Multiple Router Advertisements

  • LAYER 8 Netgate

    I just ended up with what could be called a rogue router sending Router Advertisements on a lab segment.

    Everything looked to be handled OK but I noticed something strange.

    This segment receives an RA and DHCP6 from a pfSense interface set to managed.

    The rogue router was also announcing itself as a router for the same prefix.

    In order to get the pfSense to be preferred I set it to priority High. It was then the sole default IPv6 router in the routing table.

    I had two IP addresses on the GUA prefix of the interface on the inside client host. One was received from DHCP6 (::2000) and one was obtained using SLAAC (:ecc4:62ff:fe10:a20c).

    OK so far.

    But now it gets weird.

    Any traffic sourced from the DHCP6 address to anything off-link was routed to the default gateway.

    Anything sourced from the SLAAC address to anything off-link was routed to the rogue router, despite the default route in the routing table.

    Now there was no other route I could see in the routing table for this so it looks to have been based on what the chosen source address was somehow.

    This makes a lot of sense for multi-homed scenarios (In fact I have wondered how that could be made to work at all) but I can't find anything documenting what this is or how it is supposed to work. Nor can I see how to query the router configuration in FreeBSD 12.2-STABLE (The host is a 2.5.0 test system). The (admittedly probably too old) books I have seem to indicate a lot of discretion is given to the client stack as to what to do when it receives multiple RAs.

    Anyone know for sure what is going on here?


  • @Derelict

    Use Packet Capture to capture some of those RAs and check the MAC address to see where they're coming from.

  • LAYER 8 Netgate

    I know exactly where they are coming from.

    I am looking for feedback on "client" behavior when more than one RA is on the network.

  • LAYER 8

    afaik
    SLAAC use information from RA to forward
    DHCPv6 use routing table

    https://tools.ietf.org/html/rfc6724
    7. Interactions with Routing

    https://tools.ietf.org/html/draft-ietf-v6ops-ra-guard-implementation-07


  • @Derelict said in Multiple Router Advertisements:

    I am looking for feedback on "client" behavior when more than one RA is on the network.

    Multiple RAs are permitted and IPv6 uses the priority (set in the router) to determine which one to use.

  • LAYER 8 Netgate

    @kiokoman Thanks for that RFC.

    These sections were interesting:

    5. Source Address Selection (Specifically rule 5.5 and its discussion)

    7. Interactions with Routing

    10.5. Configuring a Multi-Homed Site

    But I still don't see anything that speaks to selecting a next-hop that is not already a default gateway on an interface in the routing table based on the source or destination addresses selected by the algorithm. In fact the discussion of rule 5.5 above specifically states that implementations do not have to track that so that tells me it cannot be relied on in a network design.

    @JKnott said in Multiple Router Advertisements:

    Multiple RAs are permitted and IPv6 uses the priority (set in the router) to determine which one to use.

    I understand that but that speaks to which router the stack decides to place in the routing table. I am looking for something outlining a routing algorithm to send traffic to a router NOT in the routing table based on the source (and possibly destination) address selected for the connection.

    RFC4861 sections 5.2 and 6.3.6 seem to be getting close.

  • LAYER 8

  • LAYER 8 Netgate

  • LAYER 8

    uhm i was searching for distance-vector algorithms and link-state algorithms
    ended up reading this
    http://www.cu.ipv6tf.org/literatura/chap7.pdf
    idk when i ended up reading that rfc on another tab of my browser


  • @Derelict said in Multiple Router Advertisements:

    I understand that but that speaks to which router the stack decides to place in the routing table. I am looking for something outlining a routing algorithm to send traffic to a router NOT in the routing table based on the source (and possibly destination) address selected for the connection.

    In the Router Advertisements there is a setting for router priority. That is what RA uses. Normally, this would be used where an organization has their own address block advertised by BGP. They could have connections from multiple sources and the primary source would be given the highest priority. Then, should the primary fail, the lower priority RA would be used to send traffic through the secondary connection. Because the subnet is advertised via both connections, either one supports the same LAN addresses.


  • @Derelict said in Multiple Router Advertisements:

    RIP2?

    GEEZ NO!. RIP is obsolete. Go with OSPF these days or EIGRP if you must. The main reason for not using RIP is it has no concept of bandwidth in a hop, so it will always chose the route with the fewest hops, even if those hops support much less bandwidth than another route. Both OSPF and EIGRP consider bandwidth when determining the best route.


  • @kiokoman said in Multiple Router Advertisements:

    uhm i was searching for distance-vector algorithms and link-state algorithms
    ended up reading this

    Routing protocols have nothing to do with multiple RAs on a LAN. They are used by a router to determine the best route to another network, not the best router to use on a LAN.

  • LAYER 8 Netgate

    @JKnott You still do not seem to grasp the question I am asking. I will be setting something up deliberately to test this but it will be some time before I can do it.


  • @Derelict

    I thought you were talking about RAs from more than one source. Is that not correct? If so, then there are likely more than one router. If not, then you have some other issue. You even mention a rogue router in your original post. This is strictly a LAN issue, where you can have multiple routers and not a routing protocol issue, unless I have severely misread your original post.

  • LAYER 8 Netgate

    There is more than one router. That is known. I called it a rogue because this router should not be sending RAs and it is (breaking IPv6 connectivity for this LAB segment), which is a completely separate issue. It is the behavior of the routing done by the host receiving such RAs that is curious, not the fact that multiple routers on the network are sending RAs.


  • @Derelict

    As I mentioned, the behaviour is for the receiving device to use the priority of the RA to determine which to use. However, I have no idea what happens if both RAs have the same priority. You can use Wireshark to see what the priority of a RA is.

  • LAYER 8

    ah from the point of view of the host
    https://tools.ietf.org/html/rfc8043

  • LAYER 8 Netgate

    @kiokoman Yeah that looks like a discussion of what I'm seeing. Thanks.

  • LAYER 8 Netgate

    @JKnott You still seem to be missing the point. The RAs were received and the high-priority router was chosen as the default router as expected.

    The host was STILL sending traffic to off-link addresses sourced from the SLAAC address through the lower-prority router that announced the prefix for autoconf.

    The mechanism this routing decision was made without regard to the routing table on the host is the information I am looking for.


  • This mentions that the RA preference is associted with the default router. Do you have a default route configured?
    https://www.arubanetworks.com/techdocs/ArubaOS_63_Web_Help/Content/ArubaFrameStyles/IPv6/IPv6_Router_Advertisemen.htm

  • LAYER 8 Netgate

    Again, the RAs are used to set the default route. That route is installed in the routing table. The issue I saw was traffic sourced from the SLAAC address went to the "Medium" priority router that was not in the routing table while traffic sourced from the DHCP6 address went according to the routing table - or at least to the "High" priority router which is the same as the DHCP6 server.

  • Rebel Alliance Developer Netgate

    I don't see it in the thread yet but it's worth mentioning for others landing on this thread later that the place to look for this info is in ndp (but not yet in the pfSense GUI):

    • ndp -r shows the router list (can flush with ndp -R)
    • ndp -p shows the prefix list (can flush with ndp -P)
    • ndp -I shows the default interface used when there is no default router (clear with ndp -I delete)
    • ndp -H will harmonize the NDP router(s) info with the route table

    That helps unravel the mystery of IPv6 behavior in unexpected/weird situations like this


  • Thank you jimp very helpful advice.:) Sounds like that will solve Derelicts IPV6 mystery.

  • LAYER 8 Netgate

    Still some things to examine there but yes the ndp output is what I was looking for.