This article describes the issue of the DAD (Duplicate Address Detection) timer stopping when it detects a duplicate address.

The IPv6 DAD (Duplicate Address Detection) mechanism allows an IPv6 host to verify the uniqueness of the address before using it. It uses NS (Neighbor Solicitation) and NA (Neighbor Advertisement) ICMP packets. Specified within the NS packet are the source address of [::/128] and destination address, which is equal to the address that the host is trying to verify the uniqueness of. If the host receives NA in response, the address is not unique.

Example of IPV6 config.

• For example if IPv6 is configured on any interface say for an aggregate interface ae0 and the config for IPV6 is as follows:

ae0 {
        description Link_to_device_FPT_600G;
        aggregated-ether-options {
            lacp {
                active;
            }
        }
        unit 0 {
            family inet {
                address 172.16.2.254/30;
            }
            family inet6 {
                address : 2001:db8:ae00:1b00::1:16/64;
            }
        }
    }

• We could see that the IPv6 services do not work and we won't be able to see any route for the specified IPv6 address.

• This can also be verified from the show interfaces ae0 extensive command, where we see flags for duplicate address for IPv6

 Protocol inet6, MTU: 1500

  Max nh cache: 75000, New hold nh limit: 75000, Curr nh cnt: 0, Curr new hold cnt: 0, NH drop cnt: 0

  Generation: 289, Route table: 0

   Flags: Protocol-Down, Down, Is-Primary

   Addresses, Flags: Is-Default Is-Preferred Is-Primary Duplicate

    Destination: 2001:db8:172::1b00::1:14/126, Local: 2001:db8:ae00:1b00::1:16

    INET6 Address Flags: Duplicate

  Generation: 162

   Addresses, Flags: Is-Preferred Duplicate

    Destination: fe80::/64, Local: fe80::db:5eff:feb9:ec0

    INET6 Address Flags: Duplicate

  Generation: 164

Solution 1:

• Duplicate Address Detection is run, as part of IPv6 Neighbor Discovery protocol. It is possible that if there is another device in the network that is using same IPV6 address, then there is possibility that the duplicate flags can be generated on the interface ae0 )according to the above example). This needs to be checked internally by the customer and see if there is any possibility that same IPv6 address is assigned for two different devices.

Solution 2:

• Duplicate Address Detection is run, as part of IPv6 Neighbor Discovery protocol. Kindly check the below link for better understanding of IPv6
• IPv6 Neighbor Discovery Overview

• The IPv6 DAD (Duplicate Address Detection) mechanism allows an IPv6 host to verify the uniqueness of the address before using it. It uses NS (Neighbor Solicitation) and NA (Neighbor Advertisement) ICMP packets. Specified within the NS packet are the source address of [::/128] and destination address, which is equal to the address that the host is trying to verify the uniqueness of. If the host receives NA in response, the address is not unique.
• As soon as Junos platform detects the duplicate address, it will stop the DAD timer. This means that even if the duplicate address is removed from the other device, Junos platform will not be able to use this address without manual intervention.
• In such cases as well the duplicate flags are generated on the interfaces where IPv6 is configured even though there is no duplicate IPv6 address.

In such case we have two methods to solve the issue.

• Flapping the interface / bouncing the interface where duplicate IPv6 address flags are set. That way duplicate flags will be cleared and the IPv6 services will be start working as expected

• Second option is to disable the DAD timer on interface where issue is seen, using the following command:

" set interfaces <interface-name> unit <unit-number> family inet6 dad-disable "

These two options will help in resolving issues on IPv6 duplicate address.

Note: In the case of the SRX chassis cluster, RG0 failover won't help.

IPv6 Neighbor Discovery Overview

https://supportportal.juniper.net/s/article/SRX-DAD-timer-stops-after-detecting-duplicate-address