Project

General

Profile

Actions

Bug #6541

open

IPv6 RAs always include on-link prefix; clients may not use DHCPv6 managed addresses

Added by Bruce Simpson about 5 years ago. Updated almost 2 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
IPv6 Router Advertisements (RADVD)
Target version:
-
Start date:
06/27/2016
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
Affected Architecture:

Description

pfSense IPv6 RA support in 2.3.1-x correctly includes the 'M' (Managed) bit in its advertisements.

By contrast, Cisco IOS supports an explicit "ipv6 nd prefix default non-advertise" configuration to prevent this.

However, pfSense always includes the on-link prefix in these advertisements, even if the "Router mode" in Services -> DHCPv6 Server & RA -> LAN -> Router Advertisements is set to "Managed".

This causes Mac OS X clients to (inappropriately) use SLAAC & privacy addresses by default, unless temporary addresses are explicitly disabled system-wide using sysctl (as per FreeBSD).

Linux and Windows do not exhibit this issue and use the DHCPv6 statefully-managed address by default -- which is the desired behaviour in this configuration. (It's an office, PCI DSS is in play, and we need to at least track who initiated communication to the outside world, even if we don't act as a man-in-the-middle.)

There appears to be no option to disable advertising the on-link prefix.

Actions #1

Updated by Bruce Simpson about 5 years ago

First two sentences above are reversed -- my bad.

TL;DR -- a Cisco will let you advertise 'M' and only 'M', causing clients to use DHCPv6 managed (desired here). pfSense will advertise 'M', but also includes the RA Option 24 ('route info') for the on-link prefix. Some IPv6 clients take that as a sign to use SLAAC/privacy (not desired here).

Actions #2

Updated by Kill Bill over 4 years ago

Are you talking about this? Bug #6237

Actions #3

Updated by Jim Pingle almost 2 years ago

  • Category set to IPv6 Router Advertisements (RADVD)
Actions

Also available in: Atom PDF