当 Cisco 路由器的地址在该范围内时,为什么它会用 NDP RA 通告前缀?

网络工程 思科 思科-ios IPv6 国家发展计划
2022-02-18 04:17:26

如果我写

interface Vlan1
 ... {ipv4 config} ...
 ipv6 address 2001:DB8:5432:101::/64 eui-64
 ipv6 address FDAA:DB8:5432:101::/64 eui-64
 ipv6 enable
 ipv6 nd prefix 2001:DB8:5432:101::/64
 ipv6 nd prefix FDAA:DB8:5432:101::/64
 ipv6 nd other-config-flag
 ipv6 nd ra interval 4
 ipv6 dhcp server DHCP6_POOL
!

然后我看到的 NDP RA 看起来像(tcpdump,连接到的机器Vlan1

IP6 (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 96) fe80::{router's eui-64} > ff02::1: [icmp6 sum ok] ICMP6, router advertisement, length 96
hop limit 64, Flags [other stateful], pref medium, router lifetime 1800s, reachable time 0ms, retrans timer 0ms
  source link-address option (1), length 8 (1): {router's eui-48}
  mtu option (5), length 8 (1):  1500
  prefix info option (3), length 32 (4): 2001:db8:5432:101::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s
  prefix info option (3), length 32 (4): fdaa:db8:5432:101::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s

完全符合预期。被通告的前缀是那些配置了 的前缀ipv6 nd prefix *::/64,不多也不少。

但是,如果我在接口上配置其他地址ipv6 address但不添加这些前缀,ipv6 nd prefix如下所示

interface Vlan1
 ... {ipv4 config} ...
 ipv6 address 2001:DB8:5432:101::/64 eui-64
 ipv6 address 2001:DB8:5432:102::/64 eui-64
 ipv6 address FDAA:DB8:5432:101::/64 eui-64
 ipv6 address FDAA:DB8:5432:102::/64 eui-64
 ipv6 enable
 ipv6 nd prefix 2001:DB8:5432:101::/64
 ipv6 nd prefix FDAA:DB8:5432:101::/64
 ipv6 nd other-config-flag
 ipv6 nd ra interval 4
 ipv6 dhcp server DHCP6_POOL
!

那么我希望 RA 仅用于指定的前缀ipv6 nd prefix,但是我看到 RA 包含所有四个前缀:

IP6 (class 0xe0, hlim 255, next-header ICMPv6 (58) payload length: 160) fe80::{router's eui-64} > ff02::1: [icmp6 sum ok] ICMP6, router advertisement, length 160
hop limit 64, Flags [other stateful], pref medium, router lifetime 1800s, reachable time 0ms, retrans timer 0ms
  source link-address option (1), length 8 (1): {router's eui-48}
  mtu option (5), length 8 (1):  1500
  prefix info option (3), length 32 (4): 2001:db8:5432:101::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s
  prefix info option (3), length 32 (4): 2001:db8:5432:102::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s
  prefix info option (3), length 32 (4): fdaa:db8:5432:101::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s
  prefix info option (3), length 32 (4): fdaa:db8:5432:101::/64, Flags [onlink, auto], valid time 2592000s, pref. time 604800s

我可以使用什么配置来为路由器提供所有四个地址Vlan1,但只通告原始的两个 - 这样动态设备只会在 101 个子网中自动配置,但路由器仍然可以与在 102 个子网内静态分配的地址的服务器通信?

1个回答
ipv6 nd prefix default no-advertise

或者列出不公布的接口地址

ipv6 nd prefix 2001:DB8:5432:102::/64 no-advertise
ipv6 nd prefix FDAA:DB8:5432:102::/64 no-advertise