ipv6 for hosts behind UTM

Nobody on this ? Does anyone use ipv6 behind UTM ?

I restarted all the setup, everything is now in a /64 including the ISP interface. From inside, it's almost working (see *), I can ping all hosts including the UTM on the internal interface. Hosts with no ipv6 fixed ip get's one from prefix advertisement, all is good. Problem is that I can't ping the UTM ISP interface ipv6 :(

From outside the same, I can ping the ISP ipv6 but none of the internal ! From the UTM, using Support => Tools, I can ping an outside ipv6 using nearest routing -which means ISP interface- but not if I set the internal interface.

It seems that the firewall is blocking internal ipv6 to external and vice versa. I even try to give an ipv6 GW to internal interface (ISP interface), no changes. Also I see in ip -6 r of UTM

2a01:xxxx:yyyy::1 dev eth0.1002 metric 1024   ; ISP ipv6 GW
2a01:xxxx:yyyy::2 dev eth2 metric 1024           ; ISP interface
2a01:xxxx:yyyy::10:254 dev eth2 metric 1024  ; *** This entry should not be here, that's the ip of the second VM ! *** Internal ipv6 is ::10:1
2a01:xxxx:yyyy::/64 dev eth2 proto kernel metric 256
2a01:xxxx:yyyy::/64 dev eth0.1002 proto kernel metric 256
fe80::/64 dev eth2 proto kernel metric 256
fe80::/64 dev eth0 proto kernel metric 256
fe80::/64 dev eth0.1002 proto kernel metric 256
fe80::/64 dev eth0.1001 proto kernel metric 256
fe80::/64 dev eth0.100 proto kernel metric 256
fe80::/64 dev eth0.2 proto kernel metric 256
fe80::/64 dev eth0.1000 proto kernel metric 256
fe80::/64 dev eth0.210 proto kernel metric 256
fe80::/64 dev ifb0 proto kernel metric 256

Any help or tip is appreciated.

(*) the second VM can only be reached by the UTM VM and the physical host. Other way it's working like a charm. But that's another story.

Daniel

Me again ;)

what I see in logs is that neighbor sollicitation for external ipv6 get never answered (capture on internal interface)

19:01:35.455562 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:2: ICMP6, neighbor solicitation, who has guava, length 32
19:01:35.578057 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a01:xxxx:yyyy::1, length 32
19:01:36.474502 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:2: ICMP6, neighbor solicitation, who has guava, length 32
19:01:36.602368 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a01:xxxx:yyyy::1, length 32
19:01:37.498390 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:2: ICMP6, neighbor solicitation, who has guava, length 32
19:01:37.626370 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a01:xxxx:yyyy::1, length 32
19:01:38.522412 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:2: ICMP6, neighbor solicitation, who has guava, length 32
19:01:39.034301 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a01:xxxx:yyyy::1, length 32
19:01:39.546318 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:2: ICMP6, neighbor solicitation, who has guava, length 32
19:01:40.058373 IP6 2a01:xxxx:yyyy::10:254 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2a01:xxxx:yyyy::1, length 32
19:01:40.457457 IP6 fe80::xyz:ff:zyx:1234 > 2a01:xxxx:yyyy::10:254: ICMP6, neighbor solicitation, who has 2a01:xxxx:yyyy::10:254, length 32
19:01:40.457574 IP6 2a01:xxxx:yyyy::10:254 > fe80::xyz:ff:zyx:1234: ICMP6, neighbor advertisement, tgt is 2a01:xxxx:yyyy::10:254, length 24

but is for internal ipv6 (2 last lines).

Is there a rule to add on firewall to allow those neighbor solicitations/advertisement ?

Daniel

This sounds to me like a routing issue. 

Can you filter your TCPDump per interface and check to see if it is going out the correct one?

Neighbor solicitation is done within the same broadcast domain so if you have two interfaces with the overlapping networks that could be the issue. 

I would suggest opening a support case for this issue if everything seems correct after doing the above. 

This may be related to the RADVD issue I have been having for over a year:

https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/97554/radvd-does-not-seem-to-be-working

Basically, I can get an IPv6 address on my internal network, but no one else knows how to route to me. The outside interface is a /128 because it is supposed to be the gateway to your assigned networks. I have never heard pot any solution, and after a few updates, the problem persists. If you want, you can NAT your internal network to the /128 on the outside interface and IPv6 will work, but you will be using masquerade instead of your IP.

Is this related to your issue?

This may be related to the RADVD issue I have been having for over a year:

https://community.sophos.com/products/unified-threat-management/f/management-networking-logging-and-reporting/97554/radvd-does-not-seem-to-be-working

Basically, I can get an IPv6 address on my internal network, but no one else knows how to route to me. The outside interface is a /128 because it is supposed to be the gateway to your assigned networks. I have never heard pot any solution, and after a few updates, the problem persists. If you want, you can NAT your internal network to the /128 on the outside interface and IPv6 will work, but you will be using masquerade instead of your IP.

Is this related to your issue?

Hi Edward,

yes, seems the same problem. NATing IPv6 ... well ! I will open a case.

Daniel

If they tell you how to fix it, please post it here as I have a free license. :)