Duplicate IPv6 addresses
Following the update to Windows 10 1903, I have the following issue:
- When the PC NIC acquires it's IP, for a couple of seconds there is 1 IPv6 permanent address and 1 IPv6 temporary address, then those addresses get doubled.
Here's an example:
- First seconds after acquiring IPs:
- 5 Seconds later:
My PFSense interfaces:
And Switch (Mikrotik SWOS WLAN Assignments to ports)
Any help/hint would be greatly appreciated, since I'm really lost here and I would really love to have IPv6 back on my main PC.
@JKnott : Yes, any PC wired to the switch. Wireless clients are not affected, that's why I'm lost here.
Could this be related?
If yes, is there any way to assign IPv6 to my VLANs other way than using Prefix Delegation?
you do understand its normal to have more than 1 temp address right...
Those address are not "duplicated" they are different you see d800 and d801 on the other.
Your double global is not good, but its a different prefix..
To be honest any doesn't seem like correct term for setting a vlan on a access port.. If all there is a pc, then it should only see traffic from whatever vlan its in.. not "any" So your prob running multiple layer 3 on the same layer 2 - which is why your seeing ipv6 from multiple prefix.
@johnpoz Thanks a lot for your reply. I noticed the difference now.
Could you give me some pointers where to look? PFSense VLAN settings or Switch (Mikrotik) VLAN Settings?
As I said, the issue only arise after the update to build 1903.
Thanks again for any help you can provide.
just because you only noticed it after 1903 doesn't mean anything... Your switch settings make no sense to me..
When you have a device connected to a port and its in say vlan X... The only traffic that should go in an out of that port is vlan X... This "any" setting makes ZERO sense to me..
You would not be able to get an IP in a different prefix, unless you were on the same L2 as where that prefix is being advertised.. If your seeing prefix from 2 different network - then means you have a common L2 issue.
d800, and d801 are 2 different /64 prefixes.
Which network do you have d800 setup and which do you have d801 setup? Clearly there is a connection there at L2
@JKnott Thanks for your reply
The switch is a Mikrotik (see below) and this one is cascaded to a cisco SG200-26.
I've tagged VLAN 5 both in PFSense and on the Mikrotik switch, and nothing changed, IPv6 still don't work on my PC.
Then I've taggged packets for VLAN5 on the switch port where the PC is connected and it only works on IPv4 if I specifically tell the NIC on the PC I'm on VLAN5.
I'm really lost here :(
Thanks for all your help.
JKnott last edited by JKnott
I'm really lost here :(
Are the 2 prefixes assigned on your network? Have you run Wireshark to examine the RAs? If you're seeing RAs for both prefixes, you've got something crossed somewhere. The TP-Link problem I mentioned above was due to multicasts not being restricted to the VLAN so a device on the LAN would get the wrong prefix. Also, look at what's actually leaving pfSense. You can do that with Packet Capture right in pfSense or Wireshark, with port mirroring on the managed switch.
Not sure here
This is what gets assigned automatically on PFSense:
There is no DHCPv6, only RA:
OK, so I figured out that both prefixes (from VLAN5 and VLAN10) are assigned to the NIC on VLAN5 on the PC.
The problem is I have no idea how to limit the prefix to a specific VLAN.
Then as I stated you do not have actual vlan isolation... Your just running multiple L3 on the same L2..
That is going to be issue with your switch config.. Are these both tagged, is 1 not tagged on pfsense?
pfsense - em0 vlan5T, vlan 10T -- switch -- vlan 5U -- pc..
There would be no possible way for pc connect to vlan 5 switch port to see vlan 10, traffic - unless you have it mis configured on the switch, etc.
Well, each VLAN leaves PFSense on its own NIC:
VLAN5 is on NIC bce1 and appears in PFSense as LAN: VLAN 5 on bce1 (VLAN5)
VLAN10 is on NIC bce3 and appears in PFSense as PBNETLAN2: VLAN10 on bce3 (VLAN10)
The network cables that leave PFSense (running on a dell R710), reach the Mikrotik Switch like this:
- VLAN5 --> Port 1 --> VLAN Mode: Enable // VLAN Receive: Only Tagged // Default VLAN ID: 5
- VLAN 10 --> Port 2 --> VLAN Mode: Enable // VLAN Receive: Only Tagged // Default VLAN ID: 10
Desktop PC: Port 24: VLAN Mode: Enable // VLAN Receive: ANY // Default VLAN ID: 5
Call me stupid, but I still don't figure out what is wrong on this config.
Is port 24 an access or trunk port? Normally, it should be an access port, unless you need more than one LAN/VLAN on it.
Well, as far as I can understand from my logic, it looks more like trunk to me :(
Here's what Mikrotik says: https://wiki.mikrotik.com/wiki/SWOS/CSS326-VLAN-Example
And this is my setup:
Correct me if I'm wrong. I didn't quite get the VLANS tab part :(
@johnpoz That seemed logical at that time when I first set up the VLANs... Can this be a problem?
I do not know that switch... All I can tell you is that if your getting 2 address from two different RA then your not isolated at Layer 2 - its simple as that. Be it your switch config, or you have something else bridging the 2 L2 networks.
It makes no sense to me to run a vlan on top of the native interface if all your going to do is run 1 network on it.. Pointless... Now if your going to run more than 1 vlan on it, then there is something to be said to only tagging and no native.. But if all you have is native interface pfsense needs not now anything about vlans for that network.
But an "any" setting doesn't seem logical to me at all..
From you later image looks like you have every port as a member of 3 vlans - that is BORKED for freaking sure!!
I can tell you for freaking sure that is wrong without knowing that switch os at all...
The only ports that should be members of more than 1 vlan are ports connected to something that will sep the vlans based upon tag, etc.. Like a router interface that has more than 1 vlan on it, or a another switch uplink, or connection to an AP, etc.