IPv6 Neighbor Discovery and Router Advertisements: Config Guide

In IPv6 there is no ARP, no DHCP requirement and no default gateway field to type in - Neighbor Discovery (ND) does all three jobs at once using ICMPv6. That makes ND the single most important protocol to understand when IPv6 "just does not work": hosts get an address with the wrong prefix lifetime, ignore your router, or keep talking to a stale neighbor entry. This guide covers the five message types, router advertisement flags, duplicate address detection, the neighbor cache, and the verification commands that isolate ND problems quickly.

The five messages

Router advertisement configuration

# Junos: enable RA on the interface and tune lifetimes
set protocols router-advertisement interface ge-0/0/0.0 prefix 2001:db8:100::/64
set protocols router-advertisement interface ge-0/0/0.0 max-advertisement-interval 30
set protocols router-advertisement interface ge-0/0/0.0 min-advertisement-interval 10
set protocols router-advertisement interface ge-0/0/0.0 current-hop-limit 64
set protocols router-advertisement interface ge-0/0/0.0 managed-configuration
set protocols router-advertisement interface ge-0/0/0.0 other-stateful-configuration
run show ipv6 router-advertisement
run show ipv6 neighbors
run show ipv6 interface ge-0/0/0.0 detail

# Cisco IOS XE
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ipv6 address 2001:db8:100::1/64
Router(config-if)# ipv6 nd ra interval 30
Router(config-if)# ipv6 nd ra lifetime 1800
Router(config-if)# ipv6 nd prefix 2001:db8:100::/64 2592000 604800
Router(config-if)# ipv6 nd managed-config-flag
Router(config-if)# ipv6 nd other-config-flag
Router(config-if)# ipv6 nd ra suppress
Router# show ipv6 interface GigabitEthernet0/0
Router# show ipv6 routers
Router# show ipv6 neighbors

The M flag tells hosts to get addresses from DHCPv6; the O flag tells them to get other parameters (like DNS) from DHCPv6 while still forming their own address via SLAAC. Which combination you choose is your address management policy - see our comparison of SLAAC vs stateful and stateless DHCPv6 before setting them.

Flags, lifetimes and what hosts actually do

ndp -r                       # FreeBSD
ip -6 neigh show             # Linux
sysctl net.ipv6.conf.eth0.accept_ra          # 1 = accept RAs, 2 = accept even with forwarding
sysctl net.ipv6.conf.eth0.accept_ra_defrtr
sysctl net.ipv6.conf.eth0.ra_defrtr_metric

tcpdump -i eth0 -nn 'icmp6 and (ip6[40] == 134 or ip6[40] == 133)'   # RA / RS only
tcpdump -i eth0 -nn 'icmp6 and ip6[40] == 135'                       # NS

Prefix lifetimes matter more than most people expect. The preferred lifetime must be shorter than the valid lifetime, and a host keeps using a deprecated address (existing connections) until the valid lifetime expires. If you shorten the valid lifetime carelessly during a renumbering project, you will break long-lived sessions; if you lengthen it too much, stale addresses linger for weeks.

Duplicate Address Detection and neighbor cache

DAD sends NS messages from the tentative address; if another host replies, the address is marked duplicate and the interface stays unconfigured. On virtualised and clustered hosts this is often caused by MAC address reuse rather than a real conflict:

# Linux
sysctl net.ipv6.conf.eth0.dad_transmits
sysctl net.ipv6.conf.all.use_tempaddr
nmcli con mod eth0 ipv6.dad-timeout 1000
ip -6 addr show dev eth0

# clear a poisoned neighbor entry
ip -6 neigh flush dev eth0
ip -6 neigh replace 2001:db8:100::20 lladdr 00:11:22:33:44:55 dev eth0 nud reachable

The neighbor cache has a limited size and stale entries cause intermittent failure that looks like packet loss. Monitor with ip -6 neigh show nud failed and show ipv6 neighbors, and raise net.ipv6.neigh.default.gc_thresh3 on routers with many neighbors - beyond that threshold the kernel logs "neighbour table overflow" and drops traffic.

Diagnostics checklist

First confirm the host sees the RA (show ipv6 routers, tcpdump), then confirm a valid address and prefix length (ip -6 addr), then confirm a default route (ip -6 route), then neighbor resolution (ip -6 neigh). If the address exists but traffic fails, the fault is almost always the router's forwarding or a firewall dropping ICMPv6 - never block ICMPv6 133-137, the protocol depends on it. Related: Linux ip neigh and ARP table management, systemd-networkd configuration and inter-VLAN routing.

原文链接：https://www.juniper.net/documentation/us/en/software/junos/neighbor-discovery/topics/topic-map/ipv6-neighbor-discovery.html