October 2025 - ipv6-wg - mailman.ripe.net

Thank you for IPv6 WG @ RIPE91!
by Christian Seitz 25 Oct '25

25 Oct '25

Dear IPv6 Working Group mailing list members, I'd like to say thank you for the IPv6 WG session on Thursday morning. There have been good discussions after the presentations! For future meetings we'll also allow more time for discussion. In the past, we often had to keep the Q&A short because of the packed agenda. Thanks to the presenters Dmitriy Melnik, Wilhelm Boeddinghaus and Jen Linkova and everybody else who submitted a presentation, but has not been selected. Also thanks to Wolfgang Tremmel, our new co-chair, for his support, Raymond Jetten for his continued support until the end of Nicos term and to Nico Schottelius for his time as a co-chair. See you all in Edingburgh, and don't forget to rate the talks ;-) Ray, Wolfgang & Chris

1 0

anyone experienced this trouble with Fortinet (authenticator+firewall) and Windows AD
by jordi.palet＠consulintel.es 20 Oct '25

20 Oct '25

Hi all, Just wondering if this may be a bug or just some misconfiguration and someone in the list experienced this before. I’ve got this question from a dual-stack deployment, I will try to summarise it with the info I’ve got (not my deployment, just trying to help). Network using Windows AD and basically only Windows clients. The Windows clients are dual-stack and are authenticated in the AD. The DNS registers correctly both their IPv4 and IPv6 addresses. The Fortinet authenticator is pulling every few seconds via LDAP to the AD in order to “allow” certain groups of users to get access to Internet thru the firewall. The firewall rules are based on the user IPv4 and IPv6 addresses. It seems that this means that because the user has registered initially with IPv6 (as in dual stack takes precedence over IPv4), is reported by the authentication event from the AD to the Fortinet authenticator only the IPv6 address, so it is only gaining access to IPv6. So how you fix this in the authenticator so it gathers both the IPv4 and IPv6 addresses and consequently open the firewall for both IPv4 and IPv6 of this user? Right now it seems the only way to force the authenticator to recognise both the IPv4 and IPv6 addresses of the user is to reautenticate the user with both addresses. It looks to me strange that the authenticator only looks for the “registration event” with a single IP address and not both of them (IPv4 and IPv6, or even multiple IPv6 addresses - like the privacy one). I tried to help looking for Fortinet documents about this, but didn’t found anything relevant. Anyone has seen this behaviour before and/or has any idea about how to fix it? Regards, Jordi @jordipalet ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

4 7

Agenda for the ripe 91 meeting
by Raymond Jetten 15 Oct '25

15 Oct '25

Hello All, We are pleased to announce we have an agenda for the IPv6 Working group next week in Bucharest. https://ripe91.ripe.net/programme/meeting-plan/sessions/37/ We hope to see all of you next week at the meeting ! Christian Seitz & Raymond Jetten For Internal Use Only

1 0

RFC 9096 with dynamic IPv6 and radvd
by Max Emig 09 Oct '25

09 Oct '25

Hi all, what is the best way to implement https://www.rfc-editor.org/rfc/rfc9096.html#section-3.5 i.e. advertising stale prefixes with lifetime 0 with arguably the most popular Router Advertisement daemon? Yes, getting only dynamic IPv6 from consumer ISP is bad, but there are also other, more sensible usecases. This is concerning https://github.com/opnsense/core/issues/9261, which I may get involved in. Feel free to contact me off list to avoid clutter, my takeaway is that while FRITZ!Box and OpenWrt behave nicely, barely anything “more professional” does. Thanks Max

3 2

Co chair selection for the IPv6 WG
by Raymond Jetten 07 Oct '25

07 Oct '25

Dear members of the list. Today the deadline for showing interest for the position of IPv6 Co-Chair has ended. We had 2 candidates, but after introducing them to each other yesterday the other one decided to no longer run for this. So with 1 candidate left, we are honoured to announce that Wolfgang Tremmel will be the new co-chair of the ipv6 Working group. Feel free to show your support for Wolfgang on the list, we are very happy to have him. The official announcement will take place at the IPv6-wg session in Bucharest. Thanks and hope to see you in Bucharest. Christian and Ray For Internal Use Only

5 4

https://test-ipv6.com is announcing retirement
by Geert Jan de Groot 05 Oct '25

05 Oct '25

Hi folks, In past years, I have used https://test-ipv6.com/ as a quick "sanity test" when connecting to a network, using a guest network, or to check network configuration after making changes. I found it very useful for quick tests. Unfortunately, jfesler is announcing sunsetting the project, see https://retire.test-ipv6.com/. In the FAQ, it is mentioned "Q: Will I (jfesler) transfer the domain? A: I’d consider a reputable RIR or NIC organization serving the public interest taking things over." I wonder if a RIR or NIC organisation would consider taking over to run the service. I think it is too useful to just disappear, there are still too many not-quite-IPv6 networks, and personally I hope I don't lose the service. Thoughts, anyone? Geert Jan

3 3