IPv6 clients can't ping each other even they are in the same LAN

[yxiao]

Greetings,

I have a PVE hypervisor, and I created one VM as the DHCP server, and I have two other clients as DHCP clients. Both clients are getting their IPv6 leases successfully. One has the IP 2001:db8:1::1 and the other has IP 2001:db8:1::2. But I can't ping the clients from each other.

I did a packets capture, and I see the neighbor discovery between the server and client. And from one client, I can see the Renewal message from another client and I can see Multicast Listener Report Message v2 from another client, but there's no solicit message from the other client. 

I don't have any v-routers in this network segment, but since one client can see the message from the other client. Why there's no neighbor discovery information exchange between them? Can IPv6 experts help answer? Thank you! 

[Harold Ritter]

Hi @yxiao ,

Can you check that the VM is configured to accept the RA?

sysctl -a | grep accept_ra

Regards,

[yxiao]

Hi Harold,

Here's the results, looks like so:

[Harold Ritter]

Hi @yxiao ,

I suppose ens18 is the interface you are using for that VM, right?

If so, I think "net.ipv6.conf.ens18.accept_ra" should be set to 1 (on).

Could you try the following:

sudo sysctl -w net.ipv6.conf.ens18.accept_ra=1

Regards,

[yxiao]

Ha, yes, it is using interface ens18, let me modify it and see. Thank you very much, Harold! 

[yxiao]

Hi @Harold Ritter ,

I had a strange behavior, after i changed the "sudo sysctl -w net.ipv6.conf.ens18.accept_ra=1", both VMs in this LAN have lost their IPs from my DHCP server. I rebooted the VM and after that both VMs got the IPv6 addresses from server again.

I just don't quite understand how IPv6 LAN really work. I bought Rick's IPv6 Fundamentals book from Cisco Press, the 1st edition. He did a great illustration in chapter 5, figure 5-17. It consists of PC1 and PC2 and R1, how R1 is able to ping R2. He mentioned When there's no entry for the target PC2 IPv6 address, then PC1 puts the IPv6 packet on hold and issues a Neighbor Solicitation message. And the neighbor solicitation is sent to the solicited node multicast address.

But in my case, the problem is that as long as I pinged the IP from VM1 to VM2, i got the "connect: Network is unreachable" error message. Seems the VM1 didn't even try to send the neighbor solicitation to multicast address. I see you mentioned because there's no route, but Rick's book doesn't have more details when there's no route. What should I do? I should configure a default route on both VMs? But where should this default route go to? Should I use the IP of the vyos virtual router?

I guess my question is equal to why we don't need default route to ping each other between two IPv4 hosts in the same network section, but why we need the default route for IPv6, and how to configure this default route. Much appreciation if you can help explain further to me! 

Below is what happened if I tried to add the vyos router IP as the default route, I still get the error: No route to host:

[Harold Ritter]

Hi @yxiao ,

The VMs should get a route to each other via the prefix included in the RA. If it is not the case, then there something wrong with how the VM is setup. Can you provide the output for "ip -6 route".

You should see something like this:

cisco@PC1:~$ ip -6 route
::1 dev lo proto kernel metric 256 pref medium
2001:db8:12ff:1::/64 dev ens2 proto ra metric 100 pref medium
fe80::/64 dev ens2 proto kernel metric 256 pref medium
default via fe80::5054:ff:fe0d:4953 dev ens2 proto ra metric 100 expires 1733sec mtu 1500 pref medium
cisco@PC1:~$

Regards,

[yxiao]

here it is, from both clients:

May I ask how this default route was produced? I didn't see it in Rick's book either.

[Harold Ritter]

Hi @yxiao ,

Both the /64 for the local subnet and the default are direct consequences of the RA.

This is not the case for you. Can you check that the VMs are not set for forwarding:

sudo sysctl -a | grep net.ipv6.conf.*.forwarding

Regards,

[yxiao]

Hi Harold,

Both have the same results as below, i did changed one option I think the first one to 1, but the result was the same:

[Harold Ritter]

Hi @yxiao ,

This is good. The device will normally not accept the RA if the forwarding is set to 1, which is not the case for you. The issue is somewhere else then.

What version are you running on the VMs?

uname -a

Regards,

[yxiao]

Hi Harold,

Good to know! I am using Rocky Linux8.8 on my clients, after CentOS, I guess more people are moving to Rocky Linux

[Harold Ritter]

Hi @yxiao ,

I don't see anything wrong with this distribution, but I would definitely try with some other distribution to see if it fixes the issue.

Regards,

[yxiao]

Thank you, Harold! I will try. 

[yxiao · Accepted solution]

Hi @Harold Ritter ,

I finally found the problem. Previously, in Rocky Linux, I had chosen the option as Automatic, DHCP Only, and this option allow VM reach out to DHCP server to get the IPv6 address but broke the route. So I had to change it to Automatic option and also enable the vRouter, after both, now I am able to ping each other! 

Thank you very much for all the time and energy on troubleshooting my issue! Much appreciate for all your kind help! 

[Harold Ritter]

I am glad you found the issue @yxiao. It makes a lot of sense. Thanks for sharing