Calm down, calm down!! This post will get into those specifics and also cover IPv6 neighbor discovery. So let's keep this ball rolling!!
RFCs
RFC 4861 Neighbor Discovery for IPv6
RFC 4862 IPv6 Stateless Address Autoconfiguration
RFC 3315 Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
Neighbor Discovery
One of the first things that threw me with IPv6 is the removal of the ARP process. Instead of using ARP as a secondary process, IPv6 has neighbor discovery built in. Unlike ARP, neighbor discovery goes beyond simple layer2 to layer3 translation. IPv6 neighbor discovery has the following functions just to name a few:
- Router Discovery (RD)
- Router Advertisements (RA)
- Neighbor Solicitation (NS)
- Neighbor Advertisements (NA)
- Next-hop Determination
- Neighbor Unreachability Detection
- DAD (Duplicate Address Detection)
- Route Redirects
Neighbor Discovery Packet Types:
RA - Router Advertisement - Identifies device as an active router to those on the segment. Once IPv6 is enabled on a router, RAs are generated and sent (via multicast) regularly to the segment. RAs contain the following features:
- Prefix list used for address auto-configuration
- Ability to define routing gateway
- Flags to associate each prefix
- Ivan Pepelnjak has a good post on flags here
- Address auto-configuration parameters
- Internet parameters such as link MTU or max hop count to the internet
RS - Router Solicitation - When an IPv6 interface is enabled hosts will ask for information about local routers via an RS. Routers will then immediately reply to the RS with an RA allowing the host to learn its needed information without having to wait for the next RA advertisement.
NS - Neighbor Solicitation - Used by nodes to ask for a neighbor's link information or to insure the cached information about a neighbor is still accurate. NS messages are the same as IPv4 using ARP to request a MAC to IP resolution. The neighbor will then respond with a unicast NA (Neighbor Advertisement).
- NS messages use the Solicited-node multicast address to direct traffic towards the desired neighbor.
NA - Neighbor Advertisement - Nodes use NA messages to inform everyone of a change to a link (same as v4 gratuitous ARP). NA messages are also sent in response to a NS.
Redirect - Used by routers to inform hosts of a new or better first hop for a destination.
Since neighbor discovery uses multicast for the majority of its messages NBMA network types have an issue with IPv6. In order for IPv6 communications to flow properly on NBMA networks, static layer2 to layer3 mappings must be configured for each host.
Automatic Addressing
So you're looking at the 128-bit address and thinking, damn I dont want to type all that in each time on every device! No worries IPv6 has auto configuration built in allowing devices to self-generate a link-local address and also the ability to generate global unicast addresses.
IPv6 has several ways to generate an IP address automatically
- Stateless Auto-configuration - 64-bit prefix is assigned by router and then host generates a 64-bit unique prefix using EUI-64
- Stateful Auto-configuration - Full address is assigned by DHCPv6
Stateless Auto-Configuration (aka SLAAC)
- Can generate link-local addresses on its own
- Link-local prefix is assigned
- Host appends the modified (EUI-64) interface MAC
- Can generate global unicast addresses with the help of a router using RAs
- Host learns global prefix from advertised RA
- Host appends the modified (EUI-64) interface MAC
- If unable to receive RAs then a global address in unable to be generated and the host can only communicate on the local link.
EUI-64
In order to automatically assign a unique address to an interface IPv6 uses the interface MAC address since theoretically it should be globally unique. This is all well and good but the host portion of an address is 64-bits in length and a MAC address is only 48-bits. So EUI-64 modifies the MAC address to fit within the 64-bit size.
EUI-64 uses the following steps to generate an address
- Use the mac address of the interface.
- Invert 7th most significant bit
- Insert "FFFE" in the center of MAC address
- Prepend the assigned or link-local prefix.
Let's look at an example:
- Prefix assigned = FEC0:123::/64
- Interface mac = 1234:5678:9012
- First octet = 12 or 00010010
- 7th bit from left is most significant bit = 1
- Invert 7th bit to 0 = 00010000 = 10 = 1034:5678:9012
- Insert FFFE in between 56 and 78 = 1034:56FF:FE78:9012
- EUI-64 address = 1034:56FF:FE78:9012
- Interface IPv6 address = FEC0:123::1034:56FF:FE78:9012/64
To configure an interface to use EUI-64 auto-configuration use the following command
Link-local addresses (unless statically configured) will always use the EUI-64 format to generate an address.
Statefull Auto-Configuration (DHCPv6)
Specified in RFC 3315 DHCPv6 is not much different than DHCP for IPv4. DHCP in general is beyond the scope of this post so I'm not going into its details. If you insist on more information about DHCPv6 then read the RFC or check out Cisco's documentation here
DAD (Duplicate Address Detection):
Once a node selects an auto-configured address it then generated a NS (Node Solicitation) message to the auto-configured address's solicited-node multicast address. Remember these being listed in the show ipv6 interface command in my last post? Give me one second and I'll go over the details.
The NS is structured with an unspecified source address, and the target field, list the auto-configured address needing verification.
If no one replies to the NA the DAD process is passed and the host knows the new address is unique. The host then sends an NA (Network Advertisement) message to the ALLhost multicast address FF02::1 to inform everyone of the new address.
If the DAD process fails then the interface will reject the IP address and be unable to communicate on the link with that address.
So what is a Solicited-node multicast anyways?
Solicited-node multicast addresses are generated for each unicast or anycast address on an interface. They are the equivalent to the broadcast address for any given IPv4 subnet and are used by neighbor discovery to determine layer2 to layer3 resolution for a neighbor or destination. Solicited-node addresses are generated by appending the last 24 bits of the address to ff02:0:0:0:0:1:ff00::/104.
My last post shows the examples FF02::1:FF00:0 and FF02::1:FF00:1.
