Recommended Posts

Hi Guys,

 

We have a problem with our environment. we have DHCP server configured with Public IP range in SCOPE hence our client machine (windows 7/8) received the same range of IP address. However in our DNS server we found there are IPv6 (Host AAAA) records has been created along with host A record for any individual system. 

 

when we ping to any system it will give as RTO because it's got response from IPv6.

 

We have unchecked the IPv6 option from NIC properties. 

 

As per the MS article,  https://support.microsoft.com/en-us/kb/929852

 

About the 6to4 tunneling protocol

By default, the 6to4 tunneling protocol is enabled in Windows 7, Windows Vista, Windows Server 2008 R2, and Windows Server 2008 when an interface is assigned a public IPv4 address (that is, an IPv4 address that is not in the ranges 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). 6to4 automatically assigns an IPv6 address to the 6to4 tunneling interface for each such address that is assigned, and 6to4 will dynamically register these IPv6 addresses on the assigned DNS server. If this behavior is not desired, we recommend that you disable IPv6 tunnel interfaces on the affected hosts.

As we used same range of DHCP scope (Public IP range) since last 3 years but such issue is just occurs recently... Anyone faced such issue? please assist me on this case.

 

Thanks in advance. 

Link to comment
https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/
Share on other sites

If you are not ready to use IPv6, I really would suggest you disable it completely..

 

http://support.microsoft.com/en-us/kb/929852

 

This can be done via group policy you might want to look here

http://social.technet.microsoft.com/wiki/contents/articles/5927.how-to-disable-ipv6-through-group-policy.aspx

 

What does your ipconfig /all look like on a windows machine?  Out of the box your going to get link-local addresses on the interface.  Out of the box all addresses on this interface will be registered via dns in AD, etc. Out of the box ipv6 would be used first if you get a response for AAAA dns query.

 

Again highly recommend if your not ready to use ipv6 in your network, that you just completely disable it. This is a simple enough to turn on and turn off.

 

If you see any ipv6 stuff on your interface in ipconfig /all then yeah its most likely going to to get registered in DNS that can cause you grief if not actively setup to actually use ipv6.  Also all those nonsense transition to ipv6 interfaces like teredo, 6to4 and isatap should also just be disable and removed.. Unless you were actively wanting to use 1.. And then that 1 should be setup and the others turned off.  See the kb article linked too.

 

Ipv6 is coming, but unless your up to speed on it - it causes problems!! For example the one your seeing - it also causes noise that just serves no purpose on the network unless actively using ipv6.  Also after cleanup your ipconfig /all will be much cleaner ;)

 

I don't ever have any of the teredo, isatap, 6to4 stuff since I have cleaned that up - but I do have ipv6 configured and can enable or disable it with the checkbox in the network interface props.  So you see the top ipconfig /all when I have it disabled.  When I enable it I have both a global ipv6 address, the one that starts with 2001, and then the link local address the fe80 address.

post-14624-0-42856200-1428078883.png

 

Simple way to explain link local is think of them of private IPs (rfc1918) that are not routable on the public internet, 192.168.1.0/24 for example.  While if its a global ipv6 address then its public IP.  link locals can and are used on your local network.  But as stated, you really don't want those registered in your AD dns unless unless your network is really ready for use of ipv6 on a global setup.

ipconfig /all:

 

   Description . . . . . . . . . . . : Intel® 82579LM Gigabit Network Connection
 
   Physical Address. . . . . . . . . : 14-58-xx-xx-xx-xx
 
   DHCP Enabled. . . . . . . . . . . : Yes
 
   Autoconfiguration Enabled . . . . : Yes
 
   Link-local IPv6 Address . . . . . : fe80::xxxxx:xx:xx:%11(Preferred)
 
   IPv4 Address. . . . . . . . . . . : 161.xx.xx.x4(Preferred)
 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
 
   Lease Obtained. . . . . . . . . . : Monday, March 28, 2015 8:53:52 AM
 
   Lease Expires . . . . . . . . . . : Tuesday, April 03, 2015 8:53:53 AM
 
   Default Gateway . . . . . . . . . : 161.xx.xx.xx
 
   DHCP Server . . . . . . . . . . . : 10.xx.xx.136
 
   DHCPv6 IAID . . . . . . . . . . . : 29887
 
   DHCPv6 Client DUID. . . . . . . . : 00-01-90-01-1S-87-O8-FD-14-28-D0-BA-7H-61
 
 
 
   DNS Servers . . . . . . . . . . . : 10.xx.xx.131
 
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
 
 
Tunnel adapter 6TO4 Adapter:
 
 
 
   Connection-specific DNS Suffix  . :
 
   Description . . . . . . . . . . . : Microsoft 6to4 Adapter #2
 
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
 
   DHCP Enabled. . . . . . . . . . . : No
 
   Autoconfiguration Enabled . . . . : Yes
 
   IPv6 Address. . . . . . . . . . . : 2002:a1fp:d6a::a1fp:d7a(Preferred)
 
   Default Gateway . . . . . . . . . :
 
   DNS Servers . . . . . . . . . . . : 10.xx.xx.131
 
 
   NetBIOS over Tcpip. . . . . . . . : Disabled

And have you disabled ipv6??  Your 6to4 has address

 

2002:a1fp:d6a::a1fp:d7a(Preferred)

 

Pretty sure its going to try and register than.. Do a query for that computer name against your dns.. Do you get back ipv6 in a AAAA ?  When a computer has  public IPv6, that 6to4 will be used and will try will register in AD..

 

Here this is perfect article that goes over your issue with that 6to4

 

http://blogs.technet.com/b/askpfeplat/archive/2013/11/18/ipv6-for-the-windows-administrator-the-2002-6to4-tunnel-address-and-its-impact.aspx

 

Again if you are not ready to use ipv6 on your network, the cleanest approach is just disable it completely, remove all the adapters isatap, 6to4, teredo - you have no need for those - do you??  If you did you would have properly set the one you wanted to use up and disable the others you would of thunk ;)

 

Your other option so that 6to4 does not create address is no use public IP space on an internal network.

Thanks Budman, Issue is now resolved, we created GPO were configured IPv4 preference order over the IPv6. 

 

reference URL as you shared in your previous post.

http://social.technet.microsoft.com/wiki/contents/articles/5927.how-to-disable-ipv6-through-group-policy.aspx

 

Thanks :) 

  On 22/04/2015 at 12:51, BudMan said:

no you didn't remove the crap  Why?

Cause, system start pining to destination with IPv4, So issue just resolved that's why we didn't remove any thing. from few system we just disabled the 6to4 adopter from device manager.

 

Will remove the rest system in any weekend now. Thanks for your help Budman...  I really appreciate.  :)

  • 1 month later...

"just disabled the 6to4 adopter from device manager."

 

Not really proper way to disable it, done with a simple netsh cmd

netsh interface ipv6 6to4 set state disabled

Or can be disabled with proper flags in disabledcomponents for ipv6

 

https://support.microsoft.com/en-us/kb/929852

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Google open-sources zero-knowledge proof code for enhanced online privacy by Paul Hill When you go out to a physical store and attempt to buy alcohol or cigarettes, you’ll get asked to show some ID; online, when you want to visit adult sites, you don’t currently need to prove your age, but lawmakers in various countries are looking to change this. One technology that has been developed to address the age checks needed is Zero-Knowledge Proof, where you prove your age without having to reveal other data like birth date or ID. To help companies develop their own Zero-Knowledge Proof (ZKP) technologies, Google has released its ZKP libraries as open-source, meaning they can be taken and used in other projects or adapted. This will make it easier for third-party developers to create privacy-enhancing age verification applications. We heard a bit about ZKP from Google earlier this year when the company said that it was integrating the technology into Google Wallet to help disconnect your age from your identity. It also said at the time that it would be using it in other Google products and partner with apps like Bumble to help with verification. It also said at the time that it would open-source ZKP; that promise has now been fulfilled. As libraries, Google’s newly open-sourced software can be integrated into a whole range of applications. As mentioned, Google is using it in Google Wallet, and it could also be used to verify the age of people visiting adult websites without needing to reveal their identity as part of the verification process. Google has also said that the European Union’s eIDAS regulation encourages EU member states to integrate technologies like ZKP into the European Digital Identity Wallet (EUDI Wallet). The open-sourcing of ZKP could help with the acceleration of the development of these EUDI Wallets. The open-sourcing of the ZKP libraries by Google will benefit various groups of people. We’ve mentioned that developers will benefit as they can use the libraries in a variety of apps. Businesses will also benefit by being able to meet privacy needs more easily. Another group to benefit will be researchers who can use this “more efficient and performant ZKP implementation” to help create new applications and uses of technology. Finally, users will benefit from more private and secure digital ecosystems. Now it remains to be seen how much adoption these ZKP libraries will get, given the growing need for such technology. Image via Depositphotos.com
    • I Have a batch file that opens 2 websites dealing with money. I want to add to it with the first step to remind me to start a vpn extension that I use with chrome.  If  it is easier to use powershell that is fine too.  thx   Hope this is enough info.
    • IMO, Vivaldi feels overdesigned at this point.
    • You have to look at the value proposition. Any product can be good or bad at either the right or wrong price. At $110, the GTX 1050 was considered a good GPU for the price, and again at $160 the GTX 1650 was extremely popular and considered one of the best value GPUs ever. The problem here is this RTX 5050 has a performance uplift over the 4050 so small it is basically lost in the margin of error, yet they still price it at $250!! That is bad value. At $200 it is at least in line with the other overpriced GPUs, at $175, it would actually be a good product!
    • I built my first computer with a low profile GTX 750 Ti OC and it was a great 720p card for its time. And that was a $160 card at the time. The 50 models used to be a good mid-range for price to performance. Not anymore.
  • Recent Achievements

    • Week One Done
      956400 earned a badge
      Week One Done
    • First Post
      loose_observer earned a badge
      First Post
    • Week One Done
      BeeJay_Balu earned a badge
      Week One Done
    • Week One Done
      filminutz earned a badge
      Week One Done
    • Reacting Well
      SteveJaye earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      446
    2. 2
      ATLien_0
      157
    3. 3
      +FloatingFatMan
      148
    4. 4
      Nick H.
      65
    5. 5
      +thexfile
      62
  • Tell a friend

    Love Neowin? Tell a friend!