[KPN glas] IPv6 icm Cisco ASA 5506-X

[s.vanrossem]

Hoi,

Ik ben een beetje aan het stoeien met mijn ASA-5506-X om IPv6 werkend te krijgen op mijn LAN. Mijn ASA is uitgerust met ASA software 9.9.2 en ASDM 7.12.2.
Inmiddels heb ik het voor elkaar dat de hosts achter mijn LAN-interface dmv LL een IPv6 adres krijgen via DHCP. Echter krijg ik de route naar buiten niet een de gang lijkt het.

WAN interface

code:

WAN is up, line protocol is up
  IPv6 is enabled, link-local address is fe80::2a6:caff:fe07:6e48  
  No global unicast address is configured

  Joined group address(es):
    ff02::1:ff07:6e48
    ff02::2
    ff02::1
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use DHCP to obtain routable addresses.
  Hosts use DHCP to obtain other configuration.

code:

show ipv6 dhcp interface WAN

Geeft niets

Op mijn host via de LAN-interface

code:

eno1: Router Advertisement from fe80::1:1
eno1: adding address 2a02:a456:xxxx:1:f8ee:e583:18c8:b320/64
eno1: adding route to 2a02:a456:xxxx:1::/64
eno1: adding default route via fe80::1:1

Iemand ervaring mee?

[ Voor 72% gewijzigd door s.vanrossem op 25-06-2019 11:33 ]

[rens-br]

@s.vanrossem je openingspost is momenteel een beetje aan de karige kant, er ontbreekt namelijk een hoop informatie. Zou je eens willen toevoegen wat je nu allemaal hebt ingesteld en wat je al gevonden en geprobeerd hebt?

Op die manier kunnen we je een stuk beter helpen.

[s.vanrossem]

De config op de asa zelf:

code:

interface GigabitEthernet1/1
 nameif WAN
 security-level 0
 pppoe client vpdn group KPN
 ip address pppoe 
 ipv6 address autoconfig
 ipv6 enable
!
interface GigabitEthernet1/2
 nameif LAN
 security-level 100
 ip address 10.0.1.254 255.255.255.0 
 ipv6 address fe80::1:1 link-local
 ipv6 address 2a02:a456:xxxx:1::/64 eui-64
 ipv6 address autoconfig default trust dhcp
 ipv6 address dhcp
 ipv6 enable
 ipv6 nd ra-interval 60
 ipv6 nd managed-config-flag

[YoeriOppelaar]

Goedenavond.
Krijg je op dit moment een ipv6 op je outside interface? Bied KPN deze überhaupt op je verbinding?

[s.vanrossem]

@YoeriOppelaar op de asa krijg ik het niet voor elkaar.
Momenteel heb ik een pfsense machine schaduw draaien waarbij ik het wel voor elkaar heb gekregen dmv deze guide; Venxblog: KPN glasvezel via PFSense . Daar krijg ik netjes aan gateway en kan ik mijn lan interfaces en hosts daaronder voorzien van een /64 adres via dhcp. Met deze configuratie haal ik een 10/10 bij test-ipv6.com.

[YoeriOppelaar]

Hallo s.vanrossem,
sorry voor het laat reageren, paar dagen voor een project offline geweest.

heb je voor mij de output van de complete config (let uiteraard even op de persoonlijke dingen als omschrijvingen en zo, die mogen er uiteraard uit), en de output van "show ipv6 interface ..." en "show ipv6 route"

[s.vanrossem]

code:

: 
: Serial Number: JAD2033060Y
: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.9(2)52 
!
hostname asa
enable password ****
names
dns-guard

!
interface GigabitEthernet1/1
 nameif WAN
 security-level 0
 pppoe client vpdn group KPN
 ip address pppoe 
 ipv6 address autoconfig
 ipv6 enable
!
interface GigabitEthernet1/2
 nameif LAN
 security-level 100
 ip address 10.0.1.254 255.255.255.0 
 ipv6 address fe80::1:1 link-local
 ipv6 address 2a02:a456:xxxx:1::/64 eui-64
 ipv6 address autoconfig default trust dhcp
 ipv6 address dhcp
 ipv6 enable
 ipv6 nd ra-interval 60
 ipv6 nd managed-config-flag
!
interface GigabitEthernet1/3
 shutdown
 nameif WLAN
 security-level 100
 ip address 10.0.2.254 255.255.255.0 
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 nameif TMP
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
boot system disk0:/asa992-52-lfbff-k8.SPA
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup WAN
dns server-group DefaultDNS
 name-server 1.1.1.1 WAN
 name-server 1.0.0.1 WAN
same-security-traffic permit inter-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network ALL
 subnet 0.0.0.0 0.0.0.0
pager lines 24
logging enable
logging asdm informational
mtu WAN 1508
mtu LAN 1508
mtu WLAN 1500
mtu TMP 1500
icmp unreachable rate-limit 1 burst-size 1
icmp deny any WAN
asdm image disk0:/asdm-7122.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
nat (TMP,WAN) after-auto source dynamic any interface
nat (LAN,WAN) after-auto source dynamic any interface
ipv6 route WAN ::/0 fe80::a0ec:1375:6962:4c3d
route WAN 0.0.0.0 0.0.0.0 195.190.228.75 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http server idle-timeout 3
http server session-timeout 3
http 10.0.1.0 255.255.255.0 LAN
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map LAN_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map LAN_map interface LAN
crypto ca trustpool policy
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable LAN client-services port 443
telnet timeout 3
ssh stricthostkeycheck
ssh timeout 3
ssh version 2
ssh key-exchange group dh-group14-sha1
console timeout 0
vpdn group KPN request dialout pppoe
vpdn group KPN localname *****
vpdn group KPN ppp authentication pap
vpdn username *****

dhcpd auto_config WAN
!
dhcpd address 10.0.1.1-10.0.1.250 LAN
dhcpd dns 8.8.8.8 8.8.4.4 interface LAN
dhcpd lease 600 interface LAN
dhcpd enable LAN
!
threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 213.136.0.252 source WAN prefer
ssl server-version tlsv1.2
ssl client-version tlsv1.2
ssl dh-group group14
webvpn
 anyconnect image disk0:/anyconnect/anyconnect-linux64-4.7.03052-webdeploy-k9.pkg 1
 anyconnect image disk0:/anyconnect/anyconnect-macos-4.7.03052-webdeploy-k9.pkg 2
 anyconnect image disk0:/anyconnect/anyconnect-win-4.7.03052-webdeploy-k9.pkg 3
 anyconnect enable
 cache
  disable
 error-recovery disable
dynamic-access-policy-record DfltAccessPolicy
*****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
!
jumbo-frame reservation
!
no call-home reporting anonymous
Cryptochecksum:d6b2e1cc88f68000115226827b894557
: end

[s.vanrossem]

code:

asa# show ipv6 interface
WAN is up, line protocol is up
  IPv6 is enabled, link-local address is fe80::2a6:caff:fe07:6e48  
  No global unicast address is configured

  Joined group address(es):
    ff02::1:ff07:6e48
    ff02::2
    ff02::1
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.
LAN is up, line protocol is up
  IPv6 is enabled, link-local address is fe80::2a6:caff:fe07:6e49  
  No global unicast address is configured

  Joined group address(es):
    ff02::1:ff07:6e49
    ff02::2
    ff02::1
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 1000 milliseconds
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.

[s.vanrossem]

code:

asa# show ipv6 route

IPv6 Routing Table - 3 entries
Codes: C - Connected, L - Local, S - Static
       O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
            ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, B - BGP, V - VPN
            I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
L   fe80::/10 [0/0]
     via ::, WAN
     via ::, LAN
L   ff00::/8 [0/0]
     via ::, WAN
     via ::, LAN
S   ::/0 [1/0]
     via fe80::a0ec:1375:6962:4c3d, WAN

[YoeriOppelaar]

Hoi,
Ik zie nergens dat je een global unicast address krijgt? kreeg je deze op de PFsense wel?

[s.vanrossem]

Klopt, dat heeft te maken met RFC5072, IPv6 via PPPoe. Een ASA zou dat niet ondersteunen. Enig idee?

[YoeriOppelaar]

Dat heb ik me inderdaad niet gerealiseerd, KPN doet natuurlijk PPP.
Dan ben ik bang dat je zonder een router die de ppp op IPv4 en IPv6 ondersteunt, dit niet werkend gaat krijgen.