This article will provide guidance on how to provision IPv6 on a UniFi Security Gateway (USG). The article will explain how DHCPv6-PD and Static IPv6 are implemented, along with explaining how LAN clients obtain a IPv6 address.
NOTES & REQUIREMENTS:
Table of Contents
- Steps: How to Implement IPv6 on a USG
- Testing & Verification
- Manual Configuration (for UniFi Controllers prior to v5.7)
Depending on how the ISP has their IPv6 environment structured, the USG will either need to be configured with a static IPv6 address or receive an address via DHCPv6 on WAN.
On the LAN side of this configuration the setup may vary on the factors listed in the table above. If the USG has received a prefix delegation (PD) from the ISP, it will advertise the prefix that clients will use with stateless address auto-configuration (SLAAC) and the EUI-64 process. The static IPv6 addressing assumes you know the block of addressing that the clients are supposed to be using.
Steps: How to Implement IPv6 on a USG
- In the UniFi Controller, navigate to Devices and select the USG in question.
- In the Properties panel that will appear, go to the config tab. There will be a WAN 1 and WAN 2 section.
- The IPv6 section is where the USG is configured for either DHCPv6-PD or static IPv6 addressing.
- After all of the selections have been made, provision the changes.
- Under each individual network will be a "configure IPv6 network" section.
- If DHCPv6 was selected on WAN then prefix delegation will be used for "IPv6 Interface Type".
- Make sure the correct WAN interface and IPv6 router advertisement are applied.
- If static was chosen on WAN, the options for IPv6 gateway/subnet must be filled in along with applying the correct DHCPv6 range if desired.
- After each selection has been made click save and the USG will be provisioned.
Testing & Verification
1. SSH into the USG
2. Input the following commands:
show ipv6 route : will show IPv6 connected networks for both global and link-local address types.
show interfaces : will show IPv6 addressing under the configured interfaces.
ping6 google.com : will respond with icmp6 replies if configured correctly.
When enabled, the clients should not need intervention to complete the SLAAC process. If the clients do not have an address then disabling/enabling the NIC should bring the addressing up. A test of connectivity from a client would be to "ping6 google.com" (OS X, Linux, BSD) or "ping -6 google.com" (Windows)
Manual Configuration with .JSON File (Controller Version Pre-5.7)
Click here to see manual configuration instructions for UniFi Controller versions prior to v5.7. We recommend to upgrade to the newest version available.