ICMPv6 Router Solicitation

[kkrause]

I've recently installed Meraki MS225 switches to a few networks. I'm seeing now ICMPv6 router solicitation packets flooding the network. There are no devices on the network (a small test bed) with IPv6 enabled. The tcpdump shows the source mac address as the Meraki switch. Is there a way I can disable ICMPv6 on the switch?

TIA

[RaphaelL]

Hi ,

I'm not sure that this can be disabled on a MS. How ever I'm not sure that this is 'flooding' your network as these ICMPv6 router solicitation looks to be sent every 4.2 seconds.

[kkrause]

Thanks for the response, Raphael. I've heard the same thing from others, but no one states definitively one way or the other.

I just ran another tcpdump and received 1017 ICMPv6 router solicitation packets from the mac address of the Meraki switch. A handful of those were from the mac of the single Meraki AP I have in the test network.

[alemabrahao · Accepted solution]

Cisco Meraki Switches can pass IPv6 traffic, as well as report information on clients using IPv6. But if I'm right It does not support IPV6 configuration.

https://documentation.meraki.com/General_Administration/Other_Topics/IPv6_Device_Compatibility

[kkrause]

Thanks for your response. Looking at the doc you referenced, it doesn't appear that configuration is allowed. This jives with what I've heard elsewhere. I did notice that IPv6 ACLs are now allowed and have attempted to configure an ACL to block ICMPv6, but since the requests appear to be coming from the switch (which has no IPv6 IP assigned) I'm not having any luck in blocking the requests.

Thanks

[RaphaelL]

To be honest , I don't understand why and where the ipv6 trafic is sourced by the Meraki devices. 

Can't seem to be able to turn that off. Might need to open a case to see if there is no hidden backend options for that.

[alemabrahao]

One more information.

The IPv6 neighbor discovery process uses Internet Control Message Protocol (ICMP) messages and solicited-node multicast addresses to determine the link-layer address of a neighbor on the same network (local link), verify the reachability of a neighbor, and track neighboring devices.

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6_basic/configuration/xe-3se/3850/ip6-neighb-di...

[Crocker]

I believe we saw something similar when we installed our first MS250 at our HQ, hanging off a stack of Catalyst 3650's. Our firewall suddenly started seeing a bunch of IPv6 router solicitation requests and that set off some alarms (we shouldn't see any IPv6 traffic).

In the end, we ended up disabling IGMP snooping and Flood unknown multicast traffic under Switch -> Switch Settings -> Multicast Settings. These were enabled by default, with no way to adjust separate settings between IPv4 and IPv6.

[kkrause]

Thanks for the response. That's exactly what we're seeing as well. I'll check with the powers that be and see if your suggestion is something they would like to try.

[RaphaelL]

We only have IGMP Snooping enabled which is a deal breaker to disable and still the icmpv6 packets are being sourced by the Meraki devices: 

[alemabrahao]

I don't think that is the case.

[RaphaelL]

I agree. I disabled both settings under MS 14.33 and the MS is still sourcing the ipv6 packets : 

[Crocker]

Wonder if my notes are wrong. Have you rebooted that MS since disabling those settings?

[RaphaelL]

Yes , the MS was rebooted and the changes done about 1 hour ago and the trafic is still present.