Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

DHCPv6 Server

 

Junos OS device can act as a DHCPv6 server and allocates IP addresses to IPv6 clients. DHCPv6 server also delivers configuration settings to client hosts on a subnet or to the requesting devices that need an IPv6 prefix. The DHCPv6 local server sends and receives packets using the IPv6 protocol and informs IPv6 of the routing requirements of router clients. For more information, read this topic.

DHCPv6 Local Server Overview

The DHCPv6 local server is compatible with the DHCP local server and the DHCP relay agent, and can be enabled on the same interface as either the extended DHCP local server or DHCP relay agent.

The DHCPv6 local server provides many of the same features as the DHCP local server, including:

  • Configuration for a specific interface or for a group of interfaces

  • Site-specific usernames and passwords

  • Numbered Ethernet interfaces

  • Statically configured CoS and filters

  • AAA directed login

  • Use of the IA_NA option to assign a specific address to a client

When a DHCPv6 client logs in, the DHCPv6 local server can optionally use the AAA service framework to interact with the RADIUS server. The RADIUS server, which is configured independently of DHCP, authenticates the client and supplies the IPv6 prefix and client configuration parameters.

The client username, which uniquely identifies a subscriber or a DHCP client, must be present in the configuration in order for DHCPv6 local server to use RADIUS authentication.

You can configure DHCPv6 local server to communicate the following attributes to the AAA service framework and RADIUS at login time:

  • Client username

  • Client password

Based on the attributes that the DHCPv6 local server provides, RADIUS returns the information listed in Table 1 to configure the client:

Table 1: RADIUS Attributes and VSAs for DHCPv6 Local Server

Attribute Number

Attribute Name

Description

27

Session-Timeout

Lease time, in seconds. If not supplied, the lease does not expire

123

Delegated-IPv6-Prefix

Prefix that is delegated to the client

26-143

Max-Clients-Per-Interface

Maximum number of clients allowed per interface

To configure the extended DHCPv6 local server on the router (or switch), you include the dhcpv6 statement at the [edit system services dhcp-local-server] hierarchy level.

You can also include the dhcpv6 statement at the following hierarchy levels:

  • [edit logical-systems logical-system-name system services dhcp-local-server]

  • [edit logical-systems logical-system-name routing-instances routing-instance-name system services dhcp-local-server]

  • [edit routing-instances routing-instance-name system services dhcp-local-server]

DHCPv6 Server Overview

A Dynamic Host Configuration Protocol version 6 (DHCPv6) server can automatically allocate IP addresses to IPv6 clients and deliver configuration settings to client hosts on a subnet or to the requesting devices that need an IPv6 prefix. A DHCPv6 server allows network administrators to manage pool of IP addresses centrally among hosts and to automate the assignment of IP addresses in a network.

Note

SRX Series devices do not support DHCP client authentication. In a DHCPv6 deployment, security policies control access through the device for any DHCP client that has received an address and other attributes from the DHCPv6 server.

Some features include:

  • Configuration for a specific interface or a group of interfaces

  • Stateless address autoconfiguration (SLAAC)

  • Prefix delegation, including access-internal route installation

  • DHCPv6 server groups

The DHCPv6 server configuration usually consists of DHCPv6 options for clients, an IPv6 prefix, an address pool that contains IPv6 address ranges and options, and a security policy to allow DHCPv6 traffic. In a typical setup the provider Juniper Networks device is configured as an IPv6 prefix delegation server that assigns addresses to the customer edge device. The customer’s edge router then provides addresses to internal devices.

To configure DHCPv6 local server on a device, you include the DHCPv6 statement at the [edit system services dhcp-local-server] hierarchy level. You then create an address assignment pool for DHCPv6 that is configured in the [edit access address-assignment pool] hierarchy level using the family inet6 statement.

You can also include the dhcpv6 statement at the [edit routing-instances routing-instance-name system services dhcp-local-server] hierarchy.

Note

Existing DHCPv4 configurations in the [edit system services dhcp] hierarchy are not affected when you upgrade to Junos OS Release 10.4 from an earlier version or enable DHCPv6 server.

Example: Configuring DHCPv6 Server Options

This example shows how to configure DHCPv6 server options on SRX1500, SRX5400, SRX5600, and SRX5800 devices.

Requirements

Before you begin:

  • Determine the IPv6 address pool range.

  • Determine the IPv6 prefix. See the Understanding Address Books.

  • Determine the grace period, maximum lease time, or any custom options that should be applied to clients.

  • List the IP addresses that are available for the devices on your network; for example, DNS and SIP servers.

Overview

In this example, you set a default client limit as 100 for all DHCPv6 groups. You then create a group called my-group that contains at least one interface. In this case, the interface is ge-0/0/3.0. You set a range of interfaces using the upto command and set a custom client limit as 200 for group my-group that overrides the default limit. Finally, you configure interface ge-0/0/3.0 with IPv6 address 2001:db8:3001::1/64 and set router advertisement for interface ge-0/0/3.0. Starting with Junos OS Release 15.X49-D70 and Junos OS Release 17.3R1, you can add the option dynamic-server to dynamically support prefix and attributes that are updated by the WAN server.

Note

A DHCPv6 group must contain at least one interface.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

To configure DHCPv6 server options:

  1. Configure a DHCP local server.
  2. Set a default limit for all DHCPv6 groups.
  3. Specify a group name and interface.
  4. Set a range of interfaces.
  5. Set a custom client limit for the group.
  6. Configure an interface with an IPv6 address.
  7. Set router advertisement for the interface.

Results

From configuration mode, confirm your configuration by entering the show system services dhcp-local-server, show interfaces ge-0/0/3, and show protocols commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.

Verification

Confirm that the configuration is working properly.

Verifying DHCPv6 Local Server Configuration

Purpose

Verify that the client address bindings and statistics for the DHCPv6 local server have been configured

Action

From operational mode, enter the show dhcpv6 server binding command to display the address bindings in the client table on the DHCPv6 local server.

From operational mode, enter the show dhcpv6 server statistics command to display the DHCPv6 local server statistics.

  • clear dhcpv6 server bindings all command to clear all DHCPv6 local server bindings. You can clear all bindings or clear a specific interface, or routing instance.

  • clear dhcpv6 server statistics command to clear all DHCPv6 local server statistics.

Specifying the Address Pool for IPv6 Prefix Assignment

The DHCPv6 server configuration usually consists of DHCPv6 options for clients, an IPv6 prefix, an address pool that contains IPv6 address ranges and options, and a security policy to allow DHCPv6 traffic. In a typical setup, the provider Juniper Networks device is configured as an IPv6 prefix delegation server that assigns addresses to the customer edge device. The customer’s edge router then provides addresses to internal devices.

To configure DHCPv6 local server on a device, you include the DHCPv6 statement at the [edit system services dhcp-local-server] hierarchy level. You then create an address assignment pool for DHCPv6 that is configured in the [edit access address-assignment pool] hierarchy level using the family inet6 statement.

You can also include the dhcpv6 statement at the [edit routing-instances routing-instance-name system services dhcp-local-server] hierarchy.

Note

Existing DHCPv4 configurations in the [edit system services dhcp] hierarchy are not affected when you upgrade to Junos OS Release 10.4 from an earlier version or enable DHCPv6 server.

To configure the address pool for DHCPv6 local server:

  1. Set address-assignment pool name, family name, and prefix.
  2. Set range.

Specifying the Delegated Address Pool for IPv6 Prefix Assignment

You can explicitly specify a delegated address pool:

  • On routers—Subscriber management uses the pool to assign IPv6 prefixes for subscribers. You can specify the delegated address pool globally, for a specific group of interfaces, or for a particular interface.

  • On switches—DHCP management uses the pool to assign IPv6 prefixes for DHCP clients. You can specify the delegated address pool globally, for a specific group of interfaces, or for a particular interface.

Note

You can also use by Juniper Networks VSA 26-161 to specify the delegated address pool. The VSA-specified value always takes precedence over the delegated-address statement.

To configure the delegated address pool for DHCPv6 local server:

  1. Specify that you want to configure override options.
  2. Configure the delegated address pool.

Preventing Binding of Clients That Do Not Support Reconfigure Messages

The DHCPv6 client and server negotiate the use of reconfigure messages. When the client can accept reconfigure messages from the server, then the client includes the Reconfigure Accept option in both solicit and request messages sent to the server.

By default, the DHCPv6 server accepts solicit messages from clients regardless of whether they support reconfiguration. You can specify that the server require clients to accept reconfigure messages. In this case, the DHCPv6 server includes the Reconfigure Accept option in both advertise and reply messages when reconfiguration is configured for the client interface. Solicit messages from nonsupporting clients are discarded and the clients are not allowed to bind.

To configure the DHCPv6 local server to bind only clients that support client-initiated reconfiguration:

  • Specify strict reconfiguration.

    For all DHCPv6 clients:

    For only a particular group of DHCPv6 clients:

The show dhcpv6 server statistics command displays a count of solicit messages that the server has discarded.

Configuring DHCPv6 Rapid Commit (MX Series, EX Series)

You can configure the DHCPv6 local server to support the DHCPv6 Rapid Commit option (DHCPv6 option 14). When rapid commit is enabled, the server recognizes the Rapid Commit option in Solicit messages sent from the DHCPv6 client. (DHCPv6 clients are configured separately to include the DHCPv6 Rapid Commit option in the Solicit messages.) The server and client then use a two-message exchange (Solicit and Reply) to configure clients, rather than the default four-message exchange (Solicit, Advertise, Request, and Reply). The two-message exchange provides faster client configuration, and is beneficial in environments in which networks are under a heavy load.

You can configure the DHCPv6 local server to support the Rapid Commit option globally, for a specific group, or for a specific interface. By default, rapid commit support is disabled on the DHCPv6 local server.

To configure the DHCPv6 local server to support the DHCPv6 Rapid Commit option:

  1. Specify that you want to configure the overrides options:
  2. Enable rapid commit support:

Allow Host Inbound Traffic for DHCPv6 Traffic

For the DHCPv6 server to allow DHCPv6 requests, you must configure host inbound traffic system services to allow DCHPv6 traffic. In this example, the zone my-zone allows DHCPv6 traffic from the zone untrust, and the ge-0/0/3.0 interface is configured with the IPv6 address 2001:db8:3001::1.

To create a security zone policy to allow DHCPv6 on SRX1500, SRX5400, SRX5600, and SRX5800 devices:

  1. Create the zone and add an interface to that zone.
  2. Configure host inbound traffic system services to allow DCHPv6.
  3. If you are done configuring the device, enter commit from configuration mode.

Verifying and Managing DHCPv6 Local Server Configuration

Purpose

View or clear information about client address bindings and statistics for the DHCPv6 local server.

Action

  • To display the address bindings in the client table on the DHCPv6 local server:

  • To display DHCPv6 local server statistics:

  • To clear all DHCPv6 local server statistics:

  • To clear all DHCPv6 local server statistics:

Understanding Cascaded DHCPv6 Prefix Delegating

You can use DHCPv6 client prefix delegation to automate the delegation of IPv6 prefixes to the customer premises equipment (CPE). With prefix delegation, a delegating device delegates IPv6 prefixes to a requesting device. The requesting device then uses the prefixes to assign global IPv6 addresses to the devices on the subscriber LAN. The requesting device can also assign subnet addresses to subnets on the LAN.

With cascaded prefix delegation, the IPv6 address block is delegated to a DHCPv6 client that is running on the WAN interface of a customer edge device. The identity association (IA) for the client is used for the identity association for prefix delegation (IA_PD). The CE device requests, through DHCPv6, an IPv6 address with the IA type of nontemporary addresses (IA_NA). Both IA_PD and IA_NA are requesting in the same DHCPv6 exchange.

Figure 1: IPv6 Prefix Delegation
IPv6 Prefix Delegation

The topology in Figure 1shows an SRX Series device acting as the CPE. The WAN interface links to the provider edge (PE) device and the LAN interfaces link to the customer networks. The service provider delegates a prefix (delegated-prefix) and an IPv6 address (cpe-wan-ipv6-address) to a DHCPv6 client. When a requesting device receives that IPv6 address through the DHCPv6 client, the device must install the IPv6 address on its WAN interface. The DHCPv6 client then divides the delegated prefix into sub-prefixes and subsequently assigns them to the connected LAN interfaces of the CPE device, making some subset of the remaining space available for sub-prefix delegation.

A CPE assigns sub-prefixes to its LAN interfaces and broadcasts the sub-prefixes through device advertisement. In this scenario, the CPE acts as a sub-PE and delegates sub-prefixes and assigns them to sub-CPEs.

Note

The requirements of sub-prefix delegation are the same as for the prefix delegation defined in RFC 3769.

Figure 2: Sub-prefix Delegation
Sub-prefix Delegation

There can be multi-level sub prefix delegations, see Figure 2. The top level CPE gets a delegated prefix from the PE and delegates the sub prefixes to second level sub-CPEs, then to the third level sub-CPEs, and finally to the end levels. The end level sub-CPEs assign the IPv6 address to end hosts through SLAAC, stateless DHCPv6 or stateful DHCPv6. This is called cascaded prefix delegating.

Example - Configuring DHCPv6 Prefix Delegation (PD) over Point-to-Point Protocol over Ethernet (PPPoE)

This example shows how to configure DHCPv6 PD over PPPoE on SRX Series devices.

Requirements

No special configuration beyond the device initialization is required before configuring this feature.

Overview

The example uses SRX550M devices for configuring DHCPv6 PD over PPPoE. Before you begin, configure DHCPv6 server to permit in host-inbound traffic and receive DHCPv6 packet. Provide a host-name to establish PPPoE session. To enable IPv6, chassis reboot is required.

Configuring DHCPv6 PD over PPPoE involves the following configurations:

  • Configuring DHCPv6 Server

  • DHCPv6 Client (PD)

  • DHCPv6 Client (Auto)

Topology

The following illustration describes DHCPv6 PD over PPPoE topology which provide a configuration suite using SRX Series devices.

Figure 3 shows the topology used in this example.

Figure 3: Configuring SRX Series Devices for DHCPv6 PD over PPPoE
Configuring
SRX Series Devices for DHCPv6 PD over PPPoE

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Quick configuration for DHCPv6 Server:

  • DHCPv6 server configuration

  • PPPoE configuration

  • Router advertisement configuration

  • Enable IPv6

  • PPPoE profile configuration

  • PD address pool configuration

  • Security zone configuration

Quick configuration for DHCPv6 Client (PD):

  • DHCPv6 server configuration

  • PPPoE configuration

  • DHCPv6 client configuration

  • Enable IPv6

  • DHCPv6 server propagate configuration

  • Security zone configuration

Quick configuration for DHCPv6 Client (Auto):

  • DHCPv6 client configuration

  • Router advertisement configuration

  • Enable IPv6

  • Security zone configuration

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode in the CLI User Guide.

  1. To configure DHCPv6 server on SRX550M device:
    1. Set the interface.

    2. Configure a DHCP local server.

    3. Set a default limit for all DHCPv6 groups.

    4. Set a custom client limit for the group.

    5. Specify delegated pool name.

    6. Create a group called my-group that contains pp0 interface.

  2. Configuring PPPoE:
    1. Set interface to encapsulate PPPoE.

    2. Set chap access profile value.

    3. Set underlying interface name.

    4. Set PPPoE-options server.

    5. Set family name and address.

  3. Configuring Router advertisement:
    1. Set max advertisement interval limit.

    2. Set minimum advertisement interval limit.

    3. Set the configuration state to managed configuration.

    4. Set the configuration state to other stateful configuration.

    5. Set the prefix value.

  4. Enable IPv6:
    1. Set the family name and mode to enable IPv6.

  5. Configuring PPPoE profile:
    1. Set access profile name, client name and chap secret.

  6. Configuring PD address pool:
    1. Set address-assignment pool name, family name and prefix.

    2. Set range and prefix length.

    3. Set dhcp attributes with dns server value.

  7. Configuring Security zone:
    1. Set the zone name, interface and host-inbound-traffic system-services.

Step-by-Step Procedure

  1. To configure DHCPv6 client (PD) on SRX550M device:
    1. Set the interface.

    2. Set DHCPv6 local server to override the interface client limit.

    3. Set the process-inform pool name.

    4. Set group name and interface.

  2. Configuring PPPoE:
    1. Set the interface to encapsulate ppp over ethernet.

    2. Set default chap secret.

    3. Set chap local name.

    4. Set PPP options chap state.

    5. Set underlying-interface.

    6. Set pppoe-options.

  3. Configuring DHCPv6 client:
    1. Set the family name and dhcpv6 client type.

    2. Set the dhcpv6 client identity association type.

    3. Set update-router-advertisement interface and other stateful-configuration.

    4. Set maximum advertisement interval value.

    5. Set minimum advertisement interval value.

    6. Set client-identifier duid type.

    7. Set requested option for DHCPv6 client.

    8. Update the server.

    9. Set the protocols and the interface.

  4. Enable IPv6
    1. Set the family name and mode to enable IPv6.

  5. Configuring DHCPv6 server to propagate DNS server information to end device:
    1. Set address assignment pool name, family name and prefix.

    2. Set the interface name for propagating TCP/IP settings to pool.

  6. Configuring security zone:
    1. Set the zone name, untrust interface and system services.

    2. Set the trust interface.

Step-by-Step Procedure

  1. To configure DHCPv6 client (Auto) on SRX550M device:
    1. Set the interface, unit value, family name and DHCPv6 client type.

    2. Set Dhcpv6 client identity association type.

    3. Set client-identifier type.

    4. Set DHCPV6 client requested option.

  2. Configuring router advertisement:
    1. Set the protocol and interface.

  3. Enable IPv6.
    1. Set family name and mode.

  4. Configuring security zone:
  5. Set the zone name, trust interface and system services.

Results

  • Result for DHCPv6 Server:

From configuration mode, confirm your configuration by entering the show system services dhcp-local-server, show interfaces, show protocols, show security forwarding-options, show access profile prof-ge001, show access address-assignment pool, and show security zones commands. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

  • Result for DHCPv6 Client (PD):

  • Result for DHCPv6 Client (Auto):

Verification

Confirm that the configuration is working properly.

Verifying DHCPv6 Server Configuration

Purpose

Verify that the DHCPv6 Server has been configured.

Action

  • From operational mode, enter the show dhcpv6 server binding command.

    The following output shows the options for the show dhcpv6 server binding command.

  • From operational mode, enter the show route table inet6.0 command.

    The following output shows the options for the show route table inet6.0 command.

  • From operational mode, enter the show interfaces pp0.0 terse command.

    The following output shows the options for the show interfaces pp0.0 terse command.

Verifying DHCPv6 Client (PD) Configuration

Purpose

Verify that the DHCPv6 Client (PD) has been configured.

Action

  • From operational mode, enter the show dhcpv6 client binding detail command.

    The following output shows the options for the show dhcpv6 client binding detail command.

  • From operational mode, enter the show dhcpv6 server binding detail command.

    The following output shows the options for the show dhcpv6 server binding detail command.

  • From operational mode, enter the show route table inet6.0 command.

    The following output shows the options for the show route table inet6.0 command.

  • From operational mode, enter the show interfaces pp0.0 terse command.

    The following output shows the options for the show interfaces pp0.0 terse command.

  • From operational mode, enter the show interfaces ge-0/0/2.0 terse command.

    The following output shows the options for the show interfaces ge-0/0/2.0 terse command.

  • From operational mode, enter the show ipv6 router-advertisement command.

    The following output shows the options for the show ipv6 router-advertisement command.

Verifying DHCPv6 client (Auto) Configuration

Purpose

Verify that the DHCPv6 client (Auto) has been configured.

Action

  • From operational mode, enter the show dhcpv6 client binding detail command.

    The following output shows the options for the show dhcpv6 client binding detail command.

  • From operational mode, enter the show route table inet6.0 command.

    The following output shows the options for the show route table inet6.0 command.

  • From operational mode, enter the show ipv6 router-advertisement command.

    The following output shows the options for the show ipv6 router-advertisement command.

Release History Table
Release
Description
Starting with Junos OS Release 15.X49-D70 and Junos OS Release 17.3R1, you can add the option dynamic-server to dynamically support prefix and attributes that are updated by the WAN server.