IPv6 ICMPv6 (ND)

[Chura]

Hi Guys, I have Cisco 3900 with IPv6 configure and fully routable. Behind we have Fortigate 200a in Transparent mode. In order to allow my station to get dynamically EUI64 ip address (Kind of DHCP) i have to make rule in the Policy6 of " Any(All)-Any(All)-Allow" I' ve tried creating new customer service with ICMPv6 and no port, tried using the implicit ICMP-ANY service, nothing allow it to pass. Tried also : Interface level --> l2forward enable Interface level --> broadcast-forward enable System Level --> multicast-skip-policy enable Debug from Cisco (When the any-any-allow disabled): Aug 23 19:20:36: ICMPv6-ND: Sending RA to FF02::1 on Vlan1 Aug 23 19:20:36: ICMPv6-ND: MTU = 1500 Aug 23 19:20:36: ICMPv6-ND: prefix = <Omitted>:B00::/64 onlink autoconfig Aug 23 19:20:36: ICMPv6-ND: 2592000/604800 (valid/preferred) Debug with the Rule enabled: Aug 23 19:22:15: ICMPv6-ND: Sending RA to FF02::1 on Vlan1 Aug 23 19:22:15: ICMPv6-ND: MTU = 1500 Aug 23 19:22:15: ICMPv6-ND: prefix = <Omitted>:B00::/64 onlink autoconfig Aug 23 19:22:15: ICMPv6-ND: 2592000/604800 (valid/preferred) Aug 23 19:22:15: ICMPv6: Received ICMPv6 packet from FE80::21D:46FF:FED3:92AE, type 134 Aug 23 19:22:15: ICMPv6-ND: Received RA from FE80::21D:46FF:FED3:92AE on Vlan1 Aug 23 19:22:15: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 143 Aug 23 19:22:15: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 143 Aug 23 19:22:16: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 143 Aug 23 19:22:16: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 143 Aug 23 19:22:17: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 136 Aug 23 19:22:17: ICMPv6-ND: Received NA for <Omitted>:B00:6C6E:572E:6E48:682C on Vlan1 from FE80::225:FF:FE4A:AB5 Aug 23 19:22:17: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 136 Aug 23 19:22:17: ICMPv6-ND: Received NA for <Omitted>:B00:6C6E:572E:6E48:682C on Vlan1 from FE80::225:FF:FE4A:AB5 Aug 23 19:22:17: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 136 Aug 23 19:22:17: ICMPv6-ND: Received NA for <Omitted>:B00:225:FF:FE4A:AB5 on Vlan1 from FE80::225:FF:FE4A:AB5 Aug 23 19:22:17: ICMPv6: Received ICMPv6 packet from FE80::225:FF:FE4A:AB5, type 136 Aug 23 19:22:17: ICMPv6-ND: Received NA for <Omitted>:B00:225:FF:FE4A:AB5 on Vlan1 from FE80::225:FF:FE4A:AB5

[emnoc]

if your using EUI-64 address , than that' s not like DHCPv6. Are you having problems getting the RA announcement? I think a simple icmpv6 permit statement will allow for the RA. Aug 23 19:22:15: ICMPv6: Received ICMPv6 packet from FE80::21D:46FF:FED3:92AE, type 134 This shows RA advertisement being sent from the router

[Chura]

Hi, Yes i' m using ICMPv6 ND RA for " DHCP" since my router doesnt have DHCP6. I see the request leaving the router, but no answer from the station behind. The topology is (Cisco Router-->Fortigate Bridge --> LAN Switch --> LAN) i can see only replies when i enable the ANY(All)-ANY(All)-ALL Permit

[emnoc]

Maybe I was not clear in my response, the RA is carried via icmpv6, so you need to enable a policy in your policy6 statements to allow for this. i.e edit 2 set srcintf " EXT_NET01" set dstintf " WEB_NET01" set srcaddr " allv6" set dstaddr " allv6" set action accept set schedule " always" set service " ICMP_ANY" next end try that. Now you mention DHCPv6 are you using stateless only or do you have a DHCPv6 server on the cisco router? Their' s a big difference but that' s very mute. On DHCPv6 ( I haven' t done it on the firewall of thru the firewall , but I think you would need a fwpolicy6 policies for dhcpv6.

[Chura]

Hi, Thanks for your time. I wrote on my first comment that i' ve tried both ICMP_ANY and ICMPv6 services. none of them worked. tcpdump showed nothing incoming on the machine, while the cisco debug show its clearly leaving the router.

[Matthijs]

have you tried sniffing on the FortiGate? diag sniff pack any ' icmp6'

[Chura]

Just now... Advertisement coming 9.391081 wan1 in fe80::21d:46ff:fed3:92ae -> ff02::1: icmp6: router advertisement [class 0xe0] 9.391081 root.b in fe80::21d:46ff:fed3:92ae -> ff02::1: icmp6: router advertisement [class 0xe0] 10.402025 wan1 in 2001:0:4137:9e76:83:dd0:a8bb:e369 -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: echo request seq 32000 11.223531 wan1 in fe80::21d:46ff:fed3:92ae -> <omitted>:b00::100: icmp6: neighbor sol: who has <omitted>:b00::100 [class 0xe0] 11.223566 internal out fe80::21d:46ff:fed3:92ae -> <omitted>:b00::100: icmp6: neighbor sol: who has <omitted>:b00::100 [class 0xe0] 11.223989 internal in <omitted>:b00::100 -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor adv: tgt is <omitted>:b00::100 11.224012 wan1 out <omitted>:b00::100 -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor adv: tgt is <omitted>:b00::100 11.527821 wan1 in fe80::21d:46ff:fed3:92ae -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: neighbor sol: who has <omitted>:b00:dd06:c018:f1f9:75b [class 0xe0] 11.527857 internal out fe80::21d:46ff:fed3:92ae -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: neighbor sol: who has <omitted>:b00:dd06:c018:f1f9:75b [class 0xe0] 11.528228 internal in <omitted>:b00:dd06:c018:f1f9:75b -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor adv: tgt is <omitted>:b00:dd06:c018:f1f9:75b 11.528250 wan1 out <omitted>:b00:dd06:c018:f1f9:75b -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor adv: tgt is <omitted>:b00:dd06:c018:f1f9:75b 15.979827 internal in fe80::70d5:66b3:642:6050 -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor sol: who has fe80::21d:46ff:fed3:92ae 15.979855 wan1 out fe80::70d5:66b3:642:6050 -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor sol: who has fe80::21d:46ff:fed3:92ae 15.980907 wan1 in fe80::21d:46ff:fed3:92ae -> fe80::70d5:66b3:642:6050: icmp6: neighbor adv: tgt is fe80::21d:46ff:fed3:92ae [class 0xe0] 15.980935 internal out fe80::21d:46ff:fed3:92ae -> fe80::70d5:66b3:642:6050: icmp6: neighbor adv: tgt is fe80::21d:46ff:fed3:92ae [class 0xe0] 19.282073 wan1 in fe80::21d:46ff:fed3:92ae -> ff02::1: icmp6: router advertisement [class 0xe0] 19.282073 root.b in fe80::21d:46ff:fed3:92ae -> ff02::1: icmp6: router advertisement [class 0xe0] 20.982481 wan1 in fe80::21d:46ff:fed3:92ae -> fe80::70d5:66b3:642:6050: icmp6: neighbor sol: who has fe80::70d5:66b3:642:6050 [class 0xe0] 20.982515 internal out fe80::21d:46ff:fed3:92ae -> fe80::70d5:66b3:642:6050: icmp6: neighbor sol: who has fe80::70d5:66b3:642:6050 [class 0xe0] 20.982898 internal in fe80::70d5:66b3:642:6050 -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor adv: tgt is fe80::70d5:66b3:642:6050 20.982920 wan1 out fe80::70d5:66b3:642:6050 -> fe80::21d:46ff:fed3:92ae: icmp6: neighbor adv: tgt is fe80::70d5:66b3:642:6050 22.086396 wan1 in 2001:0:4137:9e76:83:dd0:a8bb:e369 -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: echo request seq 11586 22.982869 internal in <omitted>:b00:dd06:c018:f1f9:75b -> <omitted>:b00::1: icmp6: neighbor sol: who has <omitted>:b00::1 22.982902 wan1 out <omitted>:b00:dd06:c018:f1f9:75b -> <omitted>:b00::1: icmp6: neighbor sol: who has <omitted>:b00::1 22.983828 wan1 in <omitted>:b00::1 -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: neighbor adv: tgt is <omitted>:b00::1 [class 0xe0] 22.983870 internal out <omitted>:b00::1 -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: neighbor adv: tgt is <omitted>:b00::1 [class 0xe0] 23.907316 wan1 in 2001:0:4137:9e76:83:dd0:a8bb:e369 -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: echo request seq 49511 25.906742 wan1 in 2001:0:4137:9e76:83:dd0:a8bb:e369 -> <omitted>:b00:dd06:c018:f1f9:75b: icmp6: echo request seq 35270

[Chura]

Btw, the sniffer about is with the following rule enabled. edit 2 set srcintf " any" set dstintf " any" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " IPv6_ICMP_GRP" edit " IPv6_ICMP_GRP" set member " ICMP_ANY" " ICMPv6" ============================================ Even if it worked, i' m not so happy opening my network to world to ICMP. I' ve created new rule, with my Cisco link-local as source, and destination any edit 2 set srcintf " any" set dstintf " any" set srcaddr " CISCO_IPV6_IP_NV" set dstaddr " all" set action accept set schedule " always" set service " ANY" edit " CISCO_IPV6_IP_NV" set ip6 fe80::21d:46ff:fed3:92ae/128 And its working, but I wonder, how secure is it ?

[emnoc]

Will the Fe80 is a link-only address. I would post a bogon on my upstream interfaces and restrict this if your concern; Here' s what I typically do; ipv6 access-list mars-bogon remark MARTIANS and BOGONS filters sequence 30 deny ipv6 ::/96 any deny ipv6 host :: any deny ipv6 host ::1 any deny ipv6 ::FFFF:0.0.0.0/96 any deny ipv6 ::208.0.0.0/100 any deny ipv6 ::127.0.0.0/104 any deny ipv6 ::/104 any deny ipv6 ::255.0.0.0/104 any deny ipv6 ::/8 any deny ipv6 200::/7 any deny ipv6 3FFE::/16 any deny ipv6 2001:DB8::/32 any deny ipv6 2002:E000::/20 any deny ipv6 2002:7F00::/24 any deny ipv6 2002::/24 any deny ipv6 2002:FF00::/24 any deny ipv6 2002:A00::/24 any deny ipv6 2002:AC10::/28 any deny ipv6 2002:C0A8::/32 any deny ipv6 FC00::/7 any deny ipv6 FE80::/10 any deny ipv6 FEC0::/10 any deny ipv6 FF00::/8 any remark add BOGONS if you desired so here remark permit all other ipv6 address permit ipv6 any any ! int ten 3/1 ipv6 traffic-filter mars-bogon in But your right in opening icmpv6 to any for RA is not good. If you had a internal core router/switch that support L3, you could do the RA adv from that internal source.