IPv6 dhcp6c /48 prefix broken

In reply to a post by David_W:

I will shortly be sending in a packet capture and log extract from my router, showing the problem. I will also point them to this thread.

In reply to a post by mixt:

Anyone else seeing the same symptoms? Zen, can you un-break what ever you've decided to break today with regards to IPv6 /48 delegation? Nothing has changed my side.

In reply to a post by mixt:

Yes, looks to be back; session just bounced and its all working again.

Did they say what was wrong?

In reply to a post by David_W:

I've got the same problem. Zen's DHCPv6 server is not responding to any requests, so you cannot delegate the /48 prefix. As Zen don't install the route to the /48 until the prefix is delegated, there's no routing to and from the /48.

In reply to a post by hazey_flakes:

Have done at around 13:10 today . I'm not sure why it was missed on our testing, so I'll review that as well.

It was an over zealous ACL which was only meant to be blocking customers from sending RA's to our Gateways. The gateways don't respond to the RAs but it does spam the log files a lot. Will see if we can find out which CPE are doing that. Though they do seem to be making it difficult by sourcing the RAs from fe80::1 with src mac of 00:00:00:00:00:00.

The ACL has now been amended to allow the multicast sourced DHCPv6 messages through, so everything should be back to normal following a PPP session reset.

In reply to a post by David_W:

Whilst you are looking at the ACLs, can you amend the ACLs to allow ICMPv6 echo request / echo reply to the gateway link local addresses from CPE link local addresses (i.e. ICMPv6 types 128 and 129 from fe80::/10 to fe80::/10)? In my experience, such traffic is blocked and I don't think my firewall rules are to blame.
......
As has been wished for before, some way of setting rDNS for IPv6 would be very useful. In my case, delegation to a customer run authoritative DNS server would be fine, though not everyone is in a position to run a DNS server.

In reply to a post by Jax2:

I still have problems. It was suggested that it would help to start a new PPP session but not being very technical I do not know how to go about this.

In reply to a post by mixt:

What you really need is a feature on the Zen portal which allows you to initiate a disconnect of the PPP session from the Zen side. That would also work.

Looks like you will have to ask them to do this for you, if there's no automated way of doing it on the portal (I've not seen one).

Edited by Jax2 (Thu 11-Feb-16 12:47:38)

I was with Andrews & Arnold running full IPv4 and native IPv6. When I was with them, I was able to run your IPv6 Readiness Test and score a full 10/10.

I have now switched to Zen Internet running a HE (Hurricane Electric) IPv6 tunnel.

On both setups, I run dnsmasq (broadband router is Linux CentOS) with this listening on both IPv4 and IPv6 local interfaces. But, I now only score 9/10 for the IPv6 Readiness Test - the part that is failing is:

Your DNS server (possibly run by your ISP) appears to have no access to the IPv6 Internet, or is not configured to use it. This may in the future restrict your ability to reach IPv6-only sites.

I have looked at what is happening at this part of the test and it seems it is trying to resolve A and AAAA records against ds.v6ns.v6test.thinkbroadband.com:

Text
1 23 4	12:25:54.809629 IP 192.168.0.130.44976 > 192.168.0.1.53: 59202+ A? ds.v6ns.v6test.thinkbroadband.com. (51) 12:25:54.809687 IP 192.168.0.130.9411 > 192.168.0.1.53: 34418+ AAAA? ds.v6ns.v6test.thinkbroadband.com. (51)12:25:54.810126 IP 192.168.0.1.53 > 192.168.0.130.44976: 59202 ServFail 0/0/0 (51) 12:25:54.810239 IP 192.168.0.1.53 > 192.168.0.130.9411: 34418 ServFail 0/0/0 (51)

Can you confirm if this is expected behaviour and how exactly this part of the test works? If it is the HE tunnel, I fail to see how this would affect the result of the test.

1
23
45
67
89
1011
1213
1415
1617
1819
2021
2223
2425
2627
2829
3031

$ dig -t A ds.v6ns.v6test.thinkbroadband.com
 ; <<>> DiG 9.8.3-P1 <<>> -t A ds.v6ns.v6test.thinkbroadband.com
;; global options: +cmd;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 19089;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
 ;; QUESTION SECTION:
;ds.v6ns.v6test.thinkbroadband.com. IN  A 
;; Query time: 20 msec;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Thu Feb 11 19:50:47 2016;; MSG SIZE  rcvd: 51
 $ dig -t AAAA ds.v6ns.v6test.thinkbroadband.com
 ; <<>> DiG 9.8.3-P1 <<>> -t AAAA ds.v6ns.v6test.thinkbroadband.com
;; global options: +cmd;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16287;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
 ;; QUESTION SECTION:
;ds.v6ns.v6test.thinkbroadband.com. IN  AAAA 
;; Query time: 14 msec;; SERVER: 192.168.0.1#53(192.168.0.1)
;; WHEN: Thu Feb 11 19:51:01 2016;; MSG SIZE  rcvd: 51

In reply to a post by hazey_flakes:

With regards to rDNS, again please email the request to the IPv6 team, they'll then get this set up for you. We are working on DNS and portal tools to support IPv6 but I cannot provide a commitment for when these will be available.

Domain name:
    zen.co.uk

...

Name servers:
    ns0.zen.co.uk             212.23.8.1
    ns1.zen.co.uk             212.23.3.1

In reply to a post by mixt:

Final point of note - you really need to map some IPv6 addresses and glue-records against your name servers and with Nominet, because currently you're only serving IPv6 reverse DNS from IPv4-only enabled infrastructure.

Edited by deleted (Thu 03-Mar-16 12:28:21)

In reply to a post by mixt:

FYI, I have just gained knowledge from Zen technical support themselves that not all of Zen's gateways are IPv6 enabled. I rebooted my router yesterday and landed up on gateway dsl9 (normally I connect to dsl6) and, on that gateway, no link level IPv6 address is presented on the ppp interface, completely breaking IPv6 connectivity (this normally shows up as "inet6 addr: fe80::1/10 Scope:Link" upon running ifconfig).

In reply to a post by sor:

I'm also interested to know why Zen haven't enabled all of their gateways (or at least enough to cope with demand, as being moved off of dsl6 helped improve my speeds a bit, though nothing close to expected performance). Perhaps they're not confident that all CPE will handle it?

In reply to a post by rlees85:

Connected to gateway bng1

In reply to a post by mixt:

In reply to a post by rlees85:

Connected to gateway bng1

I was also forced onto this gateway this morning. Per the code adjustment I put in place a few days ago, my router has been disconnecting and reconnecting every minute to try and get back onto a gateway which is IPv6, but consistently lands back on this one. So I've lowered the interval at which it now checks for IPv6 back to once a day.

So IPv6 is now busted, and yet I thought this was supposed to be a non-beta service. They have until early May to sort this mess out otherwise I'm migrating back to A&A.

Edited by deleted (Mon 07-Mar-16 11:15:12)

In reply to a post by summat:

@jongreen84

Any chance of seeing if bng1.th-lon has the same issues with v6?

I moved to it for the first time ever from dsl6.th-lon and lost v6.