# IPv6 Neighbor Discovery and Host Autoconfiguration

Neighbor Discovery

ND (Neighbor Discovery) is the process of tracking the reachability status for neighbors in the local link. A security device views a neighbor as reachable when the device receives recent confirmation that the neighbor received and processed IP traffic or NS (Neighbor Solicitation) requests. Otherwise, it considers the neighbor unreachable.

NUD(Neighbor Unreachability Detection): Enables NUD, which detects and tracks failure of communication paths to neighbor devices. The security device stores reachability states for each neighbor in a Neighbor Cache table. Each entry in this table tracks the current reachability status of a neighbor.

Base Reachable Time: Sets the approximate length of time (in seconds) that the security device maintains Reachable status for a neighbor after the security device transmits a NS (Neighbor Solicitation) message to the neighbor and receives a NA message in reply. The maximum setting is 36,000 seconds. (If the interface accepts router advertisements, any received advertisements override this setting.)

Note: The Base Reachable time setting only specifies an approximation of the actual time that the status remains Reachable. The exact time interval is called Reachable Time. The security device determines Reachable Time randomly, using the Base Reachable Time as a baseline value. The resulting Reachable Time is usually within 50% to 150% of the Base Reachable Time setting.

Probe Time: Sets the time interval (in seconds) between retransmissions of NS messages during a probe. The security device performs a probe after discovering that a neighbor is unreachable. The default setting is ten seconds, and the maximum value is 300 seconds. The security device continues to send the NS messages as long as the Neighbor Cache entry status is Incomplete or Probe Forever (as when the neighbor is a next-hop gateway).

Retransmission Time: Sets the time interval (in seconds) between retransmissions of NS messages during a probe. The default setting is one second.

DAD (Duplicate Address Detection) Retry Count: Sets the DAD retry count, which is the number of consecutive NS messages that the interface sends while performing DAD for the interface. A setting of 0 disables DAD for the interface. Valid settings are from 0 to 10, and the Default setting is 3. When the device uses DAD, it tests the IPv6 address for uniqueness. The security device does not assign the interface any address found to be duplicate. The device only applies DAD to newly assigned addresses, or when the interface goes down and comes back up again.

Accept Incoming Router Advertisements: Directs the security device to learn of the existence and identity of IPv6 routers by accepting Router Advertisement (RA) messages. Note: This option is available only when the interface is in host mode. It is not available when the interface is in router mode.

Neighbor Unreachability Detection

The security device performs NUD by building and maintaining the Neighbor Cache Table, which contains the address for each neighbor to which a host recently sent traffic. The security device uses these entries to record changes in the reachability status of the neighbors. NUD allows the security device to track the changing reachability state of each neighbor, and to make traffic forwarding decisions accordingly.

A security device interface, configured to operate in router mode, can enable on-link IPv6 hosts to perform autoconfiguration of IPv6 addresses and other parameters. Host autoconfiguration eliminates (or reduces) the need to manually assign addresses to individual hosts on the IPv6 link. Because the autoconfiguration does not require a stateful configuration protocol such as DHCPv6, it is said to be stateless.

Allow RA Transmission: Directs the security device to learn of the existence and identity of other IPv6 routers by accepting RA (Router Advertisement) messages.

Note: This option is available only when the interface is in host mode. It is not available when the interface is in router mode.

Link MTU: Directs the security device IPv6 router to advertise the link-MTU (Maximum Transmission Unit) in router advertisements. The link MTU is the maximum size (expressed in bytes) of any unfragmented IPv6 packet that can traverse the IPv6 link. (The default link MTU is 1500 bytes for Ethernet, and 1490 for PPPoE. In all cases, the link MTU must be in the range of 1280 and 1500.)

Link Layer Address: Enables the Link Layer Address flag, which directs the security device IPv6 router to include the link-layer (MAC) address of the router in outgoing RA messages.

Other Parameters Configuration Flag: Enables the Other Stateful Configuration flag (O flag), which directs the local IPv6 hosts to use a stateful address autoconfiguration protocol, such as DHCPv6, to configure any parameters other than host addresses. Note: For local IPv6 hosts to perform stateless address autoconfiguration, you must disable this setting.

Reachable Time: Specifies the length of time (in seconds) that a host may consider the security device reachable after receiving a transmitted RA. When a security device transmits a NS message to a neighbor and receives a Neighbor Advertisement (NA) message in reply, the device sets the neighbor reachability status to Reachable. The Base Reachable Time setting specifies the approximate length of time (expressed in seconds) that the security device maintains the Reachable status. After this time interval passes, the status goes to Stale mode.

Note: The NUD algorithm generates this value from the Base Reachable Time (described above).

Retransmission Time: Directs the security device to include the Retransmission Time interval in outgoing RA messages. This interval (expressed in seconds) is the time that elapses between retransmissions of NS (Neighbor Solicitation) messages.

Current Hop Limit: Specifies the hop limit for packets transmitted by any local IPv6 host that uses RAs from the interface for address autoconfiguration. Setting the Current Hop Limit value to zero denotes an unspecified number of hops.

Maximum Advertisement Interval: Specifies the maximum time interval allowed between transmission of unsolicited multicast RAs from the security device IPv6 router.

Minimum Advertisement Interval: Specifies the minimum time interval allowed between transmission of unsolicited multicast RAs from the security device IPv6 router.

Default Router Lifetime: Specifies the interval of time (in seconds) that hosts may consider the security device interface to be the default router after receiving the last transmitted RA.

Advertised Router Preference: Specifies the preference level for the security device IPv6 router (high, medium, or low). When a host receives the RA from the router, and other routers are present, the preference level determines whether the host views the router as a primary router or a secondary router.