2

In our network, we have a Cisco router acting as the core router, connecting all our sites to the main site. We also have a Linux firewall connecting us to the Internet.

Site 1 --\
         +-------+   LAN   +----------------+
Site 2 --| Cisco |---------| Linux Firewall | ------ Internet
         +-------+    |    +----------------+
Site 3 --/            |
                    wksta

The LAN between the Cisco and the Firewall has (for example, not actual) 2001:DB8::/64, and the rest of 2001:DB8::/48 is distributed among the other sites.

Currently, the Cisco router is advertising 2001:DB8::/64 on the LAN, and the Linux Firewall is not advertising anything. As a result, the Cisco advertises itself as the default gateway, and wksta sends any Internet-bound traffic to the Cisco router first, then gets redirected to the Firewall by the Cisco router.

Is there a better way to do this? I'd like to be able to advertise to the LAN that 2001:DB8::/48 should be directed towards the Cisco router, but the default gateway should be the Linux Firewall. Is this possible with stateless autoconfig?

The Cisco router's current interface config:

interface FastEthernet0/0
 ipv6 address 2001:DB8::1/64
 ipv6 enable
!
Improve this question
2
  • 1
    Is there a reason you are not using separate LAN segments for end-hosts and transit routing? This avoids the exact scenario you are in right now.
    – cpt_fink
    Dec 3, 2014 at 5:27
  • Great point. That's probably the real answer.
    – NorbyTheGeek
    Dec 4, 2014 at 14:49

2 Answers 2

Reset to default
2

I don't think you can do this with just router advertisements.

My understanding here is that you want the following setup:

2001:DB8::/48 via cisco
default via linux

The problem is that router advertisements don't let you specify static routes. They just tell all the hosts what subnets are available on the local network (meaning they can be reached directly, without the gateway). Your remote sites are not on the local network, so they're not directly accessible, so router advertisements wouldn't help.

You could achieve this by adding static routes on all your local machines, but that will get annoying pretty quickly.

I would suggest disabling router advertisements on your Cisco device, and configuring them on your Linux machine. Then, on your Linux machine add a static route for 2001:DB8::/48 via the Cisco device.

Your internal traffic would still hit the Linux machine first, but you can't avoid this with just router advertisements.

You might be able to accomplish this using some sort of IPv6 neighbor proxying (this would make all the remote hosts appear to be on the same lan as your workstation), but I would not suggest that unless you really have no other option.

Improve this answer
1
  • This answer told me what I needed to know, that you can't advertise static routes via autoconfiguration. I ended up creating a transit VLAN between the Cisco router and the Linux firewall which solved the problem of needed to add static routes at all.
    – NorbyTheGeek
    Jan 9, 2015 at 17:04
0

The linux firewall should be announcing itself as a default gateway with router lifetime > 0. If the cisco router is still advertising as default gateway, try setting the AdvDefaultPreference parameter in radvd.conf on the firewall to High. Clients on the shared LAN segment should then automatically select the linux firewall as the default gateway.

Improve this answer
3
  • 1
    So, that would make the Linux firewall the default gateway, but is there also a way to advertise the rest of the /48 towards the Cisco router? If not, I have the same problem - redirects.
    – NorbyTheGeek
    Dec 2, 2014 at 20:30
  • you don't turn radv off on the cisco router, just default route advertisement. The cisco should still advertise its link-local prefixes normally.
    – Andrew Domaszek
    Dec 2, 2014 at 20:33
  • If you just want to disable redirects on the Cisco device you can use no ipv6 redirects.
    – cpt_fink
    Dec 3, 2014 at 5:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .