Static LLA gateway and RAs on tracked interfaces

dono

System: Netgate 6100
Version: 26.03.1-RELEASE

I have a pfSense firewall connected to the ISP. It receives a non-static /48 prefix. Each of the internal VLANs track the WAN prefix to delegate subnets. The interface on each VLAN auto-generates an EUI-64 LLA and advertises it as the gateway to downstream devices via RAs. I want to set the LLA on each VLAN to static fe80::<vlan>:1 and have RA send that as the default gateway instead.

I have tried the following, but none are successful.

Added as a virtual IP (IP alias). RA does not advertise it.
Added via a shellcmd.
ifconfig igc0.10 inet6 fe80::10:1/64 alias
RA does not advertise it.

A bit of searching suggests RAs can be configured to advertise a CARP VIP.
However, a CARP on each interface adds a lot of unnecessary complications that I do not want.

I suppose a shellcmd to inject AdvRASrcAddress into the radvd configuration may be possible.
But this seems too fragile and prone to later break.

For reference, below is the radvd.conf for one of the VLANs.

cat /var/etc/radvd.conf
# Automatically Generated, do not edit
# Generated for DHCPv6 Server opt1
interface igc0.10 {
        AdvSendAdvert on;
        MinRtrAdvInterval 200;
        MaxRtrAdvInterval 600;
        AdvDefaultLifetime 1800;
        AdvLinkMTU 1500;
        AdvDefaultPreference medium;
        AdvManagedFlag on;
        AdvOtherConfigFlag on;
        prefix <GUA radacted>:10::/64 {
                DeprecatePrefix on;
                AdvOnLink on;
                AdvAutonomous on;
                AdvValidLifetime 86400;
                AdvPreferredLifetime 14400;
        };
        prefix fd00:0:0:10::/64 {
                DeprecatePrefix on;
                AdvOnLink on;
                AdvAutonomous on;
        };
        route ::/0 {
                AdvRoutePreference medium;
                RemoveRoute on;
        };
        RDNSS fd00:0:0:40::21 fd00:0:0:40::22 {
                AdvRDNSSLifetime 1800;
        };
        DNSSL <redacted>  {
                AdvDNSSLLifetime 1800;
        };
};
...

Best regards.

Are there any proper solutions?
If not can this be enhanced?

MalagaFirewall8

I don’t think an IP alias is enough here. radvd normally advertises the router from the address/source pfSense chooses for that interface, and the generated config is rebuilt from the pfSense settings. CARP works because pfSense has explicit support for advertising that VIP as the router address; a shellcmd plus hand-edited AdvRASrcAddress would be a local hack and could break on service restart or upgrade. If you need this without CARP, it sounds like a feature request rather than something I’d rely on in production.

JKnott

@dono said in Static LLA gateway and RAs on tracked interfaces:

I have a pfSense firewall connected to the ISP. It receives a non-static /48 prefix. Each of the internal VLANs track the WAN prefix to delegate subnets. The interface on each VLAN auto-generates an EUI-64 LLA and advertises it as the gateway to downstream devices via RAs. I want to set the LLA on each VLAN to static fe80::<vlan>:1 and have RA send that as the default gateway instead.

I'm not sure of the problem, but first off, are you sure your prefix changes? Even though I have DHCP6-PD for my WAN, my prefix hasn't changed in over 7 years. Second,b Unique Local Addresses (ULA) may help

dono

@MalagaFirewall8 Thanks for the comment. I posted a feature request here.
Best regards.

dono

@JKnott For a few years it seemed static, but in the last year the ISP has bumped it a few times causing some untimely headaches to update. As a long-term solution I switched to track the WAN prefix.

I use ULAs for my internal servers. I am specifically looking for static LLAs on the pfSense interfaces, rather than the SLAAC-derived LLAs. This is a fairly common practice on routers to help simply network administration, such as route traces.

-- Best regards.

JKnott

@dono

Perhaps I'm missing something, but those addresses don't change, as they are normally based on the MAC address,

dono

@JKnott

Perhaps I'm missing something, but those addresses don't change, as they are normally based on the MAC address,

Yes, a LLA is static. It is a management issue. When looking at route tables on dozens on interfaces something like fe80::92ec:77ff:fe1c:9d5e is not immediately very meaningful compared to say fe80::10:1 which could encode the VLAN (10).

-- Best regards

JKnott

@dono

But setting a LLA is done on the host and has nothing to do with pfsense. All you are doing is replacing the default MAC with one you assign.

tinfoilmatt

There's nothing in RFC4291 that requires IPv6 link-local addressing to be derived from an interface's MAC address. In fact, Appendix A is dedicated to a discussion of it.

I think OP poses a legitimate use case and a novel request.

dono

@JKnott said in Static LLA gateway and RAs on tracked interfaces:

But setting a LLA is done on the host and has nothing to do with pfsense. All you are doing is replacing the default MAC with one you assign.

All devices on a link have a LLA. I am referring to the pfSense interface LLA only. RA will send it to hosts as their default route to ::/0. Check your hosts route table. Also check the pfSense route table. This LLA is completely random and makes troubleshooting difficult. That is why in networking it is common practice to set static (meaningful) LLA on router interfaces. (I don't care about the LLA on downstream hosts.)

-- Best regards

JKnott

@dono

All devices have a link local address and normally it's based on the MAC address. However, it can be assigned a locally assigned address. Regardless of which is used, it should be included with the RA. Is this not happening? What does Wireshark show?

JKnott

@tinfoilmatt said in Static LLA gateway and RAs on tracked interfaces:

There's nothing in RFC4291 that requires IPv6 link-local addressing to be derived from an interface's MAC address

The MAC address is commonly used, but it is possible to use a locally assigned address.

dono

@JKnott said in Static LLA gateway and RAs on tracked interfaces:

@dono

All devices have a link local address and normally it's based on the MAC address.

I am only interested in the LLA of the pfSense interfaces.
This becomes the ::/0 gateway for all downstream devices in their route table.

However, it can be assigned a locally assigned address. Regardless of which is used, it should be included with the RA. Is this not happening? What does Wireshark show?

It is being sent and set. To a random fe80::<...>.
And this is the problem: it is meaningless to me when troubleshooting routes for a dozen subnets.
Hence, I want to set to a static value, something that at least encodes the VLAN.
Something like fe80::<vlan>:1 would be great.
This is quite common on Cisco routers and probably others.
In pfSense when an interface is set to Track Interface there is no option in the UI to configure a static LLA.
Hence the feature request.

-- Best regards

JKnott

@dono said in Static LLA gateway and RAs on tracked interfaces:

Hence the feature request.

Would that not be part of the FreeBSD ifconfig command?

Here's from the Linux ifconfig man page:

hw class address
Set the hardware address of this interface, if the device driver supports this operation. The keyword must be followed by the name of the hardware class and the printable ASCII equivalent of the hardware address. Hardware classes currently supported include ether (Ethernet), ax25 (AMPR AX.25), ARCnet and netrom (AMPR NET/ROM).