Cisco 881 & IPv6 via PPPoE

Cisco 881 & IPv6 via PPPoE

In seara asta a venit un prieten cu un Cisco 881 la mine si m-a implorat (ma rog, m-a convins cu o bere) sa-l fac sa mearga cu IPv6. Avea deja pe el IOS c880data-universalk9-mz.124-22.YB5.bin insa nu se descurca la partea de config. Practic, ceea ce nu intelegea el era ideea de DHCPv6 cu PD (prefix delegation). Intrebarea lui era simpla: “Stiu ca un router SOHO (linksys, d-link, etc.) primeste un pachet care contine PD-ul (::/64) via DHCPv6 pe interfata PPP (WAN) si-l seteaza pe interfata lui catre LAN pentru ca are o singura interfata. De unde stie Cisco 881, care are mai multe interfete catre LAN, pe care dintre ele sa seteze PD-ul (::/64) ?”

Fara sa intru in detalii legate de numarul de interfete catre LAN de pe un router SOHO (Small Office, Home Office) i-am raspuns ca principiul pentru Cisco IOS este urmatorul. Primesc pe interfata WAN PD-ul (::/64), “il salvez” intr-o variabila (am denumit-o mai jos DH-PREFIX dar ii puteti spune oricum) si apoi imi aleg interfata catre LAN pe care setez ca “ip address” aceasta variabila. (Ma limitez la un ::/64 pentru ca am vazut ca RCS & RDS aloca un ::/64 pentru LAN dar CISCO stie sa “sparga” si un prefix mai putin specific decat ::/64 pe mai multe interfete LAN). Ca lucrurile sa fie mai clare, va ofer mai jos configul complet care a functionat pe un Cisco 881 chiar in aceasta seara, spre bucuria amicului meu:

ipv6 unicast-routing
ipv6 cef
!
vpdn enable
!
vpdn-group pppoe
# interfata WAN
interface FastEthernet4
no ip address
ipv6 nd ra suppress
duplex auto
speed auto
pppoe-client dial-pool-number 1 service-name "ipv6test"
no cdp enable
!
interface Dialer1
mtu 1492
ip address negotiated
encapsulation ppp
dialer pool 1
ipv6 address dhcp
ipv6 dhcp client pd DH-PREFIX # aceasta e variabila de care aminteam mai sus
ppp pap sent-username <USER> password 7 <PASS> #contul d-voastra de PPPoE
no cdp enable
# interfata LAN
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip tcp adjust-mss 1452
ipv6 address DH-PREFIX 0:0:0:1::/64 eui-64 # remarcati ca variabila a aparut din nou setata acum pe LAN

Sper sa va fie de ajutor si voua acest config iar daca aveti intrebari va raspund cu placere.

48 Comments

  1. eu am avut probleme cu traficul spre unele site-uri cu mss default
    asa ca am setat mss 1405 pe Dialer1 si nu am mai avut probleme

    “ip tcp adjust-mss 1405”

  2. Author

    eu am scazut 40 de bytes (header IPv6) din 1492 si din motivul asta am mers pe 1452. nu am apucat sa testez dar e interesant ce spui. poti sa incerci cu 1412 in loc de 1405 sa vedem daca nu cumva aveai un “next-header” in IPv6 ? poti sa-mi dai si cateva exemple de site-uri care iti faceau probleme te rog.

  3. Salut
    Am un 871 si din ce ai scris tu, nu-mi accepta router-ul urmatoarele comenzi:
    pppoe-client dial-pool-number 1 service-name “ipv6test”

    CISCO871(config-if)#pppoe-client dial-pool-number 1 service-name “ipv6test”
    ^
    % Invalid input detected at ‘^’ marker.

    si din setarea interfetei dialer1
    ipv6 address dhcp

    CISCO871(config-if)#ipv6 address dhcp
    % Incomplete command.

    CISCO871(config-if)#ipv6 address dhcp ?
    X:X:X:X::X/ IPv6 prefix

    Multumesc pentru orice ajutor

  4. Author

    ce versiune de IOS ai ? ti-ar trebui minim 12.4T .

  5. Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(15)T11,
    RELEASE SOFTWARE (fc2)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2009 by Cisco Systems, Inc.
    Compiled Thu 29-Oct-09 12:35 by prod_rel_team

    ROM: System Bootstrap, Version 12.3(8r)YI4, RELEASE SOFTWARE

    CISCO871 uptime is 53 minutes
    System returned to ROM by reload
    System image file is “flash:c870-advipservicesk9-mz.124-15.T11.bin”
    Last reload reason: Reload Command

  6. nu mai am acces la ruterul cu pricina πŸ™ stiu ca am incercat http://www.yahoo.com si messenger si nu imi deschidea, google.com mergea de exemplu, dupa un search pe goagal am gasit mai multe optiuni de a 1452 pana la 1405, am ales 1405, oricum optinea afecteaza doar traficul de ipv4 si da conform calculelor mss 1412 ar fi numa’ bun, nu m-am documentat f bine legat de marimea headerul tcp la pppoe πŸ™‚

  8. Multumesc Liviu, aveai dreptate. Era de la IOS
    Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(24)T6
    RELEASE SOFTWARE (fc2)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2011 by Cisco Systems, Inc.
    Compiled Tue 23-Aug-11 06:56 by prod_rel_team

    ROM: System Bootstrap, Version 12.3(8r)YI4, RELEASE SOFTWARE

    CISCO871 uptime is 1 hour, 17 minutes
    System returned to ROM by reload
    System image file is “flash:c870-advipservicesk9-mz.124-24.T6.bin”
    Last reload reason: Reload Command

    Din pacate tot nu-i dau de cap.

    Ai putea sa ne dai un show running-config de pe un router care merge IPv4/IPv6 pe RDS ?

    Multumesc anticipat.

  9. Author

    @Andrei: ce anume nu merge la tine ? pune tu running-config aici si iti spun eu ce anume ar trebui sa modifici, daca este cazul.

  10. Salut Liviu,

    Problema e ca nu-si ia IP deloc pe IPv6

    Uite config-ul, cu multumirile anticipate:

    Building configuration…

    Current configuration : 4048 bytes
    !
    version 12.4
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    !
    hostname CISCO871
    !
    boot-start-marker
    boot-end-marker
    !
    logging message-counter syslog
    no logging buffered
    enable secret 5 $1$.H2u$jZJxvOFUDUvwkSFt.UIcE.
    enable password xxxx
    !
    no aaa new-model
    clock timezone PCTime 2
    clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 4:00
    !
    crypto pki trustpoint TP-self-signed-1027977212
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1027977212
    revocation-check none
    rsakeypair TP-self-signed-1027977212
    !
    !
    crypto pki certificate chain TP-self-signed-1027977212
    certificate self-signed 01
    30820249 308201B2 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
    ………….
    0D27176E C0DA420C EE2C9595 E1
    quit
    dot11 syslog
    ip source-route
    !
    !
    ip dhcp excluded-address 172.17.77.1 172.17.77.39
    ip dhcp excluded-address 172.17.77.91 172.17.77.254
    !
    ip dhcp pool PBNET_LAN
    import all
    network 172.17.77.0 255.255.255.0
    dns-server 8.8.8.8 8.8.4.4
    default-router 172.17.77.101
    !
    !
    ip cef
    ip domain name pbnet.ro
    ip ddns update method ccp_ddns1
    HTTP
    add http://xxx:xxxx@members.dyndns.org/nic/update?system=dyndns&hostname=&myip=
    remove http://xxx:xxxx@members.dyndns.org/nic/update?system=dyndns&hostname=&myip=
    !
    ipv6 unicast-routing
    ipv6 cef
    !
    vpdn enable
    !
    vpdn-group enable
    !
    multilink bundle-name authenticated
    !
    !
    !
    username xxx privilege 15 password 0 xxxx
    !
    !
    !
    archive
    log config
    hidekeys
    !
    !
    !
    !
    !
    interface FastEthernet0
    !
    interface FastEthernet1
    !
    interface FastEthernet2
    !
    interface FastEthernet3
    !
    interface FastEthernet4
    description $ETH-WAN$
    no ip address
    duplex auto
    speed auto
    pppoe enable group global
    pppoe-client dial-pool-number 1 service-name “ipv6test”
    !
    interface Vlan1
    ip address 172.17.77.101 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    ip tcp adjust-mss 1412
    ipv6 address dh-prefix 0:0:0:0:1::/64 eui-64
    !
    interface Dialer0
    ip ddns update hostname xxx.homelinux.org
    ip ddns update ccp_ddns1
    ip address negotiated
    ip mtu 1452
    ip nat outside
    ip virtual-reassembly
    encapsulation ppp
    dialer pool 1
    dialer-group 2
    ipv6 address dhcp
    ipv6 dhcp client pd dh-prefix
    ppp authentication chap pap callin
    ppp chap hostname xxx
    ppp chap password 0 xxx
    ppp pap sent-username xxx password 0 xxx
    !
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip http server
    ip http secure-server
    !
    !
    ip nat inside source list 1 interface Dialer0 overload
    !
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.17.77.0 0.0.0.255
    dialer-list 1 protocol ip permit
    dialer-list 2 protocol ip permit
    !
    !
    !
    !
    !
    control-plane
    !
    banner login ^CPBNET ROUTER^C
    !
    line con 0
    no modem enable
    line aux 0
    line vty 0 4
    privilege level 15
    password xxx
    login local
    transport input ssh
    !
    scheduler max-task-time 5000
    end

  11. Author

    @Andrei: ca sa fiu sigur ca am inteles, tu spui ca folosind configul de mai sus primesti adresa IPv4 insa nu primesti adresa IPv6 nici macar pe Dialer0 (cu atat mai putin PD ::/64 pe Vlan1). deci dupa ce te conectezi PPPoE si verifici ca iti merge IPv4 de pe router, comanda “sh ipv6 int brief” nu-ti arata nici o adresa IPv6. corect ?

  12. Salut Liviu,

    Exact.
    “sh ip int brief” imi da IP-ul IPv4 pe Dialer0
    “sh ipv6 int brief” nu-mi da nimic

  13. Author

    @Andrei:
    vad ca ai creat un dialer-list 2 in care permiti DOAR IP (adica IPv4 implicit)

    interface Dialer0
    dialer-group 2
    !
    dialer-list 2 protocol ip permit

    incearca sa-l scoti sau sa permiti si IPv6.

  14. Salut Liviu,

    Am pus urmatoarele linii:
    access-list 1 remark CCP_ACL Category=2
    access-list 1 permit 172.17.77.0 0.0.0.255
    dialer-list 1 protocol ip permit
    dialer-list 1 protocol ipv6 permit
    dialer-list 2 protocol ip permit
    dialer-list 2 protocol ipv6 permit

    Acum cand dau sh ipv6 int brief am urmatorul rezultat:

    CISCO871#sh ipv6 int brief
    Dialer0 [up/up]
    unassigned
    FastEthernet0 [up/up]
    unassigned
    FastEthernet1 [up/down]
    unassigned
    FastEthernet2 [up/down]
    unassigned
    FastEthernet3 [up/down]
    unassigned
    FastEthernet4 [up/up]
    unassigned
    NVI0 [administratively down/down]
    unassigned
    Virtual-Access1 [up/up]
    unassigned
    Vlan1 [up/up]
    FE80::6FE:7FFF:FE1A:C1FD

    Totusi, router-ul nu-mi rezolva niciun nume pe IPv4 sau IPv6
    Pe client (Win7), imi rezolva numele pe IPv4, pe IPv6 nu, iar daca dau un trace spre un IPv6 am urmatorul rezultat:

    C:\Users\Andrei>tracert 2001:4860:4860::8844

    Tracing route to google-public-dns-b.google.com [2001:4860:4860::8844]
    over a maximum of 30 hops:

    1 181 ms 49 ms 49 ms 6to4.lon1.he.net [2001:470:0:161::2]
    2 56 ms 49 ms 48 ms gige-g4-4.core1.lon1.he.net [2001:470:0:161::1]

    3 49 ms 112 ms 49 ms 2001:7f8:4::3b41:1
    4 53 ms 65 ms 62 ms 2001:4860::1:0:3067
    5 49 ms 49 ms 53 ms 2001:4860::8:0:2dde
    6 55 ms 55 ms 55 ms 2001:4860::8:0:2ac3
    7 55 ms 58 ms 94 ms 2001:4860::2:0:87b
    8 55 ms 67 ms 55 ms 2001:4860:0:1::22f
    9 55 ms 55 ms 55 ms google-public-dns-b.google.com [2001:4860:4860::
    8844]

    Trace complete.

    Merci mult pentru orice ajutor

  15. Ok, am lamurit-o cu DNS-ul.
    Se pare ca pe router tot nu merge ceva cum trebuie….

    CISCO871#ping “www.google.com”
    Translating “www.google.com”…domain server (8.8.4.4)
    Translating “www.google.com”…domain server (8.8.4.4) [OK]

    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 209.85.148.105, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 32/33/36 ms
    CISCO871#ping ipv6.google.com

    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 2A00:1450:4001:C01::63, timeout is 2 seconds:

    % No valid route for destination
    Success rate is 0 percent (0/1)

  16. Author

    @Andrei: “sh ipv6 int brief” la tine pe router nu arata bine deloc. adica nu vad decat un IPv6 Link Local pe Vlan1 care nu are nici o legatura cu negocierea PPPoE sau DHCPv6 PD. tu ai de fapt doua probleme:
    1. routerul tau nu primeste IPv6 via PPPoE (scoate “dialer-group 2” de pe Dialer0 … te complici prea mult cu dialer-list)
    2. PC-ul tau din spate foloseste un tunel 6to4 care nu are nici o legatura cu IPv6 nativ de la RDS. se vede la traceroute-ul dat de tine ca primul hop este capatul de tunel de la Huricane Electric. ar trebui sa-ti dezactivezi asta. probabil pe PC ai doar o adresa Ipv6 care incepe cu 2002: (ceea ce inseamna ca e tunelul de care vorbesc). IPv6 nativ o sa ai cand vezi pe PC o adresa care incepe cu 2a02:2f01:

  17. Salut Liviu,

    Mii de multumiri pentru raspunsuri.
    Ti-am urmat sfatul si am scos dialer-group 2 din interfata Dialer0
    Am dat un shut/no shut pe interfetele Dialer0 si FE4, dar din pacate tot nu ia IP de la RDS cum trebuie.
    Ce zici ca ar mai trebui sa fac? Chiar nu reusesc sa-i dau de cap πŸ™

    Merci mult.
    Andrei

  18. Author

    @Andrei: lucrurile sunt contradictorii in cazul tau. sunt aproape convins ca lucrurile nu stau exact cum le-ai expus. de exemplu, eu nu cred ca te conectezi cu service name “ipv6test” si iti merge doar IPv4. eu cred ca atunci cand setezi “ipv6test” nu te poti conecta deloc si ca apoi scoti service name si iti merge doar IPv4. deci ca sa putem ajunge la o solutie trebuie sa stim exact cum stam.
    daca vrei sa te poti baza pe ajutorul nostru hai sa luam lucrurile pas cu pas:

    conecteaza-ti PC-ul “pe direct”. ar trebui sa primesti fara probleme v4 / v6 pentru ca folosesti windows 7. dupa ce treci de pasul asta si confirmi ca-ti functioneaza site-urile IPv6 recomandate de RDS revino pe blog si vom continua. iti promit ca vei reusi pana la urma sa te conectezi si din spatele routerului CISCO.

  19. Phew! In primul rand, multumesc – am cautat o gramada cum se seteaza “service name” pe un 881, si nu gaseam pe nicaieri (singurul document pe care l-am gasit la Cisco este despre setarea server-side).

    In al doilea rand, trebuie precizat ca pentru DHCPv6 (si Prefix Delegation) trebuie licenta advipservices (pe care n-o aveam si nu stiam de ce nu vrea sa imi accepte comenzile πŸ™

    Si in al treilea rand – ai idee ce ar mai trebui setat ca sa primeasca si ruta default prin DHCPv6?

  20. Salut Liviu,

    Multumesc mult pentru raspuns.
    Am incercat “pe direct” si uite rezultatele:

    C:\Users\Andrei>tracert http://www.google.com

    Tracing route to http://www.l.google.com [2a00:1450:8007::93]
    over a maximum of 30 hops:

    1 1 ms 1 ms 1 ms 2a02:2f01:104d:f000::2
    2 2 ms 1 ms 1 ms 2a02:2f01:104d:f020::1
    3 2 ms 1 ms 1 ms 2a02:2f01::c091:9000:1
    4 10 ms 10 ms 10 ms 213-154-128-73.rdsnet.ro [::ffff:213.154.128.73]

    5 10 ms 10 ms 10 ms cr01.v6.timisoara.rdsnet.ro [2a02:2f00:8708::200
    1:6]
    6 16 ms 16 ms 15 ms cr01.v6.budapesta.rdsnet.ro [2a02:2f00:8708::200
    1:250]
    7 16 ms 15 ms 16 ms xr01.v6.budapesta.rdsnet.ro [2a02:2f00:8708::400
    1:250]
    8 16 ms 16 ms 16 ms 2001:4860:1:1:0:2204:0:2
    9 17 ms 17 ms 16 ms 2001:4860::1:0:9
    10 24 ms 24 ms 24 ms 2001:4860::4:0:5
    11 40 ms 59 ms 35 ms 2001:4860::1:0:10
    12 34 ms 42 ms 33 ms 2001:4860::8:0:3016
    13 34 ms 33 ms 53 ms 2001:4860::2:0:48d
    14 35 ms 34 ms 34 ms 2001:4860:0:1::cb
    15 29 ms 29 ms 29 ms fx-in-x93.1e100.net [2a00:1450:8007::93]

    Trace complete.

    C:\Users\Andrei>

    PPP adapter RDSNET:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : RDSNET
    Physical Address. . . . . . . . . :
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes
    IPv6 Address. . . . . . . . . . . : 2a02:2f01:104d:f001::bc1b:bfca(Preferred)

    Link-local IPv6 Address . . . . . : fe80::bc1b:bfca%37(Preferred)
    IPv4 Address. . . . . . . . . . . : 188.27.191.202(Preferred)
    Subnet Mask . . . . . . . . . . . : 255.255.255.255
    Default Gateway . . . . . . . . . : fe80::1%37
    0.0.0.0
    DNS Servers . . . . . . . . . . . : 213.154.124.201
    NetBIOS over Tcpip. . . . . . . . : Disabled

    Iata si configuratia de pe Cisco 871

    CISCO871#sh ip int brief
    Interface IP-Address OK? Method Status Protocol
    Dialer0 188.27.205.134 YES IPCP up up
    FastEthernet0 unassigned YES unset up up
    FastEthernet1 unassigned YES unset up down
    FastEthernet2 unassigned YES unset up down
    FastEthernet3 unassigned YES unset up down
    FastEthernet4 unassigned YES NVRAM up up
    NVI0 unassigned YES unset administratively down down
    Virtual-Access1 unassigned YES unset up up
    Vlan1 172.17.77.101 YES NVRAM up up

    CISCO871#sh ipv6 int brief
    Dialer0 [up/up]
    unassigned
    FastEthernet0 [up/up]
    unassigned
    FastEthernet1 [up/down]
    unassigned
    FastEthernet2 [up/down]
    unassigned
    FastEthernet3 [up/down]
    unassigned
    FastEthernet4 [up/up]
    unassigned
    NVI0 [administratively down/down]
    unassigned
    Virtual-Access1 [up/up]
    unassigned
    Vlan1 [up/up]
    FE80::6FE:7FFF:FE1A:C1FD

    Multumiri anticipate,
    Andrei

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.