Extra IPv6 address when moving the device between vlans.

NogBadTheBad

If I move my Mac OS device from my normal USER vlan (2) to the IOT vlan (4) I seem to be getting an extra IPv6 address, with no changes to the Mac OS device.

Any ideas where inet6 fd6a:414f:6b31:ba43:1c3d:d5e2:a210:2f64 prefixlen 64 autoconf secured is to be coming from, I'm using Managed -RA Flags on both ?

Running 24.11 & KEA.

USER vlan (2)
 
andy@mac-pro ~ % ifconfig en0
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
	ether 00:3e:e1:c1:af:07 
	inet6 fe80::c00:d37b:8222:3a41%en0 prefixlen 64 secured scopeid 0x4 
	inet6 xxxx:yyyy:60ec:2::14 prefixlen 64 dynamic 
	inet 172.16.2.20 netmask 0xffffff00 broadcast 172.16.2.255
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect (1000baseT <full-duplex,energy-efficient-ethernet>)
	status: active
andy@mac-pro ~ % 

IOT vlan (4)

andy@mac-pro ~ % ifconfig en0
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
	ether 00:3e:e1:c1:af:07 
	inet6 fe80::c00:d37b:8222:3a41%en0 prefixlen 64 secured scopeid 0x4 
	inet6 fd6a:414f:6b31:ba43:1c3d:d5e2:a210:2f64 prefixlen 64 autoconf secured 
	inet6 xxxx:yyyy:60ec:4::64 prefixlen 64 dynamic 
	inet 172.16.4.100 netmask 0xffffff00 broadcast 172.16.4.255
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect (1000baseT <full-duplex,energy-efficient-ethernet>)
	status: active
andy@mac-pro ~ %

Drat meant to put this in the IPv6 part of the forum.

patient0

Are you connected by Wifi or cable? And if connected wirelessly are any of your AP running OpenWRT?

If I remember correctly OpenWRT sets an random ULA prefix, and what you see is an ULA address. Maybe the RA on one of the AP is not disabled?

Gertjan

@NogBadTheBad said in Extra IPv6 address when moving the device between vlans.:

ether 00:3e:e1:c1:af:07

Your MAC doesn't change, so no MAC randomization, so that's not the reason.
Your IPv4 did change, normal, as its another network.
Your GUA did change, normal, as this is another network.

How a ULA is generated, I don't know, but your Mac is on another network, so : another ULA.

Btw, is normal that a device has several IPv6 addresses.

NogBadTheBad

@Gertjan I was just puzzled that I’m using a dhcpv6 reservation on vlan 2 for the device but not on vlan 4 and I’m seeing an extra ULA on vlan 4.

Next test remove the dhcpv6 reservation from vlan 2 and see what happens.

Gertjan

@NogBadTheBad said in Extra IPv6 address when moving the device between vlans.:

dhcpv6 reservation

AFAIK, "dhcpv6" hands out a GUA, not ULA's.
Shut down dhcpv6, and your devcies won't have GUAs anymore, but ULA"s will still be there.
ULA"s are "auto generated".

NogBadTheBad

@Gertjan said in Extra IPv6 address when moving the device between vlans.:

AFAIK, "dhcpv6" hands out a GUA, not ULA's.
Shut down dhcpv6, and your devcies won't have GUAs anymore, but ULA"s will still be there.
ULA"s are "auto generated".

The dhcpv6 address doesn't appear after disabling dhcpv6, odd that inet6 fd6a:414f:6b31:ba43:1c3d:d5e2:a210:2f64 prefixlen 64 autoconf secured doesn't appear on lan 2.

andy@mac-pro ~ % ifconfig en0
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
	ether 00:3e:e1:c1:af:07 
	inet6 fe80::c00:d37b:8222:3a41%en0 prefixlen 64 secured scopeid 0x4 
	inet6 fd6a:414f:6b31:ba43:1c3d:d5e2:a210:2f64 prefixlen 64 autoconf secured 
	inet 172.16.4.100 netmask 0xffffff00 broadcast 172.16.4.255
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect (1000baseT <full-duplex,energy-efficient-ethernet>)
	status: active
andy@mac-pro ~ %

patient0

@NogBadTheBad the may not disappear because the device giving them out is still active, like an AP.

You of course can check for the IPv6 neighbours using ndp -a and the routing table netstat -rn -f inet6 to see over which link the ULA prefix is comming.

JKnott

@NogBadTheBad said in Extra IPv6 address when moving the device between vlans.:

fd6a:414f:6b31:ba43:1c3d:d5e2:a210:2f64

That's a Unique Local Address and coming from your router. You should have a different address on each VLAN, as they are different subnets. You should see the 4th address block (ba43) change with each VLAN or LAN. It appears you're using prefix ID 3 on that subnet.

JKnott

@Gertjan said in Extra IPv6 address when moving the device between vlans.:

How a ULA is generated, I don't know, but your Mac is on another network, so : another ULA.

ULA works exactly the same way as global addresses, except you set your own prefix range when you enable ULA.