Disabling IPV6

[deanrawlings]

Hi all,

 

My ISP has recommended I disable IPV6 due to recent issues where there internet filtering package isn't picking up users on our network, therefore - they say not being able to apply them to a filtering group.

 

Is this normal to disable IPV6?

 

I wouldn't say I have it configured - it's just enabled.

 

My DHCP isn't configured to push out IPV6 addresses either.

 

On our DC's 2008 and 2012 - "Local area connection" the IPv6 protocol is enabled and is also enabled on the rest of our servers and Windows 7 clients. DNS is showing IPV6 addresses for each of the clients along with their IPV4 address, so one of each per device.

 

Are there other implications with disabling IPV6? I read somewhere that it could cause AD to slow down?

 

For me to go about disabling this would it be a case of just unticking IPV6 from Local area connection properties all of our network devices Servers, workstations etc (Hopefully there would be a way to do this via script, GPO etc)?

 

Would I need to delete the IPV6 DNS Entries for rach device so just the IPV4 addresses remain?

 

I'd like to add that, our 6th form site is setup in just the same way with IPV6 ticked on a totally separate domain with no issues with the filtering.....

 

Any advice would be greatly appreciated.

 

Thanks

 

Dean

[Steve21]

Well sort of Generally people disable it as it's not needed and just adds another layer of issues in, but there's also no reason it should allow them to bypass filtering. It's still a client on the same network going out the same route etc.

 

Generally some ISPs/Firewalls physically won't route ipv6 etc, but if they're getting out there's something else causing the problem I'd say. For example they may only have filtering applied to a certain ip range etc

 

So how is the network setup, the clients with ipv4/6 are on the same range and pointing to same proxy?

 

Steve

[Roberto]

Hi all,

 

My ISP has recommended I disable IPV6 due to recent issues where there internet filtering package isn't picking up users on our network, therefore - they say not being able to apply them to a filtering group.

 

Is this normal to disable IPV6?

 

It's not normal these days to disable IPv6. There were some early issues where some apps didn't play nicely with a dual IP stack, and that's translated to cargo-cult "disable IPv6" advice more recently.

 

There might be some specific situations where specific issues arise and this could in theory be one, but I don't really see what internal IP stack has to do with external (presumably, as you mention the ISP) web filtering.

[Arthur]

Is this normal to disable IPv6?

Microsoft don't recommend disabling IPv6. As others have said, it's not normal to need to do this.

 

https://blogs.technet.microsoft.com/rmilne/2014/10/29/disabling-ipv6-and-exchange-going-all-the-way

 

It is unfortunate that some organizations disable IPv6 on their computers running Windows Vista or Windows Server 2008, where it is installed and enabled by default. Many disable IPv6-based on the assumption that they are not running any applications or services that use it. Others might disable it because of a misperception that having both IPv4 and IPv6 enabled effectively doubles their DNS and Web traffic. This is not true.

 

From Microsoft's perspective, IPv6 is a mandatory part of the Windows operating system and it is enabled and included in standard Windows service and application testing during the operating system development process. Because Windows was designed specifically with IPv6 present, Microsoft does not perform any testing to determine the effects of disabling IPv6. If IPv6 is disabled on Windows Vista, Windows Server 2008, or later versions, some components will not function. Moreover, applications that you might not think are using IPv6—such as Remote Assistance, HomeGroup, DirectAccess, and Windows Mail—could be.

 

Therefore, Microsoft recommends that you leave IPv6 enabled, even if you do not have an IPv6-enabled network, either native or tunnelled.

 

https://support.microsoft.com/en-gb/help/929852/guidance-for-configuring-ipv6-in-windows-for-advanced-users

 

We recommend that you use “Prefer IPv4 over IPv6” in prefix policies instead of disabling IPV6.

[TwistedHelixis]

I disabled IPv6 on one of my servers and it caused an issue so I had to enable it again. It was so long ago that I cant remember what the issue was, sorry.

[3s-gtech]

Back in the days of us using Server 2008 R2 for DCs, I tried disabling IPv6. It brought AD to a crawl, fixed instantly by switching it back on. Best to leave it on, as per MS's instructions.

[free780]

Only time I've disabled it is when your sending multicast traffic as most networks aren't configured for ipv6 igmp. A MDT/SCCM server for example.

[Duke5A]

Check this out: https://social.technet.microsoft.com/wiki/contents/articles/5927.how-to-disable-ipv6-through-group-policy.aspx

 

Microsoft has GPO templates available for configuring IPv6. As stated though, don't outright disable it. One of the configurable options is to make the OS prefer IPv4 over IPv6 - use this one. As to it fixing your original issue, I have no idea.

[deanrawlings]

Thanks for your feedback on this guys, really appreciate it.

 

After taking onboard your comments, speaking to a few people and some testing I've found that if I disable it at workstation/client level and leave it enabled on the servers seems to work best in my situation. I'll do a bit more work on it over the summer.

 

Thanks again,