Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Sat Aug 19, 2017 2:44 am


Author Message
admin
Post  Post subject: Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC  |  Posted: Mon Jun 23, 2014 5:23 am
Site Admin

Joined: Mon Aug 03, 2009 8:43 am
Posts: 95

Offline
 

Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC

One of the differences brought by IPv6 is the Extended Unique Identifier (EUI) (RFC2373). EUI-64 allows a host to assign iteslf a unique 64-Bit IP Version 6 interface identifier - based on it's MAC address. This algorithm is used to generate the link local IPv6 address and can also be used with a stateless mechanism.

With SLAAC (Stateless Address Auto Configuration), a host sitting in a layer2 domain assigns that specific interface a global IPv6 address based on a router-advertisement received from a router sitting in the same domain.

Along with the address, the host can also install a default route via that specific router.

While this method has very serious security implications ( as a rogue DHCP server / arp poisoning ), sometimes it is really necessary.

Configuring router-advertisment in Junos:
Code:
# show protocols router-advertisement                 
interface vlan.10 {
    max-advertisement-interval 60;
    min-advertisement-interval 10;
    other-stateful-configuration;
    prefix 2002:1470:7012:1::/64 {
        on-link;
        autonomous;
    }
}


Below is packet dump of this RA:
Code:
11:02:39.508838 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::2e21:72ff:fec6:c188 > ff02::1: [icmp6 sum ok] ICMP6, router advertisement, length 56
        hop limit 64, Flags [managed, other stateful], pref medium, router lifetime 180s, reachable time 0s, retrans time 0s
          source link-address option (1), length 8 (1): 2c:21:72:c6:c1:88
          prefix info option (3), length 32 (4): 2002:1470:7012:1::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s


About the options in router advertisement:
- Autonomous (prefix "A" flag): permits the host to use SLAAC and assign it'self an IPv6 address based on the interface's MAC address, within the /64 prefix (it is useless to use it with longer prefixes)
- " other-stateful-configuration" - use the originator of the RA as a default gateway.

To note: This procedure has serious security implications. Read the links at the end for more information.

When Router-Advertisement protocol is disabled in Junos, a new RA packet is sent with "router lifetime 0s" - meaning "Stop using me as your default router".

Interesting reads:
http://blog.ipspace.net/2012/11/ipv6-router-advertisements-deep-dive.html
http://www.fehcom.de/ipnet/ipv6/ipv6-ra.pdf
https://tools.ietf.org/html/rfc5175
It's up to each organization to decide if state(less|ful) (auto)configuration mechanism will be used to assign IPv6 inside it's own netork, mostly based on the culture, information and security features available in each case.

_________________
VPSie - SSD VPS servers in AMS-IX, LINX, DE-CIX
https://vpsie.com





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. How to configure Junos ipv6 default route

mandrei99

0

2982

Mon Feb 16, 2015 6:29 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Example of BGP update message sent from Junos for a VPLS circuit

mandrei99

0

667

Fri Jul 19, 2013 9:24 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos VPLS Label Block Operations - Example with BGP signaling

mandrei99

0

1712

Thu Jul 04, 2013 7:44 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: BGP label allocation failure: Need a nexthop address on LAN

mandrei99

1

1104

Mon Nov 10, 2014 4:28 am

mandrei99 View the latest post

There are no new unread posts for this topic. Example of BGP update message sent from Junos device when export policy is modified

mandrei99

0

575

Fri Jul 19, 2013 9:09 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: error: VRF: vrf-import needs at least one target community or a reject policy for vrf in

mandrei99

0

864

Wed Jul 03, 2013 8:39 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: GRE interface in VR with local tunnel endpoint in main routing instance

mandrei99

0

2645

Thu May 23, 2013 9:33 am

mandrei99 View the latest post

There are no new unread posts for this topic. Understanding the OSPF External NSSA LSA Metric Type 1 with JunOS examples

mandrei99

0

1464

Sun Mar 15, 2015 1:51 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Junos VPLS Virtual circuit stuck in "VC-Dn" state

mandrei99

0

1887

Tue Jul 09, 2013 9:48 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos "show bgp summary" shows different outputs for neighbors

admin

0

715

Tue Jun 14, 2016 2:56 pm

admin View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO