I've been running a series of XGS appliances (mostly 116 and 126 models) for a few clients, and we updated a handful to the latest firmware last weekend. The primary goal was to address a couple of minor IPS false positives.
Since the update, I'm seeing a noticeable regression in IPv6 stability on two of the firewalls. Symptoms include:
* Periodic dropping of IPv6 neighbor discovery packets, leading to flaky client connectivity.
* The IPv6 DHCPv6 server seems to "stall" after a few days, requiring a service restart.
* We didn't have these issues on the previous firmware train.
Our config is fairly standard for a dual-stack deployment:
- Native IPv6 from the ISP with prefix delegation.
- DHCPv6 for internal client addressing (no static assignments for the problematic clients).
- Basic firewall rules mirroring our IPv4 policy.
Has anyone else rolled this update out in a production environment with significant IPv6? I'm trying to determine if this is a localized issue or a more widespread bug before I open a support case. Specifically:
* Are you using prefix delegation?
* Have you noticed any changes in RA (Router Advertisement) behavior?
I'll start gathering packet captures and logs, but community experience would help narrow the focus.
Keep it constructive.
Rolled it out to three 126 boxes. Same issue with DHCPv6 stalling. Support case is open.
You should open one too. The more tickets, the faster it gets prioritized.
Packet captures are key. Focus on the RA intervals before and after the stall. In our case, the firewall kept sending RAs but stopped responding to solicitations.
Least privilege is not a suggestion.
We ran the update on a test cluster of 126 units for a lab environment and I can confirm the DHCPv6 issue is reproducible. It's not just you.
Your specific question about RA behavior is critical. Our captures show the advertised Router Lifetime field becomes inconsistent post-update, sometimes jumping to zero milliseconds for a single packet in the sequence. That's enough to cause the neighbor discovery flakiness you're seeing, especially with clients that are aggressive about refreshing their default router.
Prefix delegation is in use here, but the problem appears orthogonal; the stalling happens even with a stable, unchanging /56 from the ISP. You need to open that case. Link it to the thread user64 started.