Figured the collective here might have an answer. All of a sudden a network I manage started getting complaints from XBOX live users are getting error messages about “Can’t get Teredo IP address” on their consoles. Is anyone else seeing this wide spread? The Microsoft support default answer is “Your ISP is blocking ports” when I can do an nmap on each of these customers and all of the xbox live ports are open. As an FYI these are not netted customers, but have true publics.
We have tried disabling IPV6 on their interfaces and that does not seem to have helped. We have had some customers power cycle everything in their home (CPE, router, xbox) and still no go.
Anyone else running into this? Does Microsoft have a higher level support for talking with ISPs at all?
Justin Wilson
j2sw@mtin.net
www.mtin.net
www.midwest-ix.com
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
Mark
Once upon a time, Mark Andrews <marka@isc.org> said:
Given that you have IPv6 I would be looking at why the XBOXs are attempting Teredo at all. I would expect them to use the IPv6 addresses that you are assigning your customers.
The OP didn't say what type of Xbox. IIRC the Xbox 360 does not support
IPv6, while the Xbox One does (but neither would explain the Teredo).
These are all Xbox one clients. We don’t hand out IPv6 on this network yet, so I made sure to disable any sort of IPV6 on the interfaces just to be sure because I figured Teredo is tied to v6. The only thing we have not done yet is disable any IPV6 stuff on the customer routers. Everyone has been getting link local addresses for the longest time. We just disabled ipv6 totally on the interfaces just to be safe.
Justin Wilson
j2sw@mtin.net
www.mtin.net
www.midwest-ix.com
Time to buy a Xbox for the NOC so you can trouble shoot. All puns intended.
Mark
Hey, Justin. I'll ping you offline to take a closer look. For others on the list, Xbox One uses Teredo for IPv4 P2P NAT traversal for multiplayer and chat. If the consoles are unable to communicate with Teredo servers to generate a Teredo IPv6 address and detect the NAT type that is present, that can cause issues joining multiplayer games and Party Chat sessions.
Are you aware:
- Microsofts justification for Teredo is to support P2P during the
transition to IPv6 dominant networks.
- Xbox 360: Console
- IPv4 preferred and requires the Microsoft 'custom STUN and security
implementation."
- Xbox One: Console
- IPv6 preferred - Native IPv6+IPSec
- Requires unsolicited inbound IPSec and IKEv2
- "Disables firewall capabilities if one exists" - UPNP+...
- IPv4 preferred or no IPv6 = [IPv6+IPSec]+Teredo
- Teredo is only necessary for Xbox Live party chat and multiplayer
- Within the tunnel, it requires unsolicited inbound IPSec and IKEv2
- UDP long port mapping refresh intervals (60 seconds+) to avoid
losing connections to xbox peers
- Uses UPNP to "Disables firewall capabilities if one exists"
- If NAT exists, here is the most successful strategy, left to right:
- Open to the Internet > Address Restricted > Port Restricted >
Symmetric > UDP Block
- Teredo prefers UDP port 3074 vs. UDP port 3544
- XBOX - Windows 10
- Teredo is only necessary for Xbox Live party chat and multiplayer
- Most common error: “Teredo is unable to qualify”
https://support.xbox.com/en-US/xbox-on-windows/social/troubleshoot-party-chat
- If a third party firewall is installed, good chance it is blocking
teredo outbound ports or the Windows10 teredo is disabled.
Hope this helps... And don't ask about the security --- It's "good enough
for home users" 
Joe Klein
"inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1)
PGP Fingerprint: 295E 2691 F377 C87D 2841 00C1 4174 FEDF 8ECF 0CC8
Disabling anything IPv6 is counter productive. The way things are going is IPv6 and has been for many years.
Now ... what could happen is that you've got a missconfigured torredo gateway upstream.
Disabling IPv6 on customer routers etc won't solve your problem. IPv6 is here to stay.
Your best bet: set up a Terredo gateway and facilitate these Xboxes as long as you don't give them native IPv6.
Just my 2c.
Kind regards,
Martin List-Petersen
While you are at it, you might want to configure a STUN and ICE server, to
address streaming UDP.
Joe Klein
"inveniet viam, aut faciet" --- Seneca's Hercules Furens (Act II, Scene 1)
PGP Fingerprint: 295E 2691 F377 C87D 2841 00C1 4174 FEDF 8ECF 0CC8
* Martin List-Petersen <martin@airwire.ie>
Your best bet: set up a Terredo gateway and facilitate these Xboxes as
long as you don't give them native IPv6.
This is unlikely to help, as the XB1 doesn't use Teredo relays at all.
The XB1 uses Teredo to facilitate direct p2p communication between IPv4
consoles only. Essentially it is used an IPv4 NAT traversal mechanism.
Its Teredo implementation does not allow communication between IPv4 and
IPv6 peers. This is the only communication pattern which would normally
require a third-party Teredo relay. This unfortunately also means that
provisioning IPv6 is also unlikely to help, unless you're in a position
to provision it to both peers.
See: https://www.ietf.org/proceedings/88/slides/slides-88-v6ops-0.pdf
Personally I'd start out by verifying the connectivity to and
functionality of Microsoft's Teredo servers, which are used for NAT
address discovery and port mapping during tunnel setup (unlike Teredo
relays, Teredo servers aren't part of the Teredo «forwarding plane»).
Tore
Small clarification:
"- Teredo prefers UDP port 3074 vs. UDP port 3544"
On Xbox One, the Teredo client is bound to UDP 3074 as the default and communicates to the Teredo servers on the standard Teredo port, UDP 3544. If UPnP is in play and an Xbox console attempts to port map UDP 3074 and receives a mapping conflict error from the gateway, the console will fall back to a pseudo-random port in the ephemeral range. We also introduced an update last year where customers could also manually configure the console to use a non-3074 port in case UPnP wasn't enabled on the local network and multiple consoles are present.