Wired Intelligent Edge

Would like my 2930f to intervlan route ipv6 as it does with ipv4 (using dhcp code 121 to assign classless-static-routes).

Firewall gets GUA's assigned to my vlans via dhcpcd by ISP and SLAAC. They are dynamic, not stable, so I can't rely on them for local traffic.

I'd like to use ULA's and have the 2930f switch handle the intervlan ipv6 routing as opposed to a ROAS configuration. However once I enable ipv6 unicast-routing on the switch the client devices lose Internet access due to the switch now becoming the default gateway and it has no GUA's (they're dynamic so I can't just manually assign them to switches vlans). When I set ipv6 nd ra lifetime 0 on the vlans to prevent the switch from becoming the default gateway, ipv6 Internet access is resumed but the switch does not handle the ipv6 intervlan routing - I can view the packets going into and out of the firewall instead of the routing taking place in the switch itself.

What's the secret to making this work?

Thank you!

You've already found the actual problem: hosts pick their default gateway from RAs, so the moment the 2930F advertises with a nonzero router lifetime it wins, and it has no route to the internet. Killing the RA lifetime hands the gateway back to the firewall but takes your inter-VLAN routing with it. Those two knobs will always fight each other.

The way out is to let the switch win. Keep the 2930F as the default router on every VLAN, then give the switch itself a static default route pointing at the firewall's link-local address on a transit VLAN. Link-locals never change no matter how often your ISP rotates the delegated prefix, which kills the objection about dynamic GUAs. Traffic to ULAs routes in the switch, everything else hops to the firewall.

The elegant fix would be RFC 4191 route information options in the RAs, the IPv6 cousin of your option 121 trick, but I can't find any sign AOS-S exposes that in its RA config, so the static route path is the one I'd build.

------------------------------
Dustin Burns

@Worldcom Exchange, Inc.


If my post was useful accept solution and/or give kudos
------------------------------