Leased Line IPv6 problem with Unifi UDM Pro

Hi,

I have a 1G/1G Daisy leased line with a Virgin tail, with an Adva OS6250-8M and Cisco C1111-8P managed router connected to my UDM Pro. It's been up and running fine for nearly two years using IPv4, but I need to use IPv6 for some Terragraph kit. I've had the static IPv6 configured by Daisy and can use this successfully with my laptop connected directly to the Cisco, however I can't make it work properly on the UDMP, it can ping6 out fine with SSH on the UDMP and my clients receive an IPv6 address but have no IPv6 connectivity.

I've had had extensive support from Ubiquiti and Daisy, Ubiquiti say that my ISP must support prefix delegation and Daisy are unable to provide it.

https://help.ui.com/hc/en-us/articles/115005868927-U...
I find it hard to believe that the UDMP has this limitation when the help article above says:

"Depending on the configuration of the ISP, the UDM/USG can either use DHCPv6-PD (Prefix Delegation) or Static IPv6 addresses to provide IPv6 connectivity to the clients on the LAN. In both setups, the information regarding the connection type and its values is provided by the ISP."

Has anyone managed to get this to work?

I do have an Edgerouter 12P and a Mikotik Hex S I can use but are no expert at setting those up.

Thanks for any help!

Posted by Pheasant on a thread I hijacked:

Hi - First off, your question might get better visibility and answers if you start a fresh thread.

Secondly I’m no expert when it comes to IPv6, but could you not ask Daisy for a /48 or /56 prefix and simply use static addressing in lieu of PD?

@Pheasant, can you expand on how changing it to /48 or /56 might help? I'm willing to try anything.

Thanks.

Provided to me by Daisy:

The IPv6 Range 2001:xxx:xxx:2300::/56 has been routed to port Gi0/1/0 (Vlan100, port currently in use by your IPv4 network) & Gi0/1/1 (Vlan100, port currently free) on the Cisco 1111-8P router. Please configure your network with the following details:

Gateway IP: 2001:xxx:xxx:2300::1/64

Usable IP's: 2001:xxx:xxx:2300::2 - 2001:xxx:xxx:2300:ffff:ffff:ffff:ffff

Daisy's DNS Servers:

DNS Preferred: 2a04:b2c0:202:3501::35

DNS Alternate: 2001:b98:202:3502::35

Screenshots of my configuration

https://drive.google.com/file/d/1e3GFOK0L95OTcLcphY9...

https://drive.google.com/file/d/1Oklq7eMWY0RVRF7WkGk...

That to me looks like your BQM should ping 2001:xxx:xxx:2300::1 as that is excluded from your availables for the LAN.

Your LAN devices should get both two IPv6 addresses, one of them labelled "temp". That will be what "What is my IP" checkers will see, and will change very frequently. Don't give anywhere public the non-temp one as you open up the device to direct attack.

On your LAN you will also get fe80 addresses. These are the equivalent of the 192.168.x.x of IPv4 and are used for communication between devices. Also when I had IPv6, to address the gateway. (As in out to Daisy and onward).

Edited by pluralist (Fri 23-Jul-21 13:11:01)

In your first config link you have 2301. That is a /64 address you haven't been allocated. within the /56.

If they are working similarly to AAISP that I was with, you can request further /64s FOC, but on a normal non-commercial setup I doubt if it's necessary.

Edit: to add FOC (Free Of Charge)
Edit 2: to strike out the fuzzy-brained bit on the first line.

Edited by pluralist (Fri 23-Jul-21 17:42:45)

I think those details appear correct, if the OP is configuring their LAN side, which those settings appear to be, you would specify usually a /64.

They have been allocated a /56, this means they have 256 subnets available and can pick anything in the range of 2001:xxxx:xxxx:2300 to 2001:xxxx:xxxx:23ff for use on their LAN. The configuration looks okay for the LAN side, I think the issue may be how they have configured the WAN side.

You try it on AAISP!

It wouldn't work . Note I did say "If they are working similarly to AAISP that I was with".

AAISP give you a /48 with a pre-allocated /56. But to use further /56s you need to allocate them yourself in your Control Panel so that AAISP can set up the routing on their system. They don't initially set up routing for all your /56s.

How Daisy does it is what we don't know. (Googling for their help links didn't come up with anything). What we do know is that the OP can't get either of them working. It would be better therefore not to try two things at once, the second being the addition /64.

It is probable that the OP is in fact a business of some sort, invalidating a bit of my earlier post, but they need to get the "known" working first. Particularly as Daisy themselves said:

Please configure your network with the following details:

Gateway IP: 2001:xxx:xxx:2300::1/64

Usable IP's: 2001:xxx:xxx:2300::2 - 2001:xxx:xxx:2300:ffff:ffff:ffff:ffff

That seems to be similar to AA.

The lowest address within each subnet prefix (the interface identifier set to all zeroes) is reserved as the "subnet-router" anycast address, try setting the LAN address to 2001:xxxx:xxxx:2301::1/64 instead of 2001:xxxx:xxxx:2301::/64

I think AAISP are not typical of most ISPs, not said in a negative way.

I've been with Cerberus and IDNet and at no time did I need to enable more of the allocation. Cerberus I got all of /56 and IDNet all of the /48 straight from the get go, I would think AAISP is always the exception. Daisy did say they have routed all of the /56 as well.

I think we need to see the WAN setup side, how they have that set will decide if traffic routes in or out, as internally they did say devices had their IPv6 addresses, just no traffic in or out.