Quantcast
Channel: TechNet Blogs
Viewing all articles
Browse latest Browse all 34890

Stop hurting yourself by: Disabling IPv6, why do you really do it?

$
0
0

Applies to:

Windows 10/ 2016

Windows 8.1/ 2012 R2

Windows 8 / 2012

Windows 7 SP1/ 2008 R2

Background:

==========

Normally the common thing for IT administrators to do is to disable ipv6 in the network adapter.

Control PanelNetwork and InternetNetwork Connections

Right-click on a network adapter

Click on “Properties”

Uncheck the box for "Internet Protocol Version 6 (TCP/IPv6)"

Warning:  This is unsupported by us (Microsoft)

The supported work-around that many IT administrators end-up using is described in:

929852 How to disable IPv6 or its components in Windows

https://support.microsoft.com/?id=929852

Investigation:

===========

A network trace (Message Analyzer/Wireshark) showed that the device with the MAC address, [00-1A-1E-01-43-65], was sending Router Advertisement in the network segment.

Windows Vista and Windows Server 2008 and newer OS’es implements RFC 3484  and uses a prefix table to determine which address to use when multiple addresses are available for a name.

By default, it favors IPv6 global unicast addresses over IPv4 addresses.

969029 The functionality for source IP address selection in Windows Server 2008 and in Windows Vista differs from the corresponding functionality in earlier versions of Windows

https://support.microsoft.com/?id=969029

              For information about RFC 3484:

Default Address Selection for Internet Protocol version 6 (IPv6)

http://tools.ietf.org/html/rfc3484

RFC 4291 will let you set ipv4 precedence over ipv6

Using SIO_ADDRESS_LIST_SORT

https://msdn.microsoft.com/en-us/library/windows/desktop/ms740614(v=vs.85).aspx

For information about RFC 4291:

IP Version 6 Addressing Architecture

http://tools.ietf.org/html/rfc4291

Start, CMD (Run As Admin)

netsh interface ipv6 show prefixpolicies

Note that higher precedence in prefix policies is represented by a lager "precedence" value, exactly opposite to routing table "cost" value.

        40      1  ::/0

        30      2  2002::/16

        20      3  ::/96

        10      4  ::ffff:0:0/96

Note that IPv6 addresses (::/0) are preferred over IPv4 addresses (::/96, ::ffff:0:0/96).

We can create a policy that will make Contoso IPv6 tunnel less favorable than any IPv4 address:

netsh interface ipv6 add prefixpolicy 2001:470::/32 3 6

2001:470::/32 is Contoso's prefix, 3 is a Precedence (very low) and 6 is a Label.

Recommendation:

================

Use the “Prefer Ipv4 over IPv6” using the custom .admx here:

How to Disable IPv6 through Group Policy

https://social.technet.microsoft.com/wiki/contents/articles/5927.how-to-disable-ipv6-through-group-policy.aspx

OR use GPP to set the Disabled Components for “Prefer IPv4 over IPv6”

929852 How to disable IPv6 or its components in Windows

https://support.microsoft.com/?id=929852

OR if in individual machines:

Instead of manually configuring these settings, there is a fix it:

2533454 Resolving Internet connectivity issues after World IPv6 Launch (June 6, 2012)

https://support.microsoft.com/?id=2533454

Yong “Hailing from Long Beach, CA. today”.



Viewing all articles
Browse latest Browse all 34890

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>