SLAAC and DHCPv6
Rick Graziani
Cabrillo College
Rick.Graziani@cabrillo.edu
Got
IPv6?
STEAL MY
STUFF!
Shameless plug:
www.cabrillo.edu/~rgraziani/ipv6.html
IPv6 Fundamentals: A Straightforward
Approach to Understanding IPv6
•
By Rick Graziani
•
ISBN-10: 1-58714-313-5
Username = cisco
Password = perlman
IPv6 Fundamentals LiveLessons: A
Straightforward Approach to Understanding IPv6
•
By Rick Graziani
•
ISBN-10: 1-58720-457-6
©
Running Out of IPv4
• The regions with the largest populations have the lowest
percentages of people connected to the Internet
Graphic from Internet World Stats, www.internetworldstats.com/stats.htm
©
When is IPv6 going to happen?
©
From Misperceptions about ARIN IPv4 Depletion (from ARIN)
©
Wave hitting the ISP shores
•
•
•
•
•
•
•
•
•
ISPs are running out or have run out of
IPv4
70% of ISP transit traffic (IPv4 and IPv6)
is being carried over IPv6 (Cisco Live,
2015)
Large ISPs looking to go to IPv6 only
CGN is not a good option (breaks things)
47% of Internet content available on IPv6
Parts of Internet going IPv6 only
ISPs, mobile feeling the wave now
Home and corporate content is next wave
US Corporate office …. Well ….
©
192.168.1.0/24
100.64.0.0/10
CGN breaks (from RFC 6598)
• Console gaming
• Video streaming
• Peer-to-Peer Applications
©
• Geo-location
CENIC customers may be allocated space no larger
than a /27 (32 usable addresses).
In all cases, utilization of 85% or greater must be
demonstrated before additional space will be allocated.
©
And then there’s mobile…
•
•
Facebook sees 20-40% (1-2 seconds)
better performance because no NAT, CGN,
etc.
Facebook internally is IPv6 only
©
Comcast X1 is IPv6 Only - Comcast Voice is going IPv6 only
©
The benefits of deploying IPv6 only
Geoff Huston (APNIC) Addressing NANOG64 (2015)
(Comcast, Facebook, T-Mobile)
•
•
•
•
•
•
2013 – Less than 1%
IPv6
2014 – 5%
2015 – 20%
Why the sudden
growth?
Because operators
have had to go to IPv6
Comcast – 45% is
IPv6 for those dual
stack
https://www.youtube.com/watch?v=EfjdOc41g0s
©
©
©
Introduction to SLAAC (Stateless Address
Autoconfiguration)
Stateful vs Stateless
DHCPv6
Server
STATEFUL: I need
an IPv6 address
from someone who
is keeping track of
who has what
address.
•
•
STATELESS: I will
come up with my own
IPv6 address…. No
one will keep track of
what address I have.
IHey!
mightI can
not even
do that!
be
needed.
 
Stateful – Some server is keeping track or a record of the interaction.
Stateless – No one is keeping track or a record…. But device can still make
sure theirs is unique.
©
Dynamic IPv6 Address Allocation
Global Unicast
Manual
Dynamic
Stateless
Static
Static + EUI 64
IPv6
unnumbered
Stateful
SLAAC
DHCPv6
SLAAC +
DHCPv6
DHCPv6-PD
©
Dynamic IPv4 Address Allocation
I need an IPv4 addressing
information from a DHCP server.
DHCP Server
DHCP Client
Here is your IPv4
address, subnet mask,
default gateway and
DNS server addresses.
©
It Begins with the RA Message
Router(config)# ipv6 unicast-routing
ICMPv6 Router Advertisement
ICMPv6 Router Solicitation
Multicast: To all
IPv6 routers, I need
IPv6 address
information
DHCPv6
Server
Multicast: To all
IPv6 devices,
I might not even be
let me tell you how
needed. 
to do this …
• An ICMPv6 Router Advertisement (RA) suggests to all IPv6 devices on the
link how it will receive IPv6 Address Information.
• Sent periodically by an IPv6 router or…
• … when the router receives a Router Solicitation message from a host.
• Routers can be configured with IPv6 addresses without being an IPv6 router.
©
Routers versus IPv6 Routers
Router(config)# ipv6 unicast-routing
2001:DB8:CAFE:1::1/64
FE80::1
Router
•
•
FF02::1 (All-IPv6 devices)
2001:DB8:CAFE:1::1/64
FE80::1
IPv6 Router
A router (not enabled as an IPv6 router):
• Configure IPv6 addresses
• Member of All-IPv6 devices multicast group
An IPv6 router:
• Same as a non-IPv6 router
• Member of All-IPv6 routers multicast group
• Sends ICMPv6 Router Advertisement messages
• Can enable IPv6 routing protocols
• Forward IPv6 packets (transiting the router)
FF02::1 (All-IPv6 devices)
FF02::2 (All-IPv6 routers)
ICMPv6 Router
Advertisement
RIPng OSPFv3
EIGRP for IPv6
Forward IPv6 Packets
©
Option 1 and 2: Stateless Address Autoconfiguration
Router Advertisement:
3 Options
• DHCPv6 Server does not maintain state of addresses
Option 3: Stateful Address Configuration
• Address received from DHCPv6 Server
Router(config)# ipv6 unicast-routing
DHCPv6
Option 1: SLAAC – No DHCPv6 (Default on Cisco routers)
DHCPv6 Server
“I’m everything you need (Prefix, Prefix-length, Default Gateway)”
Option 2: SLAAC + Stateless DHCPv6 for DNS address
“Here is my information but you need to get other information such
as DNS addresses from a DHCPv6 server.” (DNS can be in RA)
RA
Option 3: All addressing except default gateway use DHCPv6
“I can’t help you. Ask a DHCPv6 server for all your information.”
©
RA Message Options
ICMPv6 Router Advertisement
Option 1, 2, or 3
DHCPv6
Server
The type of Router Advertisement option
depends on two RA flags:
Option
Other Configuration
(“O”) Flag
Managed Configuration
(“M”) Flag
Option 1: SLAAC – No DHCPv6
(Default on Cisco routers)
0
0
Option 2: SLAAC + Stateless
DHCPv6 for DNS address
1
0
Option 3: All addressing except
default gateway use DHCPv6
0
1
•
Configuring Flags discussed in Lesson 8.
©
Obtaining an IPv6 Address Automatically
©
SLAAC: Stateless Address Autoconfiguration
MAC: 00-19-D2-8C-E0-4C
2001:DB8:CAFE:1::/64
SLAAC Option 1 – RA Message
To:
1
2
FF02::1 (All-IPv6 devices)
From: FE80::1 (Link-local address)
Prefix: 2001:DB8:CAFE:1::
Prefix: 2001:DB8:CAFE:1::
RA
Prefix-length: /64
Default Gateway: FE80::1
Prefix-length: /64
Note: Domain name and DNS server list
may be included if router (and end system)
support RFC 6106 IPv6 RA Options for
DNS Configuration.
DHCPv6 Server
Global Unicast Address:
2001:DB8:CAFE:1: + Interface ID
3 EUI-64 Process or
Random 64-bit value
©
SLAAC: Interface ID
/64
/48
16-bit
Global Routing Prefix
Subnet ID
Operating
System
Windows XP,
Server 2003
EUI-64
MAC OSX
Linux
64-bit Interface ID
Random
64-bit
✔
✔
Windows Vista
and newer
DHCPv6 Server
SLAAC
EUI-64 Process
Randomly Generated Number
(Privacy Extension)
✔
✔
Default OS behavior can be changed.
Known instead of unknown © Copyright DOC RABE Media
Man in paper bag on head © Copyright binik
©
SLAAC: EUI-64 Option
MAC: 00-19-D2-8C-E0-4C
2001:DB8:CAFE:1::/64
SLAAC Option 1 – RA Message
To:
1
2
FF02::1 (All-IPv6 devices)
From: FE80::1 (Link-local address)
Prefix: 2001:DB8:CAFE:1::
Prefix: 2001:DB8:CAFE:1::
RA
Prefix-length: /64
Default Gateway: FE80::1
Prefix-length: /64
Note: Domain name and DNS server list
may be included if router (and end system)
support RFC 6106 IPv6 RA Options for
DNS Configuration.
DHCPv6 Server
Global Unicast Address:
2001:DB8:CAFE:1: + Interface ID
3 EUI-64 Process or
Random 64-bit value
©
Modified EUI-64 Format (Extended Unique Identifier–64)
OUI (24 bits)
00
19
Device Identifier (24 bits)
D2
8C
E0
4C
Insert FF-FE
00
19
D2
FF
FE
8C
E0
4C
00
19
D2
FF
FE
8C
E0
4C
FF
FE
8C
E0
4C
0000 0000
0010
U/L bit flipped
02
19
D2
©
Verifying SLAAC
on the PC Using
EUI-64
Router Advertisement
EUI-64
PC> ipconfig
Windows IP Configuration
Ethernet adapter Local Area Connection:
IPv6 Address. . . . . . . . : 2001:db8:cafe:1:0219:d2ff:fe8c:e04c
Link-local IPv6 Address . . : fe80::0219:d2ff:fe8c:e04c
Default Gateway
. . . . . : fe80::1
A 64-bit Interface ID and the EUI-64 process accommodates:
• The IEEE specification for a 64-bit MAC address
• 64-bit boundary processing
Why. The Dude looking at the red question mark © Copyright jojje11
©
SLAAC: Random 64-bit Interface ID
/64
/48
16-bit
Global Routing Prefix
Subnet ID
Operating
System
Windows XP,
Server 2003
EUI-64
Linux
64-bit Interface ID
Random
64-bit
✔
SLAAC
EUI-64 Process
✔
Windows Vista
and newer
MAC OSX
DHCPv6 Server
Randomly Generated Number
(Privacy Extension)
✔
✔
Known instead of unknown © Copyright DOC RABE Media
Man in paper bag on head © Copyright binik
©
Verifying SLAAC
on the PC Using
Privacy Extension
Router Advertisement
EUI-64
PC-Windows7> ipconfig
Windows IP Configuration
No FF-FE
Ethernet adapter Local Area Connection:
IPv6 Address. . . . . . . . : 2001:db8:cafe:1:50a5:8a35:a5bb:66e1
Link-local IPv6 Address . . : fe80::50a5:8a35:a5bb:66e1
Default Gateway
. . . . . : fe80::1
©
SLAAC: Including the DNS Server in the RA *
Router(config)# ipv6 unicast-routing
G0/1
2001:DB8:CAFE:1::/64
ICMPv6 Router Advertisement
• Prefix and other information
DNS Server
2001:DB8:CAFE:1::99
Router(config)# ipv6 unicast-routing
Router(config)# interface gigabitethernet 0/1
Router(config-if)# ipv6 nd ra dns server 2001:db8:cafe:1::99 600
Configures a DNS server with an IPv6 address of 2001:DB8::CAFE:1::1 to be
advertised in an RA with a lifetime of 600 seconds.
©
Ensuring Unique Unicast Addresses
Global Unicast - 2001:db8:cafe:1:50a5:8a35:a5bb:66e1
Link-local
- fe80::50a5:8a35:a5bb:66e1
Neighbor Solicitation
Not received = unique address
Received = duplicate address
Neighbor Advertisement?
• SLAAC is stateless, no entity (DHCPv6 server) maintaining a state addressto-device mappings.
• How can we guarantee the address is unique?
• Duplicate Address Detection (DAD)
• Once required for all unicast addresses (static or dynamic), RFC was
updated that DAD is only recommended.
• /64 Interface IDs!
©
You Are Probably Already Running IPv6
IPv4
IPv6
RS
IPv4
IPv6
R1
Here is an
IPv6 prefix
and
gateway
Rogue
RA
IPv4
IPv6
I need an
IPv6 prefix
•
•
•
•
Windows Vista or later, Mac OSX, Linux already running IPv6
Potential DoS or MITM attack, even if the router is not IPv6 enabled.
Even if the router is not IPv6 enabled, your clients are mostly like are!
I can still do a DoS attack on clients or perhaps even still to a MITM
attack.
• There are mitigation techniques such as RA Guard.
People Icon: Occupations set 5 © Copyright Fredy Sujono
©
DHCPv6 (Dynamic Host
Configuration Protocol for IPv6)
DHCPv6
Global Unicast
Manual
Dynamic
Stateless
Static
IPv6
unnumbered
Stateful
SLAAC
DHCPv6
SLAAC +
DHCPv6
DHCPv6-PD
Similar to IPv4 unnumbered
Static + EUI 64
©
Obtaining an IPv6 Address Automatically
©
Stateless DHCPv6
RA Message
Option 1 and 2: Stateless Address Autoconfiguration
• DHCPv6 Server does not maintain state of addresses
Option 3: Stateful Address Configuration
• Address received from DHCPv6 Server
Router(config)# ipv6 unicast-routing
DHCPv6
Option 1: SLAAC – No DHCPv6 (Default on Cisco routers)
DHCPv6 Server
“I’m everything you need (Prefix, Prefix-length, Default Gateway)”
Option 2: SLAAC + Stateless DHCPv6 for DNS address
“Here is my information but you need to get other information such
as DNS addresses from a DHCPv6 server.” (DNS can be in RA)
RA
Option 3: All addressing except default gateway use DHCPv6
“I can’t help you. Ask a DHCPv6 server for all your information.”
©
RA Message Options
ICMPv6 Router Advertisement
Option 1, 2, or 3
Option
Other Configuration
(“O”) Flag
DHCPv6
Server
Managed Configuration
(“M”) Flag
Option 1: SLAAC – No DHCPv6
(Default on Cisco routers)
0
0
Option 2: SLAAC + Stateless
DHCPv6 for DNS address
1
0
Option 3: All addressing except
default gateway use DHCPv6
0
1
©
Setting the Other Configuration Flag
G 0/0
ICMPv6 Router Advertisement
•
•
Option 2: Stateless DHCPv6
O Flag = 1, M Flag = 0
Router(config)# interface gigabitethernet 0/0
Router(config-if)# ipv6 nd other-config-flag
©
SLAAC for Addressing & DNS for Other Information
MAC: 00-19-D2-8C-E0-4C
2001:DB8:CAFE:1::/64
RA Message: Stateless DHCPv6
To:
1
2
FF02::1 (All-IPv6 devices)
From: FE80::1 (Link-local address)
Prefix: 2001:DB8:CAFE:1::
Prefix: 2001:DB8:CAFE:1::
RA
Prefix-length: /64
Prefix-length: /64
Default Gateway: FE80::1
Other Configuration Flag: 1
Global Unicast Address:
2001:DB8:CAFE:1:6909:cb1c:36a0:a595
2001:DB8:CAFE:1: + Interface ID
DHCPv6
For DNS
Stateless DHCPv6 Server
3
EUI-64 Process or
Random 64-bit value
©
Stateless DHCPv6 Configuration
Configuring Router as a Stateless DHCPv6 Server
DNS Server
2001:DB8:CAFE:9::99
G0/0
:1
2001:DB8:CAFE:1/64
RA
O=1
DHCPv6
Router(config)# ipv6 unicast-routing
Router(config)# ipv6 dhcp pool IPV6-STATELESS
Router(config-dhcpv6)# dns-server 2001:DB8:CAFE:9::99
Router(config-dhcpv6)# domain-name www.example.com
Router(config)# interface GigabitEthernet 0/0
Router(config-if)# ipv6 address 2001:DB8:CAFE:1::1/64
Router(config-if)# ipv6 address FE80::1 link-local
Router(config-if)# ipv6 nd other-config-flag
Router(config-if)# ipv6 dhcp server IPV6-STATELESS
©
Verifying Stateless DHCPv6 Server Configuration
DNS Server
2001:DB8:CAFE:9::99
G0/0
:1
2001:DB8:CAFE:1/64
RA
O=1
DHCPv6
PC> ipconfig /all
Physical Address. .
IPv6 Address. . . .
Default Gateway . .
DNS Servers . . . .
Connection-specific
. .: 00-21-9B-88-0E-40
Random 64 bits
. .: 2001:db8:cafe:1:6909:cb1c:36a0:a595
. .: fe80::1
. .: 2001:db8:cafe:9::99
DNS Suffix Search List: www.example.com
©
Verifying Stateless DHCPv6 Server Configuration
DNS Server
2001:DB8:CAFE:9::99
G0/0
:1
2001:DB8:CAFE:1/64
RA
O=1
DHCPv6
Router# show ipv6 interface gigabitethernet 0/0
GigabitEthernet 0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::1
Global unicast address(es):
2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64
<Output omitted>
Hosts use stateless autoconfig for addresses.
Hosts use DHCP to obtain other configuration.
Router#
©
Stateful DHCPv6
RA Message
Option 1 and 2: Stateless Address Autoconfiguration
• DHCPv6 Server does not maintain state of addresses
Option 3: Stateful Address Configuration
• Address received from DHCPv6 Server
Router(config)# ipv6 unicast-routing
DHCPv6
Option 1: SLAAC – No DHCPv6 (Default on Cisco routers)
DHCPv6 Server
“I’m everything you need (Prefix, Prefix-length, Default Gateway)”
Option 2: SLAAC + Stateless DHCPv6 for DNS address
“Here is my information but you need to get other information such
as DNS addresses from a DHCPv6 server.” (DNS can be in RA)
RA
Option 3: All addressing except default gateway use DHCPv6
“I can’t help you. Ask a DHCPv6 server for all your information.”
©
RA Message Options
ICMPv6 Router Advertisement
Option 1, 2, or 3
Option
Other Configuration
(“O”) Flag
DHCPv6
Server
Managed Configuration
(“M”) Flag
Option 1: SLAAC – No DHCPv6
(Default on Cisco routers)
0
0
Option 2: SLAAC + Stateless
DHCPv6 for DNS address
1
0
Option 3: All addressing except
default gateway use DHCPv6
0
1
©
Option 3 and the “A” Flag
G 0/1
As a Windows host I will still
use the RA prefix to create
temporary (SLAAC) addresses)
ICMPv6 RA
M Flag = 1
A Flag = 10
DHCPv6
DHCPv6 Server
Option
Managed
Configuration
(“M”) Flag
Option 3: All addressing
The autonomous
except
default gateway address
use
DHCPv6
they
can create an address
Address
Autoconfiguration
(“A”) Flag
Prefix in RA can
be used for
SLAAC
1
1 (default)
Yes
configuration (A) flag tells hosts that
for themselves by combining the prefix
Option
All addressing
in the3:RA
with an interface identifier.
1
0
No
except default gateway
use DHCPv6
©
Setting the Managed Configuration Flag
G 0/1
ICMPv6 Router
Advertisement
•
•
DHCPv6
DHCPv
6
Server
Option 3 Stateful DHCPv6
O Flag = 0, M Flag = 1
Router(config)# interface gigabitethernet 0/1
Router(config-if)# ipv6 nd managed-config-flag
©
Stateful DHCPv6 without SLAAC
G 0/1
ICMPv6 Router
Advertisement
•
•
•
As a Windows host I will still
use the RA prefix to create
temporary (SLAAC) addresses)
DHCPv6
Option 3 Stateful DHCPv6
O Flag = 0, M Flag = 1
No SLAAC: A Flag = 0
DHCPv
6
Server
Router(config)# interface gigabitethernet 0/1
Router(config-if)# ipv6 nd managed-config-flag
Router(config-if)# ipv6 nd prefix prefix/length no-autoconfig
•
•
no-autoconfig (Optional) Indicates to hosts on the local link that the specified
prefix cannot be used for IPv6 autoconfiguration (SLAAC).
The prefix will be advertised with the A-bit clear (autonomous addressconfiguration flag).
©
As a Windows host I will still
use the RA prefix to create
temporary (SLAAC) addresses)
Stateful DHCPv6
2001:DB8:CAFE:2::/64
RA Message: Stateful DHCPv6
To:
1
2
FF02::1 (All-IPv6 devices)
From: FE80::1 (Link-local address)
Prefix: 2001:DB8:CAFE:2::
Default Gateway: FE80::1
RA
Global Unicast Address: DHCPv6
Prefix-length: /64
Managed Configuration Flag: 1
Autonomous Address Flag: 0
DHCPv6
Stateful DHCPv6 Server
©
Stateful DHCPv6 Configuration
Configuring Router as a Stateful DHCPv6 Server
DNS Server
2001:DB8:CAFE:9::99
G0/1
:1
2001:DB8:CAFE:2/64
RA
M=1
DHCPv6
Router(config)# ipv6 unicast-routing
Can be a /64
Router(config)# ipv6 dhcp pool IPV6-STATEFUL
Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2:DEED::/80
Router(config-dhcpv6)# dns-server 2001:DB8:CAFE:9::99
Router(config-dhcpv6)# domain-name www.example.com
Router(config)# interface GigabitEthernet 0/1
Router(config-if)# ipv6 address 2001:DB8:CAFE:2::1/64
Router(config-if)# ipv6 address FE80::1 link-local
Router(config-if)# ipv6 nd managed-config-flag
Router(config-if)# ipv6 dhcp server IPV6-STATEFUL
©
Including Specific Addresses
Router(config-dhcpv6)# address prefix 2001:DB8:CAFE:2:DEED::/80
2001:DB8:CAFE:2::/64
2001:DB8:CAFE:2:0:0:0:0
2001:DB8:CAFE:2:FFFF:FFFF:FFFF:FFFF
/64
Available
addresses for this
network
/80
2001:DB8:CAFE:2:DEED::/80
2001:DB8:CAFE:2:DEED:0:0:0
2001:DB8:CAFE:2:DEED:0:0:1
2001:DB8:CAFE:2:DEED:0:0:2
INCLUDED assigned
addresses will have
these 80 bits.
. . .
All other addresses
are EXCLUDED
©
Verifying Stateful DHCPv6 Server Configuration
DNS Server
2001:DB8:CAFE:9::99
G0/1
:1
2001:DB8:CAFE:2/64
RA
M=1
DHCPv6
PC> ipconfig /all
Physical Address. .
IPv6 Address. . . .
Default Gateway . .
DNS Servers . . . .
Connection-specific
. .: 00-21-9B-88-0E-40
. .: 2001:db8:cafe:2:deed:2de8:cfd8:5
. .: fe80::1
. .: 2001:db8:cafe:9::99
DNS Suffix Search List: www.example.com
©
Verifying Stateful DHCPv6 Server Configuration
DNS Server
2001:DB8:CAFE:9::99
G0/1
:1
2001:DB8:CAFE:2/64
RA
M=1
DHCPv6
Router# show ipv6 interface gigabitethernet 0/1
GigabitEthernet 0/1 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::1
Global unicast address(es):
2001:DB8:CAFE:2::1, subnet is 2001:DB8:CAFE:2::/64
<output omitted>
Hosts use DHCP to obtain routable addresses.
Router#
©
DHCPv6 Prefix Delegation Process
(If there is time)
DHCPv4 and Private Addresses for the Home
NAT
ISP
DHCPv4
G0/1
Public IPv4 Address
for the interface
G0/1
HOME
DHCPv4
G0/0
Private IPv4 Address
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
• ISP only has to deliver a public IPv4 address for Home router interface.
• DHCPv4 and RFC 1918 private address space is used for home
network.
• NAT is used for translation – but has its drawbacks!
• No NAT between private-public IPv6 (always in debate)
©
The World of IPv6 and DHCPv6-PD
Complete IPv6 Reachability
Delegating
Router (DR)
ISP-DR
Requesting
Router (RR)
G0/1
G0/1 HOME-RR G0/0
Global IPv6 Address
DHCPv6-PD REQUEST
2
1
Global IPv6 Address
3
RA with prefix
DHCPv6-PD REPLY
©
Thank you and
STEAL MY STUFF!
www.cabrillo.edu/~rgraziani/ipv6.html
Username = cisco
Password = perlman
©