In reply to a post by JESC77:

I just created a new firewall rule, ICMPv6 on WAN Local and can now traceroute to my UDMP. Could that mean that their config is correct?


Hop Time IP Address Hostname Country
1 0 ms 2a00:85c0:1::2
2 5 ms 2001:1900:5:2:2:0:8:7d75
3 13 ms 2001:1900:2::3:159 l
4 5 ms 2001:1900:5:2:2::2a5e
5 8 ms 2001:b98:1:1::ff3e:b0
6 12 ms 2001:b98:xxx:101::35:2
7 12 ms 2001:b98:xxx:2300::2

This person had a similar problem to me and was able to resolve it by using the link local address of the router in front of his UDMP, could that be my solution?
https://community.ui.com/questions/UDM-Pro-with-Stat...

I don't think the UDM IPv6 accessibility has ever been an issue.

Can you please get a packet capture of the WAN side of the UDMP and then generate traffic (from outside your network, a ping would do) to any address in the /56 that isn't the /64 configured between the UDMP and the LAN side of the Cisco managed router? If you don't see those packets arriving at your UDMP then the route isn't configured properly on the Cisco router, and Daisy need to resolve that.

I had this exact same issue less than a week ago with a Meraki device and a leased line with a static IPv6 allocation, and the problem was the route had been removed by the ISP in error, but they fixed it by adding a route to point towards my firewall.

If you can't get a packet capture then do a traceroute to any other destination within the /56 - if you don't see the UDMP in the traceroute then it would suggest the route isn't in place.

Edited by jpm (Thu 29-Jul-21 12:22:30)

Have you tried the IPv6 connection via the second physical port on the Cisco, Gi0/1/1 to the UDM ?

In reply to a post by Pheasant:

Well done. It's a step a right direction. At least now the WAN side of the UDM Pro is responding to external ping and traceroute.

Not sure that Ubiquity Community posting is going to help - Daisy have said they don't support DHCPv6 / Prefix Delegation from their network/gear so its down to ensuring that static routing for your subnets have been correctly setup on the Cisco WAN interface to your box - which from what I have read they claim they have been.

Have you tested now to see if you can get a route out from the LAN, laptop etc connected behind the UDM Pro can you ping6 out? I can only up to the UDMP, I can ping across the LAN from laptop to laptop, it's just that no IPv6 can get from LAN to WAN.

In reply to a post by jpm:

In reply to a post by JESC77:

I just created a new firewall rule, ICMPv6 on WAN Local and can now traceroute to my UDMP. Could that mean that their config is correct?


Hop Time IP Address Hostname Country
1 0 ms 2a00:85c0:1::2
2 5 ms 2001:1900:5:2:2:0:8:7d75
3 13 ms 2001:1900:2::3:159 l
4 5 ms 2001:1900:5:2:2::2a5e
5 8 ms 2001:b98:1:1::ff3e:b0
6 12 ms 2001:b98:xxx:101::35:2
7 12 ms 2001:b98:xxx:2300::2

This person had a similar problem to me and was able to resolve it by using the link local address of the router in front of his UDMP, could that be my solution?
https://community.ui.com/questions/UDM-Pro-with-Stat...

I don't think the UDM IPv6 accessibility has ever been an issue.

Can you please get a packet capture of the WAN side of the UDMP and then generate traffic (from outside your network, a ping would do) to any address in the /56 that isn't the /64 configured between the UDMP and the LAN side of the Cisco managed router? If you don't see those packets arriving at your UDMP then the route isn't configured properly on the Cisco router, and Daisy need to resolve that.

I had this exact same issue less than a week ago with a Meraki device and a leased line with a static IPv6 allocation, and the problem was the route had been removed by the ISP in error, but they fixed it by adding a route to point towards my firewall.

If you can't get a packet capture then do a traceroute to any other destination within the /56 - if you don't see the UDMP in the traceroute then it would suggest the route isn't in place.

Here's a Wireshark capture of the UDMP ssh interface when preforming a traceroute from https://network-tools.webwiz.net/traceroute.htm to UDMP 2001:b98:xxx:2300::2
121423 206.025941 2a00:85c0:1::240:230 2001:b98:xxx:2300::2 ICMPv6 78 Echo (ping) request id=0x0687, seq=60101, hop limit=1 (reply in 121424)
121424 206.026017 2001:b98:xxx:2300::2 2a00:85c0:1::240:230 ICMPv6 78 Echo (ping) reply id=0x0687, seq=60101, hop limit=64 (request in 121423)
123528 211.236402 fe80::f692:bfff:fe78:b3d 2001:b98:xxx:2300::1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2300::1 from f4:92:bf:78:0b:3d
123529 211.240404 2001:b98:xxx:2300::1 fe80::f692:bfff:fe78:b3d ICMPv6 78 Neighbor Advertisement 2001:b98:xxx:2300::1 (rtr, sol)
125544 216.304566 fe80::c6f7:d5ff:fe20:acf4 fe80::f692:bfff:fe78:b3d ICMPv6 86 Neighbor Solicitation for fe80::f692:bfff:fe78:b3d from c4:f7:d5:20:ac:f4
125545 216.304611 fe80::f692:bfff:fe78:b3d fe80::c6f7:d5ff:fe20:acf4 ICMPv6 78 Neighbor Advertisement fe80::f692:bfff:fe78:b3d (rtr, sol)
125835 217.079963 fe80::c6f7:d5ff:fe20:acf4 2001:b98:xxx:2300::2 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2300::2 from c4:f7:d5:20:ac:f4
125836 217.080013 2001:b98:xxx:2300::2 fe80::c6f7:d5ff:fe20:acf4 ICMPv6 78 Neighbor Advertisement 2001:b98:xxx:2300::2 (rtr, sol)
127607 221.476386 fe80::f692:bfff:fe78:b3d fe80::c6f7:d5ff:fe20:acf4 ICMPv6 86 Neighbor Solicitation for fe80::c6f7:d5ff:fe20:acf4 from f4:92:bf:78:0b:3d
127608 221.480322 fe80::c6f7:d5ff:fe20:acf4 fe80::f692:bfff:fe78:b3d ICMPv6 78 Neighbor Advertisement fe80::c6f7:d5ff:fe20:acf4 (rtr, sol)

I hope you can make some sense of it!
Thanks everyone for your continued support, I really do appreciate everthing.

I need you to ping an address in the /56 that isn't also in the /64 configured on your UDMP - we know that traffic is getting to your UDMP. My suspicion is that when you ping to an address beyond the UDMP you won't see those packets arriving, which diagnoses a routing issue with the Daisy-managed Cisco router.

Post deleted by JESC77

In reply to a post by JESC77:

In reply to a post by jpm:

I need you to ping an address in the /56 that isn't also in the /64 configured on your UDMP - we know that traffic is getting to your UDMP. My suspicion is that when you ping to an address beyond the UDMP you won't see those packets arriving, which diagnoses a routing issue with the Daisy-managed Cisco router.

Sorry, can give me an example?

I mean an example address, please.

It's tricky because you've obfuscated your range.

If we say your allocation is 2001:b98:1234:2300::/56 and 2001:b98:1234:2300::2/64 is your UDMP, then 2001:b98:1234:2301::1 is the next /64 along.

If you have an external party ping that address and don't see packets on the WAN of your UDMP then you need Daisy to fix their routing before going further.

So I pinged 2001:b98:xxx:2301::1 from a network tools website and captured the following:

4094 14.428504 fe80::c6f7:d5ff:fe20:acf4 ff02::1:ff00:1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2301::1 from c4:f7:d5:20:ac:f4
4487 15.519004 fe80::c6f7:d5ff:fe20:acf4 ff02::1:ff00:1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2301::1 from c4:f7:d5:20:ac:f4
5016 16.608279 fe80::c6f7:d5ff:fe20:acf4 ff02::1:ff00:1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2301::1 from c4:f7:d5:20:ac:f4
5573 18.485024 fe80::c6f7:d5ff:fe20:acf4 ff02::1:ff00:1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2301::1 from c4:f7:d5:20:ac:f4
5828 19.576344 fe80::c6f7:d5ff:fe20:acf4 ff02::1:ff00:1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2301::1 from c4:f7:d5:20:ac:f4
6052 20.601533 fe80::c6f7:d5ff:fe20:acf4 ff02::1:ff00:1 ICMPv6 86 Neighbor Solicitation for 2001:b98:xxx:2301::1 from c4:f7:d5:20:ac:f4

That’s the Cisco router on MAC c4:f7:d5:20:ac:f4 asking which host has that 2301::1 address, and broadcasting it out the connected interface. This is sort of the IPv6 equivalent to ARP.

What should be happening is that it knows that address is behind your UDMP on 2300::2, and you should be receiving ICMP packets on the UDMP WAN interface.

Daisy have configured their managed router incorrectly and will need to add the route. There might be some awful IPv6 equivalent of proxy ARP or you could NAT it all but honestly those are terrible options and the actual fix is one line of config.