From 3eef24ea4e11aab0f1bbe47012161c18b3e46838 Mon Sep 17 00:00:00 2001 From: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com> Date: Tue, 13 Oct 2026 12:26:11 +0200 Subject: docs: Update IPv6 page to VyOS 1.5 standards (#2327) --- docs/configuration/system/ipv6.md | 469 +++++++++++++++++++++++++++++--------- 1 file changed, 360 insertions(+), 109 deletions(-) (limited to 'docs/configuration/system') diff --git a/docs/configuration/system/ipv6.md b/docs/configuration/system/ipv6.md index ee0a6ade..71409e4e 100644 --- a/docs/configuration/system/ipv6.md +++ b/docs/configuration/system/ipv6.md @@ -1,193 +1,444 @@ +--- +myst: + html_meta: + description: | + The `system ipv6` subtree provides IPv6 settings that apply to the + whole router, such as packet forwarding, the neighbor cache, + Duplicate Address Detection, and ECMP multipath hashing. It also + controls route installation filtering and next hop tracking. + keywords: ipv6, neighbor cache, dad, ecmp, multipath, next hop tracking +--- + +(ipv6)= + # IPv6 -## System configuration commands +The `system ipv6` subtree provides IPv6 settings that apply to the whole router. + +To configure IPv6 settings for an individual interface, use +`set interfaces ipv6`. + +## Configuration + +### Forwarding ```{cfgcmd} set system ipv6 disable-forwarding - Use this command to disable IPv6 forwarding on all interfaces. +**Disable IPv6 forwarding between the router's interfaces.** + +By default, the router forwards IPv6 packets between interfaces. ``` +Example: + +```none +set system ipv6 disable-forwarding +``` + +### Neighbor cache + +The neighbor cache stores mappings between each neighbor's IPv6 and +link-layer addresses, together with the neighbor's reachability state. +The router learns these entries dynamically as it communicates with +neighbors. + +```{cfgcmd} set system ipv6 neighbor table-size \<1024 | 2048 | 4096 | 8192 | 16384 | 32768\> + +**Configure the maximum number of dynamically learned entries in the +neighbor cache.** + +The default is 8192. + +This limit counts only the entries that the router learns dynamically. +It does not count entries added manually as permanent, nor entries +that another subsystem installs and maintains. + +The router derives two more thresholds from this number. Once the +neighbor cache reaches half of this number, the router removes +entries older than 5 seconds. While the neighbor cache holds fewer +than one eighth of this number, the router does not remove entries +to reclaim space. + +The command also sets the following kernel parameters: + +- `net.ipv6.neigh.default.gc_thresh3`: Takes the value of the configured + maximum number. +- `net.ipv6.neigh.default.gc_thresh2`: Takes half of that number. +- `net.ipv6.neigh.default.gc_thresh1`: Takes one eighth of that number. + +If `system sysctl parameter` sets any of these parameters, the `system +sysctl` values take precedence. +``` -```{cfgcmd} set system ipv6 neighbor table-size \ +Example: -Use this command to define the maximum number of entries to keep in -the Neighbor cache (1024, 2048, 4096, 8192, 16384, 32768). +```none +set system ipv6 neighbor table-size 16384 ``` +### Duplicate address detection ```{cfgcmd} set system ipv6 strict-dad -Use this command to disable IPv6 operation on interface when -Duplicate Address Detection fails on Link-Local address. +**Disable IPv6 on any interface where {abbr}`DAD (Duplicate Address +Detection)` detects a duplicate of the interface's MAC-based link-local +address.** + +Without this command, a duplicate MAC-based link-local address does not +disable IPv6 on the interface. + +When the router disables IPv6 on an interface this way, the router does +not re-enable IPv6 on that interface automatically. +``` + +Example: + +```none +set system ipv6 strict-dad ``` +### Multipath routing ```{cfgcmd} set system ipv6 multipath layer4-hashing -Use this command to user Layer 4 information for ECMP hashing. +**Include Layer 4 information in the +{abbr}`ECMP (Equal-Cost Multi-Path)` hash.** + +By default, the router hashes the source and destination addresses, the +protocol number, and the flow label. + +With this command, the router hashes the source and destination addresses, +the protocol number, and the source and destination port numbers instead, +so it distributes the flows between two hosts by port rather than by flow +label. ``` -### Zebra/Kernel route filtering +Example: + +```none +set system ipv6 multipath layer4-hashing +``` +### Route installation filtering -Zebra supports prefix-lists and Route Maps to match routes received from -other FRR components. The permit/deny facilities provided by these commands -can be used to filter which routes zebra will install in the kernel. +The router can apply a `route-map` to filter a routing protocol's +routes before installing them in the router's {abbr}`FIB (Forwarding +Information Base)`. -```{cfgcmd} set system ipv6 protocol \ route-map \ +```{cfgcmd} set system ipv6 protocol \ route-map \ -Apply a route-map filter to routes for the specified protocol. The following -protocols can be used: any, babel, bgp, isis, ospfv3, ripng, static +**Filter the routes of the specified protocol before the router installs +them in the FIB.** -:::{note} -If you choose any as the option that will cause all protocols that -are sending routes to zebra. -::: +The router evaluates the `route-map` for each next hop of a route and +does not install a next hop that the `route-map` denies. + +A `route-map` configured for a specific protocol applies to that +protocol instead of the `route-map` configured under `protocol any`. The +router never applies both. + +This command applies to the default {abbr}`VRF (Virtual Routing and +Forwarding)`. Use `vrf name ipv6 protocol route-map +` for another VRF. + +The `route-map` must exist under `policy route-map`. Otherwise, the +commit fails. ``` -### Nexthop Tracking +Example: + +```none +set system ipv6 protocol ospfv3 route-map OSPFV3-SRC +``` +### Next hop tracking -Nexthop tracking resolve nexthops via the default route by default. This is enabled -by default for a traditional profile of FRR which we use. It and can be disabled if -you do not want to e.g. allow BGP to peer across the default route. +Next hop tracking lets a routing protocol, such as BGP, learn whether a +route's next hop is reachable through the router's {abbr}`RIB (Routing +Information Base)`. ```{cfgcmd} set system ipv6 nht no-resolve-via-default -Do not allow IPv6 nexthop tracking to resolve via the default route. This -parameter is configured per-VRF, so the command is also available in the VRF -subnode. -``` +**Prevent IPv6 next hop tracking from resolving next hops through the +default route.** -## Operational commands +By default, next hop tracking considers a next hop reachable when only +the default route covers it. This command makes next hop tracking +require a more specific route. +The default applies to the `traditional` profile of `system frr +profile`, which is the default profile. With the `datacenter` profile, +next hop tracking does not resolve next hops through the default route, +so this command has no effect under that profile. -### Show commands +This command applies to the default VRF. Use `vrf name ipv6 nht +no-resolve-via-default` for another VRF. +``` -```{opcmd} show ipv6 neighbors +Example: -Use this command to show IPv6 Neighbor Discovery Protocol information. +```none +set system ipv6 nht no-resolve-via-default ``` +## Operation + +### Show + +```{opcmd} show ipv6 forwarding + +**Show the router's IPv6 forwarding status.** +``` ```{opcmd} show ipv6 groups -Use this command to show IPv6 multicast group membership. +**Show the router's active IPv6 network connections and its IPv6 +multicast group memberships per interface.** ``` +```{opcmd} show ipv6 multicast group -```{opcmd} show ipv6 forwarding +**Show the IPv6 multicast group memberships of the router's +interfaces, as a table sorted by interface.** +``` + +```{opcmd} show ipv6 multicast group interface \ + +**Show the IPv6 multicast group memberships of the specified interface.** +``` + +```{opcmd} show ipv6 neighbors + +**Show the router's neighbor cache.** +``` + +```{opcmd} show ipv6 neighbors interface \ + +**Show the neighbor cache entries on the specified interface.** +``` -Use this command to show IPv6 forwarding status. +```{opcmd} show ipv6 neighbors state \ + +**Show the neighbor cache entries in the specified state.** ``` +```{opcmd} show ipv6 nht + +**Show the IPv6 next hop tracking table.** +``` + +```{opcmd} show ipv6 nht vrf \ + +**Show the IPv6 next hop tracking table for the specified VRF, or for +all VRFs.** +``` ```{opcmd} show ipv6 route -Use this command to show IPv6 routes. - -Check the many parameters available for the show ipv6 route command: - -:::{code-block} none -vyos@vyos:~$ show ipv6 route -Possible completions: - Execute the current command - Show IPv6 routes of given address or prefix - - bgp Show IPv6 BGP routes - cache Show kernel IPv6 route cache - connected Show IPv6 connected routes - forward Show kernel IPv6 route table - isis Show IPv6 ISIS routes - kernel Show IPv6 kernel routes - ospfv3 Show IPv6 OSPF6 routes - ripng Show IPv6 RIPNG routes - static Show IPv6 static routes - summary Show IPv6 routes summary - table Show IP routes in policy table - tag Show only routes with tag - vrf Show IPv6 routes in VRF -::: +**Show the IPv6 routes in the router's RIB.** +``` + +```{opcmd} show ipv6 route \ + +**Show only the IPv6 routes from the given source.** +``` + +```{opcmd} show ipv6 route \
+ +**Show the IPv6 routes in the RIB for the specified address or prefix.** + +For an address, the router shows the routes for the most specific prefix +that covers the address. For a prefix, the router shows only the routes +for exactly that prefix. +``` + +```{opcmd} show ipv6 route \ longer-prefixes + +**Show the IPv6 routes for the specified prefix and for all more specific +prefixes within it.** +``` + +```{opcmd} show ipv6 route forward + +**Show the IPv6 routes in the kernel's main routing table.** +``` + +```{opcmd} show ipv6 route forward \
+ +**Show the IPv6 routes in the kernel's main routing table that exactly +match the specified address or prefix.** +``` + +```{opcmd} show ipv6 route summary + +**Show the number of IPv6 routes from each source.** + +For each source, the output shows the number of routes in the RIB and +the number of those routes installed in the FIB. BGP routes are counted +separately for eBGP and iBGP. +``` + +```{opcmd} show ipv6 route summary table \ + +**Show the number of IPv6 routes from each source in the specified +routing table.** +``` + +```{opcmd} show ipv6 route table \ + +**Show the IPv6 routes in the specified routing table.** +``` + +```{opcmd} show ipv6 route tag \ + +**Show the IPv6 routes with the specified tag.** ``` + +```{opcmd} show ipv6 route vrf \ + +**Show the IPv6 routes in the RIB of the specified VRF, or of all VRFs.** +``` + +```{opcmd} show ipv6 route vrf \ \ + +**Show the IPv6 routes from the given source in the specified VRF, or +in all VRFs.** +``` + +```{opcmd} show ipv6 route vrf \ \
+ +**Show the IPv6 routes for the given address or prefix in the +specified VRF, or in all VRFs.** +``` + +```{opcmd} show ipv6 route vrf \ \ longer-prefixes + +**Show the IPv6 routes for the specified prefix and for all more +specific prefixes within it in the specified VRF, or in all VRFs.** +``` + +```{opcmd} show ipv6 route vrf \ summary + +**Show the number of IPv6 routes from each source in the specified +VRF, or in all VRFs.** + +For each source, the output shows the number of routes in the RIB and +the number of those routes installed in the FIB. BGP routes are counted +separately for eBGP and iBGP. +``` + +```{opcmd} show ipv6 route vrf \ tag \ + +**Show the IPv6 routes with the specified tag in the specified VRF, or +in all VRFs.** +``` + ```{opcmd} show ipv6 prefix-list - Use this command to show all IPv6 prefix lists +**Show all IPv6 prefix lists configured on the router.** +``` - There are different parameters for getting prefix-list information: +```{opcmd} show ipv6 prefix-list \ - :::{code-block} none - vyos@vyos:~$ show ipv6 prefix-list - Possible completions: - Execute the current command - Show specified IPv6 prefix-list - detail Show detail of IPv6 prefix-lists - summary Show summary of IPv6 prefix-lists - ::: +**Show the specified IPv6 prefix list.** ``` +```{opcmd} show ipv6 prefix-list detail -```{opcmd} show ipv6 access-list +**Show all IPv6 prefix lists configured on the router, with details +for each list and each entry.** +``` + +```{opcmd} show ipv6 prefix-list detail \ -Use this command to show all IPv6 access lists +**Show the specified IPv6 prefix list, with details for the list and +each entry.** +``` -You can also specify which IPv6 access-list should be shown: +```{opcmd} show ipv6 prefix-list summary -:::{code-block} none -vyos@vyos:~$ show ipv6 access-list -Possible completions: - Execute the current command - Show specified IPv6 access-list -::: +**Show all IPv6 prefix lists configured on the router, with the entry +count and sequence range of each list but without the entries.** ``` -```{opcmd} show ipv6 ospfv3 - Use this command to get information about OSPFv3. +```{opcmd} show ipv6 prefix-list summary \ - You can get more specific OSPFv3 information by using the parameters - shown below: +**Show the specified IPv6 prefix list, with its entry count and +sequence range but without the entries.** +``` - :::{code-block} none - vyos@vyos:~$ show ipv6 ospfv3 - Possible completions: - Execute the current command - area Show OSPFv3 spf-tree information - border-routers - Show OSPFv3 border-router (ABR and ASBR) information - database Show OSPFv3 Link state database information - interface Show OSPFv3 interface information - linkstate Show OSPFv3 linkstate routing information - neighbor Show OSPFv3 neighbor information - redistribute Show OSPFv3 redistribute External information - route Show OSPFv3 routing table information - ::: +```{opcmd} show ipv6 prefix-list \ \ + +**Show the entry of the specified IPv6 prefix list that matches the +specified prefix.** +``` + +```{opcmd} show ipv6 prefix-list \ \ first-match + +**Show the first entry of the specified IPv6 prefix list that matches +the specified prefix.** ``` +```{opcmd} show ipv6 prefix-list \ \ longer -```{opcmd} show ipv6 ripng +**Show the entries of the specified IPv6 prefix list whose prefix is +equal to or more specific than the specified prefix.** +``` + +```{opcmd} show ipv6 prefix-list \ seq \ -Use this command to get information about the RIPNG protocol +**Show the entry with the given sequence number in the specified IPv6 +prefix list.** ``` +```{opcmd} show ipv6 access-list + +**Show all IPv6 access lists configured on the router.** +``` -```{opcmd} show ipv6 ripng status +```{opcmd} show ipv6 access-list \ -Use this command to show the status of the RIPNG protocol +**Show the specified IPv6 access list.** ``` -### Reset commands +### Reset -```{opcmd} reset bgp ipv6 \ +```{opcmd} reset ipv6 neighbors address \ -Use this command to clear Border Gateway Protocol statistics or -status. +**Reset the neighbor cache entry for the specified IPv6 address.** ``` -```{opcmd} reset ipv6 neighbors \
-Use this command to reset IPv6 Neighbor Discovery Protocol cache for -an address or interface. +```{opcmd} reset ipv6 neighbors interface \ + +**Reset the neighbor cache entries on the specified interface.** ``` + ```{opcmd} reset ipv6 route cache -Use this command to flush the kernel IPv6 route cache. -An address can be added to flush it only for that route. -``` \ No newline at end of file +**Reset the entire IPv6 kernel route cache.** +``` + +```{opcmd} reset ipv6 route cache \
+ +**Reset the IPv6 kernel route cache entries for the specified address +or prefix.** +``` + +### Clear + +```{opcmd} clear ipv6 prefix-list + +**Reset the hit counts of all entries in all IPv6 prefix lists.** +``` + +```{opcmd} clear ipv6 prefix-list \ + +**Reset the hit counts of all entries in the specified IPv6 prefix +list.** +``` + +```{opcmd} clear ipv6 prefix-list \ \ + +**Reset the hit counts of the entries in the specified IPv6 prefix list +whose prefix is equal to or less specific than the specified prefix.** +``` -- cgit v1.2.3