/59 prefix delegation block changed...

@packeteater , @Comcast_Valerie , @Comcast_JamesH , @Comcast_Dena 

Just an hour or so ago, my ipv6 routing died.  I could make it to the cablemodem not past it.  I rebooted the cablemodem, played with the lease time, toggled DHCP and now my /59 I'm receiving went from c000::/59 and c040:/59.  My ipv6 behind the cablemodem is completely broken now unless I renumber all my servers.  THe last time this happened it took about 2 hours to renumber.  Further reboots have left me with c040 and can't get me back to c000 which is the base of my /59.

Can anyone suggest a fix?  How about just routing the entire /56 to an IP address I give support?  Is this doable?  Any other suggestions to keep the /59 from changing?  Any way we can manually add in static ipv6 routes to the cable modem reather than using dhcpv6-pd ?

I'm open to any/all suggestions.  In the meantime I've turned off ipv6 on my firewall requesting the PD as in the current state it is not functional.

The most recent firmware update (about a week ago), pretty much broke IPv6. Whenever IPv6 routing dies: reboot the cable modem (about once a day) and it will come back. Don't hold your breath to get useful IPv6 support from Comcast, but if you find a fix, let us know ;-).

I had a lengthy discussion with various Comcast support people last year about these IPv6 issues, and the resolution from their IPv6 specialist was that with IPv6, Comcast does not offer static IPs, so you are out of luck. (never mind that the modem IS getting a static prefix, but the modem is messing it up).

Quick technical details:

Comcast assigns a /56 to the modem. One /64 is used for devices directly connected to the modem. Via DHCPv6-PD, a device may request a /59 (used to be /60, but that changed to a /59 last year).

IPv6 addresses are only routed by the modem if the prefix was requested by a device via DHCPv6-PD. You used to get an ICMPv6 Type 1 Code 5 if you used an IPv6 address before you received the DHCP assignment ("Source address failed ingress/egress policy"), but more recently, I have not seen these messages. Packets are dropped silently.

About a week ago, Comcast loaded a new firmware to my modem. (Software Image Name: DPC3941B_3.9p32s1_PROD_sey). With this update, a couple things changed:

* If your modem's prefix was 2001:db8::/56, you used to get 2001:db8:0000:00(c0)|(f0)/59 assigned to your devices. This now changed to 2001:db8:0000:00(00)|(20)|(40)/59. If you get the 2001:db8:0000:0000::/59: that once overlaps with the /64 assigned to the modem's network. 

* After about one day, the modem will respond with "No Prefix Available" messages. This message should be used to indicate that the prefix was assigned to a different device (but it isn't). Two workarounds: Use a different DUID (but now you will get a different prefix) or reboot the modem.

In short: disable IPv6 for a stable network, or pick a different ISP if you need IPv6 for your business.

@DCT-Michelle :

Hello & thank you for your response.

If every time a new /59 can be handed out, how am I supposed to statically ip my servers (web, dns, mail, etc) and have them work if the subnet can keep changing?  My /56 is STATIC.  How do I make my /59 static as well?  I pay for static ips!

@flybynight : I  have no other ISP option at this point.  I'm thinking I may just do an HE.NET tunnel.  Hopefully that will work better.

he.net works reasonably well (and you will get a static /48). The only issue with he.net is that some services (e.g. Netflix) are blocking them last time I checked. Netflix considers it a VPN as he.net could be used to bypass geo-restrictions.

The Comcast "upper tier" support I spoke with last time this issue came up told me that only IPv4 is "static" and they do not have a "static IPv6" product. I know... frustrating as it appears the modem is to blame here as the modem does receive the same prefix. This "you need to request a prefix to route" is stupid and appears to cause these problems. But then again, AT&T mobile does NAT for IPv6 "just because". Legacy carriers have no incentive to make IPv6 actually work right.

@Comcast_Alyssa , while I am able to tag you here, I am unable to direct message you.  Your name does not appear in the dropdown box, similar to my earlier problem with the other rep.  Are you able to send me a message that I can reply to?

Thank you,

Robert

@Comcast_Jodie I don't see an "options" for messaging.  Where do I see that & make sure it's set to Comcast Business?

Edit: I reached out to a rep with "Comcast business" next to their name to ask for help.  I'll follow up here if I'm not contacted within the next few days.

My IPv6 setup broke around the same time frame.  Despite strong evidence to the contrary, Comcast has claimed the problem is beyond the demarcation line so they can't offer support.

Even if I got this working again there's no guarantee that it would keep working since it's obvious Comcast isn't adequately testing and maintaining their deployed equipment to support IPv6 prefix delegation use-cases for businesses.

So I've pretty much given up trying to get the modem to behave reasonably and I'm considering my alternatives.

@Comcast Business I am requesting an escalation of the issues outlined in this post. We need engineering to take this issue seriously

@Comcast Business : Agree with MikeAce.  I'd like to know how/when/if this is going to be fixed.  I always viewed Comcast as a leader in the ipv6 space, and tbh, I'm starting to wonder....

FWIW: I also noticed that since the firmware update, the modem's DHCPv6 responses set the T1 parameter to 5 seconds. This causes the router to renew the IPv6 prefix every 5 seconds. I guess this is a "hack" to make sure the modem is getting "primed" with the DHCP prefix quickly after it is restarted? 

I've reached out to @Comcast Business so hopefully I will hear something soon.  If I get it resolved I will post here what the resolution is.  I hope others will do the same.  I think even if we can get a standard way to handle dhcpv6-pd problems handled, that would be a positive step for others who have dhcpv6-pd issues in the future.

@flybynight : I think your best option is going to be to "private mssage" "Comcast Business".  It seems to me like it is a "role" account and someone may be assigned to you. 

After having IPv6 drop again last night, I now finally broke down and gave Comcast customer support a try (via phone). Right now we are in the "oh. we do not support IPv6" phase of the call. Will post if something comes out of this.

Got a call back from the customer service rep that again, Comcast isn't supporting IPv6, and I should ask "my IP guy" for help (her words, not mine). But she did agree to escalate the issue and I do have a ticket number now.