Announcing /48 to BGP peer

yon 0 · Feb 26, 2021, 6:13 AM

/48 is the smallest range among BGP and bgp anycast. Less than /48 will be filtered out by the internet. No matter how much you use, you must set IP prefixes greater than or equal to /48 on at least one interface. Otherwise BGP will not broadcast ip prefixes smaller than /48.
I set at least 5 /48 IP prefixes. only config /48 or above perfixes in frr bgp, it is will can't work. it is must use /48 or greater setup in interface

PF is a routing system, not a client. It must follow professional practices and allow any possibility. It can even allow /29 or greater, because this is running a BGP router, and it can be distributed to other customers. No matter what, it is not Toys, can be ISP routers.
Because RIPE allocates at least one /29 to the customer.

As far as I know, AS4134 uses your system.

johnpoz · Feb 26, 2021, 11:52 AM

@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:

/48 is the smallest range among BGP and bgp anycast

And what does that have to with assigning a /48 to an IP on an interface -- let me think.. Yeah NOTHING!!

Derelict · Feb 26, 2021, 1:38 PM

@yon-0 Announcing a /48 via BGP and placing a /48 on an interface are two completely different things.

In your BGP configuration:

network 2001:db8:abba::/48

On interfaces:

2001:db8:abba:1:::/64
2001:db8:abba:2::/64
2001:db8:abba:3::/64
2001:db8:abba:4::/64

yon 0 · Feb 26, 2021, 11:19 PM

@derelict said in IPv6 broken beyond pfSense after 2.5 upgrade:

@yon-0 Announcing a /48 via BGP and placing a /48 on an interface are two completely different things.

In your BGP configuration:

network 2001:db8:abba::/48

On interfaces:

2001:db8:abba:1:::/64
2001:db8:abba:2::/64
2001:db8:abba:3::/64
2001:db8:abba:4::/64

only network 2001:db8:abba::/48 setup , BGP will not broadcast /48 out. In addition, there is no technical requirement that it must not be used /48 or greater in interface.

yon 0 · Feb 26, 2021, 11:31 PM

This is similar to how I have many big houses, but you said that one person can live in a small house, and the big house must be divided into the smallest house.

Then I have a lot of houses that are in greater demand. And I like to live in big houses. It doesn't say that people cannot live in big houses.

There is no problem if the interface is set to /48 or greater in linux, is it that the freebsd restriction does not allow the use of /48?

I Can't understand this, everyone has their own resources and preferences. There are different needs, if it is not a technical problem, it should not be restricted to the smallest /64. Otherwise, BGP will not stipulate that the minimum is /48

Derelict · Feb 26, 2021, 11:34 PM

@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:

@derelict said in IPv6 broken beyond pfSense after 2.5 upgrade:

@yon-0 Announcing a /48 via BGP and placing a /48 on an interface are two completely different things.

In your BGP configuration:

network 2001:db8:abba::/48

On interfaces:

2001:db8:abba:1:::/64
2001:db8:abba:2::/64
2001:db8:abba:3::/64
2001:db8:abba:4::/64

only network 2001:db8:abba::/48 setup , BGP will not broadcast /48 out.

Yes, it will if it is configured correctly.

In addition, there is no technical requirement that it must not be used /48 or greater in interface.

Yes, actually, there is. See Also RFC7421.

The de facto length of almost all IPv6 interface identifiers is therefore **64 bits.**
**The only documented exception** is in [RFC6164], which standardizes 127-bit prefixes for 
point-to-point links between routers, among other things, to avoid a loop condition
known as the ping-pong problem.

yon 0 · Feb 26, 2021, 11:39 PM

@derelict

I tested it, there must be an interface setting /48 to bgp broadcast. if LAN or other interface has no /48 or greater, pfsense 's frr can't normal broadcast. to upstream.

Derelict · Feb 26, 2021, 11:41 PM

@yon-0 I can guarantee you that nobody who is successfully announcing an IPv6 /48 has that /48 on an interface.

yon 0 · Feb 26, 2021, 11:44 PM

In addition, for larger IP segments, the shortest IP address can be used.
For example 2400:3200::1 2400:da00::6666

Derelict · Feb 26, 2021, 11:48 PM

Anyone else?

yon 0 · Feb 26, 2021, 11:49 PM

@derelict said in IPv6 broken beyond pfSense after 2.5 upgrade:

@yon-0 I can guarantee you that nobody who is successfully announcing an IPv6 /48 has that /48 on an interface.

i using /48 setup interface in ubuntu 20.10 system and runing frr 7.5

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 9000
        inet 185.154.1.130  netmask 255.255.254.0  broadcast 185.154.1.255
        inet6 2a0d:2405:512::1  prefixlen 48  scopeid 0x0<global>
        inet6 fe80::278:34ff:fee6:2f3f  prefixlen 64  scopeid 0x20<link>
        ether 00:70:30:e6:2f:3f  txqueuelen 200000  (Ethernet)
        RX packets 35921977  bytes 19914818009 (19.9 GB)
        RX errors 0  dropped 8  overruns 0  frame 0
        TX packets 24672157  bytes 19845868488 (19.8 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

yon 0 · Feb 26, 2021, 11:56 PM

@derelict said in IPv6 broken beyond pfSense after 2.5 upgrade:

Anyone else?

240C::6666 240C::6644

DIG Output:
dig @240C::6666 yahoo.com SOA

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.3 <<>> @240C::6666 yahoo.com SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58824
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;yahoo.com. IN SOA

;; ANSWER SECTION:
yahoo.com. 1800 IN SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2021022619 3600 300 1814400 600

;; Query time: 18 msec
;; SERVER: 240c::6666#53(240c::6666)
;; WHEN: Sat Feb 27 00:52:23 CET 2021
;; MSG SIZE rcvd: 99

---- Finished ------

https://bgp.he.net/ip/240C::6666

it is using /28 ipv6 for interface and bgp

yon 0 · Feb 27, 2021, 12:01 AM

DIG Output:
dig @2001:da8::666 yahoo.com SOA

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.3 <<>> @2001:da8::666 yahoo.com SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41270
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;yahoo.com. IN SOA

;; ANSWER SECTION:
yahoo.com. 1800 IN SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2021022619 3600 300 1814400 600

;; Query time: 418 msec
;; SERVER: 2001:da8::666#53(2001:da8::666)
;; WHEN: Sat Feb 27 01:00:26 CET 2021
;; MSG SIZE rcvd: 102

---- Finished ------

Derelict · Feb 27, 2021, 12:02 AM

@yon-0 Yet here you are with problems.

login-to-view

Instead of arguing with me about it, please argue with Douglas Comer instead.

Derelict · Feb 27, 2021, 12:05 AM

@yon-0 You are confusing routes and allocations with interface addressing. Please read up on the difference. Happy to help you but in this case you are wrong (and continue to belabor an incorrect position) and your IPv6 journey will be much more successful if you adhere to the established rules, standards, and protocols instead of making up your own.

yon 0 · Feb 27, 2021, 12:12 AM

@derelict

I tested it with a previous version of pfsense before, and /48 works. DHCP can work with /48 test in windows 10. /48 SLAAC maybe can't work for andriod system. This is the result of the previous test. But if you set static ip, there is no problem. for all system.
I have always used /48 on the LAN interface and BGP broadcasts, and it has been working. This time you adjusted the limit, so I found this change. I suggest that the decision is given to users to decide how large the IP segment to use.
You can prompt the recommended value and other information, but don't force the user to use what

yon 0 · Feb 27, 2021, 12:17 AM

@derelict

I used to set /48 on the LAN interface to work, but it pf2.5 doesn’t work anymore now. This is the actual change

johnpoz · Feb 27, 2021, 12:25 AM

@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:

it is using /28 ipv6 for interface and bgp

Just because AS45275 is a /28, where did you get that idea that address is 240C::6666 is using a /28 on some interface?? Sorry but that is just insane!

I used to set /48 on the LAN interface to work, but it pf2.5 doesn’t work anymore now. This is the actual change

Yeah because they prob put in logic to stop users from doing insane shit ;)

I suggest that the decision is given to users to decide how large the IP segment to use.

Not when they are going to BREAK all logic and think they could put a /48 on an interface..

yon 0 · Feb 27, 2021, 12:32 AM

@johnpoz

These IP addresses run DNS servers, so the 240C::6666 IP must be set in the interface. if that ip has no setup in interface, how we can connect it? if your not allow /48 or other setup interface , how i do setup use /32 or /48 Shortest ip in LAN's servers?

No, I don’t think so, I think you force others what you think is impossible.

DIG Output:
dig  @2620:0:ccc::2 yahoo.com SOA 


; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.3 <<>> @2620:0:ccc::2 yahoo.com SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38691
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;yahoo.com.			IN	SOA

;; ANSWER SECTION:
yahoo.com.		127	IN	SOA	ns1.yahoo.com. hostmaster.yahoo-inc.com. 2021022619 3600 300 1814400 600

;; Query time: 7 msec
;; SERVER: 2620:0:ccc::2#53(2620:0:ccc::2)
;; WHEN: Sat Feb 27 01:24:57 CET 2021
;; MSG SIZE  rcvd: 99


 ---- Finished ------

Derelict · Feb 27, 2021, 12:33 AM

@yon-0 said in IPv6 broken beyond pfSense after 2.5 upgrade:

2620:0:ccc::2

That is 2620:0:ccc:0::2/64. Guaranteed. You do realize that zero compression can include bits from both the subnet and interface portion of the address, right?