Troubleshooting IPv6 Inter-VLAN Routing

Revisiting Inter-VLAN Routing for IPv6

The "router-on-a-stick" model is a classic solution for routing between VLANs, and its logic remains identical for IPv6. A single physical link between a router and a switch is configured as an 802.1Q trunk. On the router, you create a virtual subinterface for each VLAN. Each subinterface is assigned an IPv6 address that serves as the default gateway for hosts in that specific VLAN.

The configuration involves two main parts:

1. On the Switch: The port connecting to the router is configured as a trunk to allow traffic from multiple VLANs.
2. On the Router: The physical interface is enabled, but subinterfaces are created for each VLAN. Each subinterface gets:
   • encapsulation dot1q <vlan-id> to tag traffic for the correct VLAN.
   • ipv6 address <prefix/prefix-length> to act as the default gateway for that VLAN's subnet.
   • The ipv6 enable command to activate IPv6 on the subinterface.

The logical topology looks something like this:

A Systematic Troubleshooting Approach

When inter-VLAN communication fails, a layered approach is the most effective way to find the root cause. Start from the bottom of the OSI model and work your way up.

1. Layer 2 Verification (Switch):

   • Are the VLANs created and active? Use show vlan brief.
   • Is the link to the router configured as a trunk? Is the trunk operational? Use show interface trunk. Check that the required VLANs are allowed on the trunk.

2. Layer 3 Verification (Router):

   • Is IPv6 routing enabled globally? Check for ipv6 unicast-routing in the configuration.
   • Are the subinterfaces configured correctly? Use show running-config interface <interface-id> to check that the encapsulation dot1q VLAN ID matches the intended VLAN.
   • Are the IPv6 addresses correct? Use show ipv6 interface brief. Each subinterface should have an address from the correct prefix for its VLAN and should show a status of "up/up".

3. End-to-End Connectivity Test:

   • From a host, can you ping your own default gateway? (e.g., from a PC in VLAN 100, ping the router's subinterface address for VLAN 100). If this succeeds, you have confirmed Layer 1, Layer 2, and basic Layer 3 addressing between the host and the router for that VLAN.
   • If not, the problem is likely on the local segment (bad cable, wrong VLAN assignment on the switch port, host misconfiguration, or NDP failure to find the gateway).
   • If you can ping the gateway but cannot ping a host in another VLAN, the problem lies in the routing process itself.

Case Study: A Real-World Troubleshooting Scenario

Theory is useful, but analyzing a real problem is invaluable. We are going to walk through a troubleshooting thread from the Cisco Community where a user faced this exact issue.

First, let's understand the problem from the user's perspective.

The user can reach devices within their own subnet (the gateway), but not beyond. This suggests the local link is fine, but the routing process is failing. Now, let's examine the configurations the user provided.

Did you spot it? The command ipv6 unicast-routing appears in both the router config (where it belongs) and the switch config (where it does not, for a Layer 2 switch).

This is a critical and subtle error. By enabling IPv6 routing on the switch, the user inadvertently turned it into a basic IPv6 router. This L2 switch started sending its own Router Advertisement (RA) messages. Hosts in the VLANs would hear RAs from both the real router and the switch. This can lead to hosts attempting to use the switch as a gateway, which has no path to the other subnets or the internet. The traffic is effectively "blackholed."

Now, let's see the expert's conclusion.

This case study highlights a key lesson: a device's role is defined by its configuration. A simple command can cause a Layer 2 switch to misbehave as a Layer 3 device, disrupting the entire network's routing logic.

Verifying NDP on Router Subinterfaces

Let's assume you've fixed the configuration from the case study, but a ping between VLANs still fails. The next suspect is the Neighbor Discovery Protocol.

Consider the data flow for a ping from PC1 (VLAN 10) to PC2 (VLAN 20):

1. PC1 knows PC2 is on a different subnet, so it creates an Ethernet frame destined for its default gateway's MAC address.
2. The router receives the frame on its VLAN 10 subinterface. It looks at the IPv6 packet inside, sees the destination is PC2, and performs a routing table lookup. It finds that PC2's subnet is reachable via its VLAN 20 subinterface.
3. Now, the router needs to forward the packet to PC2. It must create a new Ethernet frame for the VLAN 20 segment. To do this, it needs PC2's MAC address.
4. The router checks its neighbor cache for an entry for PC2. If there isn't one, it sends a Neighbor Solicitation (NS) message out of its VLAN 20 subinterface, asking for PC2's MAC address.
5. PC2 should respond with a Neighbor Advertisement (NA).
6. The router receives the NA, populates its neighbor cache, and can now finally forward the packet to PC2.

The critical diagnostic step is to check the router's neighbor cache with show ipv6 neighbors. If the router has sent an NS but not received an NA, you will see an entry for PC2's IP address with a state of INCOMP (Incomplete). An entry stuck in INCOMP is a clear sign that NDP is failing on that subinterface, often due to an L2 issue on the destination VLAN or an ICMPv6 filter.

Speaking of filters, this is a good time to reinforce a point from the last lesson. Firewalls or ACLs that mistakenly block ICMPv6 can completely break NDP.

Conclusion

Troubleshooting IPv6 inter-VLAN routing is a methodical process of elimination that combines your knowledge of both VLANs and IPv6 diagnostics.

Key Takeaways:

• The logical process of "router-on-a-stick" is the same for IPv6, but you must use IPv6-specific commands for addressing and routing.
• Follow a layered troubleshooting approach: verify L2 (VLANs, trunks), then L3 addressing (subinterfaces, prefixes), and finally the routing process itself.
• Always check that ipv6 unicast-routing is enabled on the router and, just as importantly, disabled on any Layer 2-only switches in the path.
• When inter-VLAN pings fail despite correct configuration, the Neighbor Discovery Protocol is the primary suspect. Use show ipv6 neighbors on the router to check for INCOMP entries, which indicate a failure in address resolution on a specific subinterface.
• Never block ICMPv6 traffic with ACLs unless you are absolutely certain you know what you are doing, as it will break NDP and cripple your IPv6 network.

In our next lesson, we will pivot from the wired world to the wireless one, starting with the fundamental principles of Radio Frequency (RF) and the 802.11 standards that govern Wi-Fi communication.