DHCPv6-PD /60 delegated but return traffic not routed back.

@user_fwd75x​ 

IPv6 has a lot of differences.  First up is how DHCP works.  Comcast, like most normal ISPs, gives you one IPv4 address.  Your router takes it and uses NAT (network address translation) to share that one single address across all your devices.  If you have a router that can support multiple subnets it will share that one IPv4 address across all your subnets.

When you request a /60 IPv6 network via DHCPv6 you are getting 16 subnets.  An IPv4 address is 32 bits.  An IPv6 address is 128 bits, with 64 bits for the network address (aka subnet) and 64 bits for individual devices.  So while IPv4 is 2^32 addresses (4,294,967,296) for the entire world, with IPv6 the minimum size of a subnet is 2^64 addresses (18,446,744,073,709,551,616) and you have 16 of them with a /60.  That leaves 2^60 aka 1,152,921,504,606,846,976 /60s for the rest of the world.  /60 is the official standard for IPv6 residential service.  What you'll need to do on the router side is configure it to assign one IPv6 subnet to your trusted vlan and one to your IoT vlan.  I'm not sure how this works on a Firewalla Gold, but on my Mikrotik router I basically just point each vlan to a pool of IPv6 networks addresses and they each grab one.

Another difference between IPv4 and IPv6 is static addresses are kind of not it in IPv6, particularly for home networks.  Your /60 or whatever is dynamic and might change, the router doesn't do NAT, and the network half of the address is subject to change.  So in other words if you want to use IPv6 between devices on your lan you want a router that has a DNS server built in that can map MAC addresses to hostnames, then hand out the current IPv6 address of said host when some other device goes looking for that hostname.

With a "trusted" lan and an "IoT" lan you'll want to have your router assign a different IPv6 subnet to each.  Very few routers support IPv6 NAT aside from serious business models.  All your clients on the lan side should generally be set to use IPv6 autoconfiguration.  Don't set them for DHCPv6.  Almost no routers support client DHCPv6.  Another big difference between IPv4 and IPv6 is clients typically generate their own IP address based on the hardware MAC address of their network adapter and the network address (first 64 bits) received from the router rather than requesting one from a DHCP server or having one statically configured.  IPv6 also supports temporary addresses for security reasons - mostly to prevent tracking, but no need to configure those.  IPv6 clients should generally just be set for autoconfiguration.  They'll send out a multicast request when they start up, and the router will reply with everything they need.  So quite different from IPv4.

hey @zandor60657 

Thanks again for the reply. I see my entire thread has been edited to remove addresses. That's slightly annoying as I don't care... but anyway.

I do understand everything you wrote above about IPV6. The Firewalla is already splitting the delegated /60 into separate /64s for my LAN/VLANs.

The issue is upstream. WAN-sourced IPv6 from the router works, but traffic sourced from one of the delegated LAN /64s fails. A WAN tcpdump shows those packets leaving toward Xfinity, but no replies return.

So, I agree the router needs to assign /64s per VLAN, but that part is happening. The local network is set up pretty much exactly as you describe.

Working with AI a bit it thinks this should be the next approach if I can get Xfinity to help.

Verify that return traffic for my delegated DHCPv6-PD /60 is routed back to my modem/router.

- check DHCPv6-PD provisioning

- check the CMTS/edge route for delegated /60

Are there actual Xfinity support people in these forums?

Do you know how I can get someone on the actual networking side of Xfinity to help?

I want to escalate to the team that owns CMTS IPv6 routing, or at least someone who understands those words. 😀

Thanks again!