DHCPv6 server — stateful IA_NA, prefix delegation IA_PD, the broadband CPE pattern

IPv6 has three address-assignment mechanisms — SLAAC, stateless DHCPv6, and stateful DHCPv6 — and the production routing engineer must operate all of them. DHCPv6 also plays a fourth role: prefix delegation, where the upstream hands a downstream CPE a /48 or /56 that the CPE carves into /64s for its LANs.

This lesson is the canonical reference for the DHCPv6 server on VyOS 1.5 LTS. It covers the stateful server with an address pool (IA_NA), the prefix-delegation pool (IA_PD), the link between Router Advertisement flags and DHCPv6 server mode, and the production failure modes where the upstream assigns but the downstream drops.

The DHCPv6 message flow

sequenceDiagram
  autonumber
  participant H as Host
  participant S as Server

  H->>S: Solicit (UDP 547 -> 547 multicast ff02::1:2)
  S-->>H: Advertise (unicast)
  H->>S: Request (unicast)
  S-->>H: Reply (unicast) with IA_NA<br/>assigning 2001:db8:1::50<br/>valid-lifetime 86400

The DHCPv6 exchange is Solicit / Advertise / Request / Reply — same shape as DHCPv4 with different terminology. The big differences from DHCPv4:

• DHCPv6 uses UDP, not TCP, for the lease.
• DHCPv6 messages are unicast or multicast (no broadcast).
• DHCPv6 carries options as TLV-encoded structures, not the DHCPv4-style option code: value strings.
• DHCPv6 listens on UDP 547 (clients listen on 547; servers use 547).

The link between RA flags and DHCPv6 server mode

flowchart TB
  subgraph RAmodes["Router Advertisement flags"]
    S1["M=0 O=0<br/>SLAAC only"]
    S2["M=0 O=1<br/>SLAAC + Stateless DHCPv6"]
    S3["M=1<br/>Stateful DHCPv6<br/>+ Stateless for DNS"]
  end
  S1 --> R1["no DHCPv6 server needed"]
  S2 --> R2["DHCPv6 server for DNS only"]
  S3 --> R3["DHCPv6 server for address + DNS"]

The Router Advertisement carries two flags:

• M (Managed) — if set, hosts use stateful DHCPv6 for address assignment.
• O (Other) — if set, hosts use stateless DHCPv6 for other configuration (DNS, NTP) but use SLAAC for their address.

The combination determines the DHCPv6 server’s role. With M=1, the server must have an address pool. With M=0/O=1, the server only needs to provide DNS via RDNSS. With both M=0/O=0, no DHCPv6 server is needed.

Configuring the DHCPv6 server with an address pool

configure
set service dhcpv6-server shared-network-name LAN1 authoritative
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' address-pool start '2001:db8:1::100'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' address-pool stop '2001:db8:1::200'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' lease-time default '86400'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' dns-server '2001:db8::53:1'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' dns-server '2001:db8::53:2'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' preferred-lifetime '14400'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' valid-lifetime '86400'
set service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' domain-name 'example.com'
set interfaces ethernet eth0 dhcpv6-server 'LAN1'
commit
save

The configuration creates a shared-network named LAN1, ties it to the 2001:db8:1::/64 subnet, and assigns addresses from the 2001:db8:1::100 to 2001:db8:1::200 range. DNS servers, domain name, and lifetimes are configured per subnet. The dhcpv6-server LAN1 on eth0 activates the server on that interface.

The matching RA for this subnet:

set interfaces ethernet eth0 ipv6 router-advert prefix '2001:db8:1::/64'
set interfaces ethernet eth0 ipv6 router-advert managed-flag
set interfaces ethernet eth0 ipv6 router-advert other-config-flag

The managed-flag tells hosts to use DHCPv6 for address assignment; the other-config-flag tells hosts to use DHCPv6 for other configuration (DNS, NTP). Without these RA flags, the DHCPv6 server sits unused.

Configuring prefix delegation

configure
set service dhcpv6-server shared-network-name PD-POOL subnet '2001:db8:abcd::/48'
set service dhcpv6-server shared-network-name PD-POOL subnet '2001:db8:abcd::/48' prefix-pool start '2001:db8:abcd::/48'
set service dhcpv6-server shared-network-name PD-POOL subnet '2001:db8:abcd::/48' prefix-pool stop '2001:db8:abcd:ffff::/48'
set service dhcpv6-server shared-network-name PD-POOL subnet '2001:db8:abcd::/48' lease-time default '604800'
set interfaces ethernet eth0 dhcpv6-server pd-prefix 'PD-POOL'
commit
save

The configuration creates a prefix pool of /48s starting at 2001:db8:abcd::/48 and ending at 2001:db8:abcd:ffff::/48 (65536 prefixes). The lease time is one week. Downstream routers that request a prefix receive one from this pool.

The downstream VyOS asks for a prefix:

configure
set interfaces ethernet eth0 dhcpv6-options parameters 1
set interfaces ethernet eth0 dhcpv6-options pd 0 length 56
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth1 sla-id '0'
set interfaces ethernet eth0 dhcpv6-options pd 0 interface eth2 sla-id '1'
set interfaces ethernet eth1 ipv6 address '::1/64'
set interfaces ethernet eth2 ipv6 address '::1/64'
commit
save

The downstream asks for a /56 prefix delegation on eth0. When the upstream grants a /56, the downstream assigns ::1/64 to eth1 with SLA-ID 0 and ::1/64 to eth2 with SLA-ID 1. The actual addresses are computed from the granted prefix.

How the result is validated

show dhcpv6 server leases
show dhcpv6 server statistics
show ipv6 nd prefix

show dhcpv6 server leases shows the granted IA_NA and IA_PD leases:

vyos@R1:~$ show dhcpv6 server leases
IA_NA subnet: 2001:db8:1::/64
  Address: 2001:db8:1::100
    IAID: 1, prefix length: 128
    preferred: 14400, valid: 86400
    duid: 00:01:00:01:aa:bb:cc:dd:ee:f0
    hostname: host-east
    last message: 2026-08-15 12:00:01

IA_PD subnet: 2001:db8:abcd::/48
  Prefix: 2001:db8:abcd:ab00::/56
    IAID: 1, prefix length: 56
    preferred: 604800, valid: 604800
    duid: 00:01:00:01:11:22:33:44:55:66
    hostname: CPE-SITE-01
    last message: 2026-08-15 12:00:02

show dhcpv6 server statistics shows the message counters. A working server has leases populated and counters incrementing.

vyos@R1:~$ show dhcpv6 server statistics
Solicits received:    1234
Advertises sent:      1234
Requests received:    1230
Replies sent:         1230
Reconfigure received: 0

Capturing the exchange

vyos@R1:~$ tcpdump -i eth0 -n port 547 -vv
12:00:01.234 IP6 fe80::1.547 > ff02::1:2.547: DHCPv6-Solicit
  IA_NA IAID 1
  Option 1 (client-identifier) length 10
12:00:01.236 IP6 2001:db8:1::1.547 > fe80::host.547: DHCPv6-Advertise
  IA_NA IAID 1, address 2001:db8:1::100, lifetime 86400
  Option 23 (DNS recursive name server) 2001:db8::53:1, 2001:db8::53:2
12:00:01.245 IP6 fe80::host.547 > ff02::1:2.547: DHCPv6-Request
  IA_NA IAID 1
12:00:01.247 IP6 2001:db8:1::1.547 > fe80::host.547: DHCPv6-Reply
  IA_NA IAID 1, address 2001:db8:1::100, lifetime 86400

The capture shows the four-message exchange, the IA_NA option, the assigned address, and the DNS option in the Reply.

How it fails

The production failure modes:

• M flag set but no DHCPv6 server. The RA says “use DHCPv6 for address” but no server is configured on the interface. Hosts wait for a Reply that never comes.
• Server bound to wrong interface. The configuration is correct but dhcpv6-server LAN1 is on eth1 instead of the LAN. Hosts send Solicit to ff02::1:2 with no response.
• Subnet mismatch. The configured subnet does not match the on-link prefix. The server replies with an address that the host rejects because it’s not on-link.
• Pool exhaustion. All addresses in the range are leased. The server replies with NoAddressesAvailable.
• PD pool exhausted. All /48s are leased. The next PD request fails.
• PD request length unsupported. The downstream requests a /64, but the upstream’s pool only supports /48 or /56. The upstream replies with NoPrefixAvailable or with a different length.

Rollback

The recovery from a broken DHCPv6 server:

• Wrong interface binding: delete interfaces ethernet eth0 dhcpv6-server LAN1 and bind to the correct interface.
• Wrong subnet: delete service dhcpv6-server shared-network-name LAN1 subnet '2001:db8:1::/64' and re-add with the correct subnet.
• Pool exhausted: extend the address-pool stop or prefix-pool stop value.
• RA flags wrong: reconfigure the RA flags to match the server mode.

The VyOS configuration rollback (rollback N) restores the previous revision.

Production discipline

Cross-course references

• XI-VyOS-IPv6 (vyos-xi-04-dhcpv6) covers the protocol and configuration this lesson extends.
• VII-VyOS-Interfaces covers the VLAN and interface binding for DHCPv6.
• XLVI-VyOS-DHCP (vyos-xlvi-01-dhcp-server) covers the DHCPv4 server; the DHCPv6 server has parallel structure.

Quiz