DHCPv6

Introduction: IPv6 host configuration

Moving from Internet Protocol version 4 (IPv4) to Internet Protocol version 6 (IPv6) changed how hosts obtain addresses and other parameters. IPv6 expanded the address space and added autoconfiguration mechanisms built on Neighbor Discovery. Host configuration therefore combines several cooperating mechanisms.

In IPv4, the Dynamic Host Configuration Protocol (DHCP) automates the assignment of addresses and network parameters. IPv6 adds a stateless address autoconfiguration mechanism called Stateless Address Autoconfiguration (SLAAC). A host can use SLAAC without a DHCPv6 server when a router advertises a suitable prefix. DHCPv6 complements this mechanism with address assignment, prefix delegation, and other parameters.

The result is DHCPv6. It has a role similar to DHCPv4, but uses its own messages, options, and identifiers. It coexists with SLAAC because routers still provide prefixes and routing information in Router Advertisements.

IPv6 autoconfiguration with SLAAC

Stateless Address Autoconfiguration (SLAAC) lets a host form an address from information in a Router Advertisement. In many IPv6 networks, a device can obtain a global unicast address without a DHCPv6 server when a router provides a suitable prefix. The process belongs to the Neighbor Discovery Protocol (NDP), which is part of the IPv6 protocol suite.

SLAAC: Router Advertisements

SLAAC relies on messages sent by routers on the local link. The host uses them to learn a prefix, a default router, and address lifetimes.

1. Router Solicitations: When an IPv6-enabled device joins a network, it sends a Router Solicitation message to the all-routers multicast group $ff02::2$. It requests a Router Advertisement.
2. Router Advertisements (RA): Routers periodically send Router Advertisement messages and may send one promptly after a solicitation. An RA contains information used by SLAAC:
   • Network prefix: For the $/64$ prefix used by SLAAC, this is the first 64 bits of an address, for example $2001:db8:acad::/64$.
   • Prefix lifetimes: A prefix has preferred and valid lifetimes that govern the use of addresses formed from it.
   • Default router: The host selects a router from the RA source link-local address and its Router Lifetime field. An RA does not carry a separate default-gateway address field.
   • Management flags: The one-bit "M" flag (Managed Address Configuration) indicates address availability through DHCPv6, while the "O" flag (Other Configuration) indicates other configuration data.
3. Address generation: The device receives a prefix and prefix length from the RA. For a $/64$ prefix, it generates the remaining 64 bits, called the Interface Identifier. This can be done in two common ways:
   • EUI-64: An older method derives a 64-bit identifier from a 48-bit MAC address using an expansion algorithm.
   • Random identifiers and privacy extensions: A host can use temporary identifiers that change over time, limiting tracking based on a stable interface identifier.
4. Uniqueness check: Before using the address, the host performs Duplicate Address Detection (DAD) to check whether another device on the link already uses it. After successful DAD, the address can be assigned to the interface. DAD checks link uniqueness; routability depends on the prefix.

Information provided with SLAAC

Basic SLAAC provides an address and a default router selection. DNS information can be carried in an RA through the RDNSS and DNSSL options, or obtained through DHCPv6. DHCPv6 is therefore one way to supplement SLAAC with DNS, NTP, and other parameters.

DHCPv6 modes of operation: the M and O flags

An IPv6 device can form an address through SLAAC, while DHCPv6 can assign addresses, delegate prefixes, and provide other options. The "M" and "O" flags in a Router Advertisement indicate which DHCPv6 services are available. They do not carry the address or default route themselves, because those values come from the relevant RA fields.

The DHCPv6 communication process

DHCPv6 uses UDP: clients listen on port 546, while servers and relay agents use port 547. It uses multicast instead of broadcast. A client starts discovery with the All DHCP Relay Agents and Servers multicast address ($ff02::1:2$). A server can reply directly to the client's link-local address; through a relay, the exchange uses RELAY-FORW and RELAY-REPL messages.

Basic four-message exchange

Stateful address assignment typically uses the following four-message exchange:

1. Solicit: The client sends a 'Solicit' message to $ff02::1:2$ while searching for a DHCPv6 server. This serves the discovery role of DHCPv4's Discover.
2. Advertise: An available server responds with an 'Advertise' message describing its service and offered parameters. A relay can return the response to the client's link.
3. Request: The client selects a server and sends a 'Request' message containing requested addresses or prefixes and other options. The server is selected from the message contents.
4. Reply: The server completes the assignment and sends a 'Reply' with addresses, lease times, and accepted options. This serves the acknowledgment role of DHCPv4's Acknowledge.

Two-message exchange: Rapid Commit

The "Rapid Commit" option can shorten the exchange. If a client includes it in a 'Solicit' message and the server supports it, the server can immediately respond with a 'Reply'. The assignment then uses two messages, Solicit and Reply, rather than the four-message sequence.

Information exchange without address assignment

For stateless configuration, the client sends an 'Information-Request' containing requested options. The server responds with a 'Reply' containing values such as DNS addresses, a domain list, or other configuration data, without assigning an address in an IA_NA.

DHCPv6 identifiers: DUID and IA

DHCPv6 uses two constructs for identifying clients and managing assignments: the DUID and the IA. The DUID identifies a client or server, while an IA groups addresses or delegated prefixes associated with one client.

DUID (DHCP Unique Identifier)

DHCPv4 can identify a client with a Client Identifier or a hardware address. DHCPv6 uses a DUID, an identifier for a client or server that should be unique within the served environment. A DUID is intended to remain stable when an interface changes, but its persistence depends on the implementation and storage. Several DUID types are defined:

• DUID-LLT (Link-Layer Address Plus Time): Combines a link-layer address, such as a MAC address, with the time when the DUID was created. Persistence requires keeping the identifier in stable storage.
• DUID-EN (Enterprise Number): Created by a vendor or organization from its enterprise number and an identifier that it assigns.
• DUID-LL (Link-Layer Address): Contains a hardware type and the interface's link-layer address without a time value.

The newer specification also defines DUID-UUID, which is based on a universally unique identifier (UUID).

IA (Identity Association)

An IA is a construct through which a client and server manage a collection of addresses, prefixes, and their leases. The client assigns an IA a unique IAID (Identity Association Identifier) so that associations of the same type can be distinguished. When requesting configuration, the client includes one or more IAs, and the server returns parameters grouped in the corresponding associations. This lets one client manage several interfaces, addresses, or prefixes. The main IA types are:

• IA_NA (Identity Association for Non-temporary Addresses): Used to request one or more ordinary IPv6 addresses with leases.
• IA_TA (Identity Association for Temporary Addresses): Used to request temporary IPv6 addresses through DHCPv6. Privacy mechanisms can also be implemented with temporary SLAAC interface identifiers.
• IA_PD (Identity Association for Prefix Delegation): Lets a delegating router request an IPv6 prefix from a DHCPv6 server, such as a provider's server. The router can advertise the delegated prefix on its downstream link and use SLAAC or its own DHCPv6 server to configure local devices.