IPv6 Question

[smccloud1]

I'm getting ready to finally roll out dual-stack IPv4 & IPv6 at work. I would like to use our domain controllers for DNS as I do with IPv4, however, for the VLANs I do not use our MX95 as the DHCP server for (most of them) there is no way to specify what DNS servers to use. And Windows Server 2019's DHCPv6 server is almost worthless. If we hadn't just renewed our MX95 license I would seriously consider swapping to something else just for better control, but alas I am stuck. Does anyone know how I can handle this without having to setup the MX95 to handle DHCP for every VLAN?

[cmr]

@smccloud1 are you saying that you want the MX to tell the client where to find the IPv6 DNS server, but you don't want the MX to be the device handing out the addresses?  Or have I got that wrong!?!

[smccloud1]

Ideally, yes.  But as soon as I tell the MX to have an IPv6 address in the VLAN it starts handing out IPv6 addresses in the VLAN.  Can't route traffic to the Internet without the MX having an IPv6 address.  I know our setup is probably more complex than most MX deployments, and I will admit that we would probably be better served with something else.  But the decision to go with one was made above my head.

[cmr]

The MXs don't support DHCPv6.  I have seen routers with DHCPv6 that only advertise DNS servers, so I see what you want to do, but the MX uses SLAAC.

[smccloud1]

Technically Windows Server DHCPv6 will let me configure DNS servers, but I'm not 100% sure it will actually work.

[PhilipDAth]

The Meraki MX doesn't run DHCPv6 (I am talking about the LAN side here).  It relies on SLAAC.

https://documentation.meraki.com/MX/Networks_and_Routing/IPv6_Support_on_MX_Security_SDWAN_Platforms...

This means the *client* chooses an IP address to use, checks to see if anyone else is using it, and then uses it.  It doesn't ask the MX for an IPv6 address, or if it can use it (like what happens in DHCP).

Your situation is a bit tricky.  It might be best to disable SLAAC on your clients, so they are forced to use DHCPv6 (such as from your DHCP server).

If you made the MX your DHCP server, then you can have it give out the IPv6 addresses of your internal DNS servers.

https://documentation.meraki.com/MX/Networks_and_Routing/IPv6_Support_on_MX_Security_SDWAN_Platforms...

I haven't tried this - but I suspect if you enabled DHCP on the MX, and then reserved every address - it would fail to give an IP address to anyone - but may still give out the DNS servers to use via DHCPv6.

[PhilipDAth]

Another option - it may be possible on your existing DHCP server to specify the IPv6 addresses for your DNS servers in the DHCPv4 config.  It is just a DHCP option.  The config would be delivered via IPv4, but at least it would bootstrap IPv6 DNS.

[smccloud1]

Windows DHCPv4 server will not let you specify an IPv6 address in DHCPv4 settings, at least that I have found yet.

[GIdenJoe]

The issue is that the MX at this time does not support the other or managed config flags in it's RA's which is a shame.

From the documentation:
As of now, we only support SLAAC on LAN with limited RA options (like prefix information, MTU, source-link layer address). We do not support DHCPv6-NA server functions.

It has been quiet for quite a while on the IPv6 front within Meraki so I'm curious where they are at.  I also recently asked about when the IPv6 support will be there for HA-pairs of MX devices.  The answer was "not this FY".  Which to me means we won't be seeing those needed features until MX20.x.

I guess it's time to keep nagging some guys in Cisco for this 😉

[smccloud1]

The bigger issue I'm having right now is that we are finally in the data center, and I have IPv6 configured on the WAN.  But from the dashboard, I cannot reach any IPv6 address from our MX95.  Lumen says all is good on our end (of course) and Meraki support said its because you aren't allowing ICMPv6 traffic in on your firewall rules (but Lumen could already ping the address?).