Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

IPv6 Neighbor Discovery

Neighbor discovery is a protocol used for IPv6 traffic that allows different nodes on the same link to advertise their existence to their neighbors, and to learn about the existence of their neighbors.

IPv6 Neighbor Discovery Overview

Neighbor discovery is a protocol that allows different nodes on the same link to advertise their existence to their neighbors and learn about their neighbors.

Routers and hosts (nodes) use Neighbor Discovery (ND) messages to determine the link-layer addresses of neighbors on attached links and to overwrite invalid cache entries. Hosts also use ND to find neighboring routers that can forward packets on their behalf.

Nodes rely on ND to actively track whether neighbors are reachable. When a router (or the path to a router) fails, nodes actively search for alternative paths to reach the destination.

This section discusses the following topics:

Improvements over IPv4 Protocols

IPv6 Neighbor Discovery corresponds to several IPv4 protocols such as Address Resolution Protocol (ARP), Internet Control Message Protocol (ICMP) Router Discovery, and ICMP Redirect.

Neighbor Discovery provides many improvements over that IPv4 set of protocols. These improvements address the following:

  • Router discovery—Enables a host to find routers on an attached link.

  • Prefix discovery—Allows a host to discover address prefixes for destinations on an attached link and differentiate between onlink destinations and those reachable only through routers.

  • Parameter discovery—Supplies a node with link and Internet parameters for outgoing packets.

  • Address resolution—Lets a node find a link-layer address for onlink destinations by using only an IPv6 address.

  • Next-hop determination—Provides an algorithm for mapping an IPv6 destination address to a neighbor's address, identifying the next router or destination.

  • Neighbor unreachability detection—Helps a node confirm that a neighbor remains reachable.

  • Duplicate address detection (DAD)—Alerts a node to any address conflicts before it finalizes an address assignment.

A router periodically multicasts a router advertisement from each of its multicast interfaces to announce its availability. Hosts listen to the router advertisements to configure addresses automatically and identify the link-local addresses of nearby routers. When a host starts, it multicasts a router solicitation to ask for immediate advertisements.

Router discovery messages are not a routing protocol. These messages allow hosts to find neighboring routers, but hosts do not use router discovery messages to decide which router is ideal for reaching a specific destination.

Neighbor discovery works through ICMP version 6 (ICMPv6) messages: router solicitation, router advertisement, neighbor solicitation, neighbor advertisement, and redirect.

For IPv6, neighbor discovery replaces the IPv4 protocols router discovery (RDISC), ARP, and ICMPv4 redirect.

Junos OS Release 9.3 and later supports Secure Neighbor Discovery (SEND).

SEND lets operators protect NDP messages. This security method applies to links where physical security is questionable, and NDP message attacks are a concern.

The Junos OS safeguards NDP messages by using cryptographically generated addresses (CGAs).

Router Discovery

A router advertisement can contain a set of prefixes. Nodes rely on these prefixes for address autoconfiguration, to maintain a database of onlink (same data link) prefixes, and to conduct DAD. If a node is onlink, the router forwards packets to that node. If the node is not onlink, the routing process forwards the packets to the next router for consideration. Each prefix entry can include a prefix length, a valid lifetime, a preferred lifetime, an onlink flag, and an autoconfiguration flag. These parameters enable address autoconfiguration and govern link settings such as the maximum transmission unit (MTU) size and hop limit.

Junos OS Release 22.4R1 and later supports NAT64 IPv6 address prefix router advertisement. The router includes the configured NAT64 IPv6 address prefix in router advertisement packets. You can configure as many as three NAT64 IPv6 address prefixes per interface.

Configure the NAT64 IPv6 address prefix with set protocols router-advertisement interface <interface-name> nat-prefix <prefix>.

Set the advertisement time with set protocols router-advertisement interface <interface-name> nat-prefix <prefix> lifetime <lifetime>.

Address Resolution

ICMPv6 neighbor discovery replaces ARP in IPv6 for mapping network addresses to link-layer addresses. Neighbor discovery also handles changes in link-layer addresses, inbound load balancing, anycast addresses, and proxy advertisements.

Nodes that want a target node’s link-layer address multicast a neighbor solicitation message carrying the target’s address.

Nodes use neighbor solicitation and advertisement messages to verify duplicate unicast addresses on the same link.The autoconfiguration of an IP address depends on the presence of a duplicate address on the same link. DAD is a requirement for autoconfiguration.

Nodes also employ neighbor solicitation and advertisement messages to perform neighbor unreachability detection. Neighbor unreachability detection checks a target node’s presence on a link.

Redirect

Routers use redirect messages to notify a host about a more suitable next-hop router or an onlink neighbor for a given destination. This mechanism is similar to ICMPv4 redirect.

Routers employ the ICMPv6 redirect message to inform on-link hosts of a better next-hop for specific destinations.

This functionality allows routers to help hosts choose more efficient local routing paths.

SLAAC

Beyond other improvements to IPv6, Neighbor Discovery also supports Stateless Address Autoconfiguration (SLAAC). IPv6 maintains the capability for stateful address assignment through DHCPv6 (and static assignment), but

SLAAC provides a streamlined approach to address configuration that suits many network environments.

SLAAC offers plug-and-play (PnP) IP connectivity in two phases:

Phase 1: Link-local address assignment

Phase 2: Global address assignment

  • Phase 1—Link-local address assignment:

    1. Link-Local Address Generation: Whenever an IPv6-enabled interface, capable of multicasting, activates, the node generates a link-local address by combining its interface identifier with the FE80::/10 prefix.

      The system does not allow users to remove the auto-generated link-local address, but an administrator can override it with a manually configured one.

    2. Duplicate Detection: Before assigning the new link-local address to its interface, the

      Node tests uniqueness with a Neighbor Solicitation message sent to that address.

      If a reply arrives, the node identifies the address as a duplicate and halts the process, which requires manual intervention.
    3. Link-Local Address Assignment:

      If the address remains unique, the node assigns it to the interface.

    At this point, the node has IPv6 connectivity to all other nodes on the same link. Only hosts proceed to Phase 2, while routers configure their interface addresses through alternate methods.

  • Phase 2—Steps for global connectivity:

    1. Router Advertisement:

      The host sends a Router Solicitation that prompts onlink routers to issue their router advertisements. When an administrator enables stateless autoconfiguration on the router, each router advertisement provides a subnet prefix that neighboring hosts can use.
    2. Global Address Generation:

      After the host obtains a subnet prefix, it combines that prefix with its interface identifier to create a global address.
    3. DAD: The host again runs DAD, but this time for the newly generated global address.

    4. Global Address Assignment:

      If no duplication is detected, the host assigns that global address to its interface.
    SLAAC delivers complete IPv6 global connectivity without any manual host configuration and requires minimal router configuration.

Supported ICMP Router Discovery and IPv6 Neighbor Discovery Standards

Junos OS substantially supports the following RFCs, which define standards for the Internet Control Message Protocol (ICMP for IP version 4 [IPv4]) and neighbor discovery (for IP version 6 [IPv6]).

  • RFC 1256, ICMP Router Discovery Messages

  • RFC 4861, Neighbor Discovery for IP version 6 (IPv6)

  • RFC 2463, Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification

  • RFC 4443, Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification

  • RFC 4862, IPv6 Stateless Address Autoconfiguration

  • RFC 8335, PROBE: A Utility for Probing Interfaces

Example: Configuring IPv6 Interfaces and Enabling Neighbor Discovery

This example shows how to configure the router or switch to send IPv6 neighbor discovery messages.

Requirements

In this example, no special configuration beyond device initialization is required.

Overview

In this example, all of the interfaces in the sample topology are configured with IPv6 addresses. If you plan to extend IPv6 functionality into your LAN, datacenter, or customer networks, you might want to use Stateless Address Auto-Configuration (SLAAC) and that means configuring router advertisements. SLAAC is an IPv6 protocol that provides some similar functionality to DHCP in IPv4. Using SLAAC, network hosts can autoconfigure a globally unique IPv6 address based on the prefix provided by a nearby router in a router advertisement. This removes the need to explicitly configure every interface in a given section of the network. Router advertisement messages are disabled by default, and you must enable them to take advantage of SLAAC.

To configure the router to send router advertisement messages, you must include at least the following statements in the configuration. All other router advertisement configuration statements are optional.

To configure neighbor discovery, include the following statements. You configure router advertisement on a per-interface basis.

Topology

Figure 1 shows a simplified sample topology.

Figure 1: ICMP Router Discover TopologyNetwork topology diagram with routers R1 to R4 connected via interfaces like fe-1/2/0.1 and IPv6 subnets such as 2001:db8:0:1::/64.

This example shows how to make sure that all of the IPv6 hosts attached to the subnets in the sample topology can auto-configure a local EUI-64 address.

CLI Quick Configuration shows the configuration for all of the devices in Figure 1. #d15e202__d15e370 describes the steps on Device R1.

Configuration

Procedure

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

Device R1

Device R2

Device R3

Device R4

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure a IPv6 neighbor discovery:

  1. Configure the network interfaces.

    This example shows multiple loopback interface addresses to simulate attached networks.

  2. Enable neighbor discovery.

Results

From configuration mode, confirm your configuration by entering the show interfaces and show protocols commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the configuration is working properly, perform this task:

Checking the Interfaces

Purpose

Verify that the interfaces are up, and view the assigned EUI-64 addresses.

Action

From operational mode, enter the show interfaces terse command.

Meaning

The output shows that all interfaces are configured with the IPv6 (inet6) address family. Each IPv6-enabled interface has two IPv6 addresses; one link-local address, and one global address. The global addresses match those shown in Figure 1. Junos OS automatically creates a link-local address for any interface that is enabled for IPv6 operation. All link-local addresses begin with the fe80::/64 prefix. The host portion of the address is a full 64 bits long and matches the link-local interface identifier. When an interface address is configured using the eui-64 statement, its interface identifier matches the interface identifier of the link-local address. This is because link-local addresses are coded according to the EUI-64 specification.

Pinging the Interfaces

Purpose

Verify connectivity between the directly connected interfaces.

Action
  1. Determine the remote router’s IPv6 interface address.

    On Device R2, run the show interfaces terse command for the interface that is directly connected to Device R1, and copy the global address into the capture buffer of your terminal emulator.

  2. On Device R1, run the ping command, using the global address that you copied.

Meaning

Junos OS uses the same ping command for both IPv4 and IPv6 testing. The lack of any interior gateway protocol (IGP) in the network limits the ping testing to directly-connected neighbors. Repeat the ping test for other directly connected neighbors.

Checking the IPv6 Neighbor Cache

Purpose

Display information about the IPv6 neighbors.

After conducting ping testing, you can find an entries for interface addresses in the IPv6 neighbor cache.

Action

From operational mode, enter the show ipv6 neighbors command.

Meaning

In IPv6, the Address Resolution Protocol (ARP) has been replaced by the Neighbor Discovery Protocol (NDP). The IPv4 command show arp is replaced by the IPv6 command show ipv6 neighbors. The key pieces of information displayed by this command are the IP address, the MAC (Link Layer) address, and the interface.

Verifying IPv6 Router Advertisements

Purpose

Confirm that devices can be added to the network using SLAAC by ensuring that router advertisements are working properly.

Action

From operational mode, enter the show ipv6 router-advertisement command.

Meaning

The output shows that router advertisements are being sent and received on Device R1’s interfaces, indicating that both Device R1 and its directly connected neighbors are configured to generate router-advertisements.

Tracing Neighbor Discovery Events

Purpose

Perform additional validation by tracing router advertisements.

Action
  1. Configure trace operations.

  2. Run the show log command.