Thread Info
  • State Verified Answer
  • Replies 8 replies
  • Subscribers 4 subscribers
  • Views 2741 views
  • Users 0 members are here
Options
Suggested

IPv6 not working since install of v18 EAP or EAP Refresh 1

Casual_User

I had a dual stack running successfully for a few years under the previous version(s) of XG.  Since installing v18 EAP1 or Refresh 1, IPv6 connectivity to the internet has failed.  The circumstances are:

  1. I have a stateful setup for my LAN that properly assigns IPv6 addresses to the connected devices
  2. The WAN connection to the ISP get the proper IPv6 prefix and the proper gateway IP
  3. I can successfully ping6 any device on my LAN from within the LAN
  4. I can successfully ping6 any device on my LAN from the XG
  5. I cannot ping6 any device on the internet from my LAN
  6. I can successfully ping6 devices on the internet from the XG
  7. When I test IPv6 compatibility using one of the various websites, they report back that there is no IPv6 connection
  8. My firewall rules that I use are migrated from v17.  The IPv6 rules are exact mirrors of the IPv4 rules (which obviously work).  The NAT rules were created by the v18 install.
  9. I have tried connecting via IPv6 from my Mac, iPhone, Win10 laptop and Win10 desktop computers using Chrome, Internet Explorer and Safari.

In order to try and pin down possible causes I've tried the following, without success:

  1. My IPv6 connection to the ISP was configured as DHCP -> Manual -> DHCP only.  I changed this to Auto.  The XG was able to successfully connect to the ISP and get the correct IPv6 settings.  A green light was indicated in the "WAN link manager".  The XG was able to ping6 and trace route to google.  I still could not ping6 or connect to the internet via IPv6 from the LAN.
  2. I deleted the automatically created NAT rules for IPv6.  I created my own NAT rules to MASQ the IPv6 WAN traffic.  While the NAT rules counters indicated that they were being used, I could not ping6 or connect via IPv6 to the internet.  I could ping6 from the XG.
  3. I disabled the NAT rules.  The same symptoms prevailed.
  4. I noticed that in the Interfaces configuration for IPv6, the Gateway IP was a link local address, which seemed odd.  From the earlier traceroute, I could see the IPv6 address of the Gateway.  I manually entered the Gateway IPv6 address.  After a minute the XG successfully connected to the ISP via IPv6 and a green light was displayed on the connection.  I could ping6 and trace route from the XG but there was no access from the LAN.
  5. I created a new IPv6 firewall rule to allow everything to the WAN (no filtering) and a linked NAT rule that applied MASQ to WAN bound traffic.  Both the new firewall rule and the new NAT rule show that there was WAN bound traffic (counters increased immediately).  I can ping6 from the XG but no IPv6 access from the LAN.
  6. I have tried the Logviewer to see what is going on with the NAT rule.  When I enable filtering through NAT it just sits there processing for ages and never produces anything.

In summary, with all the changes I made above, the firewall rule counter and NAT rule counter increase.  To me this indicates that the IPv6 traffic is being correctly processed by these rules.  I cannot pin down the problem.

At this point, I cannot think of any other options to try.  I have been in touch with the developers who have support access to my XG.  At this point, they have confirmed that the XG can ping6 and trace route IPv6.

Am I completely missing something here?  The only other thing I can think of is something has changed with my ISP.

Parents
  • 0

    Hi,

    I have successfully aetup IPv6 though the functionality is verty limited when compared to IP4 on the XG.

    My ISP rovides an link-local gateway address while I have a real IPv6 address on the external interface.

    Check that you do not have allow known users enabled, while that worked in v17 it does not work in V18?

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Thanks Ian,

    I don't have "Known Users" enabled.  I checked the existing rules and the temporary new rules.  There must be some other issue behind the scenes.

  • 0 in reply to Casual_User

    Hi,

    can you see the IPv6 address assignments in the DHCP server on the XG? Do they show up in logviewer SYSTEM?

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi,

    Yes, the dynamically assigned IPv6 addresses appear in the IPv6 lease table.  The static addresses do not, which is normal but annoying for me considering it does not follow the same behaviour as the IPv4 address lease table.  

    Yes, the IPv6 leases also appear in the Logviewer System view.

    Thanks for the assistance.

  • 0 in reply to Casual_User

    So I tried one other thing.  I noticed that for IPv4 for the computers on my LAN, the router is listed as the IPv4 address I specified on the XG but for IPv6 the router is listed as a link-local address not the IPv6 address that I specified on the XG.  On my Mac, I manually configured the IPv6 router to be the LAN IPv6 address that I have configured as the gateway (same address that I use to connect the the web console).  Once I did this, I no longer had IPv6 on my LAN.  I changed the configuration back to automatic, and the IPv6 router was automatically changed back to the link-local address and I had IPv6 LAN access again.

    This seems odd, as it is not consistent with the operation of the IPv4 DHCP.  The IPv4 address I specified is used for the router, DHCP server and DNS server.  However, for IPv6, the DHCP server and DNS server are IPv6 but the router is sent as link-local.

    I've exhausted what I can see as the troubleshooting options.  Looks like I'll wait until the next "Refresh".

  • 0 in reply to Casual_User

    Okay, no progress but more information.

    Logviewer worked today to view the NAT information.  First, I checked the IPv4 NAT rule that permits WAN access.  It showed traffic as "allowed" along with the corresponding firewall rule.  I then filtered by the IPv6 NAT rule for MASQ access to the WAN.  It showed traffic as "allowed" along with the corresponding firewall rule (I did a ping6 and traceroute6).

    This verifies that the firewall rule is correct along with my NAT rule.  It appears that data is permitted out, but nothing comes back in for IPv6.  

    One of the IPv6 test sites stated that you would get an IPv6 fail if a link-local or otherwise incorrect IPv6 address was being used by your computer.  I suppose that this may be the case, but I don't know of a way to test or change the behaviour.

Reply
  • 0 in reply to Casual_User

    Okay, no progress but more information.

    Logviewer worked today to view the NAT information.  First, I checked the IPv4 NAT rule that permits WAN access.  It showed traffic as "allowed" along with the corresponding firewall rule.  I then filtered by the IPv6 NAT rule for MASQ access to the WAN.  It showed traffic as "allowed" along with the corresponding firewall rule (I did a ping6 and traceroute6).

    This verifies that the firewall rule is correct along with my NAT rule.  It appears that data is permitted out, but nothing comes back in for IPv6.  

    One of the IPv6 test sites stated that you would get an IPv6 fail if a link-local or otherwise incorrect IPv6 address was being used by your computer.  I suppose that this may be the case, but I don't know of a way to test or change the behaviour.

Children
Unfiltered HTML