CCS-IT Posted April 3, 2015 Share Posted April 3, 2015 Hi Guys, We have a problem with our environment. we have DHCP server configured with Public IP range in SCOPE hence our client machine (windows 7/8) received the same range of IP address. However in our DNS server we found there are IPv6 (Host AAAA) records has been created along with host A record for any individual system. when we ping to any system it will give as RTO because it's got response from IPv6. We have unchecked the IPv6 option from NIC properties. As per the MS article, https://support.microsoft.com/en-us/kb/929852 About the 6to4 tunneling protocol By default, the 6to4 tunneling protocol is enabled in Windows 7, Windows Vista, Windows Server 2008 R2, and Windows Server 2008 when an interface is assigned a public IPv4 address (that is, an IPv4 address that is not in the ranges 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). 6to4 automatically assigns an IPv6 address to the 6to4 tunneling interface for each such address that is assigned, and 6to4 will dynamically register these IPv6 addresses on the assigned DNS server. If this behavior is not desired, we recommend that you disable IPv6 tunnel interfaces on the affected hosts. As we used same range of DHCP scope (Public IP range) since last 3 years but such issue is just occurs recently... Anyone faced such issue? please assist me on this case. Thanks in advance. Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/ Share on other sites More sharing options...
+BudMan MVC Posted April 3, 2015 MVC Share Posted April 3, 2015 If you are not ready to use IPv6, I really would suggest you disable it completely.. http://support.microsoft.com/en-us/kb/929852 This can be done via group policy you might want to look here http://social.technet.microsoft.com/wiki/contents/articles/5927.how-to-disable-ipv6-through-group-policy.aspx What does your ipconfig /all look like on a windows machine? Out of the box your going to get link-local addresses on the interface. Out of the box all addresses on this interface will be registered via dns in AD, etc. Out of the box ipv6 would be used first if you get a response for AAAA dns query. Again highly recommend if your not ready to use ipv6 in your network, that you just completely disable it. This is a simple enough to turn on and turn off. If you see any ipv6 stuff on your interface in ipconfig /all then yeah its most likely going to to get registered in DNS that can cause you grief if not actively setup to actually use ipv6. Also all those nonsense transition to ipv6 interfaces like teredo, 6to4 and isatap should also just be disable and removed.. Unless you were actively wanting to use 1.. And then that 1 should be setup and the others turned off. See the kb article linked too. Ipv6 is coming, but unless your up to speed on it - it causes problems!! For example the one your seeing - it also causes noise that just serves no purpose on the network unless actively using ipv6. Also after cleanup your ipconfig /all will be much cleaner I don't ever have any of the teredo, isatap, 6to4 stuff since I have cleaned that up - but I do have ipv6 configured and can enable or disable it with the checkbox in the network interface props. So you see the top ipconfig /all when I have it disabled. When I enable it I have both a global ipv6 address, the one that starts with 2001, and then the link local address the fe80 address. Simple way to explain link local is think of them of private IPs (rfc1918) that are not routable on the public internet, 192.168.1.0/24 for example. While if its a global ipv6 address then its public IP. link locals can and are used on your local network. But as stated, you really don't want those registered in your AD dns unless unless your network is really ready for use of ipv6 on a global setup. Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596805788 Share on other sites More sharing options...
CCS-IT Posted April 3, 2015 Author Share Posted April 3, 2015 ipconfig /all: Description . . . . . . . . . . . : Intel® 82579LM Gigabit Network Connection Physical Address. . . . . . . . . : 14-58-xx-xx-xx-xx DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::xxxxx:xx:xx:%11(Preferred) IPv4 Address. . . . . . . . . . . : 161.xx.xx.x4(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Monday, March 28, 2015 8:53:52 AM Lease Expires . . . . . . . . . . : Tuesday, April 03, 2015 8:53:53 AM Default Gateway . . . . . . . . . : 161.xx.xx.xx DHCP Server . . . . . . . . . . . : 10.xx.xx.136 DHCPv6 IAID . . . . . . . . . . . : 29887 DHCPv6 Client DUID. . . . . . . . : 00-01-90-01-1S-87-O8-FD-14-28-D0-BA-7H-61 DNS Servers . . . . . . . . . . . : 10.xx.xx.131 NetBIOS over Tcpip. . . . . . . . : Enabled Tunnel adapter 6TO4 Adapter: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Microsoft 6to4 Adapter #2 Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0 DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2002:a1fp:d6a::a1fp:d7a(Preferred) Default Gateway . . . . . . . . . : DNS Servers . . . . . . . . . . . : 10.xx.xx.131 NetBIOS over Tcpip. . . . . . . . : Disabled Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596806004 Share on other sites More sharing options...
CCS-IT Posted April 3, 2015 Author Share Posted April 3, 2015 Recently installed MS patches will affect this settings? because as I stated in my original post it was working fine from last 3 years. Issue is just reported on March 21st 2015. Any clue ? Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596806012 Share on other sites More sharing options...
+BudMan MVC Posted April 7, 2015 MVC Share Posted April 7, 2015 And have you disabled ipv6?? Your 6to4 has address 2002:a1fp:d6a::a1fp:d7a(Preferred) Pretty sure its going to try and register than.. Do a query for that computer name against your dns.. Do you get back ipv6 in a AAAA ? When a computer has public IPv6, that 6to4 will be used and will try will register in AD.. Here this is perfect article that goes over your issue with that 6to4 http://blogs.technet.com/b/askpfeplat/archive/2013/11/18/ipv6-for-the-windows-administrator-the-2002-6to4-tunnel-address-and-its-impact.aspx Again if you are not ready to use ipv6 on your network, the cleanest approach is just disable it completely, remove all the adapters isatap, 6to4, teredo - you have no need for those - do you?? If you did you would have properly set the one you wanted to use up and disable the others you would of thunk Your other option so that 6to4 does not create address is no use public IP space on an internal network. Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596809482 Share on other sites More sharing options...
CCS-IT Posted April 14, 2015 Author Share Posted April 14, 2015 Thanks Budman, Issue is now resolved, we created GPO were configured IPv4 preference order over the IPv6. reference URL as you shared in your previous post. http://social.technet.microsoft.com/wiki/contents/articles/5927.how-to-disable-ipv6-through-group-policy.aspx Thanks Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596818062 Share on other sites More sharing options...
+BudMan MVC Posted April 14, 2015 MVC Share Posted April 14, 2015 so you set it to prefer ipv4 but did not remove all the teredo, isatap 6to4 crap? Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596818072 Share on other sites More sharing options...
CCS-IT Posted April 22, 2015 Author Share Posted April 22, 2015 On 14/04/2015 at 18:30, BudMan said: so you set it to prefer ipv4 but did not remove all the teredo, isatap 6to4 crap? NO Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596826010 Share on other sites More sharing options...
+BudMan MVC Posted April 22, 2015 MVC Share Posted April 22, 2015 no you didn't remove the crap Why? Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596826076 Share on other sites More sharing options...
CCS-IT Posted April 22, 2015 Author Share Posted April 22, 2015 On 22/04/2015 at 12:51, BudMan said: no you didn't remove the crap Why? Cause, system start pining to destination with IPv4, So issue just resolved that's why we didn't remove any thing. from few system we just disabled the 6to4 adopter from device manager. Will remove the rest system in any weekend now. Thanks for your help Budman... I really appreciate. Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596826662 Share on other sites More sharing options...
+BudMan MVC Posted May 27, 2015 MVC Share Posted May 27, 2015 "just disabled the 6to4 adopter from device manager." Not really proper way to disable it, done with a simple netsh cmd netsh interface ipv6 6to4 set state disabled Or can be disabled with proper flags in disabledcomponents for ipv6 https://support.microsoft.com/en-us/kb/929852 Link to comment https://www.neowin.net/forum/topic/1252322-ping-not-working-correctly/#findComment-596864330 Share on other sites More sharing options...
Recommended Posts