Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,772 questions
Ping on Public IPv6 works only with opened port 129
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 87%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EEB%3C/text%3E%3C/svg%3E)
Erik Bašista
0
Reputation points
Hello support team,
When I need to perform pinging on Public IPv6 addresses assigned onto Virtual Machines in the same or different subnet, It must be allowed port 129 in NSG. It is only the one way to ensure ping on IPv6 between them. But why is this port needs to be open?
I got information, the ICMPv6 is not supported in Azure by default, from this reason can not be enabled ping by allowing ICMP only.
Many thanks for advice
Azure Virtual Network
{count} votes
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator2023-03-28T12:34:05.1133333+00:00 Hello @Erik Bašista ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
As mentioned in the IPv6 limitations section, ICMPv6 is not currently supported in Network Security Groups.
https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview#limitations
"ICMPv6 is not currently supported in Network Security Groups" means that you cannot set ICMP only as the protocol in NSG when allowing traffic to IPv6 as shown below:
However, if you set the protocol as "Any" in your NSG rules, ping to IPv6 will work.
May I know what is your NSG configuration and how are you pinging your Public IPv6 address?
Regards,
Gita
-
Erik Bašista 0 Reputation points
2023-03-29T07:24:11.6033333+00:00 Hello @GitaraniSharma-MSFT ,
Thank you for reply.
Case 1: Allowed port 129 -> Can ping Public IPv6:
I have set the following rules in NSG:
When the port 129 is enabled, after this I was able to ping Public IPv6 between the VMs. Is some reason of this behavior in NSG, please?
Without allowed port 129 I am able to ping: Private and Public IPv4 + Private IPv6 . But not Public IPv6.
Case 2: No Allowed port 129 -> Can´t ping Public IPv6:
If I remove port 129 allowed to Any protocol, like this:
There is no possibility to ping Public IPv6.
Thanks so much.
Regards,
Erik
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
2023-03-29T15:28:35.1+00:00 @Erik Bašista , like I mentioned earlier, you cannot set ICMP only as the protocol in NSG when allowing traffic to IPv6. But if you set the protocol as "Any" in your NSG rules, ping to IPv6 will work.
In case 1, I see the port 129 rule has protocol set to "Any", so it will allow ICMP traffic to IPv6.
But in case 2, when it is removed, there is an "ICMP" only protocol, which is not supported with IPv6.
How are you pinging your Public IPv6 address when you have the port 129 rule added? Are you doing a ICMP ping to the IPv6 on port 129?
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
2023-04-03T13:47:33.25+00:00 @Erik Bašista , could you please provide an update on this post for further discussion?
-
Erik Bašista 0 Reputation points
2023-04-04T09:32:24.0866667+00:00 @GitaraniSharma-MSFT , I am pinging on source VM by using ICMP only, by default.
ping <Public_IPv6> But If I change the port from 129 to random another port value (for example: 128), then I cant ping on Public IPv6 anymore, even the Any protocol is enabled. Follow example below, in this case I am not able to ping Public IPv6:
-
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator
2023-04-04T11:52:08.0633333+00:00 @Erik Bašista , thank you for sharing the additional details. Please allow me some time to check this with the Azure IPv6 Product Group team and get back to you with an update.
Sign in to comment
Sign in to answer