IPv6 Addressing: SLAAC and DHCPv6

Module Objectives

• The module focuses on SLAAC and DHCPv6 for IPv6 networks
• The objective is to configure dynamic address allocation in IPv6 networks
• IPv6 Global Unicast Address Assignment explains how an IPv6 host acquires its IPv6 configuration
• SLAAC explains the operation of SLAAC
• DHCPv6 explains the operation of DHCPv6
• The module also covers how to configure a stateful and stateless DHCPv6 server

IPv6 Global Unicast Address (GUA)

• On a router, IPv6 GUAs are manually configured using the ipv6 address ipv6-address/prefix-length interface configuration command
• Windows hosts can also be manually configured with a GUA
• Manually entering a GUA can be time-consuming and error prone
• Most Windows hosts are enabled to dynamically acquire an IPv6 GUA

IPv6 Host Link-Local Address and RA messages

• With automatic IPv6 addressing, hosts use ICMPv6 Router Advertisement (RA) messages
• RAs helps autoconfigure an IPv6 configuration
• The IPv6 link-local address is automatically created when the host boots and the Ethernet interface is active
• A Zone ID/Scope ID is the "%" and number at the end of the link-local address, used by the OS to associate the LLA with a specific interface
• DHCPv6 is defined in RFC 3315

IPv6 GUA Assignment and how to Acquire them.

• IPv6-enabled routers periodically send ICMPv6 RAs by default
• This simplifies how a host can dynamically aquire it's IPv6 configuration
• A host can dynamically be assigned a GUA using stateless and stateful services
• All methods use ICMPv6 RA messages to suggest how to create or acquire an IPv6 configuration
• Despite these suggestions, the final decision rests with the host

Router Advertisement (RA) Message Flags

• The method a client uses to obtain an IPv6 GUA depends on settings in the RA message, which includes three flags:
• A flag(Address Autoconfiguration): Signifies to use SLAAC to create an IPv6 GUA
• O flag (Other Configuration): Signifies that additional information is available from a stateless DHCPv6 server
• M flag (Managed Address Configuration): Signifies to use a stateful DHCPv6 server to obtain an IPv6 GUA
• Using diverse combinations of the A, O, and M flags, RA messages signal dynamic options to the host

SLAAC Overview

• SLAAC enables hosts to create unique IPv6 global unicast addresses without DHCPv6
• SLAAC is a stateless service, meaning no server maintains network address information
• SLAAC sends periodic ICMPv6 RA messages every 200 seconds
• RA messages provide addressing and other configuration information for hosts to autoconfigure their IPv6 address based on the RA
• Hosts can send Router Solicitation (RS) messages to request an RA
• SLAAC can be deployed alone or with DHCPv6

Enabling SLAAC

• R1 G0/0/1 has been configured with the indicated IPv6 GUA and link-local addresses
• R1 G0/0/01 IPv6 addresses include:
  • Link-local IPv6 address - fe80::1
  • GUA / subnet - 2001:db8:acad:1::1, 2001:db8:acad:1::/64
  • IPv6 all-nodes group - ff02::1
• R1 is configured to join the all IPv6 multicast group and start sending RA messages for hosts using SLAAC

Enabling SLAAC (Cont.)

• The IPv6 all-routers group responds to the IPv6 multicast address ff02::2
• show ipv6 interface command verifies that R1 has joined the IPv6 all-routers group (ff02::2)
• R1 begins sending RA messages every 200 seconds to the IPv6 all-nodes multicast address ff02::1

SLAAC Only Method

• RA messages from R1 have the following flags set:
  • A = 1: Informs the client to use the IPv6 GUA prefix in the RA and dynamically create its own Interface ID
  • O = 0 and M = 0: Informs the client to also use additional information in the RA message (DNS server, MTU, default gateway information)
• The ipconfig Windows command confirms that PC1 generated an IPv6 GUS using the R1 RA
• The default gateway address is the LLA of the R1 G0/0/1 interface

ICMPv6 RS (Router Solicitation) Messages

• A router sends RA messages every 200 seconds or when it receives an RS message from a host
  • IPv6 enabled hosts send an RS message to the IPv6 all-routers multicast address of ff02::2 to obtain IPv6 addressing

SLAAC Host Process to Generate Interface ID

• A host gets it's 64-bit IPv6 subnet information from the router RA
• It must generate the remaining 64-bit interface identifier (ID) using either:
  • Randomly generated: The 64-bit interface ID is randomly generated by the client operating system. This method is used by Windows 10 hosts
  • EUI-64: The host creates an interface ID using its 48-bit MAC address and inserts the hex value of fffe in the middle of the address.
• Note: Windows, Linux, and Mac OS allow for the user to modify the generation of the Interface ID to be either randomly generated or to use EUI-64

SLAAC Duplicate Address Detection (DAD)

• To ensure IPv6 GUA uniqueness, a SLAAC host uses DAD
  • The host sends an ICMPv6 Neighbor Solicitation (NS) message with a specially constructed solicited-node multicast address containing the last 24 bits of the host's IPv6 address
  • If no other devices respond with a Neighbor Advertisement (NA) message, the address is virtually guaranteed to be unique
  • Receiving an NA means the address is not unique, prompting the host to generate a new interface ID
• Note: DAD may not be required, but the IETF recommends it
• Most operating systems perform DAD on all IPv6 unicast addresses, regardless of configuration

DHCPv6 Operation Steps

• Stateful DHCPv6 does not require SLAAC while stateless DHCPv6 does
• When an RA indicates to use either DHCPv6 or stateful DHCPv6:
  • The host initiates communication by sending an RS message
  • The router responds, dispatching an RA message
  • Progressing in setup, the host sends a DHCPv6 SOLICIT message
  • The DHCPv6 server responds to this, sending an ADVERTISE message
  • The host then responds back to the DHCPv6 server
  • Establishing connection, the DHCPv6 server concludes with a REPLY message
• Server to client DHCPv6 messages use UDP destination port 546 and client to server use UDP destination port 547

DHCPv6 Stateless Operation

• With an RA that signals the stateless DHCPv6 method, a host uses the RA's addressing but needs additional information
  • Note: The DHCPv6 server sends configuration parameters for clients, but doesn't keep any IPv6 address list
• PC1, for example, might get a stateless RA message that contains:
  • The IPv6 GUA network prefix and prefix length
  • It has a flag set to 1 to inform the host to use SLAAC
  • It has and O flag set to 1 to seek that additional configuration information from a DHCPv6 server
  • It has an M flag set with the default value of 0
• Then, PC1 sends a DHCPv6 SOLICIT message to seek additional information from a stateless DHCPv6 server

Enabling Stateless DHCPv6 on an interface

• Stateless DHCPv6 is enabled using the ipv6 nd other-config-flag interface configuration command, which sets the O flag to 1
• The highlighted output means that the RA will tell receiving hosts to use stateless autoconfigure (A flag = 1) and contact a DHCPv6 server to get another configuration information (O flag = 1)
  • no ipv6 nd other-config-flag can reset the interface to SLAAC only

Stateful DHCPv6 Operation

• Given that an RA signifies stateful DHCPv6, the host consults with a DHCPv6 server for all setup information
  • Note: The DHCPv6 server is stateful and maintains a list of IPv6 address bindings
• For example, PC1 gets a stateful RA message that contains:
  • The IPv6 GUA network prefix and prefix length
  • A flag set to 0: It informs the host to contact a DHCPv6 server
  • O flag set to 0: This informs the host to also contact a DHCPv6 server
  • And, lastly, M flag set to the value 1
• PC1 sends a DHCPv6 SOLICIT message in seeking further information from a stateful DHCPv6 server

Enabling Stateful DHCPv6 on an Interface

• To enable Stateful DHCPv6, use the ipv6 nd managed-config-flag interface configuration command, setting the M flag to 1
• Highlighted output confirms that the RA will tell all the host to obtain all IPv6 configuration information from a DHCPv6 server (M flag = 1)

DHCPv6 Roles for Routers

• Cisco IOS routers have the strength to provide DHCPv6 services on their own
• They can act as DHCPv6 servers, clients, or relay agents.
• Can be configured in one of the following ways:
  • DHCPv6 Server - Offers stateless or stateful DHCPv6 services
  • DHCPv6 Client - Recieves IP setup from a DHCPv6 server on a router interface.
  • DHCPv6 Relay Agent - Provides DHCPv6 forwarding services for clients and servers on different networks

Configure a Stateless DHCPv6 Server

• Stateless DHCPv6 server function necessitates that the router disseminates the IPv6 network addressing details in RA messages
• Five steps to make it so:

  • Use the ipv6 unicast-routing command to enable IPv6 routing

  • The ipv6 dhcp pool POOL-NAME sets up a DHCPv6 pool name

  • Use dns-server X:X:X:X:X:X:X:X and domain-name name to set options for the DHCPv6 pool

  • Link a pool to the interface via the ipv6 dhcp server POOL-NAME command

    • (Important) The ipv6 nd other-config-flag command manually changes the O flag value sent in Router Advertisements. > Value '1' means devices obtain stateless information such as DNS information from DHCPv6

      Value '0' means that devices obtain all information needed from RA's. The A flag is set to '1' by default so clients will create thier own GUA.

  • Finally, use the ipconfig /all command to verify clients get the IPv6 details

Configure a Stateless DHCPv6 Client

• A router may function as both a DHCPv6 client and get IPv6 details from a DHCPv6 server, i.e., a DHCPv6-enabled router
  • To make this happen:
    • Using the ipv6 unicast-routing you can activate IPv6 routing
    • Setup a client router for LLA using the ipv6 enable command, either with or without a GUA setup
    • Use the ipv6 address autoconfig if you wish to use SLAAC
    • To verify a GUA has been made, use the show ipv6 interface brief
    • Lastly, make sure to use commands like the show ipv6 dhcp interface g0/0/1 which makes sure DNS and the domain name have been successfully implemented

Configure a Stateful DHCPv6 Server

• The stateful DHCP server necessitates that IPv6-enabled router be enabled to contact a DHCPv6 server to obtain all necessary IPv6 network addressing information
  • Important tips to keep in mind:
    • The command ipv6 unicast-routing enables IPv6 routing
    • To set a pool name, use the commmand ipv6 dhcp pool POOL-NAME
    • Use options during a DHCPv6 setup, i.e. address prefix
    • The pool can be connected to the interface using the command ipv6 dhcp server POOL-NAME
    • Keep in mind to use both these sets of commands

      ipv6 nd managed-config-flag which changes the 'M' flag on the RA message to tell clients to look for DHCPv6 ipv6 nd prefix default no-autoconfig to inform the client not to use SLAAC

Configuring a Stateful DHCPv6 Client

• A router must have IPv6 unicast-routing and local link-local (LLA) settings to send and gather IPv6 messages in addition to acting as a DHCPv6-based client,
  • Ensure the following steps are done:
    • Use ipv6 unicast-routing to turn on IPv6
    • To setup a client, use the command ipv6 enable with or without a GUA
    • You must also use the ipv6 address dhcp command to use DHCPv6 on a client router
    • Followed by basic GUA verifiction, using the show ipv6 interface brief command and making sure DHCPv6 information has been correctly passed across

DHCPv6 Server Verification Commands

• Use the show ipv6 dhcp pool to check DHCPv6 pool name and it's parameters, which should show active clients

DHCPv6 Server Verification Commands (cont.)

• To show IPv6 LLA, global unicast address, and what the server assigned, run the show ipv6 dhcp binding command
  • Stateful DHCPv6 servers maintain this data
  • Stateless DHCPv6 servers do not hold this information

Configuring a DHCPv6 Relay Agent.

• A Router (IPv6-configured) will have to act as the relay should the DHCP server be somewhere that clients can't reach
  • The configuration is similar to DHCPv4 setup on a relayer:
  • Use the code ipv6 dhcp relay destination ipv6-address [interface-type interface-number] to connect the client to DHCP server. Ensure the command is on the interface used by DHCPv6 clients

Verifying the DHCPv6 Relay Agent

• show ipv6 dhcp interface and show ipv6 dhcp binding will check the status of a IPv6 relayer in action, ensuring the client does indeed fetch IPv6 data when prompted