4

It seems the situation with finding routers in IPv4 with DHCP was okay and now IPv6 has RA's and we have to worry about rogue RA, different vendors provide protection against it, etc. What is IPv6 trying to fix/improve with RAs that makes the downsides worth it?

  • Sounds vaguely homework-ish? Either way RA's are a way for the host to find a gateway when using the auto-discovery function of IPv6. Also they replicate the 'ICMP Router Discovery' feature of IPv4 that is really no longer used, but was never taken out of the IPv6 standard. – cpt_fink Oct 22 '14 at 15:44
  • 3
    For unmanaged networks (home networks, but also i.e. guest networks or networks where you don't need to keep track of every single IP address) deploying using RA's is much easier than running DHCP. The router(s) just send advertisements and every host auto-configures itself. No DHCP leases store etc required. – Sander Steffann Oct 22 '14 at 16:22
  • Might sound somewhat homework-ish but nevertheless an interesting discussion. I think RA's are an improvement, but in any case you need a DHCP server to supply the clients with DNS server addresses, which kind of defeats the "not having to run DHCP" point. I think most networks will run DHCP similar to IPv4, and I myself only implement stateless autoconfig in guest networks. – RedShift Oct 22 '14 at 20:25
5

Fix? I don't know. But it's abundantly clear the committee members were blind to history: IPv4 had the same horrible, nasty, and insecure feature that was almost instantly abandoned -- ICMP Router Advertisements.

The purpose of the RA is to announce a router, the prefix for the segment (served by that router, there can be more than one router on a segment), and flags for "managed" (i.e. use DHCPv6 for addresses) and "other" (i.e. use DHCPv6 for other, non-address elements -- dns servers, domain name, etc.) IPv6 compliant hosts are required to accept and process all RAs they see, however many systems limit the number to mitigate one of the GREAT MANY security issues with RAs. (crashing systems with millions of unique RAs) As there is no support for signing or authentication, any node on a network can originate an RA and pretend to be a router, spoof the origin making some other node (possibly non-existent) eat traffic, or as previously mentioned, spew RAs until everything crashes.

1

I guess you never had to worry about rogue DHCP which is much easier to get on your network than rogue RAs.

Router Advertaisement are part of the Neighbor Discovery Protocol (NDP) not just a replacement for DHCP.

There are also methods to use RAs to migrate netwok (v6 to v6... from one prefix to another) without ever having to touch or even reboot the hosts.

  • 3
    Rogue DHCP may have historically been more common, but both rogue DHCP and RAs are equally simple. Many enterprise switches support dhcp snooping, but few can do RA guard, however the number is increasing as IPv6 gains traction. Rogue RAs work instantly and are totally invisible, until you actually look. Rogue DHCP has zero effect on existing hosts, until they restart. – Ricky Beam Oct 22 '14 at 23:12
0

DHCP has a few characteristics that could be regarded as problems.

  1. There is no way for a router to say "I have routes to these networks but not the internet in general".
  2. There are no provisions made for redundancy and load balancing of multiple gateways (this can be hacked arround at lower levels).
  3. DHCP servers are stateful
  4. There is no provision for running multiple adresses in paralell. IPv6 proponents saw running multiple addresses in parallel as a soloution to support multihoming without resorting to NAT or bloating the gloabl routing table with PI space.
  5. There is no provision for telling a client that due to unexpected network structure changes previous promises made in the DHCP lease can no longer be kept.
  • Doesn't the "classless static routes" option exactly fit your point #1? – grawity Sep 18 '17 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.