IPv6 Comcast not working - overlapping v6 prefix delegation subnets?

hardtarget

Thanks razzfazz, I will keep ya'll posted over the next few days and let you know what happens.

Okay, so I wanted to check and see if the lease times were decrementing for each of the prefix advertisements (/60 vs. /64) comparing the 10/4 capture to one from 10/6 (today).

ipv6-comcast-20131004.cap (packets 38-40)
/60 Prefix Advertisement (packet 39)
Preference: 0
Preferred lease time (pltime): 345600
Valid lease time (vltime): 345600
/64 Prefix Advertisement (packet 40)
Preference: 255
preferred lease time (pltime): 345385
valid lease time (vltime): 345385
ipv6-comcast-20131006.cap (packets 98-100)
/60 Prefix Advertisement (packet 99)
Preference: 0
Preferred lease time (pltime): 345600
Valid lease time (vltime): 345600
/64 Prefix Advertisement (packet 100)
Preference: 255
preferred lease time (pltime): 174315
valid lease time (vltime): 174315

So, it does look like the /64 lease will eventually expire in about 48 hours. Hopefully that will trigger the /60 offer to take effect.

hardtarget

Okay, so it looks like my leases have expired, I am getting a new address on the WAN interface (/128), but still nothing on the backend. I do see these error messages in the System Logs though:


Oct 8 15:31:15 	dhcp6c[72315]: client6_recvadvert: XID mismatch
Oct 8 15:31:15 	dhcp6c[72315]: client6_recvadvert: XID mismatch
Oct 8 15:29:14 	dhcp6c[72315]: client6_recvadvert: XID mismatch
Oct 8 15:29:14 	dhcp6c[72315]: client6_recvadvert: XID mismatch

In this capture from today, I can see the pltime/vltime have reset in packets 70-72–the /60 offer is valid for 345600 with preference 00 and the /64 is valid for 329817 with preference 255. To me, it seems like this is still broken, though I can't tell if it's Comcast handing out bad leases or pfSense not picking the right one--perhaps it's got something to do with the XID mismatch above as well?

kolinger

I've been struggling with the same problem as ahnhell for the last few days and finally got it working. I'm on TWC also and was able to get it to work by selecting the send prefix hint option and setting the prefix size to 64. I've verified that when I select 60 as the prefix size, I get a/56 which results in /60's for my LAN and dmz interfaces. I checked and pfsense is setting the prefix as "::/64 infinity" in dhcp6c_wan.cfg.

Am I misunderstanding how this is supposed to be configured or is TWC's implementation wrong?

razzfazz

It's just a hint, so at the end of the day, they can do whatever they want with it (including ignoring it completely); that said, that behavior does seem odd. What size prefix do they give you when you uncheck "send hint"?

kolinger

So, I spoke too soon - that's what I get for trying to test from my iPhone. But it does look like selecting a prefix of /56 will work. I will do more testing to verify.

If I don't send a hint I get a /64.

Edit: I've done further testing and verified that when I request a /56 that is what I receive. So this config seems to work (at least with TWC.)

I guess the problem is when pfSense is configured to request a /60 the sla-len in the pd options is set to 4. But when a /56 is received instead of the expected /60 each interface is configured with a /60 and stateless autoconfig won't work with this. Hope this helps someone else.

hardtarget

@kolinger:

Edit: I've done further testing and verified that when I request a /56 that is what I receive. So this config seems to work (at least with TWC.)

I've tried sending the /56 as the hint, and it's still not working. Haven't had a chance to look at a packet capture yet, but I may end up having to call Comcast, which isn't really my first choice, but I don't know what else to try.

mikeisfly

Sorry guys just saw this post. I had posted about this weeks ago in another thread. This is only for Comcast as far as I know, but if you live in the north east right now the CMTS's are not setup to deal with a prefix any larger/smaller than /64. See http://forum.pfsense.org/index.php/topic,65724.15.html

Below is a link if you private message the OP of the forum he can tell you if this feature is supported yet in your area. He will need the CMAC of your cable modem. DON'T POST YOUR CMAC IN THE PUBLIC.

http://forums.comcast.com/t5/Home-Networking-Router-WiFi/IPv6-prefix-size-and-home-routing/td-p/1495933

razzfazz

@Kyle:

I've tried sending the /56 as the hint, and it's still not working. Haven't had a chance to look at a packet capture yet, but I may end up having to call Comcast, which isn't really my first choice, but I don't know what else to try.

Did you try changing the MAC address on the WAN interface?

razzfazz

@Kyle:

I've tried sending the /56 as the hint, and it's still not working.

Also, this will definitely not work on Comcast; as far as I know, the shortest prefix they'll hand out is a /60.

AhnHEL

Finally found success, thanks to Kolinger's statements. I've been requesting a /60 trying to get this to work to no end.

Requested a /56 on WAN with DHCP6, and then setup the other interfaces for Track Interface. When selecting Track Interface, I then hit Save, and once the page refreshes, I then enter the Prefix ID, hit Save again and then Apply Changes. Then did the same for my other interfaces, then rebooted.

Once rebooted I got a proper /128 for WAN and a /64 for each of my other interfaces using the proper Prefix ID on each interface. In the screen below you can see I used 1d for LAN, 2e for WLAN, and 3f for DMZ as Prefix ID's. Any computer connected to these interfaces gets a proper IPv6 address within the correct /64 prefix ID that was setup.

Ran a test at http://test-ipv6.com and got a 10/10 using a PC behind each interface so all is working now. ;D

![Screen Shot 2013-10-09 at 7.45.40 PM.jpg_thumb](/public/imported_attachments/1/Screen Shot 2013-10-09 at 7.45.40 PM.jpg_thumb)
![Screen Shot 2013-10-09 at 7.45.40 PM.jpg](/public/imported_attachments/1/Screen Shot 2013-10-09 at 7.45.40 PM.jpg)

hardtarget

@mikeisfly:

Below is a link if you private message the OP of the forum he can tell you if this feature is supported yet in your area. He will need the CMAC of your cable modem. DON'T POST YOUR CMAC IN THE PUBLIC.

http://forums.comcast.com/t5/Home-Networking-Router-WiFi/IPv6-prefix-size-and-home-routing/td-p/1495933

I went ahead and posted a question in the Comcast forum.

@razzfazz:

Did you try changing the MAC address on the WAN interface?

No, I'd rather not do that unless I absolutely have to–it should just work.

AhnHEL

Back to IPv4 unfortunately. Every 48 hours I was losing my WAN connection, I assume during the DHCP renew and the cable modem would show loss of sync in its log files. Back to IPv4 and my connection is back to rock solid.

priller

@AhnHEL:

Back to IPv4 unfortunately. Every 48 hours I was losing my WAN connection, …..

Everything or did you just loose the IPv6 addressing?

If you are loosing the IPv6 addressing, uncheck "Block bogon networks" under the WAN interface configuration. It's a known IPv6 DHCP-PD killer.

AhnHEL

I'm losing everything, IPv4 and IPv6 addresses which requires a reboot to get back online.

entropywrench

Been playing with this all day until I found this thread.

Comcast Business and pfsense 2.2.5

I found a previous guide that suggested a /64 prefix int he Wan config for comcast. I got an address for the WAN /64 and a similar prefixed address for the LAN but at a /60

All my workstations only registered the link local address. Couldn't get them to route correctly save for the various link-local addresses

Once I set my prefix to /60 and rebooted everything seems to be working fine. I am getting expected "real" IPv6 addresses to all the workstations that request the.

Just a reboot, didn't have to wait a week or reset the mac addresses on my WAN

Hope that helps someone.

neiltiffin

I can verify that in the Kansas City area that /56 prefix would not work. I changed it to /60 and Comcast immediately served up IPv6 networks for LAN and DMZ without a reboot.

chamont

neiltiffin, Do you have Comcast business or residential? I can't seem to find a straight answer (yet) on < /64 for residential customers (which I am).
Monty

MikeV7896

@chamont:

neiltiffin, Do you have Comcast business or residential? I can't seem to find a straight answer (yet) on < /64 for residential customers (which I am).
Monty

Residential customers can request a prefix as small as /60… business customers can go down to /56. I have Comcast residential service and request a /60 with no problem.

A note though... if you have already requested a /64, you'll need to let that lease expire (or find someone at Comcast that can delete it for you) before you'll be able to request a /60. So turn off IPv6 for 7+ days, then change the prefix request to /60 and turn it back on.

entropywrench

I have some bad news on this.

Same problems, didn't get a /60 or /56, pfsense would drop the wan connection every few minutes, everything went unstable, reboots sometimes fixed.

At a different office in town I manage, the comcast business router there is a Netgear, and it got a /60 and works just fine and was easy to setup with pfSense 2.2.5. Everyone is happy. 10/10 on the ipv6 tests. yay.

Eventually I broke down and called Comcast to see if they could release my Router's mac address and hopefully re-issue a range, they didn't and said they would not, and anything I read on the internet about Comcast techs doing so was wrong and those people were very naughty.

Helpfully, they suggested I google the problem and that the SMCDG3 router I have was probably setup wrong. Then I was wished a nice day.

So I goggled and found this:

http://forums.businesshelp.comcast.com/t5/Equipment-Modems-Gateways/SMCD3G-CCR-and-IPv6/td-p/11117

TL:DR you have the SMCDG3 Comcast Business router, you are not going to get a /60, you will only ever get a /64.

The ipv6 configuration pages of the SMCDG3 (not working /60) and the Netgear (Working with a /60) look very different.

For the other office I am at (SMCDG3), I gave up and installed a Hurricane Electric Tunnel.

Anyway, if you have a SMCDG3 and can get a /60 let me know how you did it.

If you have a different device let us know and disregard.

Good luck.

MikeV7896

@entropywrench:

TL:DR you have the SMCDG3 Comcast Business router, you are not going to get a /60, you will only ever get a /64.

The ipv6 configuration pages of the SMCDG3 (not working /60) and the Netgear (Working with a /60) look very different.

For the other office I am at (SMCDG3), I gave up and installed a Hurricane Electric Tunnel.

Anyway, if you have a SMCDG3 and can get a /60 let me know how you did it.

If you're using a Comcast-supplied gateway device (it's both a modem and router) because you have a static IPv4 address, then there's not much you'll be able to do, unless there's an advanced setting somewhere that allows DHCPv6 on the SMC to allocate a smaller prefix size.

But if you don't have a static IPv4 address, then you should be able to put the gateway (this should be possible with any of Comcast's gateway devices) into Bridge mode, so that it functions as a modem only, not a router. Then you can connect your pfSense box to one of the ports, and should be able to get up to a /56 with business-class service, as the DHCP response would be coming from Comcast's servers, not the gateway.