IPv6 Neighbor Discovery Configuration

IPv6 Neighbor Discovery Configuration

Version Info

RouterOS 7.16 | Min: v6.0+ | ⏱️ 10 minutes | 🟡 Intermediate

Tested on: 7.16 7.14

Version-specific notes

• v7.1: Fixed SLAAC with IPv6 forwarding enabled (was broken in early v7)
• v7.0: Reworked ND implementation; some v6 behaviors changed
• v6.x: Same commands work on RouterOS 6.x

TL;DR (Quick Start)

For the impatient: enable IPv6 router advertisements on your LAN interface so clients get addresses via SLAAC.

/ipv6 address add address=2001:db8:1::1/64 interface=bridge advertise=yes

Verify clients receive addresses:

/ipv6 neighbor print

Overview

What this does: IPv6 Neighbor Discovery (ND) replaces ARP from IPv4 and enables Stateless Address Autoconfiguration (SLAAC). RouterOS acts as a Router Advertisement Daemon (RADVD), announcing network prefixes so clients automatically configure their IPv6 addresses.

When to use this:

• Providing IPv6 connectivity to LAN clients
• Enabling SLAAC for automatic address configuration
• Advertising DNS servers over IPv6
• Configuring ND Proxy for routing between segments

Prerequisites:

• IPv6 package enabled (included by default in v7)
• An IPv6 prefix from your ISP or tunnel broker
• Basic understanding of IPv6 addressing

Configuration Steps

Step 1: Add IPv6 Address with Advertisement

Add an IPv6 address to your LAN interface with router advertisement enabled.

/ipv6 address add address=2001:db8:1::1/64 interface=bridge advertise=yes

The advertise=yes flag tells RouterOS to include this prefix in Router Advertisements, enabling SLAAC for clients.

Step 2: Verify ND Configuration

Check the Neighbor Discovery settings for the interface.

/ipv6 nd print

Expected output:

Flags: D - dynamic, X - disabled, I - invalid
 0   interface=bridge ra-interval=3m20s-10m ra-delay=3s mtu=unspecified
     reachable-time=unspecified retransmit-interval=unspecified
     ra-lifetime=30m ra-preference=medium hop-limit=unspecified
     advertise-mac-address=yes advertise-dns=yes managed-address-configuration=no
     other-configuration=no

Step 3: Verify Prefix Advertisement

Check which prefixes are being advertised.

/ipv6 nd prefix print

Expected output:

Flags: D - dynamic, X - disabled, I - invalid
 0 D interface=bridge prefix=2001:db8:1::/64 valid-lifetime=4w2d
     preferred-lifetime=1w autonomous=yes

Step 4: Check Client Neighbors

Verify clients are receiving addresses and appearing in the neighbor table.

/ipv6 neighbor print

Expected output:

Flags: R - ROUTER
 #   INTERFACE  ADDRESS                                    MAC-ADDRESS       STATUS
 0   bridge     2001:db8:1::a1b2:c3d4:e5f6:7890           AA:BB:CC:DD:EE:FF reachable
 1   bridge     fe80::aabb:ccff:fedd:eeff                 AA:BB:CC:DD:EE:FF reachable

Common Scenarios

Scenario: Basic LAN with SLAAC

Provide automatic IPv6 addresses to all LAN clients:

# Add IPv6 address to LAN interface
/ipv6 address add address=2001:db8:1::1/64 interface=bridge advertise=yes

# Verify ND is enabled (should be automatic)
/ipv6 nd print

# Clients will automatically get addresses like:
# 2001:db8:1::aabb:ccdd:eeff:1122

Scenario: Advertise DNS Servers

Include DNS server information in Router Advertisements (RDNSS):

# Enable DNS advertisement (default is yes)
/ipv6 nd set [find interface=bridge] advertise-dns=yes

# Configure DNS servers (these will be advertised)
/ip dns set servers=2606:4700:4700::1111,2001:4860:4860::8888

Clients supporting RFC 8106 will automatically use these DNS servers.

DNS advertisement options:

• yes - Advertise configured DNS servers from /ip dns
• no - Don’t include DNS in Router Advertisements
• self - Advertise the router’s own link-local address as DNS server (router must be running DNS)

# Advertise router as DNS server (requires /ip dns enabled)
/ipv6 nd set [find interface=bridge] advertise-dns=self

Scenario: Use DHCPv6 for Addresses (Stateful)

For networks requiring DHCPv6 instead of SLAAC:

# Tell clients to use DHCPv6 for addresses
/ipv6 nd set [find interface=bridge] managed-address-configuration=yes

# Optionally keep SLAAC disabled
/ipv6 address set [find interface=bridge] advertise=no

Scenario: DHCPv6 for DNS Only (Stateless DHCPv6)

Use SLAAC for addresses but DHCPv6 for DNS and other options:

# Keep managed=no (SLAAC for addresses)
# Enable other-configuration for DHCPv6 options
/ipv6 nd set [find interface=bridge] other-configuration=yes

Scenario: Receive IPv6 via SLAAC (Router as Client)

To receive an IPv6 address from an upstream router via SLAAC:

# Enable accepting Router Advertisements (important for v7)
/ipv6 settings set accept-router-advertisements=yes

# Note: By default this is "yes-if-forwarding-disabled"
# Change to "yes" if you have forwarding enabled

Scenario: Adjust RA Timing

For faster client configuration or reduced network traffic:

# Faster initial client configuration
/ipv6 nd set [find interface=bridge] ra-interval=20s-1m

# Longer router lifetime (how long clients consider this router valid)
/ipv6 nd set [find interface=bridge] ra-lifetime=1h

Scenario: ND Proxy

Enable ND Proxy to allow routing between segments while appearing on the same link:

# Enable proxy on specific address
/ipv6 address set [find address~"2001:db8:1::"] nd-proxy=yes

Scenario: EUI-64 Auto-Generated Address

Let RouterOS automatically generate the host portion from the interface MAC address:

# Add address with EUI-64 host part generation
/ipv6 address add address=2001:db8:1::/64 interface=bridge eui-64=yes advertise=yes

The router generates an address like 2001:db8:1::aabb:ccff:fedd:eeff/64 based on the interface MAC.

When to Use EUI-64

Use eui-64=yes when you want a predictable address derived from hardware. Useful when you don’t have a specific address assigned but have a prefix.

Scenario: Skip Duplicate Address Detection

For faster address assignment in controlled environments:

# Skip DAD (only in trusted environments)
/ipv6 address add address=2001:db8:1::1/64 interface=bridge no-dad=yes

DAD Bypass Risk

Only use no-dad=yes in environments where you’re certain no address conflicts exist. Skipping DAD can cause silent connectivity issues if duplicates exist.

Scenario: Disable ND on Interface

Stop advertising on a specific interface:

/ipv6 nd set [find interface=bridge] disabled=yes

Or stop advertising a specific prefix while keeping ND active:

/ipv6 address set [find interface=bridge] advertise=no

Verification

Check 1: Verify ND is Active

/ipv6 nd print where disabled=no

Expected: Shows interface with ND enabled.

Check 2: Verify Prefix is Advertised

/ipv6 nd prefix print

Expected: Shows dynamic prefix entry with autonomous=yes.

Check 3: Verify Neighbors are Reachable

/ipv6 neighbor print where status=reachable

Expected: Client IPv6 addresses appear with reachable status.

Check 4: Test Client Connectivity

From a client, ping the router:

ping6 2001:db8:1::1

Expected: Replies received.

Troubleshooting

Symptom	Cause	Solution
Clients not getting IPv6 addresses	advertise=no on IPv6 address	Set advertise=yes on the address
Clients not getting addresses	ND disabled on interface	Enable: /ipv6 nd set [find interface=X] disabled=no
Router not accepting SLAAC addresses	Accept RA disabled or conditional	Set /ipv6 settings set accept-router-advertisements=yes
SLAAC breaks when forwarding enabled	v7 bug (fixed in 7.1+)	Upgrade RouterOS or set accept-router-advertisements=yes
Addresses deprecated immediately	advertise=no was set after yes	Clients cache prefixes; disconnect/reconnect or wait for lifetime expiry
DNS not received via RA	Client doesn’t support RDNSS (RFC 8106)	Use DHCPv6 with other-configuration=yes
Duplicate address detected	Two devices with same address or rogue RA	Check for rogue RA sources; verify EUI-64 uniqueness; use no-dad=yes only if trusted
Neighbors stuck in “incomplete”	Layer 2 issue (neighbor solicitation not reaching target)	Check switch config, VLAN tagging, firewall rules for ICMPv6
Neighbors stuck in “stale”	No recent communication	Normal state; will refresh on next communication attempt
Neighbors stuck in “delay”/“probe”	Address resolution in progress	Wait briefly; if persistent, check ICMPv6 connectivity

Common Mistakes

• Don’t forget advertise=yes - Adding an IPv6 address doesn’t automatically advertise it
• Don’t confuse ND with IP neighbors - /ipv6 neighbor is ND; /ip neighbor is discovery protocol (MNDP/LLDP)
• Don’t ignore accept-router-advertisements setting - Critical for receiving SLAAC as a client in v7
• Don’t expect immediate prefix deprecation - Clients cache prefixes according to lifetime values
• Don’t use very short lifetimes in production - Can cause address instability

Community Tips

SLAAC + Forwarding in v7: If your router needs to both forward IPv6 and receive addresses via SLAAC, explicitly set:

/ipv6 settings set accept-router-advertisements=yes

Privacy Extensions: Some clients use privacy extensions (RFC 4941) generating random addresses instead of EUI-64. This is normal and improves privacy.

Prefix Lifetime: Default valid-lifetime is 4w2d (30 days). If you change prefixes, clients may keep old addresses until this expires. Lower it temporarily when migrating:

/ipv6 nd prefix default set valid-lifetime=1h preferred-lifetime=30m

Address States Reference

State	Description
tentative	Address undergoing Duplicate Address Detection (DAD)
preferred	Address verified unique and active for all communication
deprecated	Address valid but not used for new connections
invalid	Address expired, cannot be used

Related Topics

IPv6 Address Assignment

• IPv6 Addresses - manual IPv6 address configuration
• IPv6 DHCP Server - stateful address assignment (DHCPv6)
• IPv6 DHCP Client - obtain prefix from ISP

Security

• IPv6 Firewall - protect IPv6 hosts

IPv4 Equivalent

• DHCP Server - IPv4 DHCP

Reference

• MikroTik IPv6 ND Documentation
• RFC 4861 - Neighbor Discovery for IPv6
• RFC 4862 - IPv6 Stateless Address Autoconfiguration

ND Properties Reference

Property	Type	Default	Description
interface	string	-	Interface for ND (required)
disabled	yes/no	no	Disable ND on interface
ra-interval	time range	3m20s-10m	Unsolicited RA interval
ra-delay	time	3s	Delay between solicited RAs
ra-lifetime	time	30m	Router validity period (0 = not default router)
ra-preference	low/medium/high	medium	Router selection priority
advertise-dns	yes/no/self	yes	Include DNS in RA
advertise-mac-address	yes/no	yes	Include source link-layer address
managed-address-configuration	yes/no	no	Tell clients to use DHCPv6 for addresses
other-configuration	yes/no	no	Tell clients to use DHCPv6 for other info
mtu	integer	unspecified	Advertised MTU
hop-limit	integer	unspecified	Advertised hop limit

IPv6 Address Properties Reference

Property	Type	Default	Description
address	IPv6/prefix	-	IPv6 address with prefix length
interface	string	-	Interface to assign address
advertise	yes/no	no	Include prefix in Router Advertisements
eui-64	yes/no	no	Auto-generate host part from interface MAC
no-dad	yes/no	no	Skip Duplicate Address Detection

Prefix Properties Reference

Property	Type	Default	Description
prefix	IPv6 prefix	-	Prefix to advertise
interface	string	-	Interface for prefix
autonomous	yes/no	yes	Allow SLAAC address generation
on-link	yes/no	yes	Prefix is on-link
valid-lifetime	time	4w2d	Address validity period
preferred-lifetime	time	1w	Preferred address period

Command Reference

Command	Description
/ipv6 nd print	Display ND configuration
/ipv6 nd set	Modify ND settings
/ipv6 nd prefix print	Show advertised prefixes
/ipv6 nd prefix default print	Show default prefix settings
/ipv6 neighbor print	Display neighbor table
/ipv6 settings print	Show IPv6 global settings