IPv6 Question

johnpoz

I could see if the pvid on the port connected to your device was your lan vlan id, that could get to pfsense tagged as it leaves the port connected to pfsense.

But if that was what was happening then ipv4 should work as well, unless your rules on the lan interface didn't allow IPv4?

If the traffic was actually coming to pfsense untagged, and pfsense has nothing set on the native interface.. Then it shouldn't be able to get anything.

johnnybinator

@johnpoz Yeah. Exactly.

stephenw10

So to be clear this happens when you connect a host to ix0 directly? Or some other down stream trunk link?

If it's something other than actually on ix0 on the firewall I'd guess there's something else bridging to it. It's all too easy to leak tagged traffic to untagged but much less likely to go the other way. And that would be required for ping6 to work obviously.

Steve

johnnybinator

@stephenw10 This is through a switch that has a trunk port set up on the 6100 - 10Gb.

stephenw10

So you're connecting to a trunk port on the switch and there is a separate trunk to the 6100?

That sounds like a switch config problem then. That trunk port is untagged on VLAN11 somehow?
Doesn't explain how 6 works and v4 doesn't though.

johnpoz

@stephenw10 exactly common config actually - pvid on a trunk is vlan X... As traffic enters the port untagged it gets put in vlan X.. Now when it leaves the switch to say the router it is tagged on vlan X.

But my same question that could explain what is happening - but doesn't explain why it doesn't work on ipv4.. Unless the firewall rules on lan on pfsense do not allow ipv4?

johnnybinator

@johnpoz I have no PIVD set. No Native VLAN. Just straight Trunk. on the switch or the Host. I'm sure of it.

interface ethernet 1/25
description sm3_10G
switchport mtu 9216
switchport mode trunk
switchport trunk allowed vlan all
ipv6 nd ra suppress

johnpoz

@johnnybinator said in IPv6 Question:

Just straight Trunk

And what switch allows that? If there was no native, then any untagged traffic wouldn't go anywhere - so clearly that is not what is happening.

johnnybinator

@johnpoz Clearly there's nothing clear about it.

johnpoz

@johnnybinator if pfsense is handing you IPv6 address on vlan 11

LAN (lan) -> ix0.11 -> v4: 10.200.0.254/24

Then the traffic is coming to pfsense on vlan 11, how it got there would be a switch config thing. Or a client config thing.. Pfsense isn't going to say oh untagged traffic, let me put that on my ix0.11 interface..

stephenw10

@johnnybinator

Is that the trunk port that connects to pfSense or where you're connecting the client?
Or is that the same port somehow?

johnnybinator

@stephenw10 that’s the switch port that connects to pfSense. I think what I’m going to do next is plug a host directly into the PF sense interface.

stephenw10

Um.... so how are you connecting a client to it now?

The problem is almost certainly in the switch config for the port the client is on.

Steve

johnnybinator

@stephenw10 ummm sooo….

As I’m writing this, I have a switch connected. What I was think would solve this lovely chat is if I put a host directly on the pfSense trunk.

stephenw10

Yes, that would certainly confirm if there really is something in pfSense allowing IPv6 only to leak from a VLAN to the parent.

I was just confused as to how it was connected when you were testing before. I may have misread it but I thought you had two trunk connections on the switch (presumably to another switch or an AP maybe) and were connecting the host to the other one.

Steve

johnpoz

@stephenw10 said in IPv6 Question:

allowing IPv6 only to leak from a VLAN to the parent.

But that is not what he is saying, he is saying its leaking without a tag to tagged interface..

stephenw10

Well the fact he can actually use that IP on the host implies it's going both ways which is far more unusual.

johnpoz

@stephenw10 if it was some sort of crazy leak then yeah..

But makes complete sense if the pvid on the port is vlan 11.. Other than saying its only ipv6.. But maybe the device is only requesting IPv6 because he turned ipv4 off on it, etc .etc.

What is more likely, a misconfig on the switch port with a pvid, which pretty much every switch on the planet will set, even with a trunk setting.. Normally you set this to a dead vlan in cisco land.

Or pfsense somehow saying oh look at this untagged traffic, here let my vlan 11 interface process that. Oh then let me send it out untagged so the client can get the answer ;)

But again switch is set to not allow untagged.

I have no PIVD set. No Native VLAN. Just straight Trunk

johnnybinator

@johnpoz There is no PIVD set. No native VLAN. That's the whole point of the post for the start.

Switch port that is connected to pfSense:

interface ethernet 3/26
description To PfSense
switchport mtu 9216
switchport ingress-filtering disable
switchport mode trunk
switchport trunk allowed vlan all
ipv6 nd ra suppress

Switch port connected to the host:

interface ethernet 3/20
description NFS Server
switchport mtu 9216
switchport ingress-filtering disable
switchport mode trunk
switchport trunk allowed vlan all
ipv6 nd ra suppress

Switch port configured for a different host, with PVID, that is working as expected:

nterface ethernet 3/24
description To TV Switch
no capabilities 10half
no capabilities 10full
no capabilities 100half
no capabilities 100full
switchport mtu 9216
switchport mode trunk
switchport trunk native vlan 11
switchport trunk allowed vlan all
ipv6 nd ra suppress

This is what is perplexing. In this configuration, the host connected to 3/20, booting from the install media, gets an IPv6 address from the subnet tied to VLAN 11. As of yet, still unexplained. I mentioned in another post, I can temporarily connect the same host to the pfSense port directly, eliminating the switch. That will determine whether it is my switch or not. I can most likely get to it this week, if anyone's really biting their nails over this.

johnpoz

@johnnybinator said in IPv6 Question:

switchport mode trunk
switchport trunk allowed vlan all

How do you think there is no pvid there? Cisco requires a pvid on a trunk port.. If you try and remove vlan 1, it sets 4095P.. In cisco land if you do not want pvid to be default vlan.. Then you set the native to a dead vlan..

There is some other tricks you can try with setting the port to general mode..

But best practice in ciscoland has always been to set a dead vlan as the pvid on the trunk..