Skip to content
R

Recognized Contributor

 • 

32 Messages

Wed, Feb 24, 2021 9:11 PM

/59 prefix delegation block changed...

I have a /56 static on Comcast Business.  Recently I had a cable modem issue (as determiend by comcast) and the cable modem was replaced.  Everything is working, but I received a different /59  (still inside my /56) so I had to renumber several vlans!  How do I keep this from changing?  

Thank you,


Robert

Recognized Contributor

 • 

32 Messages

1 y ago

@hiryu :

Comcast just reflashed my modem and I think I'm on the same version:

DOCSIS Software Version:2.3.10.13_5.5.0.5

Software Image Name:DPC3941B_3.9p32s1_PROD_sey

Advanced Services:DPC3941B

This is from "gateway->software" menu.

New problem solver

 • 

18 Messages

1 y ago

I am also getting  rotating IPv6 /64 addresses.  This has been happening for several years with no resolution.  Any solution?  I have two subnets that were getting a :13e0 and :13e1 (/64).  IPv6 stopped routing, so I rebooted both my router and the modem.  New addresses were :1380 and :1381.  I rebooted everything again and now they are :1360 and :1361.

My network is down because I haven't had time to go around and fix everything.

I've had a request in to support for over a week now with no solution.  I'm paying for 'static' ipv6 addresses and they aren't static.....

(edited)

Recognized Contributor

 • 

32 Messages

1 y ago

@flyingrobots :  If you find a solution please post here. 

I check this thread occasionally, but I've moved to a 6-in-4 tunnel for ipv6 from he.net (free!!).  I'd love to do native, but @Comcast Business equipment seems to be broken beyond repair.  There is NO WAY to make sure you get the same /59 handed out!  After reunumbering my vlans 3 or 4 times, I gave up & did an HE.NET tunnel.  It's literally an hour or less to setup & then maybe an hour or two to renumber my network.  I also get a /48 and don't have to deal with dhcp-pd shenanigans.  Hopefully Comcast doesn't break 6-in-4....

The ONLY subnet that stays the same is the /64 directly behind the modem.  If you are going to use ONLY that it should work great.  If you rely on dhcp-v6 pd prefixes not changing, use another solution so you don't lose your sanity.

I don't think comcast business support realy understand the problem, doesn't care, or simply has no way to fix it and waits until you give up.

@Comcast Business : Please prove me wrong.  Contact me if you have a solution where I can be guaranteed the same /59 within a /56.  I'd love to use native ipv6 on my connection with static ips!

What I don't understand is why this has remained a problem.  There are easy (technical) fixes!

  1. Let the user put in /59 static routes in the cable modem to point to a next hop.
  2. Let the user put in a /56 static route in the cable modem to the next hop and let the user do their own delegations internally.
  3. Let the user establish BGP session(s) with a non-public AS Number (64512-65534)  customer provided PE that talks to the cable modem
    1. Comcast strips the AS# & replaces it with it's own.
    2. Comcast filters an route advertisements not inside the static /56
  4. Let users put their cable modem in bridge mode & take over all the layer 3 function with a user provided router using #2 or #3.

I'm guessing it's not fixed as this type of functionality is probably in their Metro-e/DIA offerings.

(edited)

Problem solver

 • 

323 Messages

@rob__jr 

"Contact me if you have a solution where I can be guaranteed the same /59 within a /56."

You are likely sending DHCP-PD renewal requests with an empty DUID.  Per the RFC standard the serving router is required to assign a new prefix. 

As Kirk said "you have to learn why things work on a starship"  LOL

New problem solver

 • 

18 Messages

1 y ago

@rob__jr  yea...I thought I had found a solution, but alas, it was my hot spot connection to my phone that was getting the good results (Iphone is using ipv6).

They aren't going to fix it, and they really don't care...so I've reverted my network back to ipv4.  I've learned a lot, but need to move on...

btw: The new cable modem (CBR-T (CGA4131COM)) doesn't even respond to PD requests....

Contributor

 • 

23 Messages

6 m ago

Alright.. I realize this is an older post but I was having issues because of this exact situation - that is, I configured a bunch of vlans with subnets within the /59 that the comcast business gateway handed out, and it was all just lovely for a while... until at some point I restarted and all of my IPv6 systems that weren't on the same vlan as the gateway broke because I got a different /59.  I believe I've managed to configure everything to request and actually get the same prefix each time.

For context, my gatway is the CGA4131COM and I'm using an OPNsense 22.1.1 box as my router/firewall. I have four vlans configured on OPNsense.

WAN - connected to the gateway, LAN for my private network for user devices, PUB for all of my public facing servers where my static IPv4 addresses live, and SRV for internal servers that don't need to face the internet at large and shouldn't necessarily be in the same network as the end user devices.

on the LAN, PUB, and SRV vlan interfaces, the IPv6 configuration type is set to "Track Interface" which pulls from the pool of subnets in the delegated prefix assigned to the WAN interface, and I gave each a prefix ID within that - there's 32 IDs to pick from 0x0 to 0x1f.

I initially set the WAN interface to use DHCPv6 as the configuration type, and under the details, had it set to Basic, provided a prefix length of 59, and got a a prefix xxxx:xxxx:xxxx:1a0::/59 the other vlans got a /64 in that range with the prefix ID added to the end (for example, the PUB vlan id was 0x0 so it got xxxx:xxxx:xxxx:1a0::/64. I gave the LAN vlan an id of 0xc so it's subnet was xxxx:xxxx:xxxx:1ac::/64, etc). Everything was good until I had to restart the gateway after which the prefix was xxxx:xxxx:xxxx:160::/59... which.. broke everything.

It turns out that in the /56, there are only 8 /59 subnets to delegate so I found that if I restarted the gateway a few times, it would eventually give me the 1a0 prefix again.  Obviously this is a workaround that's less than ideal.  On the WAN interface, there is an "Advanced" option, but the integrated help wasn't particularly helpful so I eventually dug into the innards of the behind-the-scenes configuration.  It's FreeBSD and I was able to look up the manpage for dhcp6c.conf and also compare the file generated with the "Basic" mode with the one that was generated by the  "Advanced" mode.

Here's what eventually worked:
Configuration Mode: Advanced

In the Interface Statement section

Send Options: ia-na 0, ia-pd 0

Request Options: domain-name-servers,domain-name

Script: /var/etc/dhcp6c_wan_script.sh

(this was in the basic configuration file, which is why I included it.. the naming may be different so you'll probably need to look at the basic script first)

In the Identity Association section

Check Non-Temporary Address Allocation

id-assoc na ID: 0 (or whatever number you put after id-na in Send Options above)

Address IPv6-address: leave blank or specify an address in the /64 that the business gateway is in

Preferred Lifetime: leave blank or infinity if an address is requested above.

Valid Time: leave blank

Check Prefix Delegation

id-assoc pd ID: 0 (or whatever number you put after id-pd in Send Options above)

Prefix IPv6-Prefix: xxxx:xxxx:xxxx:1a0::/59 (that is, the specific /59 prefix you want)

Preferred Lifetime: infinity

Valid Time: leave blank

In the Prefix Interface section

Prefix Interface Site-Level Aggregation Length: 5

(this appears to be the difference in bits between /59 and /64)

everything else can be left blank/default.

On the Gateway itself, under connection -> local IP network, in the IPv6 section:

Ensure that Stateful(Use Dhcp Server) is checked.  Prefix delegation will not work otherwise.  I set the lease time to Forever and saved those settings.

After restarting the gateway and OPNsense, it is now consistently giving me the 1a0 prefix that I have everything configured to use.

I know this is one specific setup with a particular gateway and firewall, but I know OPNsense is a fork of pfsense so it ought to be similar, and if you are able to dig into the weeds a bit on your router's configuration, you might be able to find where you can set it to request a specific prefix every time.  This particular gateway appears to honor that.

(edited)

Contributor

 • 

23 Messages

As a followup, I've rebooted both my firewall and my CGA4131COM a few times just to make sure it's working as it ought to.  I am now consistently getting the correct prefix, so the CGA4131COM (at least the revision/firmware I have) honors the request if asked nicely.. or.. y'kno.. in a protocol compliant way I suppose.  Configuring other routers to properly make that request is beyond the scope of my experience, but it is clearly possible and now that I've managed to set it up, I'm sure it'll save me from random unexpected IPv6 "outages" going forward.

Contributor

 • 

27 Messages

That's using BSD eh?  I don't see those advanced type options for daemons under linux like dhclient.  Wonder if there's an alternate.

Contributor

 • 

23 Messages

yeah, pfsense and opnsense are based on BSD and I did the configuration using the web GUI which is just a front end for the configuration files.  The actual operation is determined by the content of the dhcp6c.conf.

It has continued to keep the correct prefix so there shouldn't be any reason why other routers, particularly linux based systems, can't also request a specific prefix. 

I'll have to tinker with some VMs to see if I can figure out how to do it with other systems... I have six other potentially available prefixes to tinker with, after all.

Contributor

 • 

27 Messages

I could probably do something with dibbler or some other software.

I wasn't aware that DHCPv6 IA_PD could even specify a desired PD network number.  I thought it only had an argument for desired PL assignment.

Contributor

 • 

23 Messages

For what it's worth, this is the sanitized dhcp6c.conf file that was generated on my OPNsense box:

interface lagg0_vlan1 {
  send ia-na 0;
  send ia-pd 0;
  request domain-name-servers;
  request domain-name;
  script "/var/etc/dhcp6c_wan_script.sh";
};
id-assoc na 0 {
};
id-assoc pd 0 {
  prefix xxxx:xxxx:xxxx:1a0::/59 infinity;
  prefix-interface bridge0 {
    sla-id 12;
    sla-len 5;
  };
  prefix-interface lagg0_vlan2 {
    sla-id 0;
    sla-len 5;
  };
  prefix-interface lagg0_vlan3 {
    sla-id 5;
    sla-len 5;
  };
};

If working with the configuration directly, of course substitute appropriate values for that particular setup.

In my case, the system itself has two physical interfaces so I've LAGG'd them and set up several VLANs. VLAN 1 is the cable modem network.  Bridge0 is the private network (end user devices) and is bridged with the OpenVPN TAP interface and gets the xxxx:xxxx:xxxx:1ac::/64 prefix (12 = 0xC, and 64 = 59+5).  VLAN 2 is the same vlan where my public IPv4 addresses live, so web server, mail, nextcloud, minecraft, etc.. and gets xxxx:xxxx:xxxx:1a0::/64.  VLAN 3 is my private server network - LDAP, PostgreSQL, other services and containers that have no business being exposed directly to the world, and it gets xxxx:xxxx:xxxx:1a5::/64.

I wasn't aware that I could explicitly request a specific prefix either but renumbering and/or rebooting the cable modem until I got the right prefix was supremely inconvenient.  Obviously there wasn't a lot of other helpful information on the support forums which is how I ended up on this thread in the first place, and the OPNsense and pfsense help wasn't particularly helpful either so I ended up having to dig into the man page for the underlying configuration file and just kept futzing with the GUI inputs until the config file looked like I thought it should and then rebooted OPNsense and the cable modem a few times to confirm.  OPNsense also has a "Config File Override" option wherein you can specify the complete path to an alternate configuration file and it won't try to generate one.. I didn't really want to get that far into the weeds if I could help it.

In any case, I hope this helps. If not directly, then at least by getting people pointed in the right direction notionally for their setup.