This article describes about ICMPv6 neighbor solicitation storm.

-CLI might become sluggish or slow to respond.

-Packet loss might be observed.

-CPU might suddenly increase.

When monitoring the irb/interface it shows icmp neighbor solicitation flooding the CPU within miliseconds.

19:08:02.997712 In IP6 fe80::e257:230d:589c:d2e3 > ff02::1:ff9d:895d: ICMP6, neighbor solicitation, who has fe80::6aed:5700:9d:895d, length 32
19:08:02.997748 In IP6 fe80::e257:230d:589c:d2e3 > ff02::1:ffbe:25fa: ICMP6, neighbor solicitation, who has fe80::ea24:a600:be:25fa, length 32
19:08:02.997783 In IP6 fe80::e257:230d:589c:d2e3 > ff02::1:ffbe:774b: ICMP6, neighbor solicitation, who has fe80::ea24:a600:be:774b, length 32
19:08:03.000521 In IP6 fe80::e257:230d:589c:d2e3 > ff02::1:fff9:9969: ICMP6, neighbor solicitation, who has fe80::2e4c:1500:f9:9969, length 32
19:08:03.000587 In IP6 fe80::e257:230d:589c:d2e3 > ff02::1:ff03:b65c: ICMP6, neighbor solicitation, who has fe80::22ed:4700:3:b65c, length 32
19:08:03.000625 In IP6 fe80::e257:230d:589c:d2e3 > ff02::1:ffe6:30fa: ICMP6, neighbor solicitation, who has fe80::d281:c500:e6:30fa, length 32

1 - Apply a firewall filter to block the icmpv6.

The filter can be applied on the physical / IRB / Loopback interface even if there is no ipv6 address configured.

set firewall family inet6 filter block_ipv6 term 1 from source-address fe80::/64

set firewall family inet6 filter block_ipv6 term 1 then count block_ipv6

set firewall family inet6 filter block_ipv6 term 1 then discard

set firewall family inet6 filter block_ipv6 term 2 then accept

set interface <> unit 0 family inet6 filter input blockipv6

2 - Verify if the hosts have ipv6 enabled , if you are not using it, you can disable it.