We're currently using port isolation to prevent communication between computers on the same vlan and use client isolation on our guest wifi. The reason for having this enabled is to prevent unwanted programs to spread itself between computers or to prevent potential attackers from attacking victims with a bad configured firewall on the guest network. This is working absolutely flawlessly with IPv4.

Now we would like to deploy IPv6 in our network. Especially SLAAC with Privacy Extension enabled heavily relies on reaching other clients on the network to do e.g. Duplicate Address Detection. When enabling port isolation this feature will not work anymore.

We're having no idea how to solve this issue with some "normal" switching hardware, so any idea would be helpful. The other way of solving this would be to simply ignore Duplicate Address Detection and hope that the propability is low enough to not have any collisions, but will port isolation break some other fundamental IPv6 features?

Some idea we had: We could create up to 4096 vlans and apply each vlan to a single port. The router would also have 4096 interfaces and each will send different prefixes using Router Advertisements to the client, but I think that this won't scale very well :). It's kind of what ISPs do with PPPoE tunnels, but in ugly.

  • I think the probability of a duplicate IPv6 address is sufficiently low to allow the deployment. In particular I’ve seen IPv6 successfully deployed on WiFi nets with peer-to-peer connectivity blocked by the controller. – Darrell Root Jan 17 '20 at 0:14
  • If the PC are not being moved to different locations, then the privacy extensions are really not needed, and you can simply use the original SLAAC, turning off the privacy extensions. In any case, true random addressing is selecting an address from 18,446,744,073,709,551,615 possible addresses, a pretty small chance of collisions. – Ron Maupin Jan 17 '20 at 0:45
  • "We could create up to 4096 vlans and apply each vlan to a single port." No, you could not. First, there are two reserved VLANs. Second, I do not know of any switches that will handle more than a couple of hundred or so VLANs. – Ron Maupin Jan 17 '20 at 0:49
  • Yeah I agree. The probably is really low. Here's some research which shows that the probability with 100,000 clients is about 2.16*10^-9 to get a colission (birthday paradoxon). So I think we can safely ignore it: researchgate.net/publication/… – ForJ9 Jan 17 '20 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.