IPv6 Subnetting
Hello,
So far, as i understood from different web searches and resource materials, the Internet Registry (ARIN, for example) provides a /32 address block to Top ISP. The Top ISP provides a /48 to customers or to normal ISPs (Lower ISPs). Finally, the customer breaks the /48 into subnet using the 16 bits available. (2^16=65535 /64 subnets). Here my question comes in, How is subnetting performed by this way? ... if 65535 subnets to be used, how can we categorize them into Class A, B and C like in IPv4? .... About hosts, i understand that the low-order 64 bits in the ipv6 address is used for hosts but also how do i know which hosts to assign to which subnets? ... and because VLSM is not necessary in IPv6, does it mean that the Classless Routing Protocols concept is gone and IPv6 will be Classful?
Someone kindly shed some lights on how IPv6 subnetting is performed step-by-step.
Your response is highly appreciated.
Regards,
AM
The first thing with IPv6 is to forget everything you learnt about IPv4 conservation. To put it crudely be wasteful and do not be concerned that you have 1.8x10^18 useable host addresses in a /64 and are only going to use it to address a point to point link or use it for a VLAN allocation for 15 servers.
(I am being overly simplistic here to illustrate a point, there are some subtleties, though in essence go with this)
There are also no classes, no network addresses, no broadcast addresses, no wild bit masks. Everything is CIDR, all addresses are useable.
So in the example of getting a /48, you get 65536 x /64 prefixes (2^16bits of subnetting)
Then just start assigning /64s everywhere you would assign any sized subnet in IPv4 (with the exception of loopbacks)
So from the 1st /64 sequentially number all loopbacks for devices using /128 (e.g. prefix::1, ::2, ::3, ::4 etc)
then your first point to point link gets the next /64, and the next point to point link gets the next /64 and so on, then your first VLAN gets the next /64 and so on.
So if you have 20 devices, 34 point to point links and 12 VLANs in your network you would ultimately be using 47 x /64 prefixes from your /48 and keep the rest (65489 x /64s) for later use.
That's the subnets taken care of. Hosts are in general addressed in the last 64 bits if the prefix. This can be done in one of three ways:
Manually configured (e.g. prefix::3/64, prefix::7/64, prefix::AB/64, prefix::cafe:f00d/64),
Using DHCPv6, or
Using SLAAAC (Stateless Address Auto Configuration) where the host generates its own IPv6 address using its MAC address and padding it out to 64 bits. (Do searches in these terms for more info)
String it all together using the IGP of your choice, and that is pretty much it.
I hope this helps
Similar Messages
-
Convert IPv4 address to IPv6 subnet on AD Sites
Hi,
We currently run IPv4 on our network. However, it looks like it's recommended to enable IPv6 on DFS servers according to this:
http://blogs.technet.com/askds/archive/2009/10/28/dfs-referrals-and-ipv6-outta-site.aspx
I'm having trouble creating an IPv6 subnet in AD Site and Services for my DFS servers since I'm note very familiar with IPv6. I think the IPv6 I see on the servers is the "converted" to IPv6 (see warning message below)??
DC and DFS servers are Win 2008 R2 Datacenter. It looks like the IPv6 address of the DFS servers are not "matching" the subnets I have created and therefore DFS is not associated with the correct sites causing clients to go over the WAN
to other DFS servers.
For example:
The IPv4 for my DFS servers are:
156.124.92.202/23
156.124.78.202/23
I created these IPv4 subnets:
156.124.92.0./23 --> SA-Site
156.124.78.0/23 --> AU-Site
IPv6 DHCP service is not enabled. No Static IPv6 set for the network connection. The "converted" IP seems to be
2002:9c7c:5cca::9c7c:5cca
2002:9c7c:4eca::9c7c:4eca
I created these IPv6 subnets
2002::9c7c:5c00/119
2002::9c7c:4e00/119
This is what I see on the DFS servers:
Validating the site associations on every domain controller of the following: SA-DFS-01
Warning: The server has IP addresses with conflicting site associations
Host name: SA-DFS-01
Site: SA-Site
Domain Controller: SA-AD-01
Host IP address
fe80::2c27:42f8:1294:ef4c%10
2002:9c7c:5cca::9c7c:5cca
Subnet-Site Mapping in AD
No mapping exists
No mapping exists
Host name: SA-DFS-01
Site: SA-Site
Domain Controller: AU-AD-01
Host IP address
fe80::2c27:42f8:1294:ef4c%10
2002:9c7c:5cca::9c7c:5cca
Subnet-Site Mapping in AD
No mapping exists
No mapping exists
Validating the site associations on every domain controller of the following: AU-DFS-01
Warning: The server has IP addresses with conflicting site associations
Host name: AU-DFS-01
Site: AU-Site
Domain Controller: SA-AD-01
Host IP address
2002:9c7c:4eca::9c7c:4eca
Subnet-Site Mapping in AD
No mapping exists
Warning: The server has IP addresses with conflicting site associations
Host name: AU-DFS-01
Site: AU-Site
Domain Controller: AU-AD-01
Host IP address
2002:9c7c:4eca::9c7c:4eca
Subnet-Site Mapping in AD
No mapping existsHi,
We currently run IPv4 on our network. However, it looks like it's recommended to enable IPv6 on DFS servers according to this:
http://blogs.technet.com/askds/archive/2009/10/28/dfs-referrals-and-ipv6-outta-site.aspx
I'm having trouble creating an IPv6 subnet in AD Site and Services for my DFS servers since I'm note very familiar with IPv6. I think the IPv6 I see on the servers is the "converted" to IPv6 (see warning message below)??
DC and DFS servers are Win 2008 R2 Datacenter. It looks like the IPv6 address of the DFS servers are not "matching" the subnets I have created and therefore DFS is not associated with the correct sites causing clients to go over the WAN
to other DFS servers.
For example:
The IPv4 for my DFS servers are:
156.124.92.202/23
156.124.78.202/23
I created these IPv4 subnets:
156.124.92.0./23 --> SA-Site
156.124.78.0/23 --> AU-Site
IPv6 DHCP service is not enabled. No Static IPv6 set for the network connection. The "converted" IP seems to be
2002:9c7c:5cca::9c7c:5cca
2002:9c7c:4eca::9c7c:4eca
I created these IPv6 subnets
2002::9c7c:5c00/119
2002::9c7c:4e00/119
This is what I see on the DFS servers:
Validating the site associations on every domain controller of the following: SA-DFS-01
Warning: The server has IP addresses with conflicting site associations
Host name: SA-DFS-01
Site: SA-Site
Domain Controller: SA-AD-01
Host IP address
fe80::2c27:42f8:1294:ef4c%10
2002:9c7c:5cca::9c7c:5cca
Subnet-Site Mapping in AD
No mapping exists
No mapping exists
Host name: SA-DFS-01
Site: SA-Site
Domain Controller: AU-AD-01
Host IP address
fe80::2c27:42f8:1294:ef4c%10
2002:9c7c:5cca::9c7c:5cca
Subnet-Site Mapping in AD
No mapping exists
No mapping exists
Validating the site associations on every domain controller of the following: AU-DFS-01
Warning: The server has IP addresses with conflicting site associations
Host name: AU-DFS-01
Site: AU-Site
Domain Controller: SA-AD-01
Host IP address
2002:9c7c:4eca::9c7c:4eca
Subnet-Site Mapping in AD
No mapping exists
Warning: The server has IP addresses with conflicting site associations
Host name: AU-DFS-01
Site: AU-Site
Domain Controller: AU-AD-01
Host IP address
2002:9c7c:4eca::9c7c:4eca
Subnet-Site Mapping in AD
No mapping exists
Hi,
The format seems to be incorrect. Please change them as following and check the result:
2002:9c7c:5cca::/48
2002:9c7c:4eca::/48
For more information about 6to4 address, please see:
http://technet.microsoft.com/en-us/library/cc756770(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc757359(WS.10).aspx
Hope it helps.
This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question.
This can be beneficial to other community members reading the thread. -
Windows 2012 R2 - Access problems to NFS shares via IPv6
Hello,
we setup some NFS shares on HNAS storage box. The connection to this storage is only possible over IPv6 network.
My server with Windows 2012 R2 has the feature 'Client for NFS' installed and a 'showmount -e servername/or IPv6 address' works. I can see all shares when i try to open the storagebox in Windows Explorer with the command "\\servername" or "\\IPv6
address", too.
My problem is, when I try to mount the share via "Map network drive" or "mount \\servername\sharename *" I get Error 53 - Network path not found.
The share is configured that every server in the IPv6 subnet could access it and it works on Unix machines, but not on Windows.
It does not matter if i set some option parameters for the "mount" command like sec=sys or anon, everytime error 53.
I don't know, if the share needs special options for Windows. I hope somebody can help.
Kind regardsHi,
here is the output of your 2 commands:
PS C:\Users\admin> get-SmbConnection
PS C:\Users\admin> get-SmbServerConfiguration
AnnounceServer : False
AsynchronousCredits : 64
AutoShareServer : True
AutoShareWorkstation : True
CachedOpenLimit : 0
AnnounceComment :
EnableDownlevelTimewarp : False
EnableLeasing : True
EnableMultiChannel : True
EnableStrictNameChecking : True
AutoDisconnectTimeout : 0
DurableHandleV2TimeoutInSeconds : 30
EnableAuthenticateUserSharing : False
EnableForcedLogoff : True
EnableOplocks : True
EnableSecuritySignature : True
ServerHidden : True
IrpStackSize : 15
KeepAliveTime : 2
MaxChannelPerSession : 32
MaxMpxCount : 50
MaxSessionPerConnection : 16384
MaxThreadsPerQueue : 20
MaxWorkItems : 1
NullSessionPipes : HydraLsPipe
NullSessionShares :
OplockBreakWait : 35
PendingClientTimeoutInSeconds : 120
RequireSecuritySignature : False
EnableSMB1Protocol : True
EnableSMB2Protocol : False
Smb2CreditsMax : 2048
Smb2CreditsMin : 128
SmbServerNameHardeningLevel : 0
TreatHostAsStableStorage : False
ValidateAliasNotCircular : True
ValidateShareScope : True
ValidateShareScopeNotAliased : True
ValidateTargetName : True
EncryptData : False
RejectUnencryptedAccess : True
I try to access the file share with Windows Explorer. When I enter \\fe08--babe-face-cafe-dead.ipv6-literal.net (just example), I can see all shares on the storage box. When I double-click the share, I want to access, where an access is definitely allowed,
it takes a while and then the error "\\fe08--babe-face-cafe-dead.ipv6-literal.net\share is not accessable. You might not have permission to use this network resource. ..." appears. Of this action a recorded the trace.
Another way I tried is to open command line an type "mount \\fe08--babe-face-cafe-dead.ipv6-literal.net\share *". After this an error 53 occurs immediately without any wait time. -
Happy Eyeballs for IPv6 is not working on Windows Xp
Hello,
Today IPv6 public DNS (2001:4860:4860::8888) was not reachable. I am running IPv4 and IPv6 in the dual stack. I could recive the Internet table and my IPv6 subnets are announced too. I could ping all of IPv4 websites but IPv6 websites won't work (DNS issue). Now my understanding about "Happy Eyeballs" is that if Ipv6 is not reachable it will fall back to Ipv4 auto. But it did not do that in my case. To make it worse it won't open the websites which are running over IPv4 either. I had both V4 & V6 DNS servers listed in "ipconfig/all" but I won't work.
Has anybody came across this issue? Any suggestions?
Thanks& Regards,
Deepak AmbotkarSo it sounds like your situation is that
You made successful connections using lookups on the IPv6 based DNS server.
The DNS server then became unreachable.
The IPv6 sites were now unreachable as well?
Any correct cached address should still work. However, if it was a general IPv6 outage which made the DNS server unreachable, cached DNS information for the IPv6 address might remain in place until it times out of the DNS cache. In that case, the sites become unreachable for the lifetime of the stale cache.
Once the IPv6 address age out of the cache, everything should work again.
See if ipconfig /flushdns resolves the issue when it happens.
Happy Eyeballs cannot help you if the cached DNS information becomes invalid. Happy Eyeballs sets the initial preferred path. If the network fails in the meantime, you must rely on traditional DNS timeout mechanisms for recovery. -
IPv6 internet routing question. To NAT or to Route
Hello!
I've gotten 2 /56 block of IPv6 addresses from our ISP. We're in the process of rolling out a new website and along with that I'm pushing that we create our IPv6 presence at the same time.
My Question is in regards to Routing vs NAT-ing... in my "Internet" environment, the space between my ISP routers and my firewalls, I have configured one of my 256 /64 networks 2001:XXXX:YY:100::1/64. That would mean My firewall could be 2001:XXXX:YY:100::B/64. My web servers sit in a DMZ off my firewall.
Should I:
A. Provision a random IPv6 subnet in the DMZ and use the firewall to NAT to an IP in the 2001:XXXX:YY:100::/64 range. I thought one of the points of IPv6 was to do away with NAT.
B. Provision 2001:XXXX:YY:101::/64 network in DMZ and ROUTE to the DMZ server. I am thinking this is the solution, but what Protocol to use? Im guessing I advertise my /56 via BGP to ISP, and use what? OSPFv3 between internet routers and firewalls? Use Static Routes? Is there anything that's considered 'best practice' for this type of situation?
To Route or to NAT?Hi,
if I understand correctly you have /64 on the external interface of your firewall facing your isp.
you should not use stateless auto config SLAAC on your Dmz. Setup your servers statically.
also there is not nat in ipv6, just ensure your stateful firewall handles ipv6 ok, taking special care for icmpv6.
That means you should use a /64 from your /56 for your Dmz. No nat.
whether you setup a static route towards your firewall to reach your Dmz from outside the firewall depends on your network design.
Whether you use bgp with your isp depends on what you agreed with your isp. Has your isp setup a static route of your /56 on their router to you, or are they expecting you to use bgp ?
hope this helps
mark -
CAN ANYBODY GUIDE ME ABOUT THE BASICS OF IPV6 AND IPV6 SUBNETTING.........???
HOW IT,S WORK.For introductory material, maybe also try the Agentinian chapter's Internet Society publication:
http://www.ipv6tf.org/pdf/ipv6forall.pdf
For advanced material, the NIST SP800-119 "guidelines for the secure deployment of IPv6" is short on advice but mind-bendingly helpful for understanding some of the more esoteric corners of the v6 protcol suite.
The biggest changes in v6 compared to v4 are that ARP is replaced by ICMPv6 neighbor discovery, that multicast ICMPv6 router advertisements are required, and there is a new DHCPv6 protocol which is controlled by flag bits in the router advertisements. Address scopes, particularly link-local versus global get a lot more prominent, since IPv6 hosts will continue using their fe80::/64 link-local addresses even after configuring 2000::/3 global scope addresses.
-- Jim Leinweber, WI State Lab of Hygiene -
IPv6 - Newb Question (BGP Advertisement)
Hi Everyone - Quick question on IPv6 subnetting
If we are allocated a /32 from an RIR (eg 2001:0DB0::/32), and we advertise the /32 to our upstream Inet providers - Assigning
2001:0DB0:0:10::1/64 to a loop Interface, we *should* be able to reach the Upstream providers IPv6 addresses with a source of the loop interface(As the /64 is within the /32 subnet)?
Cheers.Hi John,
Correct. You should be able to use that technique to perform initial testing for your ipv6 connectivity. You can use extended ping for instance to specify the loopback interface as the source address.
Regards -
Can anyone help figure out why the Catalyst 6509 is not able to assign an IPv6 address? Thank you.
Cisco Catalyst 6500 version 12.2(33)SXI13 configured as DHCP server for a VLAN responds to Windows 7 client with status code NOADDRS-AVAIL(2). My configuration on the 6500 for the DHCPv6 server is:
ipv6 dhcp database disk0://DHCPV6-DB
ipv6 dhcp pool VLAN206IPV6
prefix-delegation pool VLAN206IPV6-POOL
dns-server 2620:B700:0:1001::53
domain-name global.bio.com
ipv6 local pool VLAN206IPV6-POOL 2620:B700:0:12C7::/65 65
interface Vlan206
description *** IPv6 Subnet ***
ip address 10.2.104.2 255.255.255.0
ipv6 address 2620:B700:0:12C7::2/64
ipv6 nd prefix 2620:B700:0:12C7::/64 14400 14400 no-autoconfig
ipv6 nd managed-config-flag
ipv6 dhcp server VLAN206IPV6
standby version 2
standby 0 ip 10.2.104.1
standby 0 preempt
standby 6 ipv6 2620:B700:0:12C7::1/64
standby 6 preempt
I'm getting a result from my debug as follows:
Apr 10 16:28:02.873 PDT: %LINK-3-UPDOWN: Interface GigabitEthernet2/2, changed state to up
Apr 10 16:28:02.873 PDT: %LINK-SP-3-UPDOWN: Interface GigabitEthernet2/2, changed state to up
Apr 10 16:28:02.877 PDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/2, changed state to up
Apr 10 16:28:03.861 PDT: IPv6 DHCP: Received SOLICIT from FE80::5D5E:7EBD:CDBF:2519 on Vlan206
Apr 10 16:28:03.861 PDT: IPv6 DHCP: detailed packet contents
Apr 10 16:28:03.861 PDT: src FE80::5D5E:7EBD:CDBF:2519 (Vlan206)
Apr 10 16:28:03.861 PDT: dst FF02::1:2
Apr 10 16:28:03.861 PDT: type SOLICIT(1), xid 8277025
Apr 10 16:28:03.861 PDT: option ELAPSED-TIME(8), len 2
Apr 10 16:28:03.861 PDT: elapsed-time 101
Apr 10 16:28:03.861 PDT: option CLIENTID(1), len 14
Apr 10 16:28:03.861 PDT: 00010001195FD895F01FAF10689E
Apr 10 16:28:03.861 PDT: option IA-NA(3), len 12
Apr 10 16:28:03.861 PDT: IAID 0x0FF01FAF, T1 0, T2 0
Apr 10 16:28:03.861 PDT: option UNKNOWN(39), len 32
Apr 10 16:28:03.861 PDT: option VENDOR-CLASS(16), len 14
Apr 10 16:28:03.861 PDT: option ORO(6), len 8
Apr 10 16:28:03.861 PDT: DOMAIN-LIST,DNS-SERVERS,VENDOR-OPTS,UNKNOWN
Apr 10 16:28:03.861 PDT: IPv6 DHCP: Option IA-NA(3) is not supported yet
Apr 10 16:28:03.861 PDT: IPv6 DHCP: Sending ADVERTISE to FE80::5D5E:7EBD:CDBF:2519 on Vlan206
Apr 10 16:28:03.861 PDT: IPv6 DHCP: detailed packet contents
Apr 10 16:28:03.861 PDT: src FE80::21D:E6FF:FEE4:4400
Apr 10 16:28:03.861 PDT: dst FE80::5D5E:7EBD:CDBF:2519 (Vlan206)
Apr 10 16:28:03.861 PDT: type ADVERTISE(2), xid 8277025
Apr 10 16:28:03.861 PDT: option SERVERID(2), len 10
Apr 10 16:28:03.865 PDT: 00030001001DE6E44400
Apr 10 16:28:03.865 PDT: option CLIENTID(1), len 14
Apr 10 16:28:03.865 PDT: 00010001195FD895F01FAF10689E
Apr 10 16:28:03.865 PDT: option STATUS-CODE(13), len 15
Apr 10 16:28:03.865 PDT: status code NOADDRS-AVAIL(2)
Apr 10 16:28:03.865 PDT: status message: NOADDRS-AVAILHello,
maybe hitting the following bug.
Pv6 Address Assignment Support for IPv6 DHCP Server
CSCse81385
Hope this helps -
Windows 2008 R2 - High memory on lsass.exe
Windows 2008 R2 fully patched VM with 8GB of RAM and 4 vCPUs. Machine is a DC and file server.
Had an issue that just came up where lsass.exe will start sucking up memory. It gets to the point where the machine is almost not usable. The only way to get everything back in check is to reboot.
I just rebooted a little bit ago and I'm watching lsass.exe slowly start sucking up more and more memory. I'm not sure how to tell where the memory is being used and then how to remedy it. This machine has run fine as a DC/file/print server for 3 years.
Something has happened in the last week that is making it mad.Hi,
Firstly, have you typed an invalid IPv6 subnet mask in the Active Directory Sites and Services snap-in on that Windows Server 2008 R2 DC? If yes, please refer to the KB below:
The Lsass.exe process crashes on Windows Server 2008 R2-based domain controllers
If not, I would recommend you perform a virus scan on your DC and run the Performance Monitor's Active Directory Data Collector Set on that domain controller while the problem is occurring to find the root reason. To run the Active Directory Data Collector
follow these steps:
1.Run ”Perfmon.msc”and then press enter.
2.Expand Data Collector Sets > System.
3.Right-click on Active Directory Diagnostics and then click
Start in the menu which appears.
Once the report has compiled (The default setting will gather data for the report for 300 seconds, after which it will take an additional period to compile the report.), view reports which will show details of potential problems which need to be investigated
as possible causes.
Best regards,
Susie -
Does Airport Extreme 802.11ac support DHCPv6 prefix delegation
I have IPv6 working with my Airport Extreme 802.11ac. I'm experimenting (for fun) with IPv6 on my local network, and I was trying to create another IPv6 subnet using DHCPv6 prefix delegation.
Comcast (my ISP) is indeed delegating a 64-bit prefix to the Airport Extreme, but the Airport Extreme does not seem capable of sub-delegating that 64-bit prefix (into say 2 65-bit prefixes, or 4 66-bit prefixes, etc).
Is the Aiport Extreme 802.11ac is capable of sub-delegating IPv6 prefixes like this?I have the exact same problem with my ISP (Init7) here in Switzerland. They delegating IPv6 adresses via DHCPv6-PD (Prefix Delegation) and my Apple AirPort Extreme just get only an IPv4 address.
Since the worldwide use of IPv6 is rising steadily, I really hope Apple will wake up and update the firmware of its AirPort devices to support DHCPv6-PD. -
Hi all,
I've been trying to implement dhcpv6 with Windows Server 2012. Due to our ISP not offering native IPv6 access, we went through a third party tunnel provider to have ipv6 internet connectivity. What I need to do however, is set a custom prefix length for
our dhcp server. Our tunnel provider gave us a /48 block to use for hosts, but windows will only let me create a /64 size scope. Any ideas? The prefix size needs to be /48 in order for this to work correctly. All of our routers are already setup, and we attempted
to use static ipv6 configuration to do a test for configuration, which has succeeded. The only issue is dhcp giving out ipv6 with /48 prefix to work with tunnel provider. Any ideas? We use Windows Server 2008 R2, and Windows Server 2012, if that helps.I'll comment between your questions/comments:
JC - first off, in IPv6 there is the concept/operations known as Address Autoconfiguration. This process requires up to 2 components in a network system: L3 switches or router to send Router Advertisements - which tells client how to do all this, and then
possibly DHCPv6 servers to provide clients with IPv6 addresses and/or "other information" like dns, domain name, time srvr, download srvr, etc.
This taes a bit to get used to, as well as sometimes a bit of work to "discover" what all is needed and how to properly configure.
a) the DHCPv6 route is not advertised, so the distributed dynamic IPv6 addresses are useless (no connectivity between hosts); there is a manual/temporary netsh override for that, but I don't think this is the proper way to go.
JC - clients learn the default gateway via the router's Router Advertisement (RA). RFC3315 (DHCPv6) does not provide a scope option for def g/w. You should not manually enter an IPv6 def g/w.
b) Here might be another issue, I don't know how I configured the DHCPv6 role in past (stateless vs stateful), perhaps that's the problem, need to look deeper into it, but either way our outdated networking infrastructure (routers and switches) is not aware
of IPv6 protocol at all, it probably doesn't help that I don't even know how the DHCPv6 role was configured in past.
JC - if you want a DHCPv6 server to supply IPv6 addresses and DNS/domain name, etc to clients, that role is Stateful. If you want DHCPv6 to supply only DNS, domain name, etc and the RA supply the network prefix (SLAAC), that role is Stateless (SLAAC plus
some DHCPv6).
Stateful (DHCPv6) operations are the closest to how we run DHCP for IPv4 networks today.
c) I assigned static IPv6 /112 addresses to servers (and they work fine including the DNS lookups) and was hoping to have the same prefix/subnet for clients, instead I get up to 4 different IPv6 addresses on servers (static, dynamic, temporary route, link-local)
and just one address on clients and that one belonging to that dynamic prefix (not what I wanted to have initially) ...
JC - all IPv6 subnets should be /64 for 64 bit network and 64 bit Interface ID (IID) (host address), most OSs will be happier and that is the defined standard way of operating IPv6. Also as you have seen, Microsoft's DHCPv6 server does not allow you to change
the network prefix (/64).
You will always have link-local addresses, and if you are getting the IPv6 and IPv6 Temp, then your RA on the subnet is sending RA's with the "A" flag on for SLAAC, and of you have a static addresses defined for servers on the server vlan, you don't want
SLAAC config on that vlan.
d) How do I fix IP Helper on our core router to pass the IPv6 DHCP requests to other VLANs (currently they are blocked/discarded), it seems that IPv4 IP Helper doesn't work for IPv6?
JC - IPv4 and IPv6 are TOTALLY separate protocols. Everything you do for IPv4, needs a counterpart enabled for IPv6. No IPv4 config does anything for IPv6.
You need a dhcpv6-relay definition which is the IPv6 counterpart to dhcp-relay/IP helper-address...see your L3 switch/router vendor docs for configuring dhcpv6-relay.
Is it all by design then and re-installing DHCPv6 server in stateful mode won't change that or I am missing something completely?
JC - Correct, simply having Stateful (DHCPv6) is not all there is to it. You must configure your RA to instruct IPv6 clients how to address themselves. According to the IPv6 RFCs, clients are told how to address themselves (except for manual addressing),
which is not like the way IPv4 operates.
All your IPv6 config components need to be specifically configured in order for the system you want to work correctly, to work. IPv6 routing, specific option flags in the RA's, dhcpv6-relay, and DHCPv6 scopes. You can't (generally) just "turn on" IPv6 and
have it work (the way you think it should).
IPv6 is quite a beast, but it seems that majority of windows server admins (like me) have limited knowledge on how to configure it properly, resulting in some unexpected outcomes and gotchas ... then days of troubleshooting and then another gotcha ... I
browsed technet for days/weeks and either end up finding unresolved IPv6 "issue" threads where nobody knows what is what or some super-complicated solutions that truly work only for a few ... frustrating ...
JC - IPv6 is not a simple "turn-it-on" protocol, as there are differences in its operation as you see. There 5 great IPv6 books you should consider getting:
Guide to TCP/IP, 4th edition - IPv4 and IPv6 TCP/IP foundations, operations, and examples
Practical IPv6 for Windows Administrators
Understanding IPv6
IPv6 Fundamentals
IPv6 Essentials (but wait for the 3rd edition coming out in July)
Check out gogo6.com/main and view the IPv6 webinar/workshop training calendar. A few of us have facilitated some basic IPv6 trng webinars. I think the schedule is being worked on at the moment, but more classes should be coming.
Additionally, I offer IPv6 Forum Certified training. teachmeipv6.com and I provide IPv6 consulting services.
Hmm...maybe I'll design a webinar for configuring a system like you are doing: L3 switch/router configuration and server side DHCPv6 config. I currently facilitate IPv6 hands-on lab workshops (full day) that cover all of this content.
hth...Jeff
Jeff Carrell -
Archlinux as dual-stack (IPv4/v6) gateway/router
Hello everyone,
i've installed Arch on my PC a few days ago and it works perfectly, the PC is a gaming PC (Asus P8P67 Deluxe, Intel Core i3 2100, 14 GB RAM, 2x Nvidia GTX580) however for specific reasons (i don't have anything else besides IBM PCs with 600Mhz CPUs) i need to use it as a server and a router/gateway for my network (an Archlinux laptop and some Apple products), here's my current network setup :
PPPoE modem is connected to lan0 (ethernet interface) which is configured as 192.168.1.2, gateway 192.168.1.1 (it's the modem's address).
My provider (OVH in France) gives me a /64 IPv6 subnet.
ppp0 interface is created once the lan0 is up (i'm using POST_UP="pon myprovider" in netcfg script, i've already added +ipv6 in /etc/ppp/options to enable IPv6 on the ppp), it gets automatically an IPv4 address and an IPv6 one from my provider, here's the ifconfig ppp0 (i know it's deprecated but i'm so used to it...) :
ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1452
inet 109.190.20.173 netmask 255.255.255.255 destination 178.32.37.16
inet6 2001:41d0:70:1301:1c1e:882b:1e8b:efd7 prefixlen 64 scopeid 0x0<global>
inet6 fe80::1c1e:882b:1e8b:efd7 prefixlen 10 scopeid 0x20<link>
ppp txqueuelen 3 (Point-to-Point Protocol)
RX packets 6080 bytes 3571799 (3.4 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 4173 bytes 870323 (849.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
here's my IPv4 routing table :
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default * 0.0.0.0 U 0 0 0 ppp0
172.16.1.0 * 255.255.255.0 U 0 0 0 lan1
rbx-1-rdb.fr.eu * 255.255.255.255 UH 0 0 0 ppp0
192.168.1.0 * 255.255.255.0 U 0 0 0 lan0
lan1 is my local wired interface which connects to a 1000Mb/s switch, on it there is a Debian machine (the 600Mhz one) which acts as an access point (on it the wired interface is bridged with the wireless one, but all the DHCP/DNS stuff is done on my main computer and i don't think there's anything to do on the access point machine) and my other Archlinux laptop. Forwarding is enabled on both IPv4 and v6 in /etc/sysctl.conf and iptables (not ip6tables) is configured correctly, all works as would like on the IPv4 side (DHCP/DNS/internet access works for all computers on the network) here's my ifconfig lan1 :
lan1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 9152
inet 172.16.1.1 netmask 255.255.255.0 broadcast 172.16.1.255
inet6 fe80::f66d:4ff:fee3:2c96 prefixlen 64 scopeid 0x20<link>
ether f4:6d:04:e3:2c:96 txqueuelen 1000 (Ethernet)
RX packets 5060 bytes 701035 (684.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 10181 bytes 7102665 (6.7 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 20 memory 0xf5100000-f5120000
Here's my IPv6 routing table (i have experience with computers and networks in general but this is a total non-sense to me) :
Kernel IPv6 routing table
Destination Next Hop Flag Met Ref Use If
::1/128 :: U 256 0 0 lo
2001:41d0:70:1301::/64 :: UA 256 0 0 ppp0
fe80::/64 :: !n 256 0 0 lo
fe80::/64 :: U 256 0 0 lan0
fe80::/64 :: U 256 0 0 lan1
fe80::/64 :: U 256 0 0 ppp0
fe80::/10 :: U 1 0 0 ppp0
fe80::/10 :: U 256 0 0 ppp0
::/0 fe80::230:88ff:fe04:63d4 UGDAe 1024 1 0 ppp0
::/0 :: !n -1 1 312 lo
::1/128 :: Un 0 1 2 lo
2001:41d0:70:1301::/128 :: Un 0 1 0 lo
2001:41d0:70:1301:1c1e:882b:1e8b:efd7/128 :: Un 0 2 102 lo
fe80::/128 :: Un 0 1 0 lo
fe80::/128 :: Un 0 1 0 lo
fe80::/128 :: Un 0 1 0 lo
fe80::1c1e:882b:1e8b:efd7/128 :: Un 0 1 0 lo
fe80::f66d:4ff:fee3:2010/128 :: Un 0 1 0 lo
fe80::f66d:4ff:fee3:2c96/128 :: Un 0 1 0 lo
ff00::/8 :: U 256 0 0 lan0
ff00::/8 :: U 256 0 0 lan1
ff00::/8 :: U 256 0 0 ppp0
::/0 :: !n -1 1 312 lo
now with that configuration i can ping6 ipv6.google.com and get a reply :
PING ipv6.google.com(wb-in-x69.1e100.net) 56 data bytes
64 bytes from wb-in-x69.1e100.net: icmp_seq=1 ttl=56 time=49.1 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=2 ttl=56 time=48.5 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=3 ttl=56 time=48.3 ms
64 bytes from wb-in-x69.1e100.net: icmp_seq=4 ttl=56 time=50.3 ms
--- ipv6.google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 48.399/49.116/50.393/0.834 ms
but what next ? I need to redistribute that IPv6 to all my network, currently i have isc-dhcp-server (dhcpd) that gives IPv4 addresses on lan1, i also have bind which acts like a DNS resolver/cacher for my local network. I've heard about radvd which is like a dhcpd but for IPv6, however i think there's other stuff to do on the IPv6 routing table (which i don't understand) before hosts on the network can access Internet through IPv6... so here's a summary : ppp0 gets an IPv6 address, i can ping6 from this computer, and that's it...
Sorry for the long post but we're not on IRC so i don't think the usage of Pastebin is required, thanks for reading and have a nice day.Awe, way cool radvd "router advertisement daemon"
Ya, that is what you needed for IPv6 to work Ya, see the IPv6 protocol takes care of addressing for you. No need for DHCP nor NAT/PAT becuase your ISP gives you more IP's then you could ever need. In fact, you can fit every IPv4 address posible into the range of addresses your ISP gives you!
One other VARY cool thing with IPv6 is "Anycast, One-to-nearest". Really just endless super cool stuff with IPv6.
If I remember correctly like all OS's prefer to use IPv6 if avalable.
Okay, so for DNS, well I think you do need DHCP to hand that out... (I'm probaly wrong about that), anyway, I'd simply configure you DNS host by host... but I have a faint memory of some cool way that can work itself out too... in anycase:
Google DNS
/etc/resolv.conf
nameserver 2001:4860:4860::8888
nameserver 2001:4860:4860::8844
nameserver 8.8.8.8
nameserver 8.8.4.4
You know though. For security sake, you may want to configure your LAN with a Private IPv6 netwrok and subnet. All you would need to do is give the interfaces on the router an address starting with FD. Then you can use like arno-iptables-firewall to NAT the address range.
Like this is how IPv6 network and subnet addressing works
http://www.simpledns.com/private-ipv6.aspx
| 8 bits | 40 bits | 16 bits | 64 bits |
+--------+-+------------+-----------+----------------------------+
| Prefix | Global ID | Subnet ID | Interface ID |
+--------+-+------------+-----------+----------------------------+
That "Interface ID" is created by the Host automaticaly. It simply takes the MAC address of the interface and puts an "FE" in teh middel to make it 64 bits long.
A Host learns about the network half of the address by picking up the "Router Advertisement messages"
So if the interface on the LAN side of the router has a Private IP address (it starts with "FD"), that is the network the router will put in the Router Advertisement and the Host's will pick up that Network 64bits and add on it's Interface ID 64bit's. Then bam, you got yourself an IPv6 address in a "Unique Local" IPv6 address range.
EDIT:
Awe, Okay, I just re-read my CCNA book. Okay so ya, a Host or Router using stateless autoconfiguration can learn both the IPv6 address prefix and it's default router IP address using NDP RS/RA messages. However, you do need at least a stateless DHCPv6 server to hand out DNS server's IP.
Last edited by hunterthomson (2012-11-06 09:35:54) -
IPV6 DHCP stateful doesn't insert local subnet in route table
I am setting up IPV6 on a LAN using satic IPs for Win2008 servers and DHCP stateful mode for Win7 clients. All static assigned servers can ping each other and if I setup a static on the Win7 clients they can also ping the servers. However when I assign DHCP stateful mode IP to the clients they lose the ability to ping the servers. I think that was is going on is that when the Win7 machines get IP via DHCP they do not get a route in the routing table for the local subnet. I have included IP info for static and DHCP clients in attachments.
I figure if I could add the fd:0:0:1::/64 subnet to the DHCP client it would work but I haven't been able to find the correct syntax to add an "on-link" router. Furthermore, this would kind of defeat the purpose of DHCP if I had to manually add routes to clients.
I have a UC520 that is the default gateway on the LAN and seems to support IPV6. Maybe this guy can help me out?
Thanks in advance.Alain,
I disagree about the /128. If you look at the static host it also has a /128 route pointing to itself. Also the IPV4 also shows /32 routes pointing to the local IP. The static host has one additional route not found on the DHCP client which is the /64 route to the local subnet pointing to "on-link". It is not clear how to add an "on-link" route using netsh but my point is that DHCP should provide all info and relying on manually adding routes is not the optimal solution.
The UC520 does not have any IPV6 on it. I only mentioned it because usually I use Windows for DHCP but in this case Windows is giving me this weird behaviour. I would rather get Windows DHCP to solve the problem but if it can't I would use the UC520 as a backup option.
Thanks for your input.
Rgds,
Diego -
ASA 5505: VPN Access to Different Subnets
Hi All-
I'm trying to figure out how to configure our ASA so that remote users can have VPN access to two different subnets (office LAN and phone LAN). Currently, I have 3 VLANs setup -- VLAN 1 (inside), VLAN 2 (outside), VLAN 13 (phone LAN). Essentially, remote users should be able to access their PC (192.168.1.0 /24) and also access the office phone system (192.168.254.0 /24). Is this even possible? Below is the configurations on our ASA,
Thanks in advance:
ASA Version 8.2(5)
names
name 10.0.1.0 Net-10
name 20.0.1.0 Net-20
name 192.168.254.0 phones
name 192.168.254.250 PBX
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
switchport access vlan 3
interface Ethernet0/6
interface Ethernet0/7
switchport access vlan 13
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.98 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address X.X.139.79 255.255.255.224
interface Vlan3
no nameif
security-level 50
ip address 192.168.5.1 255.255.255.0
interface Vlan13
nameif phones
security-level 100
ip address 192.168.254.200 255.255.255.0
ftp mode passive
object-group service RDP tcp
port-object eq 3389
object-group service DM_INLINE_SERVICE_1
service-object ip
service-object tcp eq ssh
access-list vpn_nat_inside extended permit ip Net-10 255.255.255.224 192.168.1.0 255.255.255.0
access-list vpn_nat_inside extended permit ip Net-10 255.255.255.224 phones 255.255.255.0
access-list inside_nat0_outbound extended permit ip any Net-10 255.255.255.224
access-list inside_access_in extended permit ip any any
access-list Split_Tunnel_List standard permit Net-10 255.255.255.224
access-list phones_nat0_outbound extended permit ip any Net-10 255.255.255.224
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 host Mac any
pager lines 24
logging enable
logging timestamp
logging monitor errors
logging history errors
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu phones 1500
ip local pool SSLClientPool-10 10.0.1.1-10.0.1.20 mask 255.255.255.128
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (inside) 10 interface
global (outside) 1 interface
global (phones) 20 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
nat (outside) 10 access-list vpn_nat_inside outside
nat (phones) 0 access-list phones_nat0_outbound
nat (phones) 1 0.0.0.0 0.0.0.0
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 X.X.139.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authorization command LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=pas-asa.null
keypair pasvpnkey
crl configure
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 28800
vpn-sessiondb max-session-limit 10
telnet timeout 5
ssh 192.168.1.100 255.255.255.255 inside
ssh 192.168.1.0 255.255.255.0 inside
ssh Mac 255.255.255.255 outside
ssh timeout 60
console timeout 0
dhcpd auto_config inside
dhcpd address 192.168.1.222-192.168.1.223 inside
dhcpd dns 64.238.96.12 66.180.96.12 interface inside
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 outside
webvpn
enable outside
anyconnect-essentials
svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
svc image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 2
svc enable
tunnel-group-list enable
group-policy SSLClientPolicy internal
group-policy SSLClientPolicy attributes
wins-server none
dns-server value 64.238.96.12 66.180.96.12
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout none
vpn-session-timeout none
ipv6-vpn-filter none
vpn-tunnel-protocol svc
group-lock value PAS-SSL-VPN
default-domain none
vlan none
nac-settings none
webvpn
svc mtu 1200
svc keepalive 60
svc dpd-interval client none
svc dpd-interval gateway none
svc compression none
group-policy DfltGrpPolicy attributes
dns-server value 64.238.96.12 66.180.96.12
vpn-tunnel-protocol IPSec svc webvpn
tunnel-group DefaultRAGroup general-attributes
address-pool SSLClientPool-10
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *****
tunnel-group PAS-SSL-VPN type remote-access
tunnel-group PAS-SSL-VPN general-attributes
address-pool SSLClientPool-10
default-group-policy SSLClientPolicy
tunnel-group PAS-SSL-VPN webvpn-attributes
group-alias PAS_VPN enable
group-url https://X.X.139.79/PAS_VPN enable
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege cmd level 3 mode exec command packet-tracer
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpnclient
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context
no call-home reporting anonymousHi Jouni-
Yes, with the current configs remote users only have access to the 'inside' LAN (192.168.1.0). The digital PBX on the 'phone' LAN (192.168.254.0) is not reachable through their VPN session.
Per you recommendation, I removed the following configs from my ASA:
global (phones) 20 interface
... removing this configuration didn't make a difference -- I was still able to ping the inside LAN, but not the phone LAN.
global (inside) 10 interface
nat (outside) 10 access-list vpn_nat_inside outside
.... removing these two configurations caused the inside LAN to be unreachable. The phone LAN was not reachable, either. So, I put the '10' configurations back.
The ASDM syslog is showing the following when I try to ping the PBX (192.168.254.250) through the VPN session:
"portmap translation creation failed for icmp src outside:10.0.1.1 dest phones:PBX (type 8, code 0)"
What do you think?
Thanks! -
Cisco asa 5505: No traffic lan to wan with IPv6
Hello everybody,
I have a Cisco ASA 5505, public ipv6 in outside interface, private ipv6 in LAN, from router I can ping any ipv6 in Internet and ping my LAN ipv6. Traffic doesn't go through router.
This is my configuration.
interface Vlan1
nameif inside
security-level 100
ip address PRIV-Saturn1 255.255.255.0
ipv6 address fc00::1/7
ipv6 enable
interface Vlan2
nameif outside
security-level 0
ip address PUBLIC26 255.255.255.248
ipv6 address xxxx:yyyy:67:36::2/64
ipv6 enable
ipv6 nd suppress-ra
access-list Dynamic_Filter_ACL extended permit tcp any6 any6
ipv6 route outside ::/0 xxx:yyyy:67:36::1
Am I omitting anything?
Thanks in advance for the help.
Jos PSince you're using IPv6 private addressing (fc00::) on the inside, you need a dynamic NAT entry to translate your private IPv6 addresses to a public one.
Alternatively, you could just use a subnet of your registered IPv6 block for the inside network and not worry about NAT.
Maybe you are looking for
-
DVI - Sony TV doesn't work: PAL vs. NTSC ???
I'm trying to connect my MacBook Pro via a DVI->HDMI cable to a Sony HDTV (KLV-V32A10E). The Displays Preferences detects the second display ("SONY TV"), but the TV remains blank. Interestingly enough, none of the preferred suggested resolutions (i.e
-
How to remove the 'New Entry' button in the warning message for a dialog bo
Hi Experts, I am calling a Modal Dialog box screen having a pushbutton. On the click of the pushbutton, I am performing some checks, and giving a warning message. The warning message comes as a popup in this case and has three buttons on it. One of t
-
Creating a model for jTable in JDeveloper..
Hi everybody, I have a little problem about making a model for my jTable. Previously i've been using Netbeans and i had no problem about table models. Object[][] data={{" "," "," "," "}}; String[] columnNames = {"Pers_no","Name","Surname","Position"}
-
A program to change default fonts for templates in Keynote
Has anyone written a utility to change the default on Keynote templates. Doing it manually seems like a lot of repetition.
-
Microsoft's site says firefox 3 is compatible with windows 7. however, i've upgraded to firefox 5 and now system crashes to the blue screen.