IPv6 Address Spoofing

[ksodan]

Greetings Everyone,

I have an external interface with IPv6 enabled (::31:2) and a default IPv6 route leading to ::31:1.

Also, Topology calculation is enabled but when I try to ping the interface ::31:2 the firewall drops it as if it is address spoofing.

I haven't found any documentation about this, also I've tried the one liner which doesn't show me much IPv6 information.

Any ideas what can be the issue here?

VSX cluster, coreXL , R81.10 T156

[Chris_Atkinson]

What is the source address from which you are initiating the ping and what is the routing to reach that address?

[ksodan]

Source address is from IPv6 GUA range 2001::...

Routing to reach the address is the default route ::/0 through the external interface (PtP between FW and L3 leaf)

[the_rock]

Can you run something like below? Just replace with right ipv6.

Andy

fw ctl zdebug + drop | grep 2001:db8:3333:4444:5555:6666:7777:8888

[ksodan]

Hello Andy,

thank you for your time. Here are the results (full ips omitted):

fw6 ctl zdebug + drop

Output:

@;124675495;[kern];[tid_37];[SIM-242006539];pkt_handle_no_match: packet dropped (spoofed address), conn: <<2001:xxxx::dce7,1,fdca::xxxx:32:2,128,58>>, ifn 35
@;124675495;[kern];[tid_37];[SIM-242006539];sim_pkt_send_drop_notification: (2,0) received drop, reason: Anti-Spoofing, conn: <<2001:xxxx::dce7,1,fdca::xxxx:32:2,128,58>>;
@;124675495;[kern];[tid_37];[SIM-242006539];sim_pkt_send_drop_notification: sending packet dropped notification drop mode: 0 debug mode: 1 send as is: 0 track_lvl: -1, conn: <2001:xxxx::dce7,1,fdca::xxxx:32:2,128,58>;
@;124675495;[kern];[tid_37];[SIM-242006539];sim_pkt_send_drop_notification: sending single drop notification, conn: <<2001:xxxx::dce7,1,fdca::xxxx:32:2,128,58>>;
@;124675495;[kern];[tid_37];[SIM-242006539];do_packet_finish: SIMPKT_IN_DROP vsid=2, conn:<<2001:xxxx::dce7,1,fdca::xxxx:32:2,128,58>>;

[the_rock]

K, so its 100% clear from the drops its anti-spoofing related, as you described in the post. Can you send a screenshot of how those settings are configured from topology please? Just blur out any sensitive data.

Best,

Andy

[ksodan]

Certainly, thank you for your time for reviewing this.

Best regards,

 Krešimir

[Lesley]

If config is correct and cannot be solved that way you have to open TAC case.

I have also new issues regarding IPV6 and AS. Custom patch was needed on fwmgmt.