4
  • Platform: Juniper SRX300
  • Version: JUNOS 15.1X49-D160.2
  • ISP: Midco

I currently have an issue where the IPv6 default route is not being installed from the CMTS RA. Try as I might, I cannot get the SRX to pick up and install the default route. I have a DHCPv6 assigned GUA on the link, I have DHCPv6-PD assigned /64 subnet going back and being installed on the inside interface etc, just no default route.

Interface Map

  • ge-0/0/0 - Internal
  • ge-0/0/5 - ISP

Currently show route...

2001:48f8:4029:0:d7b:f865:2051:f208/128
               *[Direct/0] 00:07:59
                > via ge-0/0/5.0
                [Local/0] 00:07:59
                  Local via ge-0/0/5.0
2001:48f8:402a:19b1::/64
               *[Direct/0] 00:07:50
                > via ge-0/0/0.6
2001:48f8:402a:19b1::1/128
               *[Local/0] 00:08:01
                  Local via ge-0/0/0.6
fe80::ee13:db00:6d8:b300/128
               *[Local/0] 13:43:00
                  Local via ge-0/0/0.6
fe80::ee13:dbff:fed8:b305/128
               *[Local/0] 00:08:12
                  Local via ge-0/0/5.0

Notice the distinct lack of a default route. show ipv6 router-advertisement...

Interface: ge-0/0/5.0
  Advertisements sent: 429, last sent 00:00:08 ago
  Solicits received: 430, last received 00:00:00 ago
  Advertisements received: 898
  Solicited router advertisement unicast: Disable
  Advertisement from fe80::242:5aff:fe1d:b019, heard 00:00:01 ago
    Managed: 1
    Other configuration: 1
    Link MTU: 1500 bytes
    Reachable time: 3600000 ms
    Default lifetime: 1800 sec
    Retransmit timer: 0 ms
    Current hop limit: 64

Currently show interfaces terse (abbreviated)...

Interface               Admin Link Proto    Local                 Remote
ge-0/0/0                up    up
ge-0/0/0.6              up    up   inet6    2001:48f8:402a:19b1::1/64
                                            fe80::ee13:db00:6d8:b300/64
ge-0/0/5                up    up
ge-0/0/5.0              up    up   inet6    2001:48f8:4029:0:d7b:f865:2051:f208
                                            fe80::ee13:dbff:fed8:b305/64

Configuration...

show configuration interfaces
ge-0/0/0 {
    flexible-vlan-tagging;
    native-vlan-id 1;
    unit 6 {
        vlan-id 6;
        family inet6;
    }
}
ge-0/0/5 {
    unit 0 {
        family inet6 {
            dad-disable;
            dhcpv6-client {
                client-type stateful;
                client-ia-type ia-pd;
                client-ia-type ia-na;
                update-router-advertisement {
                    interface ge-0/0/0.6 {
                        managed-configuration;
                        other-stateful-configuration;
                    }
                }
                client-identifier duid-type duid-ll;
                update-server;
                retransmission-attempt 6;
            }
        }
    }
}

show configuration protocols
router-advertisement {
    interface ge-0/0/5.0 {
        managed-configuration;
        other-stateful-configuration;
    }
}

show configuration security
forwarding-options {
    family {
        inet6 {
            mode flow-based;
        }
    }
}
policies {
    from-zone trust to-zone trust {
        policy trust-to-trust {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
            }
        }
    }
    from-zone trust to-zone untrust {
        policy trust-to-untrust {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
            }
        }
    }
    from-zone untrust to-zone trust {
        policy untrust-to-trust {
            match {
                source-address any;
                destination-address any;
                application junos-icmp6-all;
            }
            then {
                permit;
            }
        }
    }
}
zones {
    security-zone trust {
        host-inbound-traffic {
            system-services {
                all;
            }
            protocols {
                all;
            }
        }
        interfaces {
            ge-0/0/0.1 {
                host-inbound-traffic {
                    system-services {
                        all;
                    }
                    protocols {
                        all;
                    }
                }
            }
            ge-0/0/0.6 {
                host-inbound-traffic {
                    system-services {
                        all;
                    }
                    protocols {
                        all;
                    }
                }
            }
        }
    }
    security-zone untrust {
        interfaces {
            ge-0/0/5.0 {
                host-inbound-traffic {
                    system-services {
                        dhcpv6;
                        ping;
                        traceroute;
                    }
                    protocols {
                        router-discovery;
                    }
                }
            }
        }
    }
}

Any help/ideas would be truly appreciated.


Updated with additional output below...

show dhcpv6 client binding interface ge-0/0/5.0 detail 

Client Interface/Id: ge-0/0/5.0
     Hardware Address:             ec:13:db:d8:b3:05
     State:                        BOUND(DHCPV6_CLIENT_STATE_BOUND)
     ClientType:                   STATEFUL
     Lease Expires:                2019-04-19 14:04:10 UTC
     Lease Expires in:             2555595 seconds
     Lease Start:                  2019-03-20 14:04:10 UTC
     Bind Type:                    IA_NA IA_PD
     Preferred prefix length       0
     Sub prefix length             0
     Client DUID:                  LL0x3-ec:13:db:d8:b3:05
     Rapid Commit:                 Off
     Server Identifier:            ::
     Update Server                 Yes
     Client IP Address:            2001:48f8:4029:0:d7b:f865:2051:f208/128
     Client IP Prefix:             2001:48f8:402a:19b1::/64

DHCP options:
    Name: server-identifier, Value: LL_TIME0x1-0x5694c708-00:1a:64:99:79:e4
    Name: dns-recursive-server, Value: 2001:48f8:11::10,2001:48f8:11::11

Update RA interfaces:
     Interface: ge-0/0/0.6
            RA Prefix:      2001:48f8:402a:19b1::/64

Updated with additional outputs suggested by JTAC...

monitor traffic interface ge-0/0/5.0 matching "icmp6 or (udp port 546 or 547)" no-resolve extensive 
Address resolution is OFF.
Listening on ge-0/0/5.0, capture size 1514 bytes

01:03:01.746789  In 
        Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 16
          Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
          Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
          Device Interface Index Extension TLV #1, length 2, value: 36096
          Logical Interface Index Extension TLV #4, length 4, value: 76
        -----original packet-----
        PFE proto 6 (ipv6): (class 0xe0, hlim 255, next-header: ICMPv6 (58), length: 32) fe80::242:5aff:fe1d:b019 > ff02::1: [icmp6 sum ok] ICMP6, router advertisement, length 32
        hop limit 64, Flags [managed, other stateful], pref medium, router lifetime 1800s, reachable time 3600000ms, retrans time 0ms
          source link-address option (1), length 8 (1): 00:42:5a:1d:b0:19
            0x0000: 0042 5a1d b019 
          mtu option (5), length 8 (1):  1500
            0x0000: 0000 0000 05dc 

show ipv6 neighbors 
IPv6 Address                 Linklayer Address  State       Exp Rtr Secure Interface 
fe80::242:5aff:fe1d:b019     00:42:5a:1d:b0:19  stale       792 yes no      ge-0/0/5.0  
5

From JTAC...

The issue you are facing is described on internal PR.

Workaround

  • Configure IPv6 default route manually.

  • Add prefix info to the RA sent

Known issue will be resolved in:

  • junos:15.1X49-D180

  • junos:17.4R3

  • junos:18.1R4

  • junos:18.2R3

  • junos:18.3R2

  • junos:18.4R2

  • junos:19.1R2

  • junos:19.2R1

Tentative release for 15.1x49-D180 is end of May.

I've had to configure the default route manually as the workaround, as I do not control the ISP's CMTS. This is accomplished by retrieving the neighbor LLA via snooping on the RA via show ipv6 router-advertisements, and using it as a qualified next-hop for default via the following command...

set routing-options rib inet6.0 static route ::/0 qualified-next-hop fe80::242:5aff:fe1d:b019 interface ge-0/0/5.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.