CloudLabBox
Try the free demo

IPv6 in practice lab 8 of 12

PMTUD and fragmentation: why ICMPv6 must not be blocked

Small pages load but large downloads hang from the office, and yet the warehouse is fine. Follow a Packet Too Big message to the filter that eats it, see why IPv6 routers never fragment, and compare the proper fix with an MSS clamp.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 3,072 MB in total. That fits the free demo too.

In your workspace: Shared, then IPv6 in practice across vendors guided labs, then 08 - PMTUD and fragmentation - why ICMPv6 must not be blocked

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
6 vCPU, 3,072 MB
Smallest plan
Lite

The scenario

Kestrel Freight's tracking server sits in the data centre. Since last week's security audit, staff at the office say the small status page loads but the 200 kB manifest download hangs. Staff at the warehouse, on the next port of the same router, have no problem. You work out why, and fix it properly.

SegmentPrefixDevices
Office LAN2001:db8:100:10::/64R1 Gi0/0 ::1, H1 ::10
Warehouse LAN2001:db8:100:11::/64R1 Gi0/2 ::1, H2 ::10
WAN circuit, MTU 14002001:db8:100:a::/64R1 Gi0/1 ::1, R2 Gi0/0 ::2
Data centre link2001:db8:100:b::/64R2 Gi0/1 ::2, R3 Gi0/0 ::3
Server LAN2001:db8:100:20::/64R3 Gi0/1 ::1, SRV ::10
DeviceRunsHow to log in
R1, R2, R3Cisco IOSv 15.9The console opens at >; enable has no password.
H1, H2, SRVAlpine Linuxroot, no password.

What you’ll practise

  • Explain why IPv6 routers never fragment and how a source learns the path MTU
  • Read Packet Too Big messages and the Fragment extension header in a capture
  • Find a PMTUD black hole from its symptoms: small transfers work, large ones hang
  • Fix an ACL so that ICMPv6 Packet Too Big passes, and show the source has learnt the smaller MTU
  • Explain what an MSS clamp hides, and when it is the only option

The tasks

  1. Start the Linux hosts
  2. Reproduce the complaint
  3. See what a router does with a large packet
  4. Find the black hole
  5. Work out why the warehouse is fine
  6. Fix the filter
  7. Keep or remove the clamp?

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of PMTUD and fragmentation - why ICMPv6 must not be blocked6 nodes, 5 links. Every link is listed as text below the diagram.R1R2R3H1H2SRVGi0/1eth0Gi0/1Gi0/0Gi0/1Gi0/0Gi0/0eth0Gi0/2eth0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/1 to R2 Gi0/0
  • R2 Gi0/1 to R3 Gi0/0
  • R1 Gi0/0 to H1 eth0
  • R1 Gi0/2 to H2 eth0
  • R3 Gi0/1 to SRV eth0
Nodes in PMTUD and fragmentation: why ICMPv6 must not be blocked, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
R3Cisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
H2Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
SRVAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder IPv6 in practice across vendors guided labs.

  3. Open 08 - PMTUD and fragmentation - why ICMPv6 must not be blocked and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More IPv6 in practice labs

All IPv6 in practice labs

Related labs in other courses

CloudLabBox is independent of Cisco, CompTIA, Juniper Networks and MikroTik. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.