IPV6 Static IPV6 address
-
johnpoz, please forget ISP already. I am building up IPV6 reference setup of configuring PFSense for myself as a learning curve. I asked for best practices. And best practices for PFSense only. Something I can use later with ISP connection. It was clear after two posts that the network they provided will not work. I will get a new next week.
But thank you for the confirmation and the clarification of transit detail.So, lets move on into practice. There are quite many parameters needed to be correct in order everything to work.. I can assume. I tried following in PFSense.
Network setup:
PFSense LAN IPV6: 2001:1111:2222:3333::1 /64DHCPv6 server enabled using following parameters:
Range start: 2001:1111:2222:3333::100
Range end: 2001:1111:2222:3333::1ff
Prefix Delegation Range start: 2001:1111:2222:3334::
Prefix Delegation Range end: 2001:1111:2222:333f::
Prefix delegation size: 64
Router mode: ManagedSo my HW setup is:
PFSense [LAN] <--> [WAN] SubRouter1 [LAN] <--> PC [NIC]PFSense LAN IP: 2001:1111:2222:3333::1/64 -> OK (set manually)
SubRouter1 WAN IP: 2001:1111:2222:3333::1c7/128 (DHCP seems to work OK)
PC IP: 2001:1111:2222:333e:6d12:8c45:1b7a:6388/128 (DHCP subnet provisioning seems to work since PC gets an address from 333e subnet OK)Lets ping:
PC to SubRouter WAN: YES
PC to PFSense LAN: YES
Subrouter to PFSense LAN: YES
SubRouter to PC: YES
PFSense to SubRouter WAN: YES
PFSense to PC: YESSo this setup seems to work on IPV6 level. I don't know if that is best practice or even suggested setup, but maybe someone can comment on that (rather than asking me to contact ISP)... and sorry, I am not ungrateful or anything. Maybe there is language barrier and I can't express myself clear enough.
What surprises me a little bit is that I haven't configured anything like "Default gateway" in SubRouter nor PC. I can see that PC has default IPV6 gateway to SubRouter's fe80-address. So it works that way just fine. Because PFSense LAN IP is in the same subnet as SubRouter's WAN routing works between PC and PFSense. But I wonder what happens when I ping Internet from PC. That remains to be seen after I have working ISP IPV6 connection next week... (I would be surprised if Subrouter knows how to handle Internet traffic, but maybe IPV6/PFSense is smart enough for that too automatically...)
Ax.
-
And yes, I wrote a little bit length message but I hope my learning notes helps someone else. I found quite many posts of how to set IPV6 on PFSense, but almost none related to Static IPs or using DHCP the way I need to. Also old seniors like me whom have done everything with IPV4 past 30 years there are quite many details done differently.
-
@axsense2 said in IPV6 Static IPV6 address:
I asked for best practices.
How is that possible, when you don't know what the ISP is providing? The setup for DHCPv6-PD is quite different from assigned static addresses.
-
@axsense2 said in IPV6 Static IPV6 address:
but almost none related to Static IPs or using DHCP the way I need to. Also old seniors like me whom have done everything with IPV4 past 30 years there are quite many details done
I'd suspect most people get IPv6 from an ISP that uses DHCPv6-PD. Again, until we know what you're dealing with, it's hard to offer advise.
-
Please forget my ISP already.
I was building a reference setup using an initial requirement that IPV6 address from ISP is static.For those whom are able to comment my setup I would be appreciated. Thank you.
-
@JKnott I'd suspect most people get IPv6 from an ISP that uses DHCPv6-PD. Again, until we know what you're dealing with, it's hard to offer advise.
Yes I can imagine that too. After reading instructions and comments.
But one more time: I am dealing with the setup I have specified and trying to build up a reference setup using those prerequisites. Got it?
-
Well then sure if you want to use the first /64 out of /48 as your transit - then sure that is possible.
-
In this reference setup the first /64 is assumed to be a transit.
But what I would like to know if is this a correct way to publish subnets to subroutes (copied from a message above)?:
Prefix Delegation Range start: 2001:1111:2222:3334::
Prefix Delegation Range end: 2001:1111:2222:333f::
Prefix delegation size: 64Ax.
-
So your going to do downstream prefix delegation? The range is only use to use part of a larger prefix in your actual delegation. Say you want to delegate the 2nd half of larger prefix, or maybe you want to only delegate the middle of the prefix to downstream devices asking for delegation - ie downstream routers.
-
Let me clarify the idea.
Lets assume ISP gives /56 network. In this theoretical example it is then 2001:1111:2222:3300::
So, 2001:1111:2222:3333 was the LAN network of PFSense. I think it was stated that SubRouters need to have /64 subnets within that /56 network? Otherwise they are not able to route to ISPSo I assigned 3334:: to 333f to be delegated to subrouters using /64 delegation size. Which they got and pinging works inside of the internal network built by this example (between 3333 and 333e and over the SubRouter).
-
You don't have to actually delegate anything if this your own internal network.. And delegating a /64 would kind of pointless.. For the same reason your isp giving you only 1 /64 would be pointless.
If you have downstream routers, then you could just statically assign everything, using link local for the transit to the downstream..
Love to see this network where you need to delegate say /60s from your /56 down to other routers, who then have other /64 behind them, etc. Are you going to be an isp for a neighborhood? A DC with multiple clients?
-
@johnpoz said in IPV6 Static IPV6 address:
Are you going to be an isp for a neighborhood?
Yes, that is correct. Been like that for 10 years and now exploring if I can upgrade to IPV6 level. There aren't subrouters behind the first level after PFSense.
I was going to delegate /64s (see specs above)If you have downstream routers, then you could just statically assign everything, using link local for the transit to the downstream..
There are probably many ways to do this. If the DHCP approach works I would probably start a pilot using that. Setup may change later tho...
-
Well if your an ISP for your neighborhood your prob going to want something bigger than a /56 ;) How many clients are you going to have? How many networks will they have behind their routers, etc.
-
There are only up to 30 so basically any size will do.
Probably the reason why ISP was giving me a static IPV6 address instead of one by DHCP is probably that the connection is business product and not consumer product. For consumers ISPs probably "always" supply IPs by DHCP. At least in this part of the world business connections have static IPs without DHCP.
"My customers" have just couple of devices behind their routers. Absolutely none of them has anything but a consumer xDSL router. -
@axsense2 said in IPV6 Static IPV6 address:
Absolutely none of them has anything but a consumer xDSL router.
Well you prob be best off just doing static for them as well.. This should take out any sort of deployment issues, and allow for them to get more segments if they need them. And for others not have to deal with ipv6 if they don't want to, etc.
This way your sure differences in their routers will not be a problem - only issue is that static will be a bit more leg work, and could be problem if you have to scale up to like 300 or 3000 at some point ;)
-
@axsense2 said in IPV6 Static IPV6 address:
There are only up to 30 so basically any size will do.
If you want the users to be able to use DHCPv6-PD, then you'll need a router that can provide it. That's an extra cost option, with Cisco gear, IIRC.
-
@JKnott said in IPV6 Static IPV6 address:
If you want the users to be able to use DHCPv6-PD, then you'll need a router that can provide it. That's an extra cost option, with Cisco gear, IIRC.
I was testing this setup using consumer xDSL modem. Delegation worked just fine. (The SubRouter in the test above was Zyxel low end modem.)
And for others not have to deal with ipv6 if they don't want to, etc.
This is true. I was thinking the same thing. Maybe I just give instructions only to them whom actually likes to use IPV6 and not to compromise rest of the users. On the other hand: if it's automatic it would mean less work for me.Well anyway... thanks for the help. If my reference setup above is just fine I will probably do a pilot with something like that - depending on what kind of IPV6 connection (from ISP) I am actually getting next week.
-
This document contains pretty much all the information I was looking for earlier. I can see that I ended up to the same setup after all.
https://www.slideshare.net/NetgateUSA/ipv6-basics-pfsense-hangout-july-2015Remark about DHCP6 with Android pays my attention. Should I advertise subnets using RA instead of DHCP6? And disable DHCP6 completely...(?)
But how to do this
with RA:
-
@axsense2 said in IPV6 Static IPV6 address:
Should I advertise subnets using RA instead of DHCP6? And disable DHCP6 completely...(?)
That's what I do. With SLAAC, you don't need DHCPv6 to assign addresses.
-
@JKnott said in IPV6 Static IPV6 address:
That's what I do. With SLAAC, you don't need DHCPv6 to assign addresses.
Yep. Got it. Need to study how to properly define this DHCP6 setup without DHCP6.
Since there is only this on RA form:
I think my 3333 network gets IPV6 addresses using SLAAC without any additional configuration. I hope I don't need to create RA Subnet of every single /64 I need to assign...
