Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a strange issue with a Cisco 877 and ipv6. My ISP provides me ipv6 connectivity natively, and the router is configured with the first address of the subnet I'm provided. On my network are around 20 hosts which all have IPv6 configured.

Each host can access the wider IPv6 internet perfectly. A traceroute shows the router appearing as the first hop, followed by my ISP.

What's really weird is that the router cannot ping6 any of the internal hosts on the network, and none of the internal hosts can ping6 the router directly. The router can ping any external ipv6 address, and it responds to IPv6 pings from external addresses.

Why is this?

Some relevent config bits:

no ipv6 source-route
ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool ipv6pool
ipv6 multicast-routing
ipv6 route ::/0 Dialer1
interface Dialer1
 description virtual dialer interface
 ip address negotiated
 ip access-group INTERNET-IN in
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer-group 1
 ipv6 enable
 ipv6 traffic-filter IPV6-IN in
 ppp authentication chap pap callin
 ppp chap hostname **
 ppp chap password 7 **
 no cdp enable
interface Vlan1
 description internal private VLAN
 ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nbar protocol-discovery
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 ip route-cache same-interface
 ip tcp adjust-mss 1452
 ipv6 address 2001:111:1111::1/64
 ipv6 enable
 ipv6 nd ra interval 4
 ipv6 dhcp server ipv6pool rapid-commit
 hold-queue 100 out


In response to some of the comments raised:

I can ping the router via IPv4, and clients get an auto-assigned IPv6 address from the correct subnet just fine. Some of the clients on the network have both auto-assigned IPv6 addresses and static IPv6 addresses, but I see the same ping behavior regardless of whether the client has a static IPv6 address or not.

I also see the same behavior if I turn off ipv6 cef.

Output of sh ipv6 neighbors:

talkbot#sh ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
FE80::21E1:D61:8F7B:EB78                   21 0022.1579.d21c  STALE Vl1
2001:111:1111:0:646:65FF:FE82:66A3          5 0446.6582.66a3  STALE Vl1
2001:111:1111:0:21E1:D61:8F7B:EB78        119 0022.1579.d21c  STALE Vl1
FE80::646:65FF:FE82:66A3                    5 0446.6582.66a3  STALE Vl1
2001:111:1111:0:225:B3FF:FEE6:47E2         13 0025.b3e6.47e2  STALE Vl1
FE80::225:B3FF:FEE6:47E2                   12 0025.b3e6.47e2  STALE Vl1
2001:111:1111:0:B957:209F:93A9:8699         0 0026.5e45.0b2c  STALE Vl1
FE80::20C:29FF:FEAE:A3B1                   15 000c.29ae.a3b1  STALE Vl1
2001:111:1111:0:F9CB:6036:495D:535C         0 0022.1579.d21c  REACH Vl1
FE80::203:97FF:FE05:C000                    - -               REACH Di1
2001:111:1111::10                           0 000c.29ce.a15d  REACH Vl1
2001:111:1111::13                          15 000c.29ae.a3b1  STALE Vl1
2001:111:1111::15                           3 000c.29b9.0130  STALE Vl1
2001:111:1111::14                          42 000c.29b9.7715  STALE Vl1
2001:111:1111::16                           3 000c.296f.74aa  STALE Vl1
FE80::20C:29FF:FE6F:74AA                    3 000c.296f.74aa  STALE Vl1
FE80::20C:29FF:FEB9:7715                    7 000c.29b9.7715  STALE Vl1
FE80::225:22FF:FEA1:321B                    8 0025.22a1.321b  STALE Vl1
FE80::20C:29FF:FECE:A15D                    0 000c.29ce.a15d  DELAY Vl1
FE80::F880:F7D2:A3DF:7BE6                   0 0026.5e45.0b2c  STALE Vl1
2001:111:1111:0:20C:29FF:FECE:A15D          3 000c.29ce.a15d  STALE Vl1
2001:111:1111:0:225:22FF:FEA1:321B          8 0025.22a1.321b  STALE Vl1
FE80::20C:29FF:FEB9:130                     3 000c.29b9.0130  STALE Vl1

Output of sh ipv6 route

talkbot#sh ipv6 route
IPv6 Routing Table - default - 4 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       D - EIGRP, EX - EIGRP external, ND - Neighbor Discovery
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
S   ::/0 [1/0]
     via Dialer1, directly connected
C   2001:111:1111::/64 [0/0]
     via Vlan1, directly connected
L   2001:111:1111::1/128 [0/0]
     via Vlan1, receive
L   FF00::/8 [0/0]
     via Null0, receive
share|improve this question
Is the address the clients cannot ping 2001:111:1111::1? (That is, the address assigned to the VLAN they are in) – David Schwartz Nov 7 '11 at 22:02
I've obfuscated, but yes. Internet clients can ping this. – growse Nov 7 '11 at 22:07
Can you post the output of show ipv6 neighbors and show ipv6 route on the router? Can you verify that the neighbor cache on the hosts includes the correct MAC address for the router? Have you tried running Wireshark on the hosts to see what is happening? (i.e. are some packets received but ignored?) – Mike Nov 12 '11 at 5:55
Also, have you tried turning off ipv6 cef to see if this is a bug with Cisco Express Forwarding? (perhaps ipv6 cef, at least in whatever version of software you're running, doesn't correctly identify IPv6 packets that need to be forwaded to software to be responded to by the host stack) Also, I found a reference that suggested that you need to also enable ipv6 cef at the interface level. – Mike Nov 12 '11 at 5:59
Can you see the Router Advertisements on VLAN1? If yes then the IPv6 capable hosts on that network should auto configure an address from the 2001:111:1111::/64 prefix. Just checking, but can you actually ping the IPv4 address from your network? – Sander Steffann Nov 15 '11 at 15:16

The issue here is that you have the same subnet (2001:111:1111::/64) on both sides, ie WAN (with Dialer1) and LAN (with Vlan1).

You can see on your routing table that if you want to reach a host from the router within that subnet, it goes to Dialer1 instead of Vlan1.

Anyhow, you should be able to reach the router from the lan on its link-local (fe80) address, and the same for any host present in the neighbor cache.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.