DHCPv6 — stateful vs stateless, IA_NA, IA_PD, RDNSS

IPv6 has three address-assignment mechanisms and they coexist:

• SLAAC — the host autoconfigure its own address from an RA-advertised prefix. Stateless. No server tracks hosts.
• Stateless DHCPv6 — RA gives the prefix (SLAAC provides the address); DHCPv6 provides other configuration (DNS, NTP, SIP). The server does not track hosts.
• Stateful DHCPv6 — RA says “use DHCPv6 for address” (M=1); DHCPv6 provides the address and any other configuration. The server tracks each lease.

Prefix delegation is the fourth role DHCPv6 plays: the upstream hands the downstream a prefix to subnet. That is separate from address assignment and uses IA_PD instead of IA_NA.

A production routing engineer must operate all three roles. The lesson walks through the message structure, the server configuration on VyOS, the relay configuration when the server is on a different segment, and the failure modes that surface when DHCPv6 silently fails.

The DHCPv6 message flow

sequenceDiagram
  autonumber
  participant H as Host
  participant S as Server
  participant U as Upstream
  participant D as Downstream

  H->>S: Solicit (UDP 547 -> 547 multicast)
  S-->>H: Advertise (unicast)
  H->>S: Request (unicast)
  S-->>H: Reply (unicast) with IA_NA<br/>assigning 2001:db8:1::50<br/>valid-lifetime 86400

  U->>S: Solicit with IA_PD request
  S-->>U: Advertise with IA_PD 2001:db8:abcd::/48
  U->>S: Request
  S-->>U: Reply with IA_PD 2001:db8:abcd::/48
  Note over U: carves 2001:db8:abcd:0::/64 for LAN1<br/>2001:db8:abcd:1::/64 for LAN2

  D->>S: Solicit (via relay on different segment)
  Note over S: relay adds link-address and peer-address
  S-->>D: Reply via relay

DHCPv6 uses UDP port 547 (clients listen on 547, server uses 547). The Solicit / Advertise / Request / Reply exchange is the same shape as DHCPv4 with different terminology. The big differences:

• DHCPv6 uses UDP, not TCP, for the lease.
• DHCPv6 messages are unicast or multicast (no broadcast).
• DHCPv6 carries options as TLV-encoded structures, not the DHCPv4-style option code: value strings.

Three deployment modes

flowchart TB
  subgraph Modes["DHCPv6 deployment modes"]
    S1["SLAAC only<br/>M=0 O=0 in RA<br/>no DHCPv6 needed"]
    S2["SLAAC + Stateless DHCPv6<br/>M=0 O=1<br/>DHCPv6 for DNS / NTP only<br/>addresses via SLAAC"]
    S3["Stateful DHCPv6<br/>M=1<br/>DHCPv6 for address and other config"]
    S4["Prefix delegation<br/>upstream grants /48 or /56<br/>downstream carves /64s"]
  end

SLAAC-only is the simplest deployment: the RA carries the prefix and hosts autoconfigure. Stateless DHCPv6 is the typical “give me DNS” pattern: the RA carries the prefix and the DHCPv6 server returns DNS servers. Stateful DHCPv6 is the “track every lease” pattern for sites that need accounting or a fixed-IP-per-MAC map. Prefix delegation is the broadband CPE pattern: the upstream gives the CPE a /48 or /56 and the CPE carves /64s for LANs.

DHCPv6 server configuration on VyOS

configure
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' address-pool start '2001:db8:1::100'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' address-pool stop '2001:db8:1::200'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' lease-time default '86400'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' dns-server '2001:db8::53:1'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' dns-server '2001:db8::53:2'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' preferred-lifetime '14400'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' valid-lifetime '86400'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' domain-name 'example.com'
set interfaces ethernet eth0 dhcpv6-server 'LAN1'
commit
save

The configuration creates a shared-network named LAN1, ties it to the 2001:db8:1::/64 subnet, and assigns addresses from the 2001:db8:1::100 to 2001:db8:1::200 range. DNS servers, domain name, and lifetimes are configured per subnet. The dhcpv6-server LAN1 on eth0 activates the server on that interface.

DHCPv6 prefix delegation — handing the CPE a prefix

configure
set service dhcpv6-server shared-network-name PD-PREFIX subnet '2001:db8:abcd::/48'
set service dhcpv6-server shared-network-name PD-PREFIX subnet '2001:db8:abcd::/48' prefix-pool start '2001:db8:abcd::/48'
set service dhcpv6-server shared-network-name PD-PREFIX subnet '2001:db8:abcd::/48' prefix-pool stop '2001:db8:abcd:ffff::/48'
set service dhcpv6-server shared-network-name PD-PREFIX subnet '2001:db8:abcd::/48' lease-time default '604800'
set interfaces ethernet eth0 dhcpv6-server pd-prefix 'PD-PREFIX'
commit
save

The configuration creates a prefix pool of /48s starting at 2001:db8:abcd::/48 and ending at 2001:db8:abcd:ffff::/48 (65536 prefixes). The lease-time is one week. Downstream routers that request a prefix receive one from this pool.

The VyOS DHCPv6 server is the ISC Kea DHCP server in VyOS 1.5. Older releases used the ISC DHCP daemon (dhcpd), which had a similar configuration shape.

Requesting a delegated prefix on a downstream VyOS

configure
set interfaces ethernet eth0 dhcpv6-options parameters 1
set interfaces ethernet eth0 dhcpv6-options pd 0 length 56
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth1 sla-id '0'
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth2 sla-id '1'
set interfaces ethernet eth1 ipv6 address '::1/64'
set interfaces ethernet eth2 ipv6 address '::1/64'
commit
save

The downstream VyOS asks for a /56 prefix delegation on eth0 (the upstream link). When the upstream grants a /56, the downstream assigns ::1/64 to eth1 with the SLA-ID 0 appended, and ::1/64 to eth2 with the SLA-ID 1 appended.

The actual addresses are computed from the granted prefix: if the granted prefix is 2001:db8:abcd:ab00::/56, the eth1 address becomes 2001:db8:abcd:ab00::1/64 and the eth2 address becomes 2001:db8:abcd:ab01::1/64.

DHCPv6 relay — when the server is on a different segment

flowchart LR
  H[Host<br/>Solicit to ff02::1:2] --> R[Relay on VyOS]
  R --> S[Server on different segment]
  S --> R
  R --> H

DHCPv6 clients send Solicit to the All-DHCP-Agents multicast group ff02::1:2. A relay agent on the link picks up the multicast, encapsulates the Solicit in a Relay-Forward message, and forwards it unicast to the configured server.

The server replies with a Relay-Reply that the relay de-encapsulates and forwards to the original client.

configure
set service dhcpv6-relay listen-interface eth0
set service dhcpv6-relay listen-interface eth1
set service dhcpv6-relay upstream-interface eth2
set service dhcpv6-relay upstream-interface eth2 address '2001:db8:ffff::53'
commit
save

The relay listens on eth0 and eth1 for client Solicit messages and forwards them via eth2 to the server at 2001:db8:ffff::53. Multiple upstream interfaces can be configured for redundancy.

RDNSS in the DHCPv6 Reply

The DHCPv6 Reply can carry DNS servers via the DNS Recursive Name Server option (option 23). Stateful DHCPv6 servers should always include this option, even if the RA also carries RDNSS, because:

• Hosts that do not implement RFC 8106 rely on DHCPv6 for DNS.
• Hosts behind a relay may receive the RA but the DHCPv6 Reply is the authoritative source.

VyOS DHCPv6 server configuration:

set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' dns-server '2001:db8::53:1'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' dns-server '2001:db8::53:2'
commit
save

Two DNS servers are configured. Hosts receive both in the Reply and use whichever responds first, with the other as backup.

How the result is validated

show dhcpv6 server leases
show dhcpv6 server statistics
show dhcpv6 relay status
tcpdump -i eth0 -n port 547
tcpdump -i eth2 -n port 547

The first shows the leases the server has granted. The second shows the message counters. The third shows the relay statistics. The fourth captures client-to-server traffic on the LAN. The fifth captures server-side traffic on the upstream.

A working server has leases populated, counters incrementing on every Solicit, and DHCPv6 traffic visible on the wire.

How it fails

The production failure modes the engineer must recognise:

• DHCPv6 server bound to the wrong interface. The server does not listen on the LAN interface. Hosts send Solicit to ff02::1:2 with no response.
• Subnet mismatch. The server is configured with the wrong subnet (2001:db8:1::/64 configured but the actual prefix is 2001:db8:2::/64). The server replies but the host discards the address because it is not on-link.
• Pool exhaustion. The address pool is too small for the number of hosts. The server replies with NoAddressesAvailable.
• Prefix pool exhausted. All /48s are leased. The next PD request fails.
• Relay on the wrong upstream. The relay forwards Solicit to the wrong server. The server responds with NotAllowed (if it knows the relay) or silently (if it does not).
• M flag set but no DHCPv6 server. The RA says “use DHCPv6 for address” but no server is configured. Hosts wait for a Reply that never comes.

Rollback

The recovery from a bad DHCPv6 configuration:

• Wrong interface binding: delete interfaces ethernet eth0 dhcpv6-server LAN1 and bind to the correct interface.
• Wrong subnet: delete service dhcpv6-server shared-network-name LAN1 subnet ... and re-add with the correct subnet.
• Pool exhaustion: increase the pool size with set service dhcpv6-server shared-network-name LAN1 subnet ... address-pool stop ... extended.
• Relay upstream: delete service dhcpv6-relay upstream-interface eth2 address ... and re-add the correct upstream address.

Production discipline

Cross-course references

The Linux course’s XIX-Linux-NetFoundations covers the kernel SLAAC + DHCPv6 interaction and the /proc/sys/net/ipv6/conf/<iface>/ knobs. The OPNsense course’s XXVIII-OPNsense-DHCP covers the firewall-side DHCPv4 and DHCPv6. The VyOS lessons vyos-xi-01-ipv6-fundamentals, vyos-xi-02-ipv6-addressing, and vyos-xi-03-ipv6-router-advertisements cover the address types and RA configuration this lesson extends.

Quiz