This KB addresses the issue where the DHCP snooping switch (with NDI enabled) will drop the Router Solicitation (RS) packets if there is no corresponding entry in the DHCP snooping database.

NDI is enabled on DHCP snooping switch, and the client will send out a Router Solicitation (RS) packet.

ROUTER SOLICITATION :

It is sent by the client. When an IPv6 node starts, it sends an RS packet to a router to request prefixes and other configuration information and waits for the router to respond with an RA packet. The client will send out the RS packet for both Link local address and the assigned IPv6 address.

ROUTER ADVERTISEMENT :

A router periodically advertises RA packets, including network configurations such as network prefix to IPv6 nodes. The router also returns RA packets as the responses to RS packets.

UNDERSTANDING OF THE ISSUE :

• Once the client comes up, it would send out the DAD (Duplicate detection packet) for Link local address and a RS packet to request prefixes and other configuration information.
• On snooping switch, since we don’t have a binding for the concerned client, it would drop the RS packet. (The RS packet will be received on client facing interface, configured as access port/untrusted port in most of the scenarios).
• Hence the client would have to wait for the RA packet that is sent by the router/L3 device periodically.
• Meanwhile, the client will initiate the SARR process and will obtain an IPv6 address. However, since it doesn’t have the default gateway details, the client will not be able to access the network.
• It is an expected behavior.

RESOLUTION OF THE ISSUE :

Below are the 2 workarounds we can use to avoid this issue :

WORKAROUND-1 :

• By reducing the interval at which Router Advertisement (RA) packets are sent periodically by the server, we can minimize the waiting time for the client. However, there may still be a brief period where the client experiences traffic impact until it receives the RA packet

WORKAROUND-2 :

• Enabling SLAAC-snooping on the snooping switch allows it to create a SLAAC (Stateless Address Autoconfiguration) binding upon receiving the Duplicate Address Detection (DAD) packet (Frame 2 in packet capture) for the Link-Local address.

Below is the command we can use to enable slaac-snooping :

set forwarding-option access-security slaac-snooping vlan <vlan_name>

To check the slaac-snooping table binding :

show access-security slaac-snooping binding

• Now, once the RS will be received, the snooping switch will not drop it (use the slaac binding) and will forward the RS packet towards the server.
• The RA packet will always be received on server facing interface configured as trusted/trunk port. Hence, they will not be dropped by the snooping switch.
• With slaac-snooping enabled, the client will always receive the RA packet in response to its RS

Note : Because SLAAC-snooping and DHCP-snooping share the same hardware-level table, an entry for a specific client will be maintained in only one of these tables at any given time.

LAB OUTPUTS WITH SLAAC-SNOOPING ENABLED :

DOT1x Table :

---(refreshed at 2024-06-20 14:44:27 IST)---

802.1X Information:

Interface    Role          State          MAC address         User

ge-0/0/1.0   Authenticator Authenticated  aa:aa:aa:aa:aa:aa   aaaaaaaaaaaa

ge-0/0/2.0   Authenticator Initialize     

xe-0/2/0.0   Authenticator Connecting   

SLAAC-SNOOPING Table :

---(refreshed at 2024-06-20 14:44:28 IST)---

IPv6 address               MAC address         Vlan          Expires    State    Interface

fe80::aaaa:aaaa:aaaa:aaaa aa:aa:aa:aa:aa:aa   vlan401                   WAIT     ge-0/0/1.0          

---(refreshed at 2024-06-20 14:44:29 IST)---

IPv6 address               MAC address         Vlan          Expires    State    Interface 

fe80::aaaa:aaaa:aaaa:aaaa  aa:aa:aa:aa:aa:aa   vlan401       86400      BOUND    ge-0/0/1.0      << for LL address (using DAD packet)

 

---(refreshed at 2024-06-20 14:44:32 IST)---

IPv6 address               MAC address         Vlan          Expires    State    Interface

fe80::aaaa:aaaa:aaaa:aaaa aa:aa:aa:aa:aa:aa   vlan401       86397      BOUND    ge-0/0/1.0          

---(refreshed at 2024-06-20 14:44:33 IST)---                                                         << Entry is deleted from slaac table

---(refreshed at 2024-06-20 14:44:34 IST)---

DHCP-SNOOPING Table :

---(refreshed at 2024-06-20 14:44:33 IST)---

IPv6 address          MAC address        Vlan    Expires State  Interface

fe80::aaaa:aaaa:aaaa:aaaa aa:aa:aa:aa:aa:aa vlan401 0      WAIT   ge-0/0/1.0          

---(refreshed at 2024-06-20 14:44:34 IST)---

IPv6 address          MAC address        Vlan    Expires State  Interface

fe80::aaaa:aaaa:aaaa:aaaa  aa:aa:aa:aa:aa:aa vlan401 2399   BOUND  ge-0/0/1.0                      << Entry got created in dhcp-snooping table

bbbb:bbb:bbbb::bb     aa:aa:aa:aa:aa:aa  vlan401 2399   BOUND  ge-0/0/1.0          

---(refreshed at 2024-06-20 14:44:36 IST)---

2024-07-09 : Article Created

2026-09-30 : Externalized