Meraki

bigjon

The customer has a quite diverse third-party and platform ecosystem with separate SASE application controls on workstations with their own security controls, 802.1x on LAN as well. They don't use IPv6 internally which is what the MX/SDWAN is providing access to. Basically, I'm trying to keep the MX/SDWAN config managable as there is no internal IPv6 use within corporate network. Enabling IPv6 confuses this SDWAN deployment. That is a kind of thin excuse though I admit. I personally accept there might be some obscure attack vectors with IPv6 by not enabling it. I have actually asked the customer architects whether they want IPv6 to be enabled officially. The increase in attack vectors by enabling IPv6 is also a consideration though which invites operational overhead/complexity which this customer definitely doesn't need. Security is a journey... this customer is not ready for that level of policy management in my opinion... but we'll see what they say regarding IPv6 requirements.

bigjon

Ok. I may have a smoking gun. It looks like the workstations have a 4G local NIC on them and Meraki might simply be gleaning IPv6 information indirectly about client state (i.e. a IPv6 ND). I was under impression WAN IP was same IPv6 subnet as the phantom IPv6 addresses on clients, but on second look and interrogration via a BGP looking glass, they're actually different ISP hosted routes. This is leading me to believe Meraki MX is just gleaning IPv6 information.

bigjon

We don't want to use IPv6... which is why SVIs have it disabled. Regardless, clients have IPv6 addresses showing up. The IPs are in the same IPv6 subnet as the WAN carriage so I assume it's SLAAC from the ISP pool. I've read annecdotal advice suggesting that MX will generate a RA. You're right though, I will have to chase down a packet capture to see what is going on with RAs. There is a setting in Network --> Configure --> General that specifies "Wireless IPv6 Bridging" : Enabled (default) that I am pondering... I don't think it's related though based on its description.

bigjon

This is very confusing to me. I am working on a large Meraki deployment where the ISP is handing out IPv4 and IPv6 addresses to the WAN interface. Meraki doesn't allow you to disable IPv6 on WAN - Annoying, but fair enough. VLAN SVIs on the LAN terminate to the MX logically from a Layert 3 perspective. SVIs have IPv6 disabled. In Network Client list, clients are getting IPv6 addresses when connected to wireless. Wired clients aren't getting IPv6 addresses From what I can figure out, Meraki MX forward the ISPs IPv6 subnet as a IPv6 RA and clients allocate their own IPs using SLAAC. Client doesn't want to disable IPv6 on workstations (as WFH option may require it). Some questions I am hoping people can answer: Is my understanding/explanation of how IPv6 addresses are allocated on the MX correct? Why are clients getting IPv6 addresses if SVIs have IPv6 disabled on MX? Why would only wireless clients be getting IPv6 addresses? What methods are available to disable clients from getting IPv6 addresses?

bigjon · ‎May 12 2022

Did you ever get a solution here (offline or not). This same issue is bugging me right now.

Meraki

Community

About bigjon

bigjon

Community Record

Badges

Re: IPv6 Disabled on VLAN but Clients Still Getting IPv6 SLAAC Addresses

Re: IPv6 Disabled on VLAN but Clients Still Getting IPv6 SLAAC Addresses

Re: IPv6 Disabled on VLAN but Clients Still Getting IPv6 SLAAC Addresses

IPv6 Disabled on VLAN but Clients Still Getting IPv6 SLAAC Addresses

Re: This switch does not have a stack configuration.

Re: IPv6 Disabled on VLAN but Clients Still Getting IPv6 SLAAC Addresses

Re: IPv6 Disabled on VLAN but Clients Still Getting IPv6 SLAAC Addresses