Loosing IPv6 connectivity after some time

[Aiko Barz]

Does anybody else have this Problem?

Our virtual machines loose their IPv6-connectivity after a period time. To be precise: They loose internet connectivity. They are still able to access neighbors within their broadcast domain. After a direct PING to the public IPv6 address of the Cisco router, they gain access again for some time.

I also have a workaround, that I have to apply to the Proxmox host:

$ cd /sys/class/net; for i in vmbr*; do echo 0 > $i/bridge/multicast_snooping; done​

I have to do this after every reboot. I am puzzled why this is all necessary.

The proxmox server creates a bridge on a 802.1Q VLAN. Example:

auto vmbr2
iface vmbr2 inet manual
bridge_ports eth1.2
bridge_stp off
bridge_fd 0​

On the other end, we use switch stacks from Cisco.

Kind regards,
Aiko

 

[abma]

I've hit the same problem.

https://pve.proxmox.com/wiki/Multicast_notes#Linux:_Disabling_Multicast_snooping_on_bridges

/etc/network/interfaces:

  post-up ( echo 1 > /sys/devices/virtual/net/$IFACE/bridge/multicast_querier )
  post-up ( echo 0 > /sys/class/net/$IFACE/bridge/multicast_snooping )

 

[scyto]

are your VMs statically IPv6 addressed, using slacc or using dhcp-v6?

have you modified any sysctls for IPv6?

have you enabled NDP on the host and VM firewalls?

have you tested with firewall off and input policy set to accept on both?

 

[abma]

are your VMs statically IPv6 addressed, using slacc or using dhcp-v6?

dhcp-v6

have you modified any sysctls for IPv6?

no.

have you enabled NDP on the host and VM firewalls?

firewall is disabled.

have you tested with firewall off and input policy set to accept on both?

no need to test as the firewall is disabled. Disabling multicast_snooping clearly fixed the problem: before every 3-5h the connection was lost.

 

[scyto]

Things is, I have same setup, don’t have same issue. Difference maybe I have NDP forwarding turned on in the kernel.

 

[abma]

I'm pretty sure the problem depends on the gateway / switch. As the gateway is configured by my provider idk whats configured there.

https://pve.proxmox.com/wiki/Multicast_notes#Disabling_IGMP_Snooping_.28not_recommended.29 :

"Snooping should be enabled on either the router / switch or on the linux bridge, but it may not work if enabled on both. If you have a hosting provider that has igmp snooping enabled on the multicast switch, it may be necessary to disable snooping on the linux bridge. ..."