当 VLAN 没有 IPv6 地址时,Cisco 3560G 未通过 IPv6 RA

当 VLAN 没有 IPv6 地址时,Cisco 3560G 未通过 IPv6 RA

问题:

当启用 L3 的交换机上有不带 IPv6 地址的 VLAN 时,除非为 VLAN 分配了 IPv6 地址,否则不会通过 VLAN 传递 RA。但是静态分配是可以正常访问的。

Switch(config)#interface Vlan 3
  no ipv6 address autoconfig # RA from mikrotik not working
  ipv6 address autoconfig # RA from mikrotik suddenly starts working
  no ipv6 address autoconfig # IPMI immediately losts SLAAC IPv6 address and become unresponsive

拓扑:

-> 上行链路 -> Cisco(L3 路由至 VLAN)-> 服务器

我在上行链路 (vlan 1) 上通过单个 /64 接收非路由的 /27 IPv4 和 /48 IPv6。因此,Cisco 将 IPv6 路由到 VLAN,其中每个 VLAN 都分配有唯一的 /64 范围,并启用 RA。每个需要 IPv4 的人都会被分配第二个端口 (模式访问 + vlan 1)。

但是 VLAN 3 比较特殊,因为它是通过 mikrotik(防火墙)委派的,并且同一个 cisco 用作 L2 交换机(访问 vlan 3)。在这种情况下,流量会通过 cisco 两次。

-> 上行链路 -> Cisco -> (Gi0/2 VLAN 2 -> ether1)Mikrotik(ether2 -> Gi0/3 VLAN 3)-> Cisco -> IPMI

然后,IPMI 连接到 VLAN 3,并且预计通过 mikrotik 管理委托的 IPv6。

当我们将 IPMI 直接连接到 mikrotik 时,它可以正常工作。

显示版本

Switch Ports Model              SW Version            SW Image
------ ----- -----              ----------            ----------
*    1 52    WS-C3560G-48TS     15.0(2)SE4            C3560-IPSERVICESK9-M

显示运行配置

version 15.0
ipv6 unicast-routing
interface GigabitEthernet0/1  # uplink port
!
interface GigabitEthernet0/2  # ether1 to mikrotik
 switchport access vlan 2
 switchport mode access
!
interface GigabitEthernet0/3  # ether2 from mikrotik, which manages IPv6 RA
 switchport access vlan 3
 switchport mode access
!
....
interface GigabitEthernet0/27 # Example of server uplink
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/28 # Example of IPMI uplink
 switchport access vlan 3
 switchport mode access
!
interface GigabitEthernet0/41 # Example of port with IPv4
 switchport access vlan 1
 switchport mode access
!
...
interface Vlan1 # Uplink VLAN
 no ip address
 ipv6 address fc00:0:0:ffff::1/64
 ipv6 nd ra suppress all
!
interface Vlan2 # Mikrotik prefix delegation network
 no ip address
 ipv6 address fc00:0:0:1::1/64
 ipv6 nd ra suppress all
!
interface Vlan3 # IPMI VLAN - IP addresses are managed by mikrotik
 no ip address
!
interface Vlan10 # VLAN for servers
 no ip address
 ipv6 address fc00:0:0:10::1/64
 ipv6 nd managed-config-flag
 ipv6 nd other-config-flag
 ipv6 dhcp relay destination .......
!
...
ipv6 route fc00:0:0:3::/64 fc00:0:0:1::2 # Prefix delegation to mikrotik
ipv6 route ::/0 fc00:ffff::2

ipv6 address autoconfig

显示 sdm 偏好

The current template is "desktop IPv4 and IPv6 routing" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.

 number of unicast mac addresses:                  1.5K
 number of IPv4 IGMP groups + multicast routes:    1K
 number of IPv4 unicast routes:                    2.75K
   number of directly-connected IPv4 hosts:        1.5K
   number of indirect IPv4 routes:                 1.25K
 number of IPv6 multicast groups:                  1.125k
 number of directly-connected IPv6 addresses:      1.5K
 number of indirect IPv6 unicast routes:           1.25K
 number of IPv4 policy based routing aces:         0.25K
 number of IPv4/MAC qos aces:                      0.5K
 number of IPv4/MAC security aces:                 0.5K
 number of IPv6 policy based routing aces:         0.25K
 number of IPv6 qos aces:                          0.625k
 number of IPv6 security aces:                     0.5K

答案1

升级到 IOS 15.0(2)SE10 (c3560-ipservicesk9-mz.150-2.SE4) 即可解决。天哪,花了一整天时间调试这个问题。

相关内容