of 60/60
SLAAC and DHCPv6 Rick Graziani Cabrillo College [email protected] Got IPv6?

SLAAC and DHCPv6 Rick Graziani Cabrillo College [email protected] Got IPv6?

  • View
    254

  • Download
    7

Embed Size (px)

Text of SLAAC and DHCPv6 Rick Graziani Cabrillo College [email protected] Got IPv6?

  • Slide 1
  • SLAAC and DHCPv6 Rick Graziani Cabrillo College [email protected] Got IPv6?
  • Slide 2
  • Shameless plug: IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6 By Rick Graziani ISBN-10: 1-58714-313-5 IPv6 Fundamentals LiveLessons: A Straightforward Approach to Understanding IPv6 By Rick Graziani ISBN-10: 1-58720-457-6 STEAL MY STUFF! Username = cisco Password = perlman www.cabrillo.edu/~rgraziani/ipv6.html
  • Slide 3
  • Running Out of IPv4 The regions with the largest populations have the lowest percentages of people connected to the Internet Graphic from Internet World Stats, www.internetworldstats.com/stats.htm
  • Slide 4
  • When is IPv6 going to happen?
  • Slide 5
  • From Misperceptions about ARIN IPv4 Depletion (from ARIN)
  • Slide 6
  • ISPs are running out or have run out of IPv4 70% of ISP transit traffic (IPv4 and IPv6) is being carried over IPv6 (Cisco Live, 2015) Large ISPs looking to go to IPv6 only CGN is not a good option (breaks things) 47% of Internet content available on IPv6 Parts of Internet going IPv6 only ISPs, mobile feeling the wave now Home and corporate content is next wave US Corporate office . Well . Wave hitting the ISP shores
  • Slide 7
  • CGN breaks (from RFC 6598) Console gaming Video streaming Peer-to-Peer Applications Geo-location 100.64.0.0/10 192.168.1.0/24
  • Slide 8
  • CENIC customers may be allocated space no larger than a /27 (32 usable addresses). In all cases, utilization of 85% or greater must be demonstrated before additional space will be allocated.
  • Slide 9
  • And then theres mobile Facebook sees 20-40% (1-2 seconds) better performance because no NAT, CGN, etc. Facebook internally is IPv6 only
  • Slide 10
  • Comcast X1 is IPv6 Only - Comcast Voice is going IPv6 only
  • Slide 11
  • The benefits of deploying IPv6 only Geoff Huston (APNIC) Addressing NANOG64 (2015) (Comcast, Facebook, T-Mobile) 2013 Less than 1% IPv6 2014 5% 2015 20% Why the sudden growth? Because operators have had to go to IPv6 Comcast 45% is IPv6 for those dual stack https://www.youtube.com/watch?v=EfjdOc41g0s
  • Slide 12
  • Slide 13
  • Slide 14
  • Introduction to SLAAC (Stateless Address Autoconfiguration)
  • Slide 15
  • Hey! I can do that! Stateful vs Stateless Stateful Some server is keeping track or a record of the interaction. Stateless No one is keeping track or a record. But device can still make sure theirs is unique. DHCPv6 Server STATEFUL: I need an IPv6 address from someone who is keeping track of who has what address. I might not even be needed. STATELESS: I will come up with my own IPv6 address. No one will keep track of what address I have.
  • Slide 16
  • Dynamic IPv6 Address Allocation Global Unicast Manual Dynamic Static IPv6 unnumbered Static + EUI 64 SLAAC DHCPv6 SLAAC + DHCPv6 StatelessStateful DHCPv6-PD
  • Slide 17
  • DHCP Server Dynamic IPv4 Address Allocation DHCP Client I need an IPv4 addressing information from a DHCP server. Here is your IPv4 address, subnet mask, default gateway and DNS server addresses.
  • Slide 18
  • It Begins with the RA Message An ICMPv6 Router Advertisement (RA) suggests to all IPv6 devices on the link how it will receive IPv6 Address Information. Sent periodically by an IPv6 router or when the router receives a Router Solicitation message from a host. Routers can be configured with IPv6 addresses without being an IPv6 router. DHCPv6 Server ICMPv6 Router Advertisement ICMPv6 Router Solicitation Multicast: To all IPv6 routers, I need IPv6 address information Multicast: To all IPv6 devices, let me tell you how to do this I might not even be needed. Router(config)# ipv6 unicast-routing
  • Slide 19
  • Routers versus IPv6 Routers A router (not enabled as an IPv6 router): Configure IPv6 addresses Member of All-IPv6 devices multicast group An IPv6 router: Same as a non-IPv6 router Member of All-IPv6 routers multicast group Sends ICMPv6 Router Advertisement messages Can enable IPv6 routing protocols Forward IPv6 packets (transiting the router) RouterIPv6 Router 2001:DB8:CAFE:1::1/64 FE80::1 2001:DB8:CAFE:1::1/64 FE80::1 FF02::1 (All-IPv6 devices) FF02::2 (All-IPv6 routers) ICMPv6 Router Advertisement Forward IPv6 Packets RIPng OSPFv3 EIGRP for IPv6 RIPng OSPFv3 EIGRP for IPv6 Router(config)# ipv6 unicast-routing
  • Slide 20
  • Router Advertisement: 3 Options DHCPv6 Server RA Router(config)# ipv6 unicast-routing Option 1: SLAAC No DHCPv6 (Default on Cisco routers) Im everything you need (Prefix, Prefix-length, Default Gateway) Option 2: SLAAC + Stateless DHCPv6 for DNS address Here is my information but you need to get other information such as DNS addresses from a DHCPv6 server. (DNS can be in RA) Option 3: All addressing except default gateway use DHCPv6 I cant help you. Ask a DHCPv6 server for all your information. DHCPv6 Option 1 and 2: Stateless Address Autoconfiguration DHCPv6 Server does not maintain state of addresses Option 3: Stateful Address Configuration Address received from DHCPv6 Server
  • Slide 21
  • SLAAC: Stateless Address Autoconfiguration DHCPv6 Server Router(config)# ipv6 unicast-routing ICMPv6 Router Advertisement Prefix and other information ICMPv6 Router Advertisement Prefix and other information SLAAC (Stateless Address Autoconfiguration) Allows a device to create its own IPv6 global unicast address without the services of a DHCPv6 server. Prefix: From the Router Advertisement (RA). Interface ID: EUI-64 Random 64-bit value 2001:DB8:CAFE:1::/64 I know the network prefix from the RA. I just need to come up with my own Interface ID for my GUA!
  • Slide 22
  • DHCPv6 DHCPv6 Server Ignoring the RA Message? The ICMPv6 Router Advertisement suggests to the host how to get its address automatically. Can a host ignore an ICMPv6 Router Advertisement? Host operating systems can include the option of ignoring the Router Advertisement from the router and only use the stateful services of a DHCPv6 server (or what ever it wants to do). However, hosts cant ignore the default gateway (source of RA) unless manually configured. ICMPv6 Router Advertisement Link-local address
  • Slide 23
  • RA Message Options DHCPv6 Server ICMPv6 Router Advertisement Option 1, 2, or 3 ICMPv6 Router Advertisement Option 1, 2, or 3 Configuring Flags discussed in Lesson 8. The type of Router Advertisement option depends on two RA flags:
  • Slide 24
  • Obtaining an IPv6 Address Automatically
  • Slide 25
  • Note: Domain name and DNS server list may be included if router (and end system) support RFC 6106 IPv6 RA Options for DNS Configuration. SLAAC Option 1 RA Message To: FF02::1 (All-IPv6 devices) From: FE80::1 (Link-local address) Prefix: 2001:DB8:CAFE:1:: Prefix-length: /64 RA 1 1 MAC: 00-19-D2-8C-E0-4C Prefix: 2001:DB8:CAFE:1:: Prefix-length: /64 Default Gateway: FE80::1 Global Unicast Address: 2001:DB8:CAFE:1: + Interface ID 2001:DB8:CAFE:1::/64 EUI-64 Process or Random 64-bit value 2 2 DHCPv6 Server 3 3 SLAAC: Stateless Address Autoconfiguration
  • Slide 26
  • SLAAC: Interface ID Global Routing Prefix 64-bit Interface ID 16-bit Subnet ID /64 /48 EUI-64 ProcessRandomly Generated Number (Privacy Extension) SLAAC DHCPv6 Server Default OS behavior can be changed. Known instead of unknown Copyright DOC RABE MediaMan in paper bag on head Copyright binik
  • Slide 27
  • Note: Domain name and DNS server list may be included if router (and end system) support RFC 6106 IPv6 RA Options for DNS Configuration. SLAAC Option 1 RA Message To: FF02::1 (All-IPv6 devices) From: FE80::1 (Link-local address) Prefix: 2001:DB8:CAFE:1:: Prefix-length: /64 RA 1 1 MAC: 00-19-D2-8C-E0-4C Prefix: 2001:DB8:CAFE:1:: Prefix-length: /64 Default Gateway: FE80::1 Global Unicast Address: 2001:DB8:CAFE:1: + Interface ID 2001:DB8:CAFE:1::/64 EUI-64 Process or Random 64-bit value 2 2 DHCPv6 Server 3 3 SLAAC: EUI-64 Option
  • Slide 28
  • Modified EUI-64 Format (Extended Unique Identifier64) 0019D28CE04C OUI (24 bits)Device Identifier (24 bits) 0019D28CE04CFFFE 19D28CE04CFFFE 0000 00 U/L bit flipped 0000 0010 020219D28CE04CFFFE Insert FF-FE
  • Slide 29
  • PC> ipconfig Windows IP Configuration Ethernet adapter Local Area Connection: IPv6 Address........ : 2001:db8:cafe:1:0219:d2ff:fe8c:e04c Link-local IPv6 Address.. : fe80::0219:d2ff:fe8c:e04c Default Gateway..... : fe80::1 Router Advertisement EUI-64 A 64-bit Interface ID and the EUI-64 process accommodates: The IEEE specification for a 64-bit MAC address 64-bit boundary processing Verifying SLAAC on the PC Using EUI-64 Why. The Dude looking at the red question mark Copyright jojje11
  • Slide 30
  • SLAAC: Random 64-bit Interface ID Global Routing Prefix 64-bit Interface ID 16-bit Subnet ID /64 /48 EUI-64 ProcessRandomly Generated Number (Privacy Extension) SLAAC DHCPv6 Server Known instead of unknown Copyright DOC RABE MediaMan in paper bag on head Copyright binik
  • Slide 31
  • PC-Windows7> ipconfig Windows IP Configuration Ethernet adapter Local Area Connection: IPv6 Address........ : 2001:db8:cafe:1:50a5:8a35:a5bb:66e1 Link-local IPv6 Address.. : fe80::50a5:8a35:a5bb:66e1 Default Gateway..... : fe80::1 Router Advertisement EUI-64 Verifying SLAAC on the PC Using Privacy Extension No FF-FE
  • Slide 32
  • SLAAC: Including the DNS Server in the RA * DNS Server Router(config)# ipv6 unicast-routing ICMPv6 Router Advertisement Prefix and other information ICMPv6 Router Advertisement Prefix and other information G0/1 2001:DB8:CAFE:1::/64 Router(config)# ipv6 unicast-routing Router(config)# interface gigabitethernet 0/1 Router(config-if)# ipv6 nd ra dns server 2001:db8:cafe:1::99 600 2001:DB8:CAFE:1::99 Configures a DNS server with an IPv6 address of 2001:DB8::CAFE:1::1 to be advertised in an RA with a lifetime of 600 seconds.
  • Slide 33
  • Global Unicast - 2001:db8:cafe:1:50a5:8a35:a5bb:66e1 Link-local - fe80::50a5:8a35:a5bb:66e1 Neighbor Advertisement? Neighbor Solicitation Ensuring Unique Unicast Addresses Not received = unique address Received = duplicate address SLAAC is stateless, no entity (DHCPv6 server) maintaining a state address- to-device mappings. How can we guarantee the address is unique? Duplicate Address Detection (DAD) Once required for all unicast addresses (static or dynamic), RFC was updated that DAD is only recommended. /64 Interface IDs!
  • Slide 34
  • You Are Probably Already Running IPv6 Windows Vista or later, Mac OSX, Linux already running IPv6 Potential DoS or MITM attack, even if the router is not IPv6 enabled. Even if the router is not IPv6 enabled, your clients are mostly like are! I can still do a DoS attack on clients or perhaps even still to a MITM attack. There are mitigation techniques such as RA Guard. R1 Rogue RA RS IPv4 IPv6 IPv4 IPv6 IPv4 IPv6 I need an IPv6 prefix Here is an IPv6 prefix and gateway People Icon: Occupations set 5 Copyright Fredy Sujono
  • Slide 35
  • Configuring a Router as a SLAAC Client
  • Slide 36
  • Routers versus IPv6 Routers A router (not enabled as an IPv6 router): Configure IPv6 addresses Member of All-IPv6 devices multicast group An IPv6 router: Same as a non-IPv6 router Member of All-IPv6 routers multicast group Sends ICMPv6 Router Advertisement messages Can enable IPv6 routing protocols Forward IPv6 packets (transiting the router) RouterIPv6 Router 2001:DB8:CAFE:1::1/64 FE80::1 2001:DB8:CAFE:1::1/64 FE80::1 FF02::1 (All-IPv6 devices) FF02::2 (All-IPv6 routers) ICMPv6 Router Advertisement Forward IPv6 Packets RIPng OSPFv3 EIGRP for IPv6 RIPng OSPFv3 EIGRP for IPv6 Router(config)# ipv6 unicast-routing
  • Slide 37
  • R1 Client Client(config)# interface gig 0/1 Client(config-if)# ipv6 enable ! Not needed Client(config-if)# ipv6 address autoconfig default Client(config-if)# no shutdown Gig 0/1 R1(config)# interface gig 0/1 R1(config-if)# ipv6 address 2001:db8:cafe:1::1/64 R1(config-if)# ipv6 address fe80::1 link-local R1(config-if)# no shutdown R1(config-if)# exit R1(config)# ipv6 unicast-routing Configuring the Router as a Client 2001:DB8:CAFE:1::/64 ICMPv6 Router Advertisement IPv6 Router Link-local address created Now I can accept RA messages and get a GUA automatically!
  • Slide 38
  • R1 Client Gig 0/1 ::1 R1# show ipv6 interface gigabitethernet 0/1 GigabitEthernet0/1 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64 Joined group address(es): FF02::1 FF02::2 FF02::FB FF02::1:FF00:1 ND router advertisements are sent every 200 seconds Hosts use stateless autoconfig for addresses. Verifying the RA Message 2001:DB8:CAFE:1::/64 ICMPv6 Router Advertisement Partial output FE80::1
  • Slide 39
  • R1 Client Gig 0/1 ::1 Client# show ipv6 interface brief GigabitEthernet0/1 [up/up] FE80::8A5A:92FF:FE3B:29E1 2001:DB8:CAFE:1:8A5A:92FF:FE3B:29E1 Client# show interface gigabitethernet 0/1 GigabitEthernet0/1 is up, line protocol is up Hardware is CN Gigabit Ethernet, address is 885a.923b.29e1 (bia 885a.923b.29e1) Verifying the Client (Router) Is Using SLAAC/EUI-64 2001:DB8:CAFE:1::/64 ICMPv6 Router Advertisement FE80::1 EUI-64
  • Slide 40
  • R1 Client Gig 0/1 ::1 Client# show ipv6 route IPv6 Routing Table - default - 4 entries Codes: C - Connected, L - Local, S - Static, U - Per-user Static route IA - ISIS interarea, IS - ISIS summary, D - EIGRP, EX - EIGRP external ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ND ::/0 [2/0] via FE80::1, GigabitEthernet0/1 NDp 2001:DB8:CAFE:1::/64 [2/0] via GigabitEthernet0/1, directly connected Router versus IPv6 Router 2001:DB8:CAFE:1::/64 ICMPv6 Router Advertisement Partial output FE80::1 Default route learned via Neighbor Discovery (SLAAC) Prefix learned via Neighbor Discovery (SLAAC)
  • Slide 41
  • DHCPv6 (Dynamic Host Configuration Protocol for IPv6)
  • Slide 42
  • DHCPv6 Global Unicast Manual Dynamic Static IPv6 unnumbered Static + EUI 64 SLAAC DHCPv6 SLAAC + DHCPv6 Similar to IPv4 unnumbered StatelessStateful DHCPv6-PD
  • Slide 43
  • DHCP Server Dynamic IPv4 Address Allocation DHCP Client I need an IPv4 addressing information from a DHCP server. Here is your IPv4 address, subnet mask, default gateway and DNS server addresses.
  • Slide 44
  • All Dynamic Addressing Begins with the RA Message An ICMPv6 Router Advertisement (RA) suggests to all IPv6 devices on the link how it will receive IPv6 Address Information. Sent periodically by an IPv6 router or when the router receives a Router Solicitation message from a host. DHCPv6 Server ICMPv6 Router Advertisement ICMPv6 Router Solicitation Multicast: To all IPv6 routers, I need IPv6 address information Multicast: To all IPv6 devices, let me tell you how to do this I might not even be needed.
  • Slide 45
  • Router Advertisement: 3 Options DHCPv6 Server RA Router(config)# ipv6 unicast-routing Option 1: SLAAC No DHCPv6 (Default on Cisco routers) Im everything you need (Prefix, Prefix-length, Default Gateway) Option 2: SLAAC + Stateless DHCPv6 for DNS address Here is my information but you need to get other information such as DNS addresses from a DHCPv6 server. (DNS can be in RA) Option 3: All addressing except default gateway use DHCPv6 I cant help you. Ask a DHCPv6 server for all your information. DHCPv6 Option 1 and 2: Stateless Address Autoconfiguration DHCPv6 Server does not maintain state of addresses Option 3: Stateful Address Configuration Address received from DHCPv6 Server
  • Slide 46
  • RA Message Options The type of Router Advertisement option depends on two RA flags: Other Configuration Flag and Managed Configuration Flag Default: Both flags are set to 0 (Option 1) Use me (RA) for all your addressing information, no additional information available via DHCPv6. Other Configuration Flag when set to 1 (Option 2) Use me (RA) for your address but you need to get OTHER information from a stateless DHCPv6 server. Managed Configuration Flag when set to 1 (Option 3) The client needs to get ALL of its MANAGED information from a stateful DHCPv6 server, except default gateway. DHCPv6 Server ICMPv6 Router Advertisement Option 1, 2, or 3 ICMPv6 Router Advertisement Option 1, 2, or 3
  • Slide 47
  • RA Message Options DHCPv6 Server ICMPv6 Router Advertisement Option 1, 2, or 3 ICMPv6 Router Advertisement Option 1, 2, or 3
  • Slide 48
  • Obtaining an IPv6 Address Automatically
  • Slide 49
  • Stateless DHCPv6
  • Slide 50
  • RA Message DHCPv6 Server RA Router(config)# ipv6 unicast-routing Option 1: SLAAC No DHCPv6 (Default on Cisco routers) Im everything you need (Prefix, Prefix-length, Default Gateway) Option 2: SLAAC + Stateless DHCPv6 for DNS address Here is my information but you need to get other information such as DNS addresses from a DHCPv6 server. (DNS can be in RA) Option 3: All addressing except default gateway use DHCPv6 I cant help you. Ask a DHCPv6 server for all your information. DHCPv6 Option 1 and 2: Stateless Address Autoconfiguration DHCPv6 Server does not maintain state of addresses Option 3: Stateful Address Configuration Address received from DHCPv6 Server
  • Slide 51
  • RA Message Options DHCPv6 Server ICMPv6 Router Advertisement Option 1, 2, or 3 ICMPv6 Router Advertisement Option 1, 2, or 3
  • Slide 52
  • Stateless DHCPv6 I created my own address (Stateless), and have the default gateway, but I need a DNS address IPv6 Router & DHCPv6 Server Router as a Stateless DHCPv6 Server ICMPv6 Router Advertisement Option 2: Stateless DHCPv6 O Flag = 1, M Flag = 0 ICMPv6 Router Solicitation 1 1 2 2 Note: Domain name and DNS server list may be included if router (and end system) support RFC 6106 IPv6 RA Options for DNS Configuration. Stateless DHCP Server
  • Slide 53
  • Setting the Other Configuration Flag ICMPv6 Router Advertisement Option 2: Stateless DHCPv6 O Flag = 1, M Flag = 0 Router(config)# interface gigabitethernet 0/0 Router(config-if)# ipv6 nd other-config-flag G 0/0
  • Slide 54
  • RA Message: Stateless DHCPv6 To: FF02::1 (All-IPv6 devices) From: FE80::1 (Link-local address) Prefix: 2001:DB8:CAFE:1:: Prefix-length: /64 Other Configuration Flag: 1 RA 1 1 MAC: 00-19-D2-8C-E0-4C Prefix: 2001:DB8:CAFE:1:: Prefix-length: /64 Default Gateway: FE80::1 Global Unicast Address: 2001:DB8:CAFE:1: + Interface ID 2001:DB8:CAFE:1::/64 EUI-64 Process or Random 64-bit value 2 2 Stateless DHCPv6 Server 3 3 SLAAC for Addressing & DNS for Other Information 2001:DB8:CAFE:1:6909:cb1c:36a0:a595 DHCPv6 For DNS
  • Slide 55
  • Stateless DHCPv6 Configuration
  • Slide 56
  • Configuring Router as a Stateless DHCPv6 Server Step 1: Enable IPv6 routing to send ICMPv6 Router Advertisement Router(config)# ipv6 unicast-routing Step 2: Configure stateless DHCPv6 and parameters Router(config)# ipv6 dhcp pool pool-name Router(config-dhcpv6)# dns-server dns-server-address Router(config-dhcpv6)# domain-name domain-name Step 3: Configure interface: RA message and DHCPv6 server Router(config)# interface type number Router(config-if)# ipv6 nd other-config-flag Router(config-if)# ipv6 dhcp server pool-name IPv6 Router & DHCPv6 Server RA 0 = 1 RA 0 = 1 DHCPv6 No client address information.
  • Slide 57
  • IPv6 Router & DHCPv6 Server 2001:DB8:CAFE:1/64 G0/0 :1 DNS Server Configuring Router as a Stateless DHCPv6 Server RA Message DHCPv6 O Flag = 1, M Flag = 0 I created my own address (Stateless), and now I need to get a DNS address using stateless DHCPv6. 2001:DB8:CAFE:9::99
  • Slide 58
  • Router(config)# ipv6 unicast-routing Router(config)# ipv6 dhcp pool IPV6-STATELESS Router(config-dhcpv6)# dns-server 2001:DB8:CAFE:9::99 Router(config-dhcpv6)# domain-name www.example.com Router(config)# interface GigabitEthernet 0/0 Router(config-if)# ipv6 address 2001:DB8:CAFE:1::1/64 Router(config-if)# ipv6 address FE80::1 link-local Router(config-if)# ipv6 nd other-config-flag Router(config-if)# ipv6 dhcp server IPV6-STATELESS Configuring Router as a Stateless DHCPv6 Server 2001:DB8:CAFE:1/64 G0/0 :1 DNS Server 2001:DB8:CAFE:9::99 RA O = 1 RA O = 1 DHCPv6
  • Slide 59
  • PC> ipconfig /all Physical Address....: 00-21-9B-88-0E-40 IPv6 Address......: 2001:db8:cafe:1:6909:cb1c:36a0:a595 Default Gateway....: fe80::1 DNS Servers......: 2001:db8:cafe:9::99 Connection-specific DNS Suffix Search List: www.example.com 2001:DB8:CAFE:1/64 G0/0 :1 DNS Server 2001:DB8:CAFE:9::99 RA O = 1 RA O = 1 DHCPv6 Verifying Stateless DHCPv6 Server Configuration Random 64 bits
  • Slide 60
  • Router# show ipv6 interface gigabitethernet 0/0 GigabitEthernet 0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64 Hosts use stateless autoconfig for addresses. Hosts use DHCP to obtain other configuration. Router# 2001:DB8:CAFE:1/64 G0/0 :1 DNS Server 2001:DB8:CAFE:9::99 RA O = 1 RA O = 1 DHCPv6 Verifying Stateless DHCPv6 Server Configuration
  • Slide 61
  • Stateful DHCPv6
  • Slide 62
  • RA Message DHCPv6 Server RA Router(config)# ipv6 unicast-routing Option 1: SLAAC No DHCPv6 (Default on Cisco routers) Im everything you need (Prefix, Prefix-length, Default Gateway) Option 2: SLAAC + Stateless DHCPv6 for DNS address Here is my information but you need to get other information such as DNS addresses from a DHCPv6 server. (DNS can be in RA) Option 3: All addressing except default gateway use DHCPv6 I cant help you. Ask a DHCPv6 server for all your information. DHCPv6 Option 1 and 2: Stateless Address Autoconfiguration DHCPv6 Server does not maintain state of addresses Option 3: Stateful Address Configuration Address received from DHCPv6 Server
  • Slide 63
  • RA Message Options DHCPv6 Server ICMPv6 Router Advertisement Option 1, 2, or 3 ICMPv6 Router Advertisement Option 1, 2, or 3
  • Slide 64
  • Im only using the default gateway address from the RA. I need to contact a stateful DHCPv6 server for all my addressing. IPv6 Router & DHCPv6 Server Router as a Stateful DHCPv6 Server ICMPv6 Router Advertisement Option 3: Stateful DHCPv6 O Flag = 0, M Flag = 1 ICMPv6 Router Solicitation 1 1 2 2 Stateless DHCPv6 Stateful DHCP Server
  • Slide 65
  • Option 3 and the A Flag ICMPv6 RA M Flag = 1 A Flag = 1 ICMPv6 RA M Flag = 1 A Flag = 1 G 0/1 DHCPv6 DHCPv6 Server As a Windows host I will still use the RA prefix to create temporary (SLAAC) addresses) 0 The autonomous address configuration (A) flag tells hosts that they can create an address for themselves by combining the prefix in the RA with an interface identifier.
  • Slide 66
  • Setting the Managed Configuration Flag ICMPv6 Router Advertisement Option 3 Stateful DHCPv6 O Flag = 0, M Flag = 1 Router(config)# interface gigabitethernet 0/1 Router(config-if)# ipv6 nd managed-config-flag G 0/1 DHCPv6 DHCPv 6 Server
  • Slide 67
  • Stateful DHCPv6 without SLAAC ICMPv6 Router Advertisement Option 3 Stateful DHCPv6 O Flag = 0, M Flag = 1 No SLAAC: A Flag = 0 Router(config)# interface gigabitethernet 0/1 Router(config-if)# ipv6 nd managed-config-flag Router(config-if)# ipv6 nd prefix prefix/length no-autoconfig G 0/1 DHCPv6 DHCPv 6 Server no-autoconfig (Optional) Indicates to hosts on the local link that the specified prefix cannot be used for IPv6 autoconfiguration (SLAAC). The prefix will be advertised with the A-bit clear (autonomous address- configuration flag). As a Windows host I will still use the RA prefix to create temporary (SLAAC) addresses)
  • Slide 68
  • RA Message: Stateful DHCPv6 To: FF02::1 (All-IPv6 devices) From: FE80::1 (Link-local address) Prefix: 2001:DB8:CAFE:2:: Prefix-length: /64 Managed Configuration Flag: 1 Autonomous Address Flag: 0 RA 1 1 Default Gateway: FE80::1 Global Unicast Address: DHCPv6 2001:DB8:CAFE:2::/64 2 2 Stateful DHCPv6 Server Stateful DHCPv6 DHCPv6 As a Windows host I will still use the RA prefix to create temporary (SLAAC) addresses)
  • Slide 69
  • Stateful DHCPv6 Configuration
  • Slide 70
  • Configuring Router as a Stateful DHCPv6 Server Step 1: Enable IPv6 routing to send ICMPv6 Router Advertisement Router(config)# ipv6 unicast-routing Step 2: Configure stateful DHCPv6 and parameters Router(config)# ipv6 dhcp pool pool-name Router(config-dhcpv6)# address prefix prefix/length Router(config-dhcpv6)# dns-server dns-server-address Router(config-dhcpv6)# domain-name domain-name Step 3: Configure interface: RA message and DHCPv6 server Router(config)# interface type number Router(config-if)# ipv6 nd managed-config-flag Router(config-if)# ipv6 nd prefix prefix/prefix-length no-autoconfig Router(config-if)# ipv6 dhcp server pool-name IPv6 Router & DHCPv6 Server RA M = 1 A=1 RA M = 1 A=1 DHCPv6 Client address information.
  • Slide 71
  • Router(config)# ipv6 unicast-routing Router(config)# ipv6 dhcp pool IPV6-STATEFUL Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2:DEED::/80 Router(config-dhcpv6)# dns-server 2001:DB8:CAFE:9::99 Router(config-dhcpv6)# domain-name www.example.com Router(config)# interface GigabitEthernet 0/1 Router(config-if)# ipv6 address 2001:DB8:CAFE:2::1/64 Router(config-if)# ipv6 address FE80::1 link-local Router(config-if)# ipv6 nd managed-config-flag Router(config-if)# ipv6 dhcp server IPV6-STATEFUL Configuring Router as a Stateful DHCPv6 Server 2001:DB8:CAFE:2/64 G0/1 :1 DNS Server 2001:DB8:CAFE:9::99 RA M = 1 RA M = 1 DHCPv6 Can be a /64
  • Slide 72
  • Router-IPV4(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.9 Including Only Valid Addresses to Be Assigned With IPv4, a router enabled as a DHCPv4 server we specifically EXCLUDE addresses from being assigned. All other addresses are INCLUDED as possible assigned addresses. With IPv6, a router enabled as a DHCPv6 server we specifically INCLUDE addresses to be assigned. All other addresses are EXCLUDED as possible assigned addresses. Using the prefix length of the LAN may include the routers address and other statically assigned addresses. Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2::/64 Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2:DEED::/80
  • Slide 73
  • Including Specific Addresses 2001:DB8:CAFE:2::/64 2001:DB8:CAFE:2:0:0:0:0 2001:DB8:CAFE:2:FFFF:FFFF:FFFF:FFFF 2001:DB8:CAFE:2:DEED::/80 2001:DB8:CAFE:2:DEED:0:0:0 2001:DB8:CAFE:2:DEED:0:0:1 2001:DB8:CAFE:2:DEED:0:0:2... /64/80 INCLUDED assigned addresses will have these 80 bits. Available addresses for this network Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2:DEED::/80 All other addresses are EXCLUDED
  • Slide 74
  • PC> ipconfig /all Physical Address....: 00-21-9B-88-0E-40 IPv6 Address......: 2001:db8:cafe:2:deed:2de8:cfd8:5 Default Gateway....: fe80::1 DNS Servers......: 2001:db8:cafe:9::99 Connection-specific DNS Suffix Search List: www.example.com 2001:DB8:CAFE:2/64 G0/1 :1 DNS Server 2001:DB8:CAFE:9::99 RA M = 1 RA M = 1 DHCPv6 Verifying Stateful DHCPv6 Server Configuration
  • Slide 75
  • Router# show ipv6 interface gigabitethernet 0/1 GigabitEthernet 0/1 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:CAFE:2::1, subnet is 2001:DB8:CAFE:2::/64 Hosts use DHCP to obtain routable addresses. Router# 2001:DB8:CAFE:2/64 G0/1 :1 DNS Server 2001:DB8:CAFE:9::99 RA M = 1 RA M = 1 DHCPv6 Verifying Stateful DHCPv6 Server Configuration
  • Slide 76
  • Router(config)# ipv6 unicast-routing Router(config)# ipv6 dhcp pool IPV6-STATELESS Router(config-dhcpv6)# dns-server 2001:DB8:CAFE:9::99 Router(config-dhcpv6)# domain-name www.example.com Router(config)# ipv6 dhcp pool IPV6-STATEFUL Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2:DEED::/80 Router(config-dhcpv6)# dns-server 2001:DB8:CAFE:9::99 Router(config-dhcpv6)# domain-name www.example.com Router(config)# interface GigabitEthernet 0/0 Router(config-if)# ipv6 address 2001:DB8:CAFE:1::1/64 Router(config-if)# ipv6 address FE80::1 link-local Router(config-if)# ipv6 nd other-config-flag Router(config-if)# ipv6 dhcp server IPV6-STATELESS Router(config)# interface GigabitEthernet 0/1 Router(config-if)# ipv6 address 2001:DB8:CAFE:2::1/64 Router(config-if)# ipv6 address FE80::1 link-local Router(config-if)# ipv6 nd managed-config-flag Router(config-if)# ipv6 dhcp server IPV6-STATEFUL Stateless and Stateful DHCPv6 Server G0/1 G0/0 Stateless Stateful
  • Slide 77
  • DHCPv6 Relay (If there is time)
  • Slide 78
  • Forwarding DHCPv6 Messages Relay agent creates a RELAY-FORWARD message containing the original DHCPv6 message from the client and forwards the message to a server. The ipv6-address can be: Unicast or multicast IPv6 address Link-scope: The output interface must be specified for this kind of address. 2001:DB8:CAFE:2/64 G0/1 :1 DHCPv6 Server 2001:DB8:CAFE:9::55 DHCPv6 Router(config)# interface GigabitEthernet 0/1 Router(config-if)# ipv6 dhcp relay destination ipv6-address [exit-int] RELAY-FORWARD G0/0 :1
  • Slide 79
  • Forwarding DHCPv6 Messages using unicast When the destination of the DHCP server is a global unicast address, no multicast routing is required. 2001:DB8:CAFE:2/64 G0/1 :1 DHCPv6 Server 2001:DB8:CAFE:9::55 DHCPv6 Router(config)# ipv6 unicast-routing Router(config)# interface GigabitEthernet 0/1 Router(config-if)# ipv6 nd managed-config-flag Router(config-if)# ipv6 dhcp relay destination 2001:DB8:CAFE:9::55 g0/0 RELAY-FORWARD To: 2001:DB8:CAFE:9::55 G0/0 :1 Only required if link-local unicast is used
  • Slide 80
  • Forwarding DHCPv6 Messages using Multicast When the destination of the DHCP server is FF05::1:3 (All-DHCPv6 Servers) multicast address, then we need multicast routing enabled for IPv6. 2001:DB8:CAFE:2/64 G0/1 :1 DHCPv6 Server 2001:DB8:CAFE:9::55 DHCPv6 Router(config)# ipv6 unicast-routing Router(config)# ipv6 multicast-routing Router(config)# interface GigabitEthernet 0/1 Router(config-if)# ipv6 nd managed-config-flag Router(config-if)# ipv6 dhcp relay destination FF05::1:3 RELAY-FORWARD To FF05::1:3 All-DHCPv6 Servers G0/0 :1
  • Slide 81
  • DHCPv6 Prefix Delegation Process (If there is time)
  • Slide 82
  • DHCPv4 and Private Addresses for the Home ISP only has to deliver a public IPv4 address for Home router interface. DHCPv4 and RFC 1918 private address space is used for home network. NAT is used for translation but has its drawbacks! No NAT between private-public IPv6 (always in debate) ISP HOME Public IPv4 Address for the interface G0/1 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 G0/0 Private IPv4 Address NAT DHCPv4
  • Slide 83
  • The World of IPv6 and DHCPv6-PD ISP-DR HOME-RR G0/1 G0/0 Delegating Router (DR) Requesting Router (RR) Global IPv6 Address Complete IPv6 Reachability DHCPv6-PD REQUEST DHCPv6-PD REPLY 1 1 2 2 RA with prefix 3 3
  • Slide 84
  • Thank you and STEAL MY STUFF! Username = cisco Password = perlman www.cabrillo.edu/~rgraziani/ipv6.html