10: ICMPv6 Neighbor Discovery Rick Graziani Cabrillo College Rick.Graziani@cabrillo.edu

For more information please check out my Cisco Press book and video series: IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6 By Rick Graziani ISBN-10: 1-58714-313-5 IPv6 Fundamentals LiveLessons: A Straightforward Approach to Understanding IPv6 By Rick Graziani ISBN-10: 1-58720-457-6

10.1: Introducing ICMPv6 Neighbor Discovery

ICMPv6 Neighbor Discover Protocol ICMPv6 Neighbor Discovery defines 5 different packet types: Router Solicitation Message Router Advertisement Message Used with dynamic address allocation Neighbor Solicitation Message Neighbor Advertisement Message Used with address resolution (IPv4 ARP) Redirect Message Similar to ICMPv4 redirect message Router-to-Device messaging Router-Device Messaging Device-Device Messaging See these processes with: R1# debug ipv6 nd

ICMPv6 Redirect Network X Similar functionality as ICMPv4. Destination: PCB Destination: Network X Host IPv6 Network A IPv6 Network B PCA PCB Similar functionality as ICMPv4. Like IPv4, a router informs an originating host of the IP address of a router that is on the local link and is closer to the destination. Unlike IPv4, a router informs an originating host that the destination host (on a different prefix/network) is on the same link as itself. http://technet.microsoft.com/en-us/library/cc781672(v=ws.10).aspx Redirect Function Routers use the redirect function to inform originating hosts of a better first-hop neighbor to which traffic should be forwarded for a specific destination. Routers use the redirect function for two purposes: A router informs an originating host of the IP address of a router available on the local link that is closer to the destination. The term closer is a routing metric function used to reach the destination network segment. This condition can occur when multiple routers are on a network segment, the originating host chooses a default router, and it is not the best one to use to reach the destination. A router informs an originating host that the destination is a neighbor (it is on the same link as the originating host). This condition can occur when the prefix list of a host does not include the prefix of the destination. Because the destination does not match a prefix in the list, the originating host forwards the packet to its default router. The following steps occur in the IPv6 redirect process: The originating host sends a unicast packet to its default router. The router processes the packet and notes that the address of the originating host is a neighbor. Additionally, the router notes that both the originating host and the next-hop are on the same link. The router forwards the packet to the appropriate next-hop address. The router sends the originating host a Redirect message. In the Target Address field of the Redirect message is the next-hop address of the node to which the originating host should send packets addressed to the destination. For packets redirected to a router, the Target Address field is set to the link-local address of the router. For packets redirected to a host, the Target Address field is set to the destination address of the packet originally sent. The Redirect message includes the Redirected Header option. The message might also include the Target Link-Layer Address option. 5. Upon receiving the Redirect message, the originating host updates the destination address entry in the destination cache with the address in the Target Address field. If the Redirect message includes the Target Link-Layer Address option, its contents are used to create or update the corresponding entry in the neighbor cache. Only the first router in the path between the originating host and the destination sends redirect messages, and (like ICMPv6 error messages) they are rate limited. Hosts never send Redirect messages, and routers never update routing tables based on the receipt of a Redirect message.

10.2: Router Solicitation and Router Advertisement Messages

Dynamic Address Allocation in IPv4 DHCPv4 Server 1 2 I need IPv4 addressing information. Here is everything you need. DHCPv4 server is a stateful server.

Dynamic Address Allocation in IPv6 To all IPv6 routers: I need IPv6 address information. I might not be needed. Router(config)# ipv6 unicast-routing ICMPv6 Router Solicitation DHCPv6 Server ICMPv6 Router Advertisement To all IPv6 devices: Let me tell you how to do this … 1. SLAAC SLAAC (Stateless Address Autoconfiguration) 2. SLAAC with Stateless DHCPv6 The Router Advertisement (RA) tells hosts how it will receive IPv6 Address Information. Sent periodically by an IPv6 router or… … when the router receives a Router Solicitation (RS) message from a host. More options for devices to get addressing. The device doesn’t need to access a DHCPv6 server for addressing. It’s router, its default gateway is its way out of the network and everything it needs for addressing. Much more in lesson XXX 3. Stateful DHCPv6

ICMPv6 Router Advertisement RA Message Options ICMPv6 Router Advertisement Option 1, 2, or 3 DHCPv6 Server Option Other Configuration (“O”) Flag Managed Configuration (“M”) Flag Option 1: SLAAC – No DHCPv6 (Default on Cisco routers) Option 2: SLAAC + Stateless DHCPv6 for DNS address 1 Option 3: All addressing except default gateway use DHCPv6 RA flags discussed in more detail in Lesson 10. Configuring Flags discussed in Lesson 8.

Option 3 and the “A” Flag 1 1 (default) Yes No As a Windows host I will still use the RA prefix to create temporary (SLAAC) addresses) ICMPv6 RA M Flag = 1 A Flag = 1 G 0/1 DHCPv6 DHCPv6 Server Option Managed Configuration (“M”) Flag Address Autoconfiguration (“A”) Flag Prefix in RA can be used for SLAAC Option 3: All addressing except default gateway use DHCPv6 1 1 (default) Yes No The autonomous address configuration (A) flag tells hosts that they can create an address for themselves by combining the prefix in the RA with an interface identifier. RA flags discussed in more detail in Lesson 10. Configuring Flags discussed in Lesson 8.

Router Solicitation / Router Advertisement 2001:DB8:CAFE:1::/64 Link-local: FE80::1 MAC: 00-03-6b-e9-d4-80 Link-local: FE80::50A5:8A35:A5BB:66E1 MAC: 00-21-9b-d9-c6-44 R1 PC1 Router Solicitation Sent when device needs IPv6 addressing information. Router Advertisement Sent every 200 seconds or in response to RS 1 To: FF02::2 (All-IPv6 Routers) From: FE80::50A5:8A35:A5BB:66E1 ICMPv6 Router Solicitation RS 2 To: FF02::1 (All-IPv6 devices) From: FE80::1 (Link-local address) ICMPv6 Router Advertisement RA

Analyzing the Router Solicitation Message

Router Solicitation Message Ethernet II, Src: 00:21:9b:d9:c6:44, Dst: 33:33:00:00:00:02 Internet Protocol Version 6 0110 .... = Version: 6 [Traffic class and Flowlabel not shown] Payload length: 16 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: fe80::50a5:8a35:a5bb:66e1 Destination: ff02::2 Internet Control Message Protocol v6 Type: 133 (Router solicitation) Code: 0 Checksum: 0x3277 [correct] ICMPv6 Option (Source link-layer address) Type: Source link-layer address (1) Length: 8 Link-layer address: 00:21:9b:d9:c6:44 Ethernet multicast MAC address – Maps to “all IPv6 routers” Next header is an ICMPv6 header Link-local address of PC1 All-IPv6-routers multicast address Router Solicitation message MAC address of PC1 but RA is sent as all-IPv6-host multicast Lesson 6 discusses the mapping of IPv6 multicast addresses to Ethernet MAC addresses Router Solicitation Message

Analyzing the Router Advertisement Message

An IPv6 Router R1(config)# ipv6 unicast-routing R1# show ipv6 interface gigabitethernet 0/0 GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:1 MTU is 1500 bytes <output omitted for brevity> ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. All-routers multicast group M & O flags = 0

Analyzing the Router Advertisement Message Ethernet II, Src: 00:03:6b:e9:d4:80, Dst: 33:33:00:00:00:01 Internet Protocol Version 6 0110 .... = Version: 6 .... 1110 0000 .... .... .... .... .... = Traffic class: 0x000000e0 .... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000 Payload length: 64 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: fe80::1 Destination: ff02::1 Ethernet multicast MAC address – Maps to “All-IPv6 devices” Next Header is an ICMPv6 header Link-local address of R1. Added to hosts’ Default Router List and is the address they will use as their default gateway. All-IPv6 devices multicast Continued next slide

Router Advertisement Message Internet Control Message Protocol v6 Type: 134 (Router advertisement) Code: 0 Cur hop limit: 64 Flags: 0x00 ICMPv6 Option (Source link-layer address) Type: Source link-layer address (1) Length: 8 Link-layer address: 00:03:6b:e9:d4:80 ICMPv6 Option (MTU) Type: MTU (5) MTU: 1500 ICMPv6 Option (Prefix information) Type: Prefix information (3) Length: 32 Prefix Length: 64 Prefix: 2001:db8:cafe:1:: Router Advertisement Recommended Hop Limit value for hosts M and O flags indicate that no information is available via DHCPv6 Router R1’s MAC address MTU of the link. Prefix-length (/64) to be used for autoconfiguration. Prefix of this network to be used for autoconfiguration Router Advertisement Message

10.3: Neighbor Solicitation and Neighbor Advertisement Messages

Address Resolution: IPv4 and IPv6 ARP Request: Broadcast IPv4: ARP over Ethernet Ethernet ARP Request/Reply ARP Cache Know IPv4, what is the MAC? My IPv4! Here is the MAC? 2 1 ARP Reply PC2 ARP Request PC1 2 1 My IPv6! Here is the MAC? Know IPv6, what is the MAC? Neighbor Advertisement Neighbor Solicitation Neighbor Cache IPv6: ICMPv6 over IPv6 over Ethernet NS: Multicast NS: Solicited Node Multicast Ethernet More about address resolution in Lesson X. More about Solicited Node Multicast in Lesson X and Y. IPv6 Header ICMPv6: Neighbor Solicitation/Advertisement

Neighbor Solicitation and Neighbor Advertisement 2001:DB8:CAFE:1::100/64 2001:DB8:CAFE:1::200/64 FF02::1:FF00:200 (Solicited Node Multicast) MAC Address 00-1B-24-04-A2-1E MAC Address 00-21-9B-D9-C6-44 PC2 PC1 1 PC1> ping 2001:DB8:CAFE:1::200 4 Neighbor Advertisement Neighbor Solicitation 3 Neighbor Cache <empty until step 5> 2 5 NS: Multicast NS: Solicited Node Multicast Ethernet IPv6 Header ICMPv6: Neighbor Solicitation/Advertisement NA: Unicast NA: Unicast More about address resolution in Lesson X. More about Solicited Node Multicast in Lesson X and Y.

Neighbor Solicitation 2001:DB8:CAFE:1::100/64 2001:DB8:CAFE:1::200/64 FF02::1:FF00:200 (Solicited Node Multicast) Neighbor Cache MAC Address 00-1B-24-04-A2-1E MAC Address 00-21-9B-D9-C6-44 PC2 PC1 Neighbor Solicitation I know the IPv6, but what is the MAC?

PC1 NS Ethernet II, Src: 00:21:9b:d9:c6:44, Dst: 33:33:ff:00:02:00 Internet Protocol Version 6 0110 .... = Version: 6 .... 0000 0000 .... .... .... .... .... = Traffic class: 0x00000000 .... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000 Payload length: 32 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: 2001:db8:cafe:1::100 Destination: ff02::1:ff00:200 Internet Control Message Protocol v6 Type: 135 (Neighbor solicitation) Code: 0 Checksum: 0xbbab [correct] Reserved: 0 (Should always be zero) Target: 2001:db8:cafe:1::200 ICMPv6 Option (Source link-layer address) Type: Source link-layer address (1) Length: 8 Link-layer address: 00:21:9b:d9:c6:44 Mapped multicast address for PC2 Next header is an ICMPv6 header Global unicast address of PC1 Solicited-node multicast address of PC2 Neighbor Solicitation message Target IPv6 address, needing MAC address (if two devices have the same solicited node address, this resolves the issue) MAC address of the sender, PC1

Neighbor Advertisement 2001:DB8:CAFE:1::100/64 2001:DB8:CAFE:1::200/64 FF02::1:FF00:200 (Solicited Node Multicast) MAC Address 00-1B-24-04-A2-1E MAC Address 00-21-9B-D9-C6-44 PC2 PC1 Neighbor Advertisement Neighbor Cache It’s my IPv6 and here is my MAC?

PC2 NA Ethernet II, Src: 00:1b:24:04:a2:1e, Dst: 00:21:9b:d9:c6:44 Internet Protocol Version 6 0110 .... = Version: 6 .... 0000 0000 .... .... .... .... .... = Traffic class: 0x00000000 .... .... .... 0000 0000 0000 0000 0000 = Flowlabel: 0x00000000 Payload length: 32 Next header: ICMPv6 (0x3a) Hop limit: 255 Source: 2001:db8:cafe:1::200 Destination: 2001:db8:cafe:1::100 Internet Control Message Protocol v6 Type: 136 (Neighbor advertisement) Code: 0 Checksum: 0x1b4d [correct] Flags: 0x60000000 Target: 2001:db8:cafe:1::200 ICMPv6 Option (Target link-layer address) Type: Target link-layer address (2) Length: 8 Link-layer address: 00:1b:24:04:a2:1e Unicast MAC address of PC1 Next header is an ICMPv6 header Global unicast address of PC2 Global unicast address of PC1 Neighbor Advertisement message IPv6 address of the sender, PC2 ICMPv6 Target IPv6 – you knew this but you needed – Link-layer Dest IPv6 and Dest MAC – Were part of the Neighbor Solicitation message MAC address of the sender, PC2

ICMPv6 Duplicate Address Detection (DAD) Global Unicast - 2001:DB8:CAFE:1::200 Link-local - FE80::1111:2222:3333:4444 See the process with: R1# debug ipv6 nd PC2 Neighbor Solicitation Hopefully no Neighbor Advertisement Duplicate Address Detection (DAD) is used to guarantee that an IPv6 unicast address is unique on the link. A device will send a Neighbor Solicitation for its own unicast address (static or dynamic). After a period of time, if a NA is not received, then the address is deemed unique. Once required, RFC was updated to where it is only recommended - /64 Interface ID makes duplicates unlikely!

10.4: Neighbor Cache

Neighbor Cache ? PC1 Neighbor Cache IPv6 Address MAC Address Neighbor Solicitation Neighbor Advertisement PC1 Neighbor Cache IPv6 Address MAC Address 2001:DB8:ACAD:1::10 0021.9bd9.c644 IPv6 - 2001:DB8:ACAD:1::10 MAC - 0021.9bd9.c644 ? Neighbor Cache – Maps IPv6 addresses with Ethernet MAC addresses Similar to ARP Cache for IPv4 5 States (2 noticeable and 3 transitory): Reachable: Packets have recently been received providing confirmation that this device is reachable. Stale: A certain time period has elapsed since a packet has been received from this address. Transitory States: INCOMPLETE, DELAY, PROBE

Neighbor Cache R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface FE80::50A5:8A35:A5BB:66E1 16 0021.9bd9.c644 STALE Fa0/0 2001:DB8:AAAA:1::100 16 0021.9bd9.c644 STALE Fa0/0 R1# ping 2001:db8:aaaa:1::100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:AAAA:1::100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms 2001:DB8:AAAA:1::100 0 0021.9bd9.c644 REACH Fa0/0 R1# Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

Neighbor Cache FSM Neighbor Cache (“ARP Cache”) See the process with: R1# debug ipv6 nd Neighbor Solicitation (NS) sent No Entry Exists Incomplete 3 NS sent with no NA returned NA received Reachable Time exceeded (default 30 sec) Or Unsolicited NA received Reachable NS sent and NA received Packet returned (TCP increasing ACK) Stale – no action required (Requires resolution again) Packet sent Delay (Resolution pending) 5 sec Probe (Reresolution in progress) http://cisconinja.wordpress.com/2009/03/07/ipv6-neighbor-discovery/ The only ways that reachability can be confirmed are: 1. Hints from an upper-layer protocol show that the connection is making forward progress – for example increasing, non-duplicate TCP acknowledgements are received. 2. A solicited NA is received in response to an NS. The NA must be solicited because an unsolicited NA would only confirm 1-way reachability. 3 NS sent with no NA returned

Neighbor Cache R1# debug ipv6 nd ICMP Neighbor Discovery events debugging is on R1# ping 2001:db8:aaaa:1::100 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:AAAA:1::100, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms *Oct 16 01:41:51.575: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) Resolution request *Oct 16 01:41:51.575: ICMPv6-ND: Created ND Entry Chunk pool *Oct 16 01:41:51.575: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) DELETE -> INCMP *Oct 16 01:41:51.575: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) Sending NS *Oct 16 01:41:51.575: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) Queued data for resolution *Oct 16 01:41:51.579: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) Received NA from 2001:DB8:AAAA:1::100 *Oct 16 01:41:51.579: ICMPv6-ND: Validating ND packet options: valid *Oct 16 01:41:51.579: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) LLA c471.fe7d.9c29 *Oct 16 01:41:51.579: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) INCMP -> REACH *Oct 16 01:42:21.639: ICMPv6-ND: (GigabitEthernet0/1,2001:DB8:AAAA:1::100) REACH -> STALE R1# Age Time (in minutes) since the address was confirmed to be reachable. A hyphen (-) indicates a static entry.

For more information please check out my Cisco Press book and video series: IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6 By Rick Graziani ISBN-10: 1-58714-313-5 IPv6 Fundamentals LiveLessons: A Straightforward Approach to Understanding IPv6 By Rick Graziani ISBN-10: 1-58720-457-6

10: ICMPv6 Neighbor Discovery Rick Graziani Cabrillo College Rick.Graziani@cabrillo.edu