Router Advertisements in VyOS

Router Advertisements (RA) is an IPv6 mechanism that lets routers automatically configure network parameters on clients through periodic advertisements. RA is a key part of SLAAC (Stateless Address Autoconfiguration) and is defined in RFC 4861.

Overview

Router Advertisements provide:

SLAAC (Stateless Address Autoconfiguration): Automatic IPv6 address creation by clients
Prefix delegation: Advertising network prefixes
Default gateway: Informing clients about the default router
DNS configuration: Delivering DNS servers and search domains
MTU configuration: Advertising the network MTU
Router lifetime: Lifetime of the default route
Managed/Other flags: Controlling DHCPv6 modes

Protocol: ICMPv6, type 134 (Router Advertisement)

RFC: RFC 4861 (Neighbor Discovery), RFC 4862 (SLAAC)

SLAAC vs DHCPv6

Router Advertisements work together with DHCPv6 through control flags:

Mode	Managed Flag	Other Flag	Description
SLAAC only	0	0	Full autoconfiguration through RA
Stateless DHCPv6	0	1	Addresses via SLAAC, parameters via DHCPv6
Stateful DHCPv6	1	1	Addresses and parameters via DHCPv6
SLAAC + DNS via RA	0	0	SLAAC with RDNSS/DNSSL in RA

Choosing a mode

SLAAC only: Simple networks without centralized management
Stateless DHCPv6: When additional parameters are needed (DNS, NTP)
Stateful DHCPv6: Centralized management and client tracking
SLAAC + RDNSS: Modern approach with DNS in RA

Basic configuration

Simple Router Advertisement

# IPv6 address on the interface
set interfaces ethernet eth0 address 2001:db8:1::1/64

# Enable RA on the interface
set service router-advert interface eth0

# Advertise the prefix
set service router-advert interface eth0 prefix 2001:db8:1::/64

commit
save

Clients will automatically create addresses in the 2001:db8:1::/64 prefix using SLAAC.

RA with automatic prefix detection

# Use ::/64 for automatic detection
set service router-advert interface eth0 prefix ::/64

commit
save

The ::/64 prefix automatically uses the prefix configured on the interface.

RA with DNS servers

# Router Advertisement with RDNSS (Recursive DNS Server)
set service router-advert interface eth0 prefix 2001:db8:1::/64
set service router-advert interface eth0 name-server 2001:4860:4860::8888
set service router-advert interface eth0 name-server 2001:4860:4860::8844

# DNS search domain (DNSSL)
set service router-advert interface eth0 dnssl example.com

commit
save

Advanced configuration

Managed and Other-Config flags

Managed Flag (Stateful DHCPv6)

# Clients obtain addresses via DHCPv6
set service router-advert interface eth0 prefix 2001:db8:1::/64
set service router-advert interface eth0 managed-flag

# Requires a configured DHCPv6 server
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN interface eth0

commit
save

Other-Config Flag (Stateless DHCPv6)

# Addresses via SLAAC, parameters via DHCPv6
set service router-advert interface eth0 prefix 2001:db8:1::/64
set service router-advert interface eth0 other-config-flag

# DHCPv6 for parameters only (no address-range)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth0

commit
save

RA transmission intervals

# Maximum interval (sec) between RAs
set service router-advert interface eth0 interval max 600

# Minimum interval (sec)
set service router-advert interface eth0 interval min 200

commit
save

Defaults: max=600 sec (10 minutes), min=200 sec.

Router Preference

Router priority when several are present:

set service router-advert interface eth0 default-preference <low|medium|high>

Examples:

# High priority (preferred router)
set service router-advert interface eth0 default-preference high

# Medium priority (default)
set service router-advert interface eth0 default-preference medium

# Low priority (backup router)
set service router-advert interface eth0 default-preference low

commit
save

Link MTU

Advertise the network MTU:

set service router-advert interface eth0 link-mtu 1500

commit
save

Hop Limit

Hop limit value for outgoing packets:

set service router-advert interface eth0 hop-limit 64

commit
save

Default: 64 (standard IPv6 value).

Reachable Time

Neighbor reachable time (milliseconds):

set service router-advert interface eth0 reachable-time 30000

commit
save

Retransmit Timer

Neighbor Solicitation retransmit timer (milliseconds):

set service router-advert interface eth0 retrans-timer 1000

commit
save

Router Lifetime

Lifetime of the default route (seconds):

set service router-advert interface eth0 default-lifetime 1800

commit
save

Default: 1800 sec (30 minutes).

A value of 0 means the router should not be used as a default gateway.

Disabling RA

No-Send-Advert

Completely disable periodic RAs:

set service router-advert interface eth0 no-send-advert

commit
save

The interface will still respond to Router Solicitation.

No-Send-Interval

Disable the Mobile IPv6 interval option:

set service router-advert interface eth0 no-send-interval

commit
save

Prefixes (Prefix Configuration)

Prefix options

Autonomous Flag

Allow SLAAC (enabled by default):

# Disable SLAAC for this prefix
set service router-advert interface eth0 prefix 2001:db8:1::/64 no-autonomous-flag

commit
save

On-Link Flag

Prefix is reachable on the local network (enabled by default):

# Prefix is not on the local network
set service router-advert interface eth0 prefix 2001:db8:1::/64 no-on-link-flag

commit
save

Preferred Lifetime

Preferred lifetime for addresses (seconds):

set service router-advert interface eth0 prefix 2001:db8:1::/64 preferred-lifetime 604800

commit
save

Default: 604800 sec (7 days).

A value of infinity means an infinite lifetime.

Valid Lifetime

Valid lifetime for addresses (seconds):

set service router-advert interface eth0 prefix 2001:db8:1::/64 valid-lifetime 2592000

commit
save

Default: 2592000 sec (30 days).

Multiple prefixes

# Advertise several prefixes
set service router-advert interface eth0 prefix 2001:db8:1::/64
set service router-advert interface eth0 prefix 2001:db8:2::/64
set service router-advert interface eth0 prefix 2001:db8:3::/64

# Different parameters for different prefixes
set service router-advert interface eth0 prefix 2001:db8:1::/64 preferred-lifetime 604800
set service router-advert interface eth0 prefix 2001:db8:2::/64 preferred-lifetime 86400
set service router-advert interface eth0 prefix 2001:db8:3::/64 no-autonomous-flag

commit
save

NAT64 Prefix

NAT64 lets IPv6-only clients reach IPv4 resources.

Basic NAT64 setup

# Advertise the NAT64 prefix
set service router-advert interface eth0 nat64prefix 64:ff9b::/96

commit
save

Well-known NAT64 prefix: 64:ff9b::/96

Supported NAT64 masks

The NAT64 prefix can use:

/32
/40
/48
/56
/64
/96 (well-known prefix)

Examples:

# Well-known prefix (96-bit)
set service router-advert interface eth0 nat64prefix 64:ff9b::/96

# Organization-specific (64-bit)
set service router-advert interface eth0 nat64prefix 2001:db8:64::/64

# Network-specific (96-bit)
set service router-advert interface eth0 nat64prefix 2001:db8:1:64::/96

commit
save

NAT64 Valid Lifetime

# NAT64 prefix lifetime (seconds)
set service router-advert interface eth0 nat64prefix 64:ff9b::/96 valid-lifetime 65528

commit
save

Default: 65528 seconds.

DNS Configuration (RDNSS and DNSSL)

RDNSS (Recursive DNS Server)

# DNS servers via RA
set service router-advert interface eth0 name-server 2001:4860:4860::8888
set service router-advert interface eth0 name-server 2001:4860:4860::8844
set service router-advert interface eth0 name-server 2001:db8:1::53

commit
save

RDNSS Lifetime

# Lifetime of DNS entries (seconds)
set service router-advert interface eth0 name-server 2001:4860:4860::8888 lifetime 300

commit
save

Default: the router lifetime is used.

DNSSL (DNS Search List)

# Search domains
set service router-advert interface eth0 dnssl example.com
set service router-advert interface eth0 dnssl corp.example.com
set service router-advert interface eth0 dnssl lab.example.com

commit
save

DNSSL Lifetime

# Lifetime of the search list (seconds)
set service router-advert interface eth0 dnssl example.com lifetime 300

commit
save

Supported interface types

Router Advertisements are supported on:

ethernet - physical Ethernet interfaces
bonding - bond interfaces
bridge - bridge interfaces
vxlan - VXLAN tunnels
geneve - Geneve tunnels
l2tpv3 - L2TPv3 tunnels
openvpn - OpenVPN interfaces
pseudo-ethernet - pseudo-Ethernet (VLAN)
tunnel - tunnel interfaces
wireguard - WireGuard VPN
wireless - wireless interfaces
wwan - wireless WAN interfaces

Configuration examples

Example 1: Simple SLAAC

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

# Router Advertisement for SLAAC
set service router-advert interface eth1 prefix 2001:db8:1::/64

# DNS via RDNSS
set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 name-server 2001:4860:4860::8844
set service router-advert interface eth1 dnssl example.com

commit
save

Clients will create addresses of the form 2001:db8:1::xxxx:xxxx:xxxx:xxxx.

Example 2: Stateless DHCPv6 + SLAAC

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

# Router Advertisement with other-config flag
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 other-config-flag

# DHCPv6 for parameters (no addresses)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save

Addresses via SLAAC, DNS and domain via DHCPv6.

Example 3: Stateful DHCPv6

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

# Router Advertisement with managed flag
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 managed-flag
set service router-advert interface eth1 other-config-flag

# DHCPv6 for addresses and parameters
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save

Full management through DHCPv6.

Example 4: Multiple prefixes

# Multiple IPv6 addresses on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64
set interfaces ethernet eth1 address 2001:db8:2::1/64
set interfaces ethernet eth1 address 2001:db8:3::1/64

# RA for all prefixes
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 prefix 2001:db8:2::/64
set service router-advert interface eth1 prefix 2001:db8:3::/64

# DNS
set service router-advert interface eth1 name-server 2001:4860:4860::8888

commit
save

Example 5: RA with NAT64

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

# Router Advertisement with NAT64
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 nat64prefix 64:ff9b::/96

# DNS64 server
set service router-advert interface eth1 name-server 2001:db8:1::53

commit
save

IPv6-only clients will be able to reach IPv4 through NAT64.

Example 6: High-priority router

# Primary router with high priority
set interfaces ethernet eth1 address 2001:db8:1::1/64

set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 default-preference high
set service router-advert interface eth1 default-lifetime 3600

# DNS
set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 dnssl example.com

commit
save

Example 7: Backup router

# Backup router with low priority
set interfaces ethernet eth1 address 2001:db8:1::2/64

set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 default-preference low
set service router-advert interface eth1 default-lifetime 1800

commit
save

Example 8: RA on multiple interfaces

# LAN 1
set interfaces ethernet eth1 address 2001:db8:1::1/64
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 name-server 2001:4860:4860::8888

# LAN 2
set interfaces ethernet eth2 address 2001:db8:2::1/64
set service router-advert interface eth2 prefix 2001:db8:2::/64
set service router-advert interface eth2 name-server 2001:4860:4860::8888

# LAN 3 (Guest)
set interfaces ethernet eth3 address 2001:db8:100::1/64
set service router-advert interface eth3 prefix 2001:db8:100::/64
set service router-advert interface eth3 default-lifetime 600  # Short lifetime for guest

commit
save

Example 9: RA on VLANs

# VLAN 10 - Management
set interfaces ethernet eth1 vif 10 address 2001:db8:10::1/64
set service router-advert interface eth1.10 prefix 2001:db8:10::/64
set service router-advert interface eth1.10 managed-flag
set service router-advert interface eth1.10 name-server 2001:db8:10::53

# DHCPv6 for management
set service dhcpv6-server shared-network-name MGMT subnet 2001:db8:10::/64 address-range start 2001:db8:10::100 stop 2001:db8:10::150
set service dhcpv6-server shared-network-name MGMT interface eth1.10

# VLAN 20 - Users
set interfaces ethernet eth1 vif 20 address 2001:db8:20::1/64
set service router-advert interface eth1.20 prefix 2001:db8:20::/64
set service router-advert interface eth1.20 other-config-flag

# VLAN 30 - Guest (SLAAC only)
set interfaces ethernet eth1 vif 30 address 2001:db8:30::1/64
set service router-advert interface eth1.30 prefix 2001:db8:30::/64
set service router-advert interface eth1.30 name-server 2001:4860:4860::8888

commit
save

Example 10: RA on a Bridge

# Bridge interface
set interfaces bridge br0 address 2001:db8:1::1/64
set interfaces bridge br0 member interface eth2
set interfaces bridge br0 member interface eth3

# Router Advertisement on the bridge
set service router-advert interface br0 prefix 2001:db8:1::/64
set service router-advert interface br0 name-server 2001:4860:4860::8888
set service router-advert interface br0 dnssl example.com

commit
save

Example 11: Short intervals for fast convergence

# Fast RAs for testing or critical applications
set interfaces ethernet eth1 address 2001:db8:1::1/64

set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 interval max 30    # 30 seconds
set service router-advert interface eth1 interval min 10    # 10 seconds

commit
save

Example 12: Custom lifetime parameters

# Different lifetimes for different purposes
set interfaces ethernet eth1 address 2001:db8:1::1/64

set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 prefix 2001:db8:1::/64 preferred-lifetime 86400    # 1 day
set service router-advert interface eth1 prefix 2001:db8:1::/64 valid-lifetime 604800       # 7 days

set service router-advert interface eth1 default-lifetime 1800                              # 30 minutes
set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 name-server 2001:4860:4860::8888 lifetime 600      # 10 minutes

commit
save

Monitoring and diagnostics

Viewing the RA configuration

show configuration service router-advert

Checking IPv6 on the interface

show interfaces ethernet eth1

Make sure the IPv6 address is assigned and the interface is UP.

Checking IPv6 routing

show ipv6 route

RA logs

# radvd logs (the RA daemon)
show log | match radvd

# Real-time monitoring
monitor log | match radvd

Testing from a client

On a Linux client:

# View the received RAs
sudo radvdump

# Example output:
# Router advertisement from fe80::1 (hoplimit 64)
#         Prefix 2001:db8:1::/64
#         Prefix options: onlink autoconf
#         Preferred lifetime 604800, valid lifetime 2592000

# View IPv6 addresses
ip -6 addr show eth0

# Example output:
# inet6 2001:db8:1::a00:27ff:fe8d:c04d/64 scope global dynamic
# inet6 fe80::a00:27ff:fe8d:c04d/64 scope link

# View the default gateway
ip -6 route show

# Example output:
# default via fe80::1 dev eth0 proto ra metric 1024

On Windows:

# View IPv6 addresses
ipconfig

# Detailed information
netsh interface ipv6 show address

# Routing table
netsh interface ipv6 show route

Checking SLAAC addresses

# On the router - scan IPv6 neighbors
show ipv6 neighbors

# Example output:
# IPv6 Address                            Age Hardware Address State Interface
# 2001:db8:1::a00:27ff:fe8d:c04d         0   08:00:27:8d:c0:4d REACH eth1
# fe80::a00:27ff:fe8d:c04d               0   08:00:27:8d:c0:4d REACH eth1

ICMPv6 statistics

show ipv6 icmpv6 statistics

Look at the “Router Advertisement” section.

Troubleshooting

Problem: Clients do not receive IPv6 addresses

Diagnostics:

# 1. Check the RA configuration
show configuration service router-advert

# 2. Check IPv6 on the interface
show interfaces ethernet eth1

# 3. Check IPv6 forwarding
sysctl net.ipv6.conf.all.forwarding

# 4. Logs
show log | match radvd

# 5. Firewall
show firewall ipv6

Solution:

# Make sure IPv6 forwarding is enabled (automatic when interfaces are configured)
# Check the firewall - ICMPv6 must be allowed

# Allow ICMPv6 Router Advertisement
set firewall ipv6 name LAN_LOCAL rule 100 action accept
set firewall ipv6 name LAN_LOCAL rule 100 protocol ipv6-icmp
set firewall ipv6 name LAN_LOCAL rule 100 icmpv6 type router-advertisement

# Restart radvd
restart router-advert

commit
save

Problem: RAs are sent, but clients do not configure themselves

Cause: The client may not support SLAAC, or it is blocked by a firewall on the client.

Diagnostics on the client (Linux):

# Check accept_ra
cat /proc/sys/net/ipv6/conf/eth0/accept_ra
# Should be: 1 or 2

# Enable accept_ra
sudo sysctl -w net.ipv6.conf.eth0.accept_ra=2

# Make it persistent
echo "net.ipv6.conf.eth0.accept_ra = 2" | sudo tee -a /etc/sysctl.conf

Solution:

# On the router - send RA manually
restart router-advert

# On the client - refresh the configuration
sudo systemctl restart networking
# or
sudo dhclient -6 -r eth0 && sudo dhclient -6 eth0

Problem: Clients get addresses but no DNS

Cause: DNS is not configured in the RA, or the client does not support RDNSS.

Solution:

# Add name-server to the RA
set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 name-server 2001:4860:4860::8844

# Or use DHCPv6 for DNS
set service router-advert interface eth1 other-config-flag
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save

Problem: Multiple routers cause conflicts

Cause: Several routers send RAs with the same priority.

Solution:

# On the primary router
set service router-advert interface eth1 default-preference high

# On the backup router
set service router-advert interface eth1 default-preference low

commit
save

Problem: DHCPv6 works, but SLAAC does not

Cause: The autonomous flag is disabled.

Solution:

# Make sure the autonomous flag is enabled (default)
delete service router-advert interface eth1 prefix 2001:db8:1::/64 no-autonomous-flag

# Check the configuration
show configuration service router-advert interface eth1

commit
save

Problem: Clients do not see the router as a default gateway

Cause: Router lifetime = 0, or the router is not sending RAs.

Solution:

# Set the router lifetime
set service router-advert interface eth1 default-lifetime 1800

# Verify that RA is not disabled
delete service router-advert interface eth1 no-send-advert

commit
save

Problem: NAT64 does not work

Diagnostics:

# Check the NAT64 prefix in the RA
show configuration service router-advert interface eth1

# On the client
ping 64:ff9b::8.8.8.8  # Should ping 8.8.8.8

Solution:

# Configure the NAT64 prefix
set service router-advert interface eth1 nat64prefix 64:ff9b::/96

# Configure NAT64 translation (if needed)
# (Depends on additional NAT64 daemon configuration)

commit
save

Best practices

1. Choosing the right mode

# Enterprise with centralized management
set service router-advert interface eth1 managed-flag

# Simple networks
set service router-advert interface eth1 prefix ::/64

2. Configuring DNS

Always configure DNS:

# Via RDNSS in the RA
set service router-advert interface eth1 name-server 2001:4860:4860::8888

# Or via DHCPv6
set service router-advert interface eth1 other-config-flag
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888

3. Multiple DNS servers

set service router-advert interface eth1 name-server 2001:4860:4860::8888
set service router-advert interface eth1 name-server 2001:4860:4860::8844
set service router-advert interface eth1 name-server 2001:db8:1::53  # Local DNS

4. Proper intervals

# Stable network - long intervals
set service router-advert interface eth1 interval max 600

# Dynamic network - short intervals
set service router-advert interface eth1 interval max 60
set service router-advert interface eth1 interval min 20

5. Sensible lifetimes

# Preferred lifetime < Valid lifetime
set service router-advert interface eth1 prefix 2001:db8:1::/64 preferred-lifetime 604800   # 7 days
set service router-advert interface eth1 prefix 2001:db8:1::/64 valid-lifetime 2592000      # 30 days

6. Priorities for HA

# Primary router
set service router-advert interface eth1 default-preference high

# Secondary router
set service router-advert interface eth1 default-preference low

7. Documenting prefixes

Document the purpose of each prefix:

# Production LAN
set service router-advert interface eth1 prefix 2001:db8:1::/64

# Management VLAN
set service router-advert interface eth1.10 prefix 2001:db8:10::/64

# Guest WiFi
set service router-advert interface eth1.30 prefix 2001:db8:30::/64

8. Security

Use a firewall to protect against rogue RAs:

# Allow RA only from trusted interfaces
set firewall ipv6 name WAN_LOCAL rule 100 action drop
set firewall ipv6 name WAN_LOCAL rule 100 protocol ipv6-icmp
set firewall ipv6 name WAN_LOCAL rule 100 icmpv6 type router-advertisement

9. MTU Configuration

Configure the MTU if you use tunnels:

# For GRE/IPsec tunnels
set service router-advert interface eth1 link-mtu 1280

# For Jumbo frames
set service router-advert interface eth1 link-mtu 9000

10. Monitoring

Check regularly:

show ipv6 neighbors
show log | match radvd

Integration with other features

RA + DHCPv6

Hybrid approach (recommended):

# SLAAC for addresses
set service router-advert interface eth1 prefix 2001:db8:1::/64

# DHCPv6 for parameters
set service router-advert interface eth1 other-config-flag
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

RA + DNS Forwarding

# RA points to the local DNS
set service router-advert interface eth1 name-server 2001:db8:1::1

# DNS Forwarding on the router
set service dns forwarding listen-address 2001:db8:1::1
set service dns forwarding name-server 2001:4860:4860::8888

RA + Firewall

# Allow ICMPv6 (including RA)
set firewall ipv6 name LAN_LOCAL rule 100 action accept
set firewall ipv6 name LAN_LOCAL rule 100 protocol ipv6-icmp

# Block external RAs (rogue RA protection)
set firewall ipv6 name WAN_LOCAL rule 100 action drop
set firewall ipv6 name WAN_LOCAL rule 100 protocol ipv6-icmp
set firewall ipv6 name WAN_LOCAL rule 100 icmpv6 type router-advertisement

RA + High Availability (VRRP)

# Configure VRRP IPv6 on both routers
set high-availability vrrp group LAN vrid 10
set high-availability vrrp group LAN interface eth1
set high-availability vrrp group LAN address 2001:db8:1::1/64

# RA on the VIP address (master only)
set service router-advert interface eth1 prefix 2001:db8:1::/64

Useful commands

# RA configuration
show configuration service router-advert

# IPv6 interfaces
show interfaces

# IPv6 routing
show ipv6 route

# IPv6 neighbors
show ipv6 neighbors

# radvd logs
show log | match radvd
monitor log | match radvd

# Restart RA
restart router-advert

# ICMPv6 statistics
show ipv6 icmpv6 statistics

# Check IPv6 connectivity
ping 2001:db8:1::100

# Traceroute IPv6
traceroute6 2001:4860:4860::8888

Conclusion

Router Advertisements in VyOS provide a powerful and flexible platform for autoconfiguring IPv6 networks. Support for SLAAC, DHCPv6 integration, NAT64, RDNSS/DNSSL, and multiple interfaces makes VyOS an ideal solution for modern IPv6 deployments.

Key benefits of RA in VyOS:

Full automation of IPv6 client configuration
Flexible modes (SLAAC, Stateless DHCPv6, Stateful DHCPv6)
Support for modern standards (RDNSS, DNSSL, NAT64)
Operation across multiple interface types
Integration with DHCPv6, DNS, and Firewall

Recommendations for production:

Use SLAAC + DHCPv6 (hybrid mode) for a balance of simplicity and functionality
Configure DNS via RDNSS in the RA or via DHCPv6
Plan prefixes in advance and document them
Configure priorities for HA scenarios
Protect against rogue RAs with a firewall
Monitor radvd logs regularly
Test with different clients (Linux, Windows, macOS)

Router Advertisements in VyOS deliver enterprise-grade IPv6 autoconfiguration management with the reliability and flexibility required for production environments.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

DHCPv6 Server in VyOS Dynamic DNS (DDNS) in VyOS