9

What are the necessary steps to configure IOS 12.4(25f) to support IPv6? Comcast is the ISP, and I'll be using a Server 2012 box for internal DHCPv6.

I'll need to grab a DHCPv6 address from Comcast for the external interface.

So far, on my external interface, I have: 

ipv6 address autoconfig default
ipv6 enable
ipv6 traffic-filter al in
ipv6 verify unicast reverse-path
ipv6 dhcp client pd comcast-ipv6

For the 'al' access-list, I have:
permit udp any any eq 546

Improve this question
0

2 Answers 2

Reset to default
8

Well firstly you need to globally enable on your router 

ipv6 unicast-routing
ipv6 cef

I believe you should also have the following on your WAN interface:

ipv6 address dhcp
ipv6 enable
ipv6 nd autoconfig default-route
ipv6 dhcp client pd comcast-ipv6-prefix

When you're starting out, stay clear of any access-lists or traffic-filters (ipv6 CBAC) until you get your connection working. Otherwise you'll just end up shooting yourself in the foot. Unless, of course, you've done this a million times and you know exactly what works every time.

Improve this answer
3
  • ipv6 address dhcp and ipv6 nd autoconfig default-route are not available commands on this version of IOS. As for the ACL, isn't that a requirement (at least, on IPv4 it appears to be) in order to allow DHCPv6 traffic in on the WAN interface?
    – user1569
    Jun 6, 2013 at 5:39
  • understood....the ACL to allow dhcp/bootp is a requirement. However, what I'm saying is don't even put the ACL in when you're trying to configure the equipment. Once you have it running stable without the ACL, then start putting rules in and finding out what blocks DHCP. Otherwise you're going to waste more time figuring out if its an ACL problem or a config problem. I'll see if I can pull out some 12.4(25f) code on a router in a lab. I guess my commands are for 15.x code ;)
    – knotseh
    Jun 6, 2013 at 13:42
  • My 1841 is significantly slower on 15.x code, I actually downgraded back to 12.4. I should have probably mentioned that I already have IPv4 set up on this pulling a DHCP address from Comcast. I suppose I can probably go without the ACL on the IPv6 side of the fence and it wouldn't make a difference, though. How would I pass the IPv6 block assigned to me back to my Server 2012 DHCP to serve DHCPv6? I don't want to serve it from my router as Windows will not pick up DNSv6 addresses from autoconfig.
    – user1569
    Jun 7, 2013 at 2:52
4

To complete this, here is what I have for the 1841 running 12.4(24)T8, which has a bug for HTTP inspection over IPv6, so a work-around ACL is provided.

ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool ComcastPool
 prefix-delegation pool comcast-ipv6
 dns-server <IPv6-IP>
 domain-name internal.domain
ipv6 inspect name traffic ftp
ipv6 inspect name traffic udp
ipv6 inspect name traffic icmp

interface FastEthernet0/0
 ipv6 address dhcp
 ipv6 address autoconfig default
 ipv6 enable
 ipv6 traffic-filter wan-in in
 ipv6 traffic-filter wan-out out
 ipv6 verify unicast reverse-path
 ipv6 dhcp client pd comcast-ipv6
 ipv6 inspect traffic out

interface FastEthernet0/1
 ipv6 address comcast-ipv6 ::1/64
 ipv6 address autoconfig
 ipv6 enable
 ipv6 nd other-config-flag
 ipv6 dhcp server ComcastPool

ipv6 access-list wan-in
 permit icmp any any
 permit udp any any eq 546
 permit tcp any any established
 sequence 100 deny ipv6 any any

ipv6 access-list wan-out
 permit icmp any any
 permit tcp any any
 permit udp any any
 sequence 100 deny ipv6 any any
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.