2

According to rfc4861 the source address for Router Solicitation(ICMPv6 type 133), Neighbor Solicitation(ICMPv6 type 135) and Neighbor Advertisement(ICMPv6 type 136) can be an address assigned to the interface. Am I correct, that this address can also be anything else than link-local(fe80::/10) address? The reason I'm asking is that I'm working on an ingress firewall and when I study example filters(for example rfc6192), then source address for NDP protocol is not restricted.

4
  • In the most scenarios ICMPv6 uses link-local as source. Of course when device advertises another address from interface, it can uses this one. But if we are talking about firewall rules, we don't need to use source address at all, only ICMP type. Jan 28 '20 at 10:04
  • Remember that packets with Link-Local addressing cannot be routed to a different network, so firewall rules play no part in that because those packets will not pass through a firewall.
    – Ron Maupin
    Jan 28 '20 at 14:30
  • @RonMaupin I meant the firewall which filters the traffic to router control plane, e.g punted traffic.
    – Martin
    Jan 28 '20 at 15:17
  • Be sure to also look at RFC 4890, Recommendations for Filtering ICMPv6 Messages in Firewalls. It has some good explanations, and what you should allow seems to shock many people with IPv4 experience.
    – Ron Maupin
    Jan 28 '20 at 15:22
1

The source address is not constrained to link-local and you should not rely on that, as per your own source. One good usecase for this is to expedite population of neighbor caches. If you send a ND you can inlcude a source link-layer address (usually MAC) that can be tied to the sending source IP. That can be used to pre-populate the neighbor cache on any receiving node (the entry will not be stable but that's a technical detail that does not matter). So when soliciting for example for a GUA neighbor, it actually makes sense to use an assigned GUA source from the same prefix on that interface if available.

There is also an informational RFC 4890 that can help with these things. Relevant here are sections 4.3 and 4.4, you'll see a similar conclusion, the differentiation is on ICMPv6 type and on destination (i.e. transit/local). One note though, this RFC is useful as a help, but it's informational, don't take it too literally (it is clearly written from the perspective of a specific kind of firewall and does certainly not apply in general).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.