Unregistered Multicast Filtering vs. NDP Protocol for IP V6 Ping SG300

[johanneslohmann]

Hi everybody,

we are running several switches of the SG 300 Series all with Firmware sx300_fw-14088.

We are having a setup that uses a lot of Multi Cast so we use the IGMP Feature of the Switch and enable unregistered multicast filtering.

However: if we enable unregistered multicast filtering, we cannot get a Ping V6 to work. We know, that the basis is the NDP protocol to resolve mac addresses to IP v6.

It seems as if the switch thinks that the multicast based NDP protocotol is unregistered multicast.

Any suggestions?

an example configuration configuration is attached to this mail:

[Tom Watts]

Hi, IGMP and NDP don't work well together. You should be using MLD if any at all. IGMP is for ipv4, MLD is for ipv6, with either configured for their respective suite, this should manage your queries fine.

You see, the problem here I think is unregister multicast is defined as a packet that does not have an address of any of your groups. If I'm not mistaken the unregister multicast would be considered an ipv4 variety but the NDP contains ipv6 information, therefore must be dropped.

Please feel free to correct me if I'm mistaken, I'm not by any means an ipv6 expert.

[edgar.reinke]

There are strict rules to map L3 IPv6 Addresses and L3 IPv4 addresses to L2 Mac Addresses. At the end those Mac Addresses are Multicast addresses independent of their roots (IPv6 or IPv4). Of course you are able to keep them separate from each other (00-01-FF vs. 33-33-FF), but both have the I/G-Bit set to 1 and for a Switch those addresses are multicasts.

It might be that you are using the default Multicast properties: Forwarding Method for IPv6 and Forwarding Method for IPv4 equals MAC Group address. Therefore, the Switch should use the Multicast Mac addresses as an IGMP Snooping filter as well. The Multicast Mac Address which is used in ICMP Type 135 (Neighbor Solicitation) of course is not registered via IGMP and will get blocked. This is only a guess, but it should be worth the effort to Switch the forwarding method to IP Group address.

Cheers,

@gar

[edgar.reinke]

... ok, we finished our tests. From our perspective this a bug. ICMP ND uses Solicited MC addresses (means an IPv6 MC address which belongs to the IPv6 unicast address of the node). Of course Solicited MC addresses will never be registered using MLD. We can see that the switch sees all IPv6 MC addresses registered with MLD. Therefore, MLD on the switch is working, but the Solicited MC addresses cannot be part of this table.

When Filtering Unregistered MC addresses is enabled the Switch starts blocking the IPv6 Solicited MC addresses ... it seems to be that the switch does not keep IPv6 MC addresses separate from IPv6 Solicited MC addresses used by the IPv6 ND process.

Regards,

@gar

[michal.puczynski]

Just for community to know, I am running network that uses multiple Cisco switches, Cat 3750, 3750E, 3750X and also SG-200 in numerous variants 8-port, 26-port and SG-300 52 ports.

I have the same issue with IPV6 router advertisements. These are blocked once I filter unregistered multicast. This is confirmed on all hosts attached to the switch.

Default switch SG200 and SG300 setting is to forward unregistered multicast and it seems to be ok for most small office cases, but I am running a lot of multicast, thus IGMP snooping must be enabled and unregistered multicast forwarding disabled, otherwise ports are flooded with more than 100Mbps multicast (yes I do have so many sources).

I have tried different combinations, but for SG200-08 none is working. For SG200-26 and SG300-52, the following one works: disable forwarding on host ports, leave it on on trunk ports. Be sure switch learned mrouter port and it is seen either by "dynamic" or it is set manually.