The cisco ASA firewall allows for you to manage failover link addressing with an ipv6 address.
It's uses the exact same command but just subsitute the ipv4 address with a ipv6;
e.g ( master )
failover
failover lan unit primary <------MASTER
failover lan interface LANFAIL Port-channel1
failover polltime unit msec 300 holdtime msec 900
failover polltime interface 2 holdtime 15
failover replication http
failover link LANFAIL Port-channel1
failover interface ip LANFAIL 2001:db8:666::1/64 standby 2001:db8:666::2
failover group 1
preempt
failover group 2
secondary
preempt
e.g (slave )
failover
failover lan unit secondary <------STANDBY
failover lan interface LANFAIL Port-channel1
failover polltime unit msec 300 holdtime msec 900
failover polltime interface 2 holdtime 15
failover replication http
failover link LANFAIL Port-channel1
failover interface ip LANFAIL 2001:db8:666::1/64 standby 2001:db8:666::2
failover group 1
preempt
failover group 2
secondary
preempt
As usual you can define a ipv6 address on your ifname and specify a ipv6 address for standby
!
interface gi0/0
nameif inside_trust
security-level 100
ipv6 enable
ip address 192.168.88.1 255.255.255.0 standby 192.168.88.2
ipv6 address 2001:db8:192::1/64 standby 2001:db8:192::2
end
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Monday, August 10, 2015
Thursday, August 6, 2015
Support transfer ( FTNT vrs PANW )
One of the biggest complaints with the fortinet hardware, if you buy any item from let's say ebay and it has a support contract is almost very difficult to transfer any remainding registration. Even if the item is out of support, it's still hard to change ownership.
Here's what the Kb@FTNT states
http://kb.fortinet.com/kb/documentLink.do?externalID=FD36119
Okay for comparison PaloAlto makes it very easy.
Just thought it was interesting to see how 2 security vendors handle transfer of ownership
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Here's what the Kb@FTNT states
http://kb.fortinet.com/kb/documentLink.do?externalID=FD36119
Okay for comparison PaloAlto makes it very easy.
Just thought it was interesting to see how 2 security vendors handle transfer of ownership
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Why host /systems clocks need the correct time ( important )
HTTPs web access can be quite interesting. If your clocks are way off , you will be flagged and prevent from accessing the site.
E.g ( google mail and Chrome-Browser )
Look at these 2 screenshots taken & with the date incorrectly applied
Google chrome will warn you, but other browsers will execute in a loop and never establish the SSL handshake.
It deals primarily with SSL certificates validations and expiration. If the browser is too far ahead or behind a certification date, you can't trust the SSL connection.
Take a look;
Nice !
So keep this thought in mind," if you have access problems with google applications or various sites, make sure your system clock is correct!"
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
E.g ( google mail and Chrome-Browser )
Look at these 2 screenshots taken & with the date incorrectly applied
Google chrome will warn you, but other browsers will execute in a loop and never establish the SSL handshake.
It deals primarily with SSL certificates validations and expiration. If the browser is too far ahead or behind a certification date, you can't trust the SSL connection.
Take a look;
So keep this thought in mind," if you have access problems with google applications or various sites, make sure your system clock is correct!"
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Lack of SSLvpn history fortigate
In this posting, I will like to share a sslvpn statistics issues.
The Fortigate SSLVPN Webportal access has a window dialog, that should provide login history, but I found out that it does not update any information.
This was found under fortiOS 5.2.3 Take a look at these following screenshot.
The Fortigate SSLVPN Webportal access has a window dialog, that should provide login history, but I found out that it does not update any information.
This was found under fortiOS 5.2.3 Take a look at these following screenshot.
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Wednesday, August 5, 2015
fortigate device identification can easily be forged
In this post I will point out that fortigate device identification and how it's not 100% fool-proof. In fact it can easily be fooled.
I know plenty of firewall engineer in the FTNT camp, and most swear by device identification, but the truth is; " they are bias for it & are mistaken on the actual security protection that it offers".
Device identification is typically used to control a wide audience of device & mainly by mac_address or device type ( computer phone tablet etc....). But the method used by fortinet is not as solid as some may think.
I've seen numerous public k-12 schools deploy this method to restrict or attempt to restrict mobile devices from the network access. In one school I was at, they attempted to ban all non -Apple tablets from the classroom environment and it was a big failed.
1st off mac address filtering and those that deploy it, really don't understand it ( imho ) or blindly put all trust in it. Either way, any two-bit end-user who has admin or super-user access and can change the system interface mac address, can easily fool any systems that relies on mac-filtering.
My macbook for example, can have it's wired or wireless interface(s) ether-address change just by disabling the interface and using the ifconfig to reconfigure the ether address.
review the manpages for airport and ifconfig cli commands
e.g ( changing wireless interface en0 mac_address after disassociating )
2nd, the http user-agent detection for a device can easily be substituted via a user-agent switcher. Once again any two-bit end users can execute this with ease. Here's my macbook Air BIA Mac_Address = b8:e8:56:12:d2:08
I change the user-agent within the firefox browser and the same macbook can now posed as a window host, linux host or palmOS, etc.....
Guess what ? My device is still really a macbook Air! But are you 100% sure ? Please take a look at the diag user device list outputs.
A user-agent detection website site can be used to show and display your claimed user-agent
Here's some example of wrong identifications.
And here's the correct one.
Even a Nexus10 tablet could be masked as a iPad device or iPod using the chameleon app. And yes this is a Samsung Tablet impostering as a Apple Product with no "rooting".
Let's look at just some of the defined categories that are listed.
In this output the only tablet ( android ) that's correctly ID is my nexus 10 tablet, all others devices including my wife's Galaxy Note3 are Identified as a Android-Tablet.
Funny, my older NexusS phone was properly identified as a phone.
So be careful on how you deploy device identification and if you define a blacklist. This method for network control is not 100% perfect. Numerous other & better means for controlling devices access exists such-as ;
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
I know plenty of firewall engineer in the FTNT camp, and most swear by device identification, but the truth is; " they are bias for it & are mistaken on the actual security protection that it offers".
Device identification is typically used to control a wide audience of device & mainly by mac_address or device type ( computer phone tablet etc....). But the method used by fortinet is not as solid as some may think.
I've seen numerous public k-12 schools deploy this method to restrict or attempt to restrict mobile devices from the network access. In one school I was at, they attempted to ban all non -Apple tablets from the classroom environment and it was a big failed.
1st off mac address filtering and those that deploy it, really don't understand it ( imho ) or blindly put all trust in it. Either way, any two-bit end-user who has admin or super-user access and can change the system interface mac address, can easily fool any systems that relies on mac-filtering.
My macbook for example, can have it's wired or wireless interface(s) ether-address change just by disabling the interface and using the ifconfig to reconfigure the ether address.
e.g ( changing wireless interface en0 mac_address after disassociating )
2nd, the http user-agent detection for a device can easily be substituted via a user-agent switcher. Once again any two-bit end users can execute this with ease. Here's my macbook Air BIA Mac_Address = b8:e8:56:12:d2:08
I change the user-agent within the firefox browser and the same macbook can now posed as a window host, linux host or palmOS, etc.....
Guess what ? My device is still really a macbook Air! But are you 100% sure ? Please take a look at the diag user device list outputs.
Here's some example of wrong identifications.
Even a Nexus10 tablet could be masked as a iPad device or iPod using the chameleon app. And yes this is a Samsung Tablet impostering as a Apple Product with no "rooting".
Let's look at just some of the defined categories that are listed.
In this output the only tablet ( android ) that's correctly ID is my nexus 10 tablet, all others devices including my wife's Galaxy Note3 are Identified as a Android-Tablet.
Funny, my older NexusS phone was properly identified as a phone.
So be careful on how you deploy device identification and if you define a blacklist. This method for network control is not 100% perfect. Numerous other & better means for controlling devices access exists such-as ;
- deploying fortinet FSSO agent
- enabling layer2 802.1x
- captive portals w/user authentications
- NAC_profiling
- EndPoint Registrations
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Just how many ipv6 prefixes can be advertisd in ICMPv6-RA ( fortigate-juniper-cisco firewall ) ?
A:
So if the cisco switch is limited a total of 44 total ipv6 prefixes, what can a fortigate firewall do?
32 ipv6 prefixes, and that's the max number you can install under the "config ip6-prefix-list" per interface. You can't configure more than 32 prefixes per interface.
B:
So if the cisco switch is limited to of 44 total ipv6 prefixes, what can a juniper SRX firewall do?
44 ipv6 prefixes,you can configure more than the max number with the "set protocols router-advertisement interface" per interface. But the junos will only deliver the 1st 44 prefixes in the ICMPv6 RA per interface.
C:
So if the cisco switch is limited to of 44 total ipv6 prefixes, what can a cisco ASA firewall do?
45 ipv6 prefixes, you can configure more under the interface, but the cisco ASA will only deliver the 1st 45 prefixes.
But I ran into a problem with a macosx machine picking up prefixes that I will discuss my finding in a future post.
These where the following firewall versions that I tested with;
Fortinet Fortigate = FortiOS 5.2.3
Juniper SRX = JUNOS 12.1X46-D15.3
cisco ASA = 9.4.1
So why the total amount of prefixes are limited to just 44 or 45 ipv6-prefixes ?
The total is due to the size of the ethernet frame "MTU". With a 1500byte MTU, you can only have a ICMPv6 RA packet with 44-45 ipv6 prefixes. This packet has all of the details to include the prefix-length and any timer options for lifetime. Any more and the ICMPv6 RA will not fit into a standard ethernet.frame
So to prove this point, I took the same Juniper SRX and changed the interface vlan.0 mtu from 1500 to 1000bytes.
see the before and after screenshots
Now while the ICMPv6 RA is being constructed & sent, the total ethernet frame size is smaller, so less prefixes are included in the Router-Advertisement. So we now have a total of 28 ipv6 prefixes in one advertisement.
IPv6 hates fragmentation, and it will not fragment or install two route-advertisements
The RFC 6980 speaks a little about this and the security risks of ND and fragments.
https://www.rfc-editor.org/info/rfc6980
I hope this sheds some light on the ICMPv6 RAs packets, please read the these 2 other postings
http://socpuppet.blogspot.com/2014/03/protection-from-rouge-ra-advertisements.html
http://socpuppet.blogspot.com/2015/07/ipv6-ra-security-concerns.html
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
So if the cisco switch is limited a total of 44 total ipv6 prefixes, what can a fortigate firewall do?
32 ipv6 prefixes, and that's the max number you can install under the "config ip6-prefix-list" per interface. You can't configure more than 32 prefixes per interface.
B:
So if the cisco switch is limited to of 44 total ipv6 prefixes, what can a juniper SRX firewall do?
44 ipv6 prefixes,you can configure more than the max number with the "set protocols router-advertisement interface" per interface. But the junos will only deliver the 1st 44 prefixes in the ICMPv6 RA per interface.
C:
So if the cisco switch is limited to of 44 total ipv6 prefixes, what can a cisco ASA firewall do?
45 ipv6 prefixes, you can configure more under the interface, but the cisco ASA will only deliver the 1st 45 prefixes.
These where the following firewall versions that I tested with;
Fortinet Fortigate = FortiOS 5.2.3
Juniper SRX = JUNOS 12.1X46-D15.3
cisco ASA = 9.4.1
So why the total amount of prefixes are limited to just 44 or 45 ipv6-prefixes ?
The total is due to the size of the ethernet frame "MTU". With a 1500byte MTU, you can only have a ICMPv6 RA packet with 44-45 ipv6 prefixes. This packet has all of the details to include the prefix-length and any timer options for lifetime. Any more and the ICMPv6 RA will not fit into a standard ethernet.frame
So to prove this point, I took the same Juniper SRX and changed the interface vlan.0 mtu from 1500 to 1000bytes.
Now while the ICMPv6 RA is being constructed & sent, the total ethernet frame size is smaller, so less prefixes are included in the Router-Advertisement. So we now have a total of 28 ipv6 prefixes in one advertisement.
The RFC 6980 speaks a little about this and the security risks of ND and fragments.
https://www.rfc-editor.org/info/rfc6980
I hope this sheds some light on the ICMPv6 RAs packets, please read the these 2 other postings
http://socpuppet.blogspot.com/2014/03/protection-from-rouge-ra-advertisements.html
http://socpuppet.blogspot.com/2015/07/ipv6-ra-security-concerns.html
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Tuesday, August 4, 2015
Just how many ipv6 prefixes can be advertisd in ICMPv6-RA ( cisco switch ) ?
I was really bored today, so I enabled some ipv6 interfaces on a cisco 6509-E switch and cisco 2960S switch. Just to see how may ipv6 route-advertisement can be inserted for autoconf.
My outcome was a big surprise. Most unix and windows systems can take upto 15 max ipv6-prefixes.
Will the cisco 2960S with auto config , can take much more, but 1st here's the cfg.
And on the cisco 6509-E, I decided to inject 100 prefixes on my interface. I used a cfgmaker to speed up my configuration;
Now we enabled debug to monitor the ipv6 ND RAs
debug ipv6 nd was used for ipv6 prefixes diagnostics
Only 44 prefixes assigned on my vlan9 interface from the cisco 6509-E where sent. So out of the 100 prefixes, we've only had autconf configure 44. Than the 2960S threw up an error via the ipv6 address manager.
So does a limitation exists in the number of ipv6 prefixes that can be advertised via a cisco L3 switch? I used tshark to confirm just how many prefixes are being sent out of the 100 that was enabled on my ipv6 interface & it confirms 44 prefixes where advertised by the L3 cisco switch.
A local debug on RA-enabled L3 switch shows 44 ipv6 prefixes being sent also;
Aug 4 15:00:39.699: ICMPv6-ND: Request to send RA for FE80::1EE6:C7FF:FE52:A6C0
Aug 4 15:00:39.699: ICMPv6-ND: Setup RA from FE80::1EE6:C7FF:FE52:A6C0 to FF02::1 on Vlan9
Aug 4 15:00:39.699: ICMPv6-ND: MTU = 1500
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:1::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:2::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:3::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:4::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:5::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:6::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:7::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:8::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:9::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:10::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:11::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:12::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:13::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:14::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:15::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:16::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:17::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:18::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:19::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:20::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:21::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:22::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:23::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:24::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:25::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:26::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:27::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:28::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:29::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:30::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:31::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:32::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:33::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:34::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:35::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:36::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:37::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:38::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:39::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:40::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:41::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:42::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:43::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:44::/64 onlink autoconfig
and
Aug 4 15:03:57.027: ICMPv6-ND: Request to send RA for FE80::1EE6:C7FF:FE52:A6C0
Aug 4 15:03:57.027: ICMPv6-ND: Setup RA from FE80::1EE6:C7FF:FE52:A6C0 to FF02::1 on Vlan9
Aug 4 15:03:57.027: ICMPv6-ND: MTU = 1500
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:1::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:2::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:3::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:4::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:5::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:6::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:7::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:8::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:9::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:10::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:11::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:12::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:13::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:14::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:15::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:16::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:17::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:18::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:19::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:20::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:21::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:22::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:23::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:24::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:25::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:26::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:27::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:28::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:29::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:30::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:31::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:32::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:33::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:34::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:35::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:36::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:37::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:38::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:39::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:40::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:41::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:42::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:43::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:44::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
The software used on the cisco layer2 and layer3 switches.
software 6509-E = 15.1(2)SY2 adv-enterprise
software 2960S = 15.2(1)E2
Interesting but the question that arose, " does any layer2 ipv6 enabled subnet need that many ipv6 prefixes ? " . The answer is all up to you.
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
My outcome was a big surprise. Most unix and windows systems can take upto 15 max ipv6-prefixes.
Will the cisco 2960S with auto config , can take much more, but 1st here's the cfg.
And on the cisco 6509-E, I decided to inject 100 prefixes on my interface. I used a cfgmaker to speed up my configuration;
Now we enabled debug to monitor the ipv6 ND RAs
Only 44 prefixes assigned on my vlan9 interface from the cisco 6509-E where sent. So out of the 100 prefixes, we've only had autconf configure 44. Than the 2960S threw up an error via the ipv6 address manager.
So does a limitation exists in the number of ipv6 prefixes that can be advertised via a cisco L3 switch? I used tshark to confirm just how many prefixes are being sent out of the 100 that was enabled on my ipv6 interface & it confirms 44 prefixes where advertised by the L3 cisco switch.
A local debug on RA-enabled L3 switch shows 44 ipv6 prefixes being sent also;
Aug 4 15:00:39.699: ICMPv6-ND: Request to send RA for FE80::1EE6:C7FF:FE52:A6C0
Aug 4 15:00:39.699: ICMPv6-ND: Setup RA from FE80::1EE6:C7FF:FE52:A6C0 to FF02::1 on Vlan9
Aug 4 15:00:39.699: ICMPv6-ND: MTU = 1500
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:1::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:2::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:3::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:4::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:5::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:6::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:7::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:8::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:9::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:10::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:11::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:12::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:13::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:14::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:15::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:16::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:17::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:18::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:19::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:20::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:21::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:22::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:23::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:24::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:25::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:26::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:27::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:28::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:29::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:30::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:31::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:32::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:33::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:34::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:35::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:36::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:37::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:38::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:39::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:40::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:41::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:42::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:43::/64 onlink autoconfig
Aug 4 15:00:39.699: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:00:39.699: ICMPv6-ND: prefix = 2001:DB8:44::/64 onlink autoconfig
and
Aug 4 15:03:57.027: ICMPv6-ND: Request to send RA for FE80::1EE6:C7FF:FE52:A6C0
Aug 4 15:03:57.027: ICMPv6-ND: Setup RA from FE80::1EE6:C7FF:FE52:A6C0 to FF02::1 on Vlan9
Aug 4 15:03:57.027: ICMPv6-ND: MTU = 1500
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:1::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:2::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:3::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:4::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:5::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:6::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:7::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:8::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:9::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:10::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:11::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:12::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:13::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:14::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:15::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:16::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:17::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:18::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:19::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:20::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:21::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:22::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:23::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:24::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:25::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:26::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:27::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:28::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:29::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:30::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:31::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:32::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:33::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:34::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:35::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:36::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:37::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:38::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:39::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:40::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:41::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:42::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:43::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
Aug 4 15:03:57.027: ICMPv6-ND: prefix = 2001:DB8:44::/64 onlink autoconfig
Aug 4 15:03:57.027: ICMPv6-ND: 2592000/604800 (valid/preferred)
The software used on the cisco layer2 and layer3 switches.
software 6509-E = 15.1(2)SY2 adv-enterprise
software 2960S = 15.2(1)E2
Interesting but the question that arose, " does any layer2 ipv6 enabled subnet need that many ipv6 prefixes ? " . The answer is all up to you.
Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix -----a----t---- socpuppets ---dot---com
^ ^
=( * * )=
o
/ \
Subscribe to:
Posts (Atom)