Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY

JKnott

I'm on v2.6.0. I guess there's difference between yours and the CE version. Hopefully it's implemented by default.

In the screen capture, it appears you're using a link local address (starts with fe80). As I mentioned above, you can't use those. I don't know what's happening with Cloudeflare. Try the method I did to find the first global address and see what happens. Regardless, unless you have multiple WAN connections, that monitor doesn't do much.

lohphat

@jknott What's interesting is that the WAN segment doesn't get an IPv6 assignment so that there's an external gateway address.

lohphat

This post is deleted!

MikeV7896

The setting is in System > Advanced > Networking in 22.05... so it could apply to all interfaces on the system (and I think I need to update my original config post to note that)...

However, I don't believe it helps any, as I recently reloaded my pfSense box (had package installer issues) and reused the configuration, and every time I rebooted, a new prefix was received. So I think Verizon is doing something else. And I have a static DUID set in System > Advanced > Networking too.

Bob.Dig

@mikev7896 said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

The setting is in System > Advanced > Networking in 22.05... so it could apply to all interfaces on the system

Thanks for pointing that out! Didn't know that it is there now.

I don't use it for myself though.

JKnott

@lohphat said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

@jknott What's interesting is that the WAN segment doesn't get an IPv6 assignment so that there's an external gateway address.

Some ISPs don't provide a global WAN address, as it's not needed. Routing is often done with link local addresses. If you need a global address for VPN, etc., you can use the address on the LAN interface. I have a global WAN address, but it plays no part in routing to my network.

lohphat

@jknott Well I'm left with the residual problem that I can't enter in a specific monitoring address in the WAN_DHCP6 gateway config.

Currently it's just monitoring the link-local address but having link doesn't mean you have transit if there's a fault in the CPE (Verizon ONT).

I can't even enter in the next hop as a monitoring address.

This is a change of behavior between Spectrum and Verizon. Both offer IPv6 natively, and I could use any valid IPv6 address for the Monitoring host with Spectrum.

I shall continue to play with it...

JKnott

@lohphat

It shouldn't matter who your ISP is, an address is an address. Maybe someone who has your version can help. I have the CE version here.

Bob.Dig

@jknott I think he meant that he can not have gateway-monitoring to a public IPv6-address because WAN has no public IPv6-address with this ISP, which is a bummer.

JKnott

@bob-dig

I wonder if Use non-local gateway, under Advanced, would help with this. Given he can ping an outside address means he's using a LAN side address for that.

Bob.Dig

@jknott Interesting.

Or it is maybe this:

Static route
Do not add static route for gateway monitor IP address via the chosen interface By default the firewall adds static routes for gateway monitor IP addresses to ensure traffic to the monitor IP address leaves via the correct interface. Enabling this checkbox overrides that behavior.

JKnott

@bob-dig

I suspect the problem is with a link local WAN address, there is no usable subnet and the non local gateway may be a way around that. I don't think removing a static route would fix that.

lohphat

@jknott said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

I wonder if Use non-local gateway, under Advanced, would help with this. Given he can ping an outside address means he's using a LAN side address for that.

About that. I'm using the WAN i/f in the ping and it works fine. That's what's really confusing me.

Update: Aha!

I tried the ping from the WAN and LAN and noticed that ping is using the LAN interface even though WAN is selected -- so that may explain why the monitor IP is failing as it doesn't know to use the LAN interface instead.

Screenshot 2022-11-06 194647.png

lohphat

@bob-dig said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

@jknott Interesting.

Or it is maybe this:

Static route
Do not add static route for gateway monitor IP address via the chosen interface By default the firewall adds static routes for gateway monitor IP addresses to ensure traffic to the monitor IP address leaves via the correct interface. Enabling this checkbox overrides that behavior.

Just tried this. Didn't work.

JKnott

@lohphat

Have you tried what I suggested about the non-local gateway?

lohphat

@jknott said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

Have you tried what I suggested about the non-local gateway?

Yes. No joy -- didn't work.

JKnott

@lohphat

Well, I guess you'll have to rely on the IPv4 monitor then. I have no idea why some ISPs don't provide a WAN address. It's not as though there's an address shortage.

Bob.Dig

@lohphat said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

Just tried this. Didn't work.

What happens if you uncheck that and then create your own static route to that same external IP...

lohphat

@bob-dig said in Just flipped from Spectrum to FiOS in NYC and have IPv6 out of the box FINALLY:

What happens if you uncheck that and then create your own static route to that same external IP...

Will try that shortly.

Related question: Why doesn't the WAN config for Ipv6 offer a place to assign a Prefix ID like the other i/f configs do since they're tracking the WAN IPv6 config delegation?

It seems that the WAN config should be able to assign the external WAN i/f an address. Or is that controlled by the ISP's RA?

Perhaps I can ask Verizon to have their side assign one...

JKnott

@lohphat

That would really mess up routing. You'd have your internal prefix on the WAN interface.