Installation Guide

IPv6 ND Proxy
Enabling the ND proxy feature causes the router to reply on behalf of the target host (if the target host exists).
For nodes on dierent segments, the NS request for resolving the neighbor may not reach another host. The reply will contain the link-
local address of the router interface which is sending the reply, instead of the link-local address of the target host.
When any IPv6 packet is received on a proxy interface, it must be parsed to see whether it is known to be one of the following types:
• ICMPv6 Neighbor Solicitation (NS)
If the received packet is an ICMPv6 Neighbor Solicitation (NS), the NS is processed locally but no NA is generated immediately.
Instead the NS is proxied, and the NA will be proxied when it is received. This ensures that the proxy does not interfere with
hosts moving from one segment to another, since it never responds to an NS based on its own cache.
• ICMPv6 Neighbor Advertisement (NA)
If the received packet is an ICMPv6 Neighbor Advertisement (NA), the neighbor cache on the receiving interface is rst updated
as if the NA were locally destined, and then the NA is proxied.
ND Proxy Example
In the following topology, A and B are nodes on separate segments which are connected by proxy P.
• A and B have link-layer addresses a and b, respectively.
• P has link-layer addresses p1 and p2 on the two segments.
A---|---P---|---B
a p1 p2 b
When A attempts to send an initial IPv6 packet to B, the following actions occur:
• Route look up for destination address B is executed on A. Before the packet can be sent, A needs to resolve B's link-layer
address and sends a Neighbor Solicitation (NS) to the solicited-node multicast address for B. The Source Link-Layer Address
(SLLA) option in the solicitation contains A's link-layer address.
• P receives the solicitation (since it is receiving all link-layer multicast packets) and processes it. Since it is an NS, it creates a
neighbor entry for A on interface 1, and records its link-layer address. It also creates a neighbor entry for B (on an arbitrary proxy
interface) in the INCOMPLETE state. Since the packet is multicast, P then needs to proxy the NS out on all other proxy
interfaces on the subnet. Before sending the packet out on interface 2, it replaces the link-layer address in the SLLA option with
its own link-layer address of p2.
• B receives this NS, processing it as usual. A neighbor entry for A is created and mapped to the link-layer address p2. In
response, a Neighbor Advertisement (NA) is sent to A containing B's link-layer address b. The NA is sent using A's neighbor
entry, i.e. to the link-layer address p2.
• The NA is received by P, which is processed as would occur with any unicast packet; i.e. the NA is forwarded out of interface 1,
based on the neighbor cache. However, before actually sending the packet out, it is inspected to determine if the packet about
to be sent is one that requires proxying. Since it is an NA, it updates its neighbor entry for B to be REACHABLE and records the
link-layer address b. P then replaces the link-layer address in the LLA option with its own link-layer address on the outgoing
interface, p1. The packet is then sent out on interface 1.
• When A receives this NA, it is processed as usual. Hence a neighbor entry is created for B on interface 1 in the REACHABLE
state, and the link-layer address p1 is recorded.
IPv6 ND Proxy
Extreme Routing MLX Series Hardware Installation Guide
236 53-1004203-04