IPv6 router advertisements — SLAAC, prefix options, M/O flags, RDNSS

Router Advertisements (RA) are the IPv6 mechanism that lets a router push configuration to every host on the link. The router periodically multicasts an RA to ff02::2 (all-routers, but hosts also listen). The RA carries the prefix the hosts should use, the lifetime of that prefix, whether the host should also use DHCPv6, and — since RFC 8106 — which DNS resolvers the hosts should query.

A host that boots on an IPv6 link sends a Router Solicitation (RS, ICMPv6 type 133) and waits for an RA. If no RA arrives, the host falls back to link-local-only operation and cannot reach the global internet. RA delivery is therefore critical infrastructure.

The RA message and its options

flowchart TB
  RA["ICMPv6 type 134 Router Advertisement<br/>sent to ff02::1 every 200 seconds by default"]
  RA --> HOP["Cur Hop Limit<br/>hop limit to use for outgoing packets"]
  RA --> LIFE["Router Lifetime<br/>how long this router is a default router<br/>0 = remove from default router list"]
  RA --> REACH["Reachable Time<br/>how long neighbour entries stay REACHABLE"]
  RA --> RETR["Retrans Timer<br/>how long between NS retransmissions"]
  RA --> PIO["Prefix Information Option (PIO)<br/>prefix, valid lifetime, preferred lifetime, A/L flags"]
  RA --> MTU["MTU option<br/>link MTU to use"]
  RA --> RDNSS["RDNSS option (RFC 8106)<br/>DNS server addresses and lifetime"]
  RA --> ROUTE["Route Information Option (RIO)<br/>specific routes to advertise"]

The mandatory fields are hop limit, router lifetime, reachable time, and retrans timer. The optional fields — PIO, MTU, RDNSS, RIO — are what the operator configures per-interface.

SLAAC — Stateless Address Autoconfiguration

sequenceDiagram
  autonumber
  participant H as Host (booting)
  participant R as Router

  H->>R: RS (ICMPv6 type 133)
  R-->>H: RA with PIO<br/>prefix 2001:db8:1::/64<br/>A=1 L=1<br/>valid 86400 preferred 14400
  Note over H: builds address<br/>2001:db8:1::5054:ff:fe12:3456
  H->>R: NS (DAD)<br/>solicit ff02::1:ff12:3456
  Note over R: no other host responds
  H-->>H: DAD passes, address valid

SLAAC is “stateless” because the router does not track which hosts got which addresses. The router advertises a /64 prefix; each host picks an interface identifier (EUI-64 from MAC or random for privacy) and assigns itself an address in that /64. The host runs DAD (Duplicate Address Detection) by sending an NS to its own solicited-node multicast group. If no NA comes back, the address is unique and valid.

SLAAC works for any host that just needs an address and a default route. It does not give the host DNS, NTP, or other “other” configuration. Those require RDNSS or DHCPv6.

M/O flags — Managed and Other-config

The Managed (M) flag tells the host to use stateful DHCPv6 for address assignment. The Other-config (O) flag tells the host to use stateless DHCPv6 for “other” information (DNS, NTP) without using DHCPv6 for the address itself.

flowchart TB
  subgraph Cases["M and O flag combinations"]
    C0["M=0 O=0<br/>SLAAC only<br/>no DHCPv6"]
    C1["M=0 O=1<br/>SLAAC for address<br/>Stateless DHCPv6 for DNS / NTP"]
    C2["M=1 O=0<br/>Stateful DHCPv6 for address<br/>no other config"]
    C3["M=1 O=1<br/>Stateful DHCPv6 for address and other config"]
  end

The four combinations cover the spectrum from “pure SLAAC” to “pure DHCPv6” with two mixed modes for the cases where operators want SLAAC for the address but DHCP for the DNS.

A/P flags — Autonomous and On-link

Each PIO has its own A (Autonomous) and L (On-link) flags, independent of the M/O flags on the RA header.

• A=1: hosts should SLAAC-autoconfigure an address from this prefix.
• L=1: the prefix is on-link; hosts add a connected route for it.

A prefix is typically A=1 and L=1 — autoconfigure and on-link. A “no on-link” prefix (L=0, A=1) means the host should autoconfigure but should not treat the prefix as on-link. A “no SLAAC” prefix (L=1, A=0) means the prefix is on-link for routing but the host should not autoconfigure from it.

Prefix lifetimes

flowchart LR
  T0["Time 0<br/>address preferred"]
  T1["Preferred Lifetime reached<br/>e.g. 14400s<br/>address deprecated<br/>new connections discouraged<br/>existing connections still work"]
  T2["Valid Lifetime reached<br/>e.g. 86400s<br/>address invalid<br/>removed from interface"]

The PIO carries two lifetimes. The Preferred Lifetime is how long an autoconfigured address is “preferred” — new outbound connections should use it. After this lifetime, the address is “deprecated” — existing connections still work but new ones should use a different address. The Valid Lifetime is how long the address is valid at all; after this, the kernel removes it.

The lifetime ratio matters. A common production pattern is valid 86400 preferred 14400 (one day valid, four hours preferred). Operators with stable prefixes use larger values (valid 2592000 preferred 604800 — 30 days valid, 7 days preferred).

RDNSS — Recursive DNS Server option

flowchart LR
  R[VyOS router<br/>RA with RDNSS] --> D1[2001:db8::53:1<br/>primary DNS]
  R --> D2[2001:db8::53:2<br/>secondary DNS]
  R --> H[Host learns DNS<br/>via RA without DHCPv6]

RFC 8106 added the RDNSS option so hosts can learn DNS servers from the RA without running DHCPv6. The option carries the DNS server addresses and a lifetime. Hosts that support RFC 8106 use these addresses directly; older hosts ignore the option and fall back to whatever DNS they had configured.

The lifetime on the RDNSS option is separate from the prefix lifetime. Operators typically set them to the same value so a prefix change rotates the DNS at the same time.

How RAs are configured on VyOS

configure
set interfaces ethernet eth0 ipv6 router-advert cur-hop-limit 64
set interfaces ethernet eth0 ipv6 router-advert lifetime 1800
set interfaces ethernet eth0 ipv6 router-advert reachable-time 0
set interfaces ethernet eth0 ipv6 router-advert retrans-timer 0
set interfaces ethernet eth0 ipv6 router-advert interval 200
set interfaces ethernet eth0 ipv6 router-advert managed-flag 'off'
set interfaces ethernet eth0 ipv6 router-advert other-config-flag 'off'
set interfaces ethernet eth0 ipv6 router-advert prefix '2001:db8:1::/64'
set interfaces ethernet eth0 ipv6 router-advert prefix '2001:db8:1::/64' autonomous-flag 'on'
set interfaces ethernet eth0 ipv6 router-advert prefix '2001:db8:1::/64' on-link-flag 'on'
set interfaces ethernet eth0 ipv6 router-advert prefix '2001:db8:1::/64' preferred-lifetime 14400
set interfaces ethernet eth0 ipv6 router-advert prefix '2001:db8:1::/64' valid-lifetime 86400
set interfaces ethernet eth0 ipv6 router-advert dns-server '2001:db8::53:1'
set interfaces ethernet eth0 ipv6 router-advert dns-server '2001:db8::53:2'
commit
save

The configuration sets the RA parameters on eth0. Hosts on the segment receive the RA, autoconfigure addresses from 2001:db8:1::/64, learn the DNS servers, and use the router as a default gateway for 1800 seconds (router lifetime).

How the RA is validated

show ipv6 nd
show ipv6 router-advertisements
rdisc6 eth0
tcpdump -i eth0 -n ip6

The first two are the VyOS view. The third is the ndisc6 tool, which sends an RS and prints the RA. The fourth is the on-wire capture — the operator should see RAs arriving every 200 seconds.

vyos@vyos:~$ show ipv6 nd
Interface: eth0
  State: LINK_UP
  Router Advertisement: enabled
  RA interval: 200s
  RA lifetime: 1800s
  RA reachable-time: 0
  RA retrans-timer: 0
  RA managed-flag: off
  RA other-config-flag: off

  Prefix: 2001:db8:1::/64
    Autonomous-flag: on
    On-link-flag: on
    Preferred-lifetime: 14400
    Valid-lifetime: 86400

  DNS Server: 2001:db8::53:1, 2001:db8::53:2

A host that runs rdisc6 eth0 will show the same options from the consumer side.

How it fails

The production failure modes the engineer must recognise:

• No RA sent. A misconfigured interface with router-advert disabled leaves hosts without a default route. They have link-local only.
• RA flag M=0 but hosts expect DHCPv6. A dual-stack deployment where Windows hosts need DHCPv6 to autoconfigure but the operator has M=0; Windows hosts get SLAAC addresses but no DNS.
• RDNSS option not respected. Hosts older than RFC 8106 (Windows 7, some Linux kernels before 3.13) ignore the RDNSS option. The operator must run stateless DHCPv6 for those hosts.
• Prefix valid-lifetime too short. A prefix lifetime shorter than the host’s preferred-lifetime causes the host to drop the address before it has a new one to use. Common operational misconfiguration.
• Hop limit set to 0. Some firewalls block hop-limit-0 packets because they look like NULL. RA defaults to 64; an operator setting 0 sends RAs that the firewall discards.
• Router lifetime = 0. Hosts immediately remove the router from their default router list. Common test mistake that ships to production.

Rollback

The recovery from a bad RA configuration:

• No RA sent: set interfaces ethernet eth0 ipv6 router-advert ...; commit; save.
• Wrong M/O flag: change the flag setting and commit; save.
• Wrong lifetime: delete interfaces ethernet eth0 ipv6 router-advert prefix ... and re-add with correct lifetimes.
• Hop-limit 0: set interfaces ethernet eth0 ipv6 router-advert cur-hop-limit 64; commit; save.

Production discipline

Cross-course references

The Linux course’s XIX-Linux-NetFoundations covers the kernel SLAAC implementation and addrgenmode. The OPNsense course’s I-OPNsense-NetFoundations covers the equivalent RA configuration on the firewall. The VyOS lessons vyos-xi-01-ipv6-fundamentals and vyos-xi-02-ipv6-addressing cover the protocol and address types this lesson assumes. The lesson vyos-xi-04-dhcpv6 extends RA configuration to the stateful DHCPv6 case.

Quiz