Xbox Live and Teredo
Figured the collective here might have an answer. All of a sudden a network I manage started getting complaints from XBOX live users are getting error messages about “Can’t get Teredo IP address” on their consoles. Is anyone else seeing this wide spread? The Microsoft support default answer is “Your ISP is blocking ports” when I can do an nmap on each of these customers and all of the xbox live ports are open. As an FYI these are not netted customers, but have true publics. We have tried disabling IPV6 on their interfaces and that does not seem to have helped. We have had some customers power cycle everything in their home (CPE, router, xbox) and still no go. Anyone else running into this? Does Microsoft have a higher level support for talking with ISPs at all? Justin Wilson j2sw@mtin.net www.mtin.net www.midwest-ix.com
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers. Mark
On 3 Jan 2018, at 9:25 am, Justin Wilson <lists@mtin.net> wrote:
Figured the collective here might have an answer. All of a sudden a network I manage started getting complaints from XBOX live users are getting error messages about “Can’t get Teredo IP address” on their consoles. Is anyone else seeing this wide spread? The Microsoft support default answer is “Your ISP is blocking ports” when I can do an nmap on each of these customers and all of the xbox live ports are open. As an FYI these are not netted customers, but have true publics.
We have tried disabling IPV6 on their interfaces and that does not seem to have helped. We have had some customers power cycle everything in their home (CPE, router, xbox) and still no go.
Anyone else running into this? Does Microsoft have a higher level support for talking with ISPs at all?
Justin Wilson j2sw@mtin.net
www.mtin.net www.midwest-ix.com
-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
Once upon a time, Mark Andrews <marka@isc.org> said:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support IPv6, while the Xbox One does (but neither would explain the Teredo). -- Chris Adams <cma@cmadams.net>
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe. Justin Wilson j2sw@mtin.net www.mtin.net www.midwest-ix.com
On Jan 2, 2018, at 6:06 PM, Chris Adams <cma@cmadams.net> wrote:
Once upon a time, Mark Andrews <marka@isc.org> said:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support IPv6, while the Xbox One does (but neither would explain the Teredo). -- Chris Adams <cma@cmadams.net>
Time to buy a Xbox for the NOC so you can trouble shoot. All puns intended. Mark
On 3 Jan 2018, at 10:15 am, Justin Wilson <lists@mtin.net> wrote:
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe.
Justin Wilson j2sw@mtin.net
www.mtin.net www.midwest-ix.com
On Jan 2, 2018, at 6:06 PM, Chris Adams <cma@cmadams.net> wrote:
Once upon a time, Mark Andrews <marka@isc.org> said:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support IPv6, while the Xbox One does (but neither would explain the Teredo). -- Chris Adams <cma@cmadams.net>
-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
Are you aware: - Microsofts justification for Teredo is to support P2P during the transition to IPv6 dominant networks. - Xbox 360: Console - IPv4 preferred and requires the Microsoft 'custom STUN and security implementation." - Xbox One: Console - IPv6 preferred - Native IPv6+IPSec - Requires unsolicited inbound IPSec and IKEv2 - "Disables firewall capabilities if one exists" - UPNP+... - IPv4 preferred or no IPv6 = [IPv6+IPSec]+Teredo - Teredo is only necessary for Xbox Live party chat and multiplayer - Within the tunnel, it requires unsolicited inbound IPSec and IKEv2 - UDP long port mapping refresh intervals (60 seconds+) to avoid losing connections to xbox peers - Uses UPNP to "Disables firewall capabilities if one exists" - If NAT exists, here is the most successful strategy, left to right: - Open to the Internet > Address Restricted > Port Restricted > Symmetric > UDP Block - Teredo prefers UDP port 3074 vs. UDP port 3544 - XBOX - Windows 10 - Teredo is only necessary for Xbox Live party chat and multiplayer - Most common error: “Teredo is unable to qualify” https://support.xbox.com/en-US/xbox-on-windows/social/troubleshoot-party-cha... - If a third party firewall is installed, good chance it is blocking teredo outbound ports or the Windows10 teredo is disabled. Hope this helps... And don't ask about the security --- It's "good enough for home users" :( Joe Klein "inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1) PGP Fingerprint: 295E 2691 F377 C87D 2841 00C1 4174 FEDF 8ECF 0CC8 On Tue, Jan 2, 2018 at 6:19 PM, Mark Andrews <marka@isc.org> wrote:
Time to buy a Xbox for the NOC so you can trouble shoot. All puns intended.
Mark
On 3 Jan 2018, at 10:15 am, Justin Wilson <lists@mtin.net> wrote:
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe.
Justin Wilson j2sw@mtin.net
www.mtin.net www.midwest-ix.com
On Jan 2, 2018, at 6:06 PM, Chris Adams <cma@cmadams.net> wrote:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses
Once upon a time, Mark Andrews <marka@isc.org> said: that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support IPv6, while the Xbox One does (but neither would explain the Teredo). -- Chris Adams <cma@cmadams.net>
-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
Small clarification: "- Teredo prefers UDP port 3074 vs. UDP port 3544" On Xbox One, the Teredo client is bound to UDP 3074 as the default and communicates to the Teredo servers on the standard Teredo port, UDP 3544. If UPnP is in play and an Xbox console attempts to port map UDP 3074 and receives a mapping conflict error from the gateway, the console will fall back to a pseudo-random port in the ephemeral range. We also introduced an update last year where customers could also manually configure the console to use a non-3074 port in case UPnP wasn't enabled on the local network and multiple consoles are present. -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Joe Klein Sent: Tuesday, January 2, 2018 4:13 PM To: Mark Andrews <marka@isc.org> Cc: NANOG list <nanog@nanog.org> Subject: Re: Xbox Live and Teredo Are you aware: - Microsofts justification for Teredo is to support P2P during the transition to IPv6 dominant networks. - Xbox 360: Console - IPv4 preferred and requires the Microsoft 'custom STUN and security implementation." - Xbox One: Console - IPv6 preferred - Native IPv6+IPSec - Requires unsolicited inbound IPSec and IKEv2 - "Disables firewall capabilities if one exists" - UPNP+... - IPv4 preferred or no IPv6 = [IPv6+IPSec]+Teredo - Teredo is only necessary for Xbox Live party chat and multiplayer - Within the tunnel, it requires unsolicited inbound IPSec and IKEv2 - UDP long port mapping refresh intervals (60 seconds+) to avoid losing connections to xbox peers - Uses UPNP to "Disables firewall capabilities if one exists" - If NAT exists, here is the most successful strategy, left to right: - Open to the Internet > Address Restricted > Port Restricted > Symmetric > UDP Block - Teredo prefers UDP port 3074 vs. UDP port 3544 - XBOX - Windows 10 - Teredo is only necessary for Xbox Live party chat and multiplayer - Most common error: “Teredo is unable to qualify” https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.xbox.com%2Fen-US%2Fxbox-on-windows%2Fsocial%2Ftroubleshoot-party-chat&data=02%7C01%7Cdveit%40microsoft.com%7C65a1a83fad664db4ea6308d5523ef9e9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636505352789854753&sdata=ArbsmYbrIPFlVG2ydBCw0jBa8m6WHyZirDT2Rgz7a1A%3D&reserved=0 - If a third party firewall is installed, good chance it is blocking teredo outbound ports or the Windows10 teredo is disabled. Hope this helps... And don't ask about the security --- It's "good enough for home users" :( Joe Klein "inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1) PGP Fingerprint: 295E 2691 F377 C87D 2841 00C1 4174 FEDF 8ECF 0CC8 On Tue, Jan 2, 2018 at 6:19 PM, Mark Andrews <marka@isc.org> wrote:
Time to buy a Xbox for the NOC so you can trouble shoot. All puns intended.
Mark
On 3 Jan 2018, at 10:15 am, Justin Wilson <lists@mtin.net> wrote:
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe.
Justin Wilson j2sw@mtin.net
https://na01.safelinks.protection.outlook.com/?url=www.mtin.net&data =02%7C01%7Cdveit%40microsoft.com%7C65a1a83fad664db4ea6308d5523ef9e9% 7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636505352789854753&sdat a=P6GoT4YSwbQ%2FT9guweaTf25wy7J77UkoZqqGBiFXkVo%3D&reserved=0 https://na01.safelinks.protection.outlook.com/?url=www.midwest-ix.co m&data=02%7C01%7Cdveit%40microsoft.com%7C65a1a83fad664db4ea6308d5523 ef9e9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63650535278985475 3&sdata=uCDl6dWK8vXzCOKkui0LV3RHwhEa8GRzj31xOGSKfXs%3D&reserved=0
On Jan 2, 2018, at 6:06 PM, Chris Adams <cma@cmadams.net> wrote:
Once upon a time, Mark Andrews <marka@isc.org> said:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support IPv6, while the Xbox One does (but neither would explain the Teredo). -- Chris Adams <cma@cmadams.net>
-- Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org
Hey, Justin. I'll ping you offline to take a closer look. For others on the list, Xbox One uses Teredo for IPv4 P2P NAT traversal for multiplayer and chat. If the consoles are unable to communicate with Teredo servers to generate a Teredo IPv6 address and detect the NAT type that is present, that can cause issues joining multiplayer games and Party Chat sessions. -----Original Message----- From: NANOG [mailto:nanog-bounces@nanog.org] On Behalf Of Justin Wilson Sent: Tuesday, January 2, 2018 3:15 PM To: NANOG list <nanog@nanog.org> Subject: Re: Xbox Live and Teredo These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe. Justin Wilson j2sw@mtin.net https://na01.safelinks.protection.outlook.com/?url=www.mtin.net&data=02%7C01%7Cdveit%40microsoft.com%7C991c6b77eb124e576dd808d55236e511%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636505318085908776&sdata=q5nSKZiUbB0K5VvmN2bcOJ%2Fi9OuRVFFyL%2BaqX7uea24%3D&reserved=0 https://na01.safelinks.protection.outlook.com/?url=www.midwest-ix.com&data=02%7C01%7Cdveit%40microsoft.com%7C991c6b77eb124e576dd808d55236e511%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636505318085908776&sdata=leIx4fqr1OZfXXn1Z3wPWDigni6pLuV3h7JqwIA1%2Bxs%3D&reserved=0
On Jan 2, 2018, at 6:06 PM, Chris Adams <cma@cmadams.net> wrote:
Once upon a time, Mark Andrews <marka@isc.org> said:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support IPv6, while the Xbox One does (but neither would explain the Teredo). -- Chris Adams <cma@cmadams.net>
On 02/01/18 23:15, Justin Wilson wrote:
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe.
Disabling anything IPv6 is counter productive. The way things are going is IPv6 and has been for many years. Now ... what could happen is that you've got a missconfigured torredo gateway upstream. Disabling IPv6 on customer routers etc won't solve your problem. IPv6 is here to stay. Your best bet: set up a Terredo gateway and facilitate these Xboxes as long as you don't give them native IPv6. Just my 2c. Kind regards, Martin List-Petersen -- Airwire Ltd. - Ag Nascadh Pobail an Iarthair http://www.airwire.ie Phone: 091-865 968 Registered Office: Moy, Kinvara, Co. Galway, 091-865 968 - Registered in Ireland No. 508961
While you are at it, you might want to configure a STUN and ICE server, to address streaming UDP. Joe Klein "inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1) PGP Fingerprint: 295E 2691 F377 C87D 2841 00C1 4174 FEDF 8ECF 0CC8 On Tue, Jan 2, 2018 at 10:19 PM, Martin List-Petersen <martin@airwire.ie> wrote:
On 02/01/18 23:15, Justin Wilson wrote:
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe.
Disabling anything IPv6 is counter productive. The way things are going is IPv6 and has been for many years.
Now ... what could happen is that you've got a missconfigured torredo gateway upstream.
Disabling IPv6 on customer routers etc won't solve your problem. IPv6 is here to stay.
Your best bet: set up a Terredo gateway and facilitate these Xboxes as long as you don't give them native IPv6.
Just my 2c.
Kind regards, Martin List-Petersen -- Airwire Ltd. - Ag Nascadh Pobail an Iarthair http://www.airwire.ie Phone: 091-865 968 Registered Office: Moy, Kinvara, Co. Galway, 091-865 968 - Registered in Ireland No. 508961
* Martin List-Petersen <martin@airwire.ie>
Your best bet: set up a Terredo gateway and facilitate these Xboxes as long as you don't give them native IPv6.
This is unlikely to help, as the XB1 doesn't use Teredo relays at all. The XB1 uses Teredo to facilitate direct p2p communication between IPv4 consoles only. Essentially it is used an IPv4 NAT traversal mechanism. Its Teredo implementation does not allow communication between IPv4 and IPv6 peers. This is the only communication pattern which would normally require a third-party Teredo relay. This unfortunately also means that provisioning IPv6 is also unlikely to help, unless you're in a position to provision it to both peers. See: https://www.ietf.org/proceedings/88/slides/slides-88-v6ops-0.pdf Personally I'd start out by verifying the connectivity to and functionality of Microsoft's Teredo servers, which are used for NAT address discovery and port mapping during tunnel setup (unlike Teredo relays, Teredo servers aren't part of the Teredo «forwarding plane»). Tore
participants (7)
-
Chris Adams -
Darrin Veit -
Joe Klein -
Justin Wilson -
Mark Andrews -
Martin List-Petersen -
Tore Anderson