Okta Access Gateway Generates IPv6 Duplicate Address Detection Failure Logs

Okta Access Gateway (OAG) generates excessive IPv6 warning logs when administrators disable IPv6 at the kernel level but leave it enabled on the network interface. Administrators can resolve this issue by upgrading to Okta Access Gateway version 2024.9.2 or later, or by commenting out the IPv6 options in the network interface configuration file and restarting the network service. When this issue occurs, Okta Access Gateway generates the following warning logs, though it does not cause functional issues.

2023-06-02T07:07:41.992-07:00 okta-worker.lab NetworkManager <warn> [1685714861.9918] platform-linux: do-add-ip6-address[2: fe80::88b:aff:feee:dfb5]: failure 13 (Permission denied)

2023-06-02T07:07:43.990-07:00 okta-worker.lab NetworkManager <warn> [1685714863.9907] ipv6ll[b57e3b17062b91ed,ifindex=2]: changed: no IPv6 link local address to retry after Duplicate Address Detection failures (back off)

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG)

Okta Access Gateway generates these logs because administrators disabled IPv6 at the kernel level but left it enabled in the network interface configuration.

How does an administrator stop the IPv6 duplicate address detection failure logs in Okta Access Gateway?

Upgrade Okta Access Gateway to version 2024.9.2 or later to resolve the excessive IPv6 warning logs. If upgrading is not possible, access the management console shell, verify the kernel configuration, disable the IPv6 options in the network interface configuration file, and restart the network service.

1. Sign in to the management console shell.
2. Check the configuration at the kernel level.

   sudo sysctl -p | grep ipv6

• NOTE: Okta Access Gateway displays a value of 1 if IPv6 is disabled at the kernel level, as shown in the following example.

  net.ipv6.conf.all.disable_ipv6 = 1
  net.ipv6.conf.default.disable_ipv6 = 1

3. Check the interface configuration file for IPv6 options.

   cat /etc/sysconfig/network-scripts/ifcfg-eth0

4. Open the file in an editor and comment out the IPv6 entries by adding a # at the beginning of the line.

   sudo vi /etc/sysconfig/network-scripts/ifcfg-eth0

5. Restart the network service.

   sudo systemctl restart NetworkManager

6. Validate that the logs no longer appear.

   sudo tail -F /opt/oag/logs/all/ics_all.log