or ipv6 address ipv6-address link-local or ipv6 enable or ipv6 address ipv6-address [eui-64] or ipv6 nd suppress-ra

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Configures an IPv6 address for the interface. You can assign several IPv6 addresses to an interface, such as an IPv6 link-local, site-local, and global address. However, at a minimum, you must configure a link-local address.

There are several methods for configuring IPv6 addresses for an interface. Pick the method that suits your needs from the next step.

Step 4

ipv6 address autoconfig or ipv6 address ipv6-address link-local or ipv6 enable or ipv6 address ipv6-address [eui-64] or ipv6 nd suppress-ra

Example:

Switch(config-if)# ipv6 address autoconfig or

Switch(config-if)# ipv6 address FE80::260:3EFF:FE11:6770 link-local or

Switch(config-if)# ipv6 enable or

Switch(config-if)# ipv6 address ipv6 address 2001:0DB8:0:1::/64 eui-64 or

Switch(config-if)# ipv6 nd suppress-ra

Configures the following:

Autoconfig: Enables stateless autoconfiguration on the interface. Enabling stateless autoconfiguration configures IPv6 addresses based on prefixes received in Router Advertisement messages. A link-local address, based on the Modified EUI-64 interface ID, is automatically generated for the interface when stateless autoconfiguration is enabled.
Link-local address: Configures a link-local address on the interface. If you do not assign any other IPv6 addresses to the interface, you can manually define the link-local address or generating one based on the interface MAC address (Modified EUI-64 format).

IPv6 on the interface:

Enables IPv6 on the interface and automatically generate the link-local address using the Modified EUI-64 interface ID based on the interface MAC address.

Note

You do not need to use the ipv6 enable command if you enter any other ipv6 address commands on an interface; IPv6 support is automatically enabled as soon as you assign an IPv6 address to the interface.

Site-local or global address: Assigns a site-local or global address to the interface. When you assign a site-local or global address, a link-local address is automatically created. Use the optional eui-64 keyword to use the Modified EUI-64 interface ID in the low order 64 bits of the address.
Suppress Router Advertisement messages: By default, router advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on interfaces for which you do not want FWSM to supply the IPv6 prefix (for example, the outside interface).

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring IPv6 on a Bridge Domain Interface

To configure IPv6 on a bridge domain interface, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. service instance id ethernet [evc-id]

5. encapsulation dot1q {any | vlan-id [vlan-id [-vlan-id]]}

6. bridge-domain bridge-id

7. exit

8. no shutdown

9. exit

10. interface BDI interface number

11. ipv6 address {X:X:X:X::X link-local | X:X:X:X::X/prefix [anycast | eui-64] | autoconfig [default]} or ip address ip-address mask

12. no shutdown

13. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface gigabitethernet 0/1

Specifies the port adapter type and the location of the interface to be configured. The slot is always 0 and the port is the number of the port.

Step 4

service instance id ethernet [evc-id]

Example:

Switch(config-if)# service instance 100 ethernet

Configures an Ethernet service instance on an interface and enters service instance configuration mode.

Step 5

encapsulation dot1q {any | vlan-id [vlan-id [-vlan-id]]}

Example:

Switch(config-if-srv)# encapsulation dot1q 100

Defines the matching criteria that maps the ingress dot1q, QinQ, or untagged frames on an interface to the appropriate service instance.

Step 6

bridge-domain bridge-id

Example:

Switch(config-if-srv)# bridge-domain 3000

Binds the Ethernet service instance to a bridge domain instance where bridge-id is the identifier for the bridge domain instance.

The valid values for bridge-id range from 1 to 4096.

Step 7

exit

Example:

Switch(config-if-srv)# exit

Exits the service instance configuration mode.

Step 8

no shutdown

Example:

Switch(config-if)# no shutdown

Enables an interface.

Step 9

exit

Example:

Switch(config-if)# exit

Exits the interface configuration mode.

Step 10

interface BDI interface number

Example:

Switch(config)# interface bdi 3000

Specifies a bridge domain interface.

Note

The interface number must be same as the bridge-id.

Step 11

ipv6 address {X:X:X:X::X link-local | X:X:X:X::X/prefix [anycast | eui-64] | autoconfig [default]} or ip address ip-address mask

Example:

Switch(config-if)# ipv6 address 20::1/64

Switch(config-if)# ip address 20.1.1.1 255.255.255.0

Specifies the IPv6 or IPv4 address for the bridge domain interface.

Step 12

no shutdown

Example:

Switch(config-if)# no shutdown

Enables an interface.

Step 13

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring IPv6 Duplicate Address Detection

During the stateless autoconfiguration process, duplicate address detection verifies the uniqueness of new unicast IPv6 addresses before the addresses are assigned to interfaces (the new addresses remain in a tentative state while duplicate address detection is performed). Duplicate address detection is first performed on the new link-local address. And only when the link local address is verified as unique, duplicate address detection is performed on all the other IPv6 unicast addresses on the interface.

Duplicate address detection is suspended on interfaces that are administratively down. While an interface is administratively down, the unicast IPv6 addresses assigned to the interface are set to a pending state. An interface returning to an administratively up state restarts duplicate address detection for all of the unicast IPv6 addresses on the interface.

When a duplicate address is identified, the state of the address is set to DUPLICATE and the address is not used. If the duplicate address is the link-local address of the interface, the processing of IPv6 packets is disabled on the interface and an error message is issued. If the duplicate address is a global address of the interface, the address is not used and an error message is issued. However, all configuration commands associated with the duplicate address remain as configured while the state of the address is set to DUPLICATE.

If the link-local address for an interface changes, duplicate address detection is performed on the new link-local address and all of the other IPv6 address associated with the interface are regenerated (duplicate address detection is performed only on the new link-local address).

FWSM uses neighbor solicitation messages to perform duplicate address detection. By default, the number of times an interface performs duplicate address detection is 1.

To change the number of duplicate address detection attempts and the neighbor solicitation message interval, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd dad attempts value

5. ipv6 nd ns-interval value

6. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 nd dad attempts value

Example:

Switch(config-if)# ipv6 nd dad attempts 50

Changes the number of duplicate address detection attempts.

The value argument can be any value from 0 to 600. Setting the value argument to 0 disables duplicate address detection on the interface.

Step 5

ipv6 nd ns-interval value

Example:

Switch(config-if)# ipv6 nd ns-interval 1500

Changes the neighbor solicitation message interval. When you configure an interface to send out more than one duplicate address detection attempt, you can also use the ipv6 nd ns-interval command to configure the interval at which the neighbor solicitation messages are sent out. By default, they are sent out once every 1000 milliseconds.

The value argument can be from 1000 to 3600000 milliseconds.

Note

Changing this value changes it for all neighbor solicitation messages sent out on the interface, and not just those used for duplicate address detection.

Step 6

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring IPv6 Default and Static Routes

IPv6 unicast routing is always enabled. FWSM routes IPv6 traffic between interfaces as long as the interfaces are enabled for IPv6 and the IPv6 access lists allow the traffic. You can add a default route and static routes using the ipv6 route command.

To configure an IPv6 default route and static routes, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. ipv6 route interface_name ::/0 next_hop_ipv6_addr

4. ipv6 route if_name destination next_hop_ipv6_addr [admin_distance]

5. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Switch> `enable`	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Switch# `configure terminal`	Enters global configuration mode.
Step 3	ipv6 route interface_name ::/0 next_hop_ipv6_addr Example: Switch(config)# `ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1`	Adds a default IPv6 route.
Step 4	ipv6 route if_name destination next_hop_ipv6_addr [admin_distance] Example: Switch(config)# `ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1 [110]`	(Optional) Adds an IPv6 static route to the IPv6 routing table.
Step 5	end Example: Switch(config-if)# `end`	Returns to privileged EXEC mode.

Configuring IPv6 Access Lists

Configuring an IPv6 access list is similar configuring an IPv4 access, but with IPv6 addresses.

To create an access list, use the ipv6 access-list command to create entries for the access list. There are two main forms of this command to choose from, one for creating access list entries specifically for ICMP traffic, and one to create access list entries for all other types of IP traffic.

To configure an IPv6 access list, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. ipv6 access-list id [line num] {permit | deny} icmp source destination [icmp_type]

4. ipv6 access-list id [line num] {permit | deny} protocol source [src_port] destination [dst_port]

5. access-group iaccess_list_name {in | out} interface if_name [icmp_type]

6. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Switch> `enable`	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Switch# `configure terminal`	Enters global configuration mode. To create an IPv6 access list entry specifically for ICMP traffic go to step 3. To create an IPv6 access list entry for IP traffic other than ICMP go to step 4.
Step 3	ipv6 access-list id [line num] {permit \| deny} icmp source destination [icmp_type] Example: Switch(config)# `ipv6 access-list acl_grp permit tcp any host 3001:1::203:A0FF:FED6:162D`	Creates an IPv6 access list entry specifically for ICMP traffic. The following describes the arguments for the ipv6 access-list command: id—The name of the access list. Use the same id in each command when you are entering multiple entries for an access list. line num—When adding an entry to an access list, you can specify the line number in the list where the entry should appear. permit \| deny—Determines whether the specified traffic is blocked or allowed to pass. icmp—Indicates that the access list entry applies to ICMP traffic. protocol—Specifies the traffic being controlled by the access list entry. The entry could be the name (ip, tcp, or udp) or number (1-254) of an IP protocol. Alternatively, you can specify a protocol object group using object-group grp_id. source and destination—Specifies the source or destination of the traffic. The source or destination can be an IPv6 prefix, in the format prefix/length, to indicate a range of addresses, the keyword any, to specify any address, or a specific host designated by host host_ipv6_addr. src_port and dst_port—The source and destination port (or service) argument. Enter an operator (lt for less than, gt for greater than, eq for equal to, neq for not equal to, or range for an inclusive range) followed by a space and a port number (or two port numbers separated by a space for the range keyword). icmp_type—Specifies the ICMP message type being filtered by the access rule. The value can be a valid ICMP type number (from 0 to 155)or one of the ICMP type literals as shown in Appendix D, “Addresses, Protocols, and Ports”. Alternatively, you can specify an ICMP object group using object-group id. Skip step 4 (required only when creating an IPv6 access list entry for IP traffic other than ICMP) and go to step 5.
Step 4	ipv6 access-list id [line num] {permit \| deny} protocol source [src_port] destination [dst_port] Example: Switch(config)# `ipv6 access-list acl_grp permit tcp any host 3001:1::203:A0FF:FED6:162D`	Creates an IPv6 access list entry.
Step 5	access-group iaccess_list_name {in \| out} interface if_name [icmp_type] Example: Switch(config-if)# `ip access-group noncorp in`	Applies the specified access list to the incoming or outgoing interface. When you are filtering on source addresses, you typically apply the access list to an incoming interface. Filtering on source addresses is most efficient when applied near the destination.
Step 6	end Example: Switch(config-if)# `end`	Returns to privileged EXEC mode.

Configuring the Neighbor Solicitation Message Interval

To configure the interval between IPv6 neighbor solicitation retransmissions on an interface, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd ns-interval value

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 nd ns-interval value

Example:

Switch(config-if)# ipv6 nd ns-interval 1500

The value argument can be from 1000 to 3600000 milliseconds.

Note

This setting is also sent in router advertisement messages.

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring the Neighbor Reachable Time

The neighbor reachable time enables detecting unavailable neighbors. Shorter configured times enable detecting unavailable neighbors more quickly; however, shorter times consume more IPv6 network bandwidth and processing resources in all IPv6 network devices. Very short configured times are not recommended in normal IPv6 operation.

To configure the amount of time that a remote IPv6 node is considered reachable after a reachability confirmation event has occurred, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd reachable-time value

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 nd reachable-time value

Example:

Switch(config-if)# ipv6 nd reachable-time 1000

Sets the amount of time that a remote IPv6 node is reachable.

The value argument can be from 0 to 3600000 milliseconds. The default is 0.

Note

This information is also sent in router advertisement messages.

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring the Router Advertisement Transmission Interval

To change the interval between router advertisement transmissions on an interface, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd ra-interval [msec] value

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 nd ra-interval [msec] value

Example:

Switch(config-if)# ipv6 nd ra-interval 1000

Sets the interval between IPv6 router advertisement transmissions.

The optional msec keyword indicates that the value provided is in milliseconds. If this keyword is not present, the value provided is in seconds.

The value argument can be from 3 to 1800 seconds or from 500 to 1800000 milliseconds if the msec keyword is provided. The default is 200 seconds.

Note

The interval between transmissions should be less than or equal to the IPv6 router advertisement lifetime if the FWSM is configured as a default router by using the ipv6 nd ra-lifetime command. To prevent synchronization with other IPv6 nodes, randomly adjust the actual value used to within 20 percent of the desired value.

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring the Router Lifetime Value

The router lifetime value specifies how long nodes on the local link should consider FWSM as the default router on the link.

To configure the router lifetime value in IPv6 router advertisements on an interface, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd ra-lifetime value

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 nd ra-lifetime value

Example:

Switch(config-if)# ipv6 nd ra-lifetime 5000

Sets the interval between IPv6 router advertisement transmissions.

The value argument can be from 0 to 9000 seconds. The default is 1800 seconds.

Note

Entering 0 indicates that FWSM should not be considered a default router on the selected interface.

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Configuring the IPv6 Prefix

Stateless autoconfiguration uses IPv6 prefixes provided in router advertisement messages to create the global unicast address from the link-local address.

To configure which IPv6 prefixes are included in IPv6 router advertisements, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd prefix ipv6-prefix/prefix-length

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 nd prefix ipv6-prefix/prefix-length

Example:

Switch(config-if)# ipv6 nd prefix 2001:200:200::/35 1000 900

Configures which IPv6 prefixes are included in IPv6 router advertisements.

Note

For stateless autoconfiguration to work properly, the advertised prefix length in router advertisement messages must always be 64 bits.

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Suppressing Router Advertisement Messages

By default, Router Advertisement messages are automatically sent in response to router solicitation messages. You may want to disable these messages on any interface for which you do not want FWSM to supply the IPv6 prefix (for example, the outside interface).

To suppress IPv6 router advertisement transmissions on an interface, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 nd suppress-ra

5. end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Switch> `enable`	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Switch# `configure terminal`	Enters global configuration mode.
Step 3	interface type slot/port Example: Switch(config)# `interface GigabitEthernet 0/1`	Enters interface configuration mode.
Step 4	ipv6 nd suppress-ra Example: Switch(config-if)# `ipv6 nd suppress-ra`	Suppresses the router lifetime value.
Step 5	end Example: Switch(config-if)# `end`	Returns to privileged EXEC mode.

Configuring a Static IPv6 Neighbor

You can manually define a neighbor in the IPv6 neighbor cache. If an entry for the specified IPv6 address already exists in the neighbor discovery cache—learned through the IPv6 neighbor discovery process—the entry is automatically converted to a static entry. Static entries in the IPv6 neighbor discovery cache are not modified by the neighbor discovery process.

To configure a static entry in the IPv6 neighbor discovery cache, complete the following steps:

SUMMARY STEPS

1. enable

2. configure terminal

3. interface type slot/port

4. ipv6 neighbor ipv6_address if_name mac_address

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable

Example:

Switch> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2

configure terminal

Example:

Switch# configure terminal

Enters global configuration mode.

Step 3

interface type slot/port

Example:

Switch(config)# interface GigabitEthernet 0/1

Enters interface configuration mode.

Step 4

ipv6 neighbor ipv6_address if_name mac_address

Example:

Switch(config-if)# ipv6 neighbor 3001:1::45A inside 002.7D1A.9472

Configures a static entry in the IPv6 neighbor discovery cache.

The ipv6_address argument is the link-local IPv6 address of the neighbor, the if_name argument is the interface through which the neighbor is available, and the mac_address argument is the MAC address of the neighbor interface.

Note

The clear ipv6 neighbors command does not remove static entries from the IPv6 neighbor discovery cache.

Step 5

end

Example:

Switch(config-if)# end

Returns to privileged EXEC mode.

Troubleshooting Tips

Use these debug commands to troubleshoot IPv6:

debug ipv6 pim—Helps discover whether the PIM protocol activities are working correctly.
debug ipv6 mrib route—Displays update information related to the route database made by MRIB clients, which is then redistributed to the clients.
debug ipv6 mfib pak—Enables debugging output for packet forwarding activity.
debug ipv6 mld—Helps discover whether the MLD protocol activities are working correctly.
debug ipv6 mld explicit—Displays information related to the explicit tracking of hosts.
debug ipv6 mld interface <interface no> —Displays multicast-related information about an interface.
debug ipv6 mld group < Hostname or X:X:X:X::X > —Displays the multicast groups that are directly connected to the router and that were learned through Multicast Listener Discovery (MLD).

Configuration Examples for IPv6

Configuring IPv6 Duplicate Address Detection

The following example shows how to configure an IPv6 duplicate address detection:

configure terminal
interface GigabitEthernet 0/1
ipv6 address 2001:db8::/64 eui64
ipv6 nd reachable-time 10

Configuring IPv6 Default Route

The following example shows how to configure an IPv6 default route:

configure terminal
interface GigabitEthernet 0/1
ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1

Configuring IPv6 Static Route

The following example shows how to configure an IPv6 static route:

configure terminal
interface GigabitEthernet 0/1
ipv6 route inside 7fff::0/32 3FFE:1100:0:CC00::1 [110]

Configuring IPv6 Access Lists

The following example shows how to configure an IPv6 access lists:

configure terminal
interface GigabitEthernet 0/1
ipv6 access-list acl_grp permit tcp any host 3001:1::203:A0FF:FED6:162D
ip access-group noncorp in

Configuring the Neighbor Solicitation Message Interval

The following example shows how to configure the neighbor solicitation message interval:

configure terminal
interface GigabitEthernet 0/1
interface GigabitEthernet 0/1 ipv6 nd ns-interval 1500

Configuring the Neighbor Reachable Time

The following example shows how to configure the neighbor reachable time:

configure terminal
interface GigabitEthernet 0/1
ipv6 nd reachable-time 1000

Configuring the Router Advertisement Transmission Interval

The following example shows how to configure the router advertisement transmission interval:

configure terminal
interface GigabitEthernet 0/1
ipv6 nd ra-interval 1000

Configuring the Router Lifetime Value

The following example shows how to configure the router lifetime value:

configure terminal
interface GigabitEthernet 0/1
ipv6 nd ra-lifetime 5000

Configuring the IPv6 Prefix

The following example shows how to configure the IPv6 prefix:

configure terminal
interface GigabitEthernet 0/1
ipv6 nd prefix 2001:200:200::/35 1000 900

Suppressing Router Advertisement Messages

The following example shows how to suppress router advertisement messages:

configure terminal
interface GigabitEthernet 0/1
ipv6 nd suppress-ra

Configuring a Static IPv6 Neighbor

The following example shows how to configure a static IPv6 neighbor:

configure terminal
interface GigabitEthernet 0/1
ipv6 neighbor 3001:1::45A inside 002.7D1A.9472

Verifying the IPv6 Configuration

Use the show ipv6 interface and show ipv6 route commands to display the various interfaces, multicast groups, protocol, and more for IPv6. This section contains examples of these commands and sample data.

IPv6 Interface Settings

To display the IPv6 interface settings, enter the following command:

Switch# show ipv6 interface [if_name]

Including the interface name, such as “outside”, displays the settings for the specified interface. Excluding the name from the command displays the setting for all interfaces that have IPv6 enabled on them. The output for the command shows the following:

The name and status of the interface.
The link-local and global unicast addresses.
The multicast groups the interface belongs to.
ICMP redirect and error message settings.
Neighbor discovery settings.

Switch# show ipv6 interface [if_name]

ipv6interface is down, line protocol is down
IPv6 is enabled, link-local address is fe80::20d:88ff:feee:6a82 [TENTATIVE]
No global unicast address is configured
Joined group address(es):
ff02::1
ff02::1:ffee:6a82
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds

Note

The show interface command displays only the IPv4 settings for an interface. To see the IPv6 configuration on an interface, use the show ipv6 interface command. The show ipv6 interface command does not display any IPv4 settings for the interface (if both are configured on the interface).

IPv6 Routes

To display the routes in the IPv6 routing table, use this command:

Switch# show ipv6 route

The output from the show ipv6 route command is similar to the IPv4 show route command. It displays the following information:

The protocol that derived the route.
The IPv6 prefix of the remote network.
The administrative distance and metric for the route.
The address of the next-hop router.
The interface through which the next hop router to the specified network is reached.

Switch# show ipv6 route

IPv6 Routing Table - 7 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
L fe80::/10 [0/0]
via ::, inside
L fec0::a:0:0:a0a:a70/128 [0/0]
via ::, inside
C fec0:0:0:a::/64 [0/0]
via ::, inside
L ff00::/8 [0/0]
via ::, inside

Additional References for IPv6

The following sections provide references related to the IPv6 feature.

Related Topic	Document Title
IPv6 addressing and connectivity	IPv6 Configuration Guide
Cisco IOS commands	Cisco IOS Master Commands List, All Releases
IPv6 commands	Cisco IOS IPv6 Command Reference
Cisco IOS IPv6 features	Cisco IOS IPv6 Feature Mapping
RFCs for IPv6	IPv6 RFCs

Standards and RFCs

Standard/RFC	Title
RFCs for IPv6	IPv6 RFCs

MIBs

MIB	MIBs link
CISCO-CONFIG-COPY-MIB CISCO-CONFIG-MAN-MIB CISCO-DATA-COLLECTION-MIB CISCO-FLASH-MIB CISCO-SNMP-TARGET-EXT-MIB ENTITY-MIB IP-FORWARD-MIB IP-MIB NOTIFICATION-LOG-MIB SNMP-TARGET-MIB CISCO-CONFIG-COPY-MIB and CISCO-FLASH-MIB support IPv6 addressing when TFTP, remote copy protocol (rcp), or FTP is used.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use the Cisco MIB Locator found at the following URL: http://tools.cisco.com/ITDIT/MIBS/servlet/index

MIB

MIBs link

CISCO-CONFIG-COPY-MIB
CISCO-CONFIG-MAN-MIB
CISCO-DATA-COLLECTION-MIB
CISCO-FLASH-MIB
CISCO-SNMP-TARGET-EXT-MIB
ENTITY-MIB
IP-FORWARD-MIB
IP-MIB
NOTIFICATION-LOG-MIB
SNMP-TARGET-MIB

CISCO-CONFIG-COPY-MIB and CISCO-FLASH-MIB support IPv6 addressing when TFTP, remote copy protocol (rcp), or FTP is used.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use the Cisco MIB Locator found at the following URL:

http://tools.cisco.com/ITDIT/MIBS/servlet/index

RFCs

RFC	Title
No new or modified RFCs are supported, and support for existing RFCs has not been modified.	—

Technical Assistance

Description	Link
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.	http://www.cisco.com/cisco/web/support/index.html

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Was this Document Helpful?

Feedback

Contact Cisco

Open a Support Case
(Requires a Cisco Service Contract)

Cisco ME 2600X Series Ethernet Access Switch Software Configuration Guide

Bias-Free Language

Results

Chapter: IP Version 6 Support for the Management Port

IP Version 6 Support for the Management Port

IP Version 6 Support for the Management Port

Finding Feature Information

Prerequisites for IPv6

Restrictions for IPv6

Information About IPv6

IPv6-Enabled Commands

IPv6 Neighbor Discovery

Neighbor Solicitation Messages

Router Advertisement Messages

How to Configure IPv6

Configuring IPv6 on an Interface

Configuring IPv6 on a Bridge Domain Interface

Configuring IPv6 Duplicate Address Detection

Configuring IPv6 Default and Static Routes

Configuring IPv6 Access Lists

Configuring the Neighbor Solicitation Message Interval

Configuring the Neighbor Reachable Time

Configuring the Router Advertisement Transmission Interval

Configuring the Router Lifetime Value

Configuring the IPv6 Prefix

Suppressing Router Advertisement Messages

Configuring a Static IPv6 Neighbor

Troubleshooting Tips

Configuration Examples for IPv6

Configuring IPv6 Duplicate Address Detection

Configuring IPv6 Default Route

Configuring IPv6 Static Route

Configuring IPv6 Access Lists

Configuring the Neighbor Solicitation Message Interval

Configuring the Neighbor Reachable Time

Configuring the Router Advertisement Transmission Interval

Configuring the Router Lifetime Value

Configuring the IPv6 Prefix

Suppressing Router Advertisement Messages

Configuring a Static IPv6 Neighbor

Verifying the IPv6 Configuration

IPv6 Interface Settings

IPv6 Routes

Additional References for IPv6

Related Documents

Standards and RFCs

MIBs

RFCs

Technical Assistance

Was this Document Helpful?

Contact Cisco