Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Fri Jun 02, 2023 4:23 am


Author Message
admin
Post  Post subject: Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC  |  Posted: Mon Jun 23, 2014 5:23 am
Site Admin

Joined: Mon Aug 03, 2009 8:43 am
Posts: 104

Offline
 

Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC

One of the differences brought by IPv6 is the Extended Unique Identifier (EUI) (RFC2373). EUI-64 allows a host to assign iteslf a unique 64-Bit IP Version 6 interface identifier - based on it's MAC address. This algorithm is used to generate the link local IPv6 address and can also be used with a stateless mechanism.

With SLAAC (Stateless Address Auto Configuration), a host sitting in a layer2 domain assigns that specific interface a global IPv6 address based on a router-advertisement received from a router sitting in the same domain.

Along with the address, the host can also install a default route via that specific router.

While this method has very serious security implications ( as a rogue DHCP server / arp poisoning ), sometimes it is really necessary.

Configuring router-advertisment in Junos:
Code:
# show protocols router-advertisement                 
interface vlan.10 {
    max-advertisement-interval 60;
    min-advertisement-interval 10;
    other-stateful-configuration;
    prefix 2002:1470:7012:1::/64 {
        on-link;
        autonomous;
    }
}


Below is packet dump of this RA:
Code:
11:02:39.508838 IP6 (hlim 255, next-header ICMPv6 (58) payload length: 56) fe80::2e21:72ff:fec6:c188 > ff02::1: [icmp6 sum ok] ICMP6, router advertisement, length 56
        hop limit 64, Flags [managed, other stateful], pref medium, router lifetime 180s, reachable time 0s, retrans time 0s
          source link-address option (1), length 8 (1): 2c:21:72:c6:c1:88
          prefix info option (3), length 32 (4): 2002:1470:7012:1::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s


About the options in router advertisement:
- Autonomous (prefix "A" flag): permits the host to use SLAAC and assign it'self an IPv6 address based on the interface's MAC address, within the /64 prefix (it is useless to use it with longer prefixes)
- " other-stateful-configuration" - use the originator of the RA as a default gateway.

To note: This procedure has serious security implications. Read the links at the end for more information.

When Router-Advertisement protocol is disabled in Junos, a new RA packet is sent with "router lifetime 0s" - meaning "Stop using me as your default router".

Interesting reads:
http://blog.ipspace.net/2012/11/ipv6-router-advertisements-deep-dive.html
http://www.fehcom.de/ipnet/ipv6/ipv6-ra.pdf
https://tools.ietf.org/html/rfc5175
It's up to each organization to decide if state(less|ful) (auto)configuration mechanism will be used to assign IPv6 inside it's own netork, mostly based on the culture, information and security features available in each case.

_________________
VPSie - SSD VPS servers in AMS-IX, LINX, DE-CIX
https://vpsie.com





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Junos router advertisements - Unix IPv6 stateless autoconfiguration via SLAAC"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. JUNOS BGP: How to drain a BGP peering router gracefully without bgp session reset

admin

0

4433

Thu Sep 14, 2017 10:09 am

admin View the latest post

There are no new unread posts for this topic. How to configure Junos ipv6 default route

mandrei99

0

6854

Mon Feb 16, 2015 6:29 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Example of BGP update message sent from Junos for a VPLS circuit

mandrei99

0

2414

Fri Jul 19, 2013 9:24 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos VPLS Label Block Operations - Example with BGP signaling

mandrei99

0

3765

Thu Jul 04, 2013 7:44 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: BGP label allocation failure: Need a nexthop address on LAN

mandrei99

1

3253

Mon Nov 10, 2014 4:28 am

mandrei99 View the latest post

There are no new unread posts for this topic. Example of BGP update message sent from Junos device when export policy is modified

mandrei99

0

2151

Fri Jul 19, 2013 9:09 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: error: VRF: vrf-import needs at least one target community or a reject policy for vrf in

mandrei99

0

3385

Wed Jul 03, 2013 8:39 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: GRE interface in VR with local tunnel endpoint in main routing instance

mandrei99

0

5163

Thu May 23, 2013 9:33 am

mandrei99 View the latest post

There are no new unread posts for this topic. Understanding the OSPF External NSSA LSA Metric Type 1 with JunOS examples

mandrei99

0

4014

Sun Mar 15, 2015 1:51 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Junos VPLS Virtual circuit stuck in "VC-Dn" state

mandrei99

0

4658

Tue Jul 09, 2013 9:48 am

mandrei99 View the latest post

 

Who is online
Users browsing this forum: No registered users and 1 guest
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
cronNews News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO