Workaround to not break IPv6 RA, ... is setting: FW_BOOT_FULL_INIT="yes" in /etc/sysconfig/SuSEfirewall2 (at least in SuSEfirewall2-3.6.312-3.3.noarch on leap-41.1).