A active/standby failover is to set up for IPv6. Current configuration excerpt:
interface Ethernet1 nameif inside security-level 100 ipv6 address 2001:4bd8:x:y::/64 eui-64 ipv6 enable ipv6 nd prefix 2001:4bd8:x:y::/64 ! failover failover key ***** failover replication http failover link failover Ethernet5 failover interface ip failover ... !
primary# sh ipv6 interface brief inside [up/up] fe80::20d:88ff:fe10:7a98 2001:4bd8:x:y:20d:88ff:fe10:7a98 secondary# sh ipv6 interface brief inside [up/up] fe80::20d:88ff:fe10:70c4 2001:4bd8:x:y:20d:88ff:fe10:70c4
This results in the following autoconfig entry on an inside host:
It's obivous that the router announcement from the secondary pix is send despite the machine is in standby state. This causes the responses from the inside host to send to the standby pix which silently drops the packets.
Crosschecking the usage of the wrong route (display neighbour states):
primary# sh ipv6 neighbor IPv6 Address Age Link-layer Addr State Interface
2001:4bd8:x:y:20e:cff:fe36:822c 60 000e.0c36.822c STALE inside fe80::20e:cff:fe36:822c 60 000e.0c36.822c STALE insidesecondary# sh ipv6 neighbor IPv6 Address Age Link-layer Addr State Interface fe80::20e:cff:fe36:822c 0 000e.0c36.822c REACH inside
Packet debug on the inside host:
11:27 00:0d:88:10:7a:98 > 00:0e:0c:36:82:2c, ethertype IPv6 (0x86dd), length 118: 2001:4bd8:0:666:280:adff:fe1e:79ba > 2001:4bd8:x:y:20e:cff:fe36:822c: icmp6: echo request seq 1 11:27 00:0e:0c:36:82:2c > 00:0d:88:10:70:c4, ethertype IPv6 (0x86dd), length 118: 2001:4bd8:x:y:20e:cff:fe36:822c > 2001:4bd8:0:666:280:adff:fe1e:79ba: icmp6: echo reply seq 1 11:27 00:0e:0c:36:82:2c > 00:0d:88:10:70:c4, ethertype IPv6 (0x86dd), length 74: 2001:4bd8:x:x:20e:cff:fe36:822c.25 > 2001:4bd8:0:104:230:6eff:fe06:8b73.54880: R [tcp sum ok] 0:0(0) ack 3120461656 win 0 (len 20, hlim 64)Please note the different mac addresses: Packets come from primary and answers are send to secondary. Furthermore you can see a TCP-RST from the pix denying outgoing SMTP via IPv6.
How can IPv6 configured correctly in failover enviroment?