Internet Protocol version 6 (IPv6) has been with us for nearly 30 years. IPv6 adoption on the public Internet has steadily increased over the last decade, and today is approaching 50%. However, enterprise adoption of IPv6 has been surprisingly sluggish despite its numerous benefits. IPv6 includes an expanded address space that removes complex subnetting requirements and globally unique addressing that eliminates the need to perform Network Address Translation (NAT), among others. Organizations should consider deploying IPv6 internally to take advantage of these capabilities.
IPv6 and RRAS
I’ve deployed Microsoft Always On VPN for customers using IPv6 numerous times. The following describes configuration settings required to support IPv6 in a Microsoft environment using a Windows Server Routing and Remote Access (RRAS) server.
To begin, open the Routing and Remote Access management console (rrasmgmt.msc) on the RRAS VPN server, then follow the steps below to enable IPv6 support for Always On VPN connections.
Note: The configuration below assumes that IPv6 is already deployed on the internal network, either natively or dual-stacked with IPv4.
IPv6 Remote Access
Perform the following steps to enable IPv6 remote access on the RRAS VPN server.
- Right-click the RRAS VPN server in the navigation tree and choose Properties.
- Check the box next to the IPv6 Remote access server on the General tab.
Prefix Assignment
Next, an IPv6 prefix must be assigned to each RRAS VPN server. This IPv6 prefix must be unique for each server and not in use anywhere else on the internal network. Unlike IPv4, IPv6 addresses cannot be assigned from the same prefix (subnet) as the VPN server’s internal network interface. With that, ensure that internal network IPv6 routing returns traffic for the assigned IPv6 prefixes to the corresponding VPN server.
Perform the following steps to assign an IPv6 prefix for VPN client use.
- Right-click the RRAS VPN server in the navigation tree and choose Properties.
- Select the IPv6 tab.
- Check the box next to Enable IPv6 Forwarding.
- If force tunneling is required (not recommended), check the box next to Enable Default Route Advertisement.
- Enter an IPv6 prefix in the IPv6 prefix assignment field. Again, ensure the IPv6 prefix is globally unique, and that internal network routing is configured to return traffic to the VPN server that owns the prefix.
- If your RRAS server is multi-homed, select the internal network interface from the Adapter drop-down list.
DHCP
Organizations with IPv6 deployed internally may use Microsoft Windows DHCPv6 or a dedicated DNS/DHCP/IP Address Management (IPAM) (DDI) solution like Infoblox. However, Windows Server RRAS does not support DHCPv6 for VPN client IP address assignment. Administrators must manually assign an IPv6 prefix per server. However, administrators can use DHCP alongside IPv6 prefix assignment for VPN client IPv4 addressing.
Limitations
While IPv6 may solve some problems for Always On VPN administrators, it has some limitations. Here are some crucial considerations for IPv6 and Always On VPN at the time of this writing.
Traffic Filters
You cannot use IPv6 when configuring traffic filters for Always On VPN. Specifying IPv6 elements in a traffic filter rule will prevent Always On VPN from working at all. More details here.
Intune and Routing
When split tunneling is enabled, Microsoft Intune will not accept IPv6 routes using the standard IPv6 subnet prefix of /64. The UI complains that “the value must be between 1 and 32”.
You can use the custom XML deployment option to configure Always On VPN to support split tunneling correctly as a workaround.
Additional Information
Everything You Never Knew about NAT
Disabling IPv6 Breaks Windows Server RRAS
Microsoft Always On VPN Traffic Filters and IPv6
Discussing Microsoft and IPv6 on the IPv6 Buzz Podcast (Packet Pushers)
