# DHCPv6 Server in VyOS

> DHCPv6 server in VyOS - automatic IPv6 address assignment, Prefix Delegation, DUID, static mappings, and integration with SLAAC

Source: https://opennix.org/en/docs/vyos/services/vyos-dhcpv6/



DHCPv6 (Dynamic Host Configuration Protocol for IPv6) is a protocol for automatically configuring IPv6 addresses and network parameters for clients. VyOS provides a full-featured DHCPv6 server for centralized management of IPv6 addressing on the network.

## Overview

DHCPv6 is used for:

- **Automatic IPv6 address assignment**: Centralized address management
- **Parameter configuration**: DNS servers, search domain, NTP servers
- **Static reservations**: Fixed addresses for servers and equipment
- **Prefix delegation**: Delegating prefixes to routers (DHCPv6-PD)
- **Integration with SLAAC**: Working together with Router Advertisement

### DHCPv6 vs SLAAC

| Feature | DHCPv6 | SLAAC (Stateless) |
|----------------|--------|-------------------|
| Address assignment | Stateful (server controls) | Stateless (client generates) |
| DNS servers | Yes | Via RDNSS (RA) |
| Search domain | Yes | Via DNSSL (RA) |
| Centralized management | Yes | Limited |
| Static reservations | Yes | No |
| Client tracking | Yes (lease tracking) | No |

**Operating modes**:
- **Stateful DHCPv6**: Full address management (managed flag in RA)
- **Stateless DHCPv6**: Parameters only, addresses via SLAAC (other-config flag)
- **Hybrid**: SLAAC for addresses + DHCPv6 for parameters

## Basic Configuration

### Simple DHCPv6 server

```bash
# Shared network for DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200

# DNS servers
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844

# Search domain
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com

# Apply on interface
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save
```

### Router Advertisement for managed mode

DHCPv6 requires Router Advertisement to inform clients:

```bash
# Router Advertisement on the interface
set service router-advert interface eth1 prefix 2001:db8:1::/64

# Managed flag (clients use DHCPv6 for addresses)
set service router-advert interface eth1 managed-flag

# Other-config flag (clients use DHCPv6 for parameters)
set service router-advert interface eth1 other-config-flag

commit
save
```

### Static reservation (static mapping)

```bash
# Static reservation by DUID
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 identifier 00:01:00:01:12:34:56:78:ab:cd:ef:01:23:45
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 ipv6-address 2001:db8:1::10

commit
save
```

**Note**: DHCPv6 uses a DUID (DHCP Unique Identifier) instead of a MAC address.

## Advanced Configuration

### Stateless DHCPv6 (parameters only)

```bash
# DHCPv6 for parameters (without addresses)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com

# Do NOT set address-range (clients get addresses via SLAAC)

set service dhcpv6-server shared-network-name LAN interface eth1

# Router Advertisement without managed flag
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 other-config-flag  # Parameters only

commit
save
```

### DHCPv6 Prefix Delegation (PD)

Prefix Delegation allows delegating IPv6 prefixes to downstream routers:

```bash
# Prefix delegation pool
set service dhcpv6-server shared-network-name LAN subnet 2001:db8::/48 prefix-delegation prefix 2001:db8:1000::/52 delegated-length 56

# Apply on interface
set service dhcpv6-server shared-network-name LAN interface eth1

commit
save
```

The downstream router will request a /56 prefix from the pool 2001:db8:1000::/52.

### Multiple shared networks

```bash
# LAN 1
set service dhcpv6-server shared-network-name LAN1 subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN1 subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN1 interface eth1

# LAN 2
set service dhcpv6-server shared-network-name LAN2 subnet 2001:db8:2::/64 address-range start 2001:db8:2::100 stop 2001:db8:2::200
set service dhcpv6-server shared-network-name LAN2 subnet 2001:db8:2::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN2 interface eth2

commit
save
```

### Lease time configuration

```bash
# Lease time configuration
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time default 86400  # 24 hours
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time minimum 3600   # 1 hour
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time maximum 172800 # 48 hours

commit
save
```

### NTP and SIP servers

```bash
# NTP servers via DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 nis-server 2001:db8:1::50

# SIP servers (for VoIP)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 sip-server-address 2001:db8:1::60

commit
save
```

### Vendor options

```bash
# Vendor-specific options
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 vendor-option cisco option 1 value 'option-value'

commit
save
```

## Configuration Examples

### Example 1: Basic managed DHCPv6

```bash
# DHCPv6 server
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 managed-flag
set service router-advert interface eth1 other-config-flag

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

commit
save
```

### Example 2: Stateless DHCPv6 + SLAAC

```bash
# DHCPv6 for parameters only (without addresses)
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
set service dhcpv6-server shared-network-name LAN interface eth1

# Router Advertisement for SLAAC (without managed flag)
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 other-config-flag  # Parameters only via DHCPv6

# IPv6 on the interface
set interfaces ethernet eth1 address 2001:db8:1::1/64

commit
save
```

### Example 3: Static reservations for servers

```bash
# DHCPv6 pool
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN interface eth1

# Static reservations
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping web-server identifier 00:01:00:01:aa:bb:cc:dd:11:22:33:44:55:66
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping web-server ipv6-address 2001:db8:1::10

set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping db-server identifier 00:01:00:01:aa:bb:cc:dd:77:88:99:aa:bb:cc
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping db-server ipv6-address 2001:db8:1::11

set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping dns-server identifier 00:01:00:01:aa:bb:cc:dd:dd:ee:ff:00:11:22
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping dns-server ipv6-address 2001:db8:1::53

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:1::/64
set service router-advert interface eth1 managed-flag

commit
save
```

### Example 4: DHCPv6 Prefix Delegation for branch offices

**Head office (delegates prefixes)**:

```bash
# DHCPv6 with Prefix Delegation
set service dhcpv6-server shared-network-name WAN subnet 2001:db8::/48 prefix-delegation prefix 2001:db8:1000::/52 delegated-length 56
set service dhcpv6-server shared-network-name WAN interface eth0

# Router Advertisement on WAN
set service router-advert interface eth0 prefix 2001:db8::/64

# IPv6 on the WAN interface
set interfaces ethernet eth0 address 2001:db8::1/64

commit
save
```

**Branch office (requests prefix delegation)**:

```bash
# DHCPv6 client to obtain a prefix
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 address 1
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 sla-id 0

# Router Advertisement on LAN for clients
set service router-advert interface eth1 prefix ::/64  # The delegated prefix will be used

commit
save
```

### Example 5: Multiple VLANs with DHCPv6

```bash
# VLAN 10 - Management
set interfaces ethernet eth1 vif 10 address 2001:db8:10::1/64
set service dhcpv6-server shared-network-name MGMT subnet 2001:db8:10::/64 address-range start 2001:db8:10::100 stop 2001:db8:10::150
set service dhcpv6-server shared-network-name MGMT subnet 2001:db8:10::/64 name-server 2001:db8:10::53
set service dhcpv6-server shared-network-name MGMT interface eth1.10

set service router-advert interface eth1.10 prefix 2001:db8:10::/64
set service router-advert interface eth1.10 managed-flag

# VLAN 20 - Users
set interfaces ethernet eth1 vif 20 address 2001:db8:20::1/64
set service dhcpv6-server shared-network-name USERS subnet 2001:db8:20::/64 address-range start 2001:db8:20::100 stop 2001:db8:20::500
set service dhcpv6-server shared-network-name USERS subnet 2001:db8:20::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name USERS interface eth1.20

set service router-advert interface eth1.20 prefix 2001:db8:20::/64
set service router-advert interface eth1.20 managed-flag

# VLAN 30 - Guest (stateless)
set interfaces ethernet eth1 vif 30 address 2001:db8:30::1/64
set service dhcpv6-server shared-network-name GUEST subnet 2001:db8:30::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name GUEST interface eth1.30

set service router-advert interface eth1.30 prefix 2001:db8:30::/64
set service router-advert interface eth1.30 other-config-flag  # Stateless

commit
save
```

### Example 6: DHCPv6 with VRF

```bash
# VRF for isolation
set vrf name CUSTOMER-A table 100

# Interface in VRF
set interfaces ethernet eth1 vrf CUSTOMER-A
set interfaces ethernet eth1 address 2001:db8:100::1/64

# DHCPv6 in VRF
set service dhcpv6-server shared-network-name VRF-A subnet 2001:db8:100::/64 address-range start 2001:db8:100::100 stop 2001:db8:100::200
set service dhcpv6-server shared-network-name VRF-A subnet 2001:db8:100::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name VRF-A interface eth1

# Router Advertisement
set service router-advert interface eth1 prefix 2001:db8:100::/64
set service router-advert interface eth1 managed-flag

commit
save
```

## Monitoring and Diagnostics

### Viewing active leases

```bash
# Show all DHCPv6 leases
show dhcpv6 server leases

# Example output:
# IPv6 address       DUID                                          State
# 2001:db8:1::100    00:01:00:01:12:34:56:78:aa:bb:cc:dd:ee:ff    active
```

### Viewing statistics

```bash
# DHCPv6 server statistics
show dhcpv6 server statistics

# Output includes:
# - Number of active leases
# - Available addresses in the pool
# - Pool utilization (%)
```

### Checking the configuration

```bash
# Show DHCPv6 configuration
show configuration service dhcpv6-server

# Show Router Advertisement
show configuration service router-advert
```

### DHCPv6 logs

```bash
# DHCPv6 server logs
show log | match dhcpv6

# Real-time monitoring
monitor log | match dhcpv6

# Detailed logs (if debug is enabled)
show log dhcp6
```

### Checking the client DUID

On the client (Linux):

```bash
# View DUID
cat /var/lib/dhcp/dhclient6.leases | grep ia-na

# Windows PowerShell
Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv6Address

# macOS
ipconfig getv6packet en0
```

### Testing from the client

```bash
# Linux - request a DHCPv6 address
sudo dhclient -6 -v eth0

# View the obtained address
ip -6 addr show eth0

# View DNS received via DHCPv6
cat /etc/resolv.conf
```

### Checking Router Advertisement

```bash
# On the router
show ipv6 route

# Send RA manually (for testing)
sudo radvdump

# On the client (Linux)
ip -6 route show
```

## Troubleshooting

### Issue: Clients do not receive IPv6 addresses

**Diagnostics**:

```bash
# 1. Check DHCPv6 configuration
show configuration service dhcpv6-server

# 2. Check Router Advertisement
show configuration service router-advert

# 3. Check IPv6 forwarding
sysctl net.ipv6.conf.all.forwarding

# 4. Logs
show log | match dhcpv6

# 5. Check the interface
show interfaces ethernet eth1
```

**Solution**:

```bash
# Make sure managed-flag is set
set service router-advert interface eth1 managed-flag

# Check the address-range
show configuration service dhcpv6-server shared-network-name LAN

# Restart the service (if necessary)
restart dhcpv6 server

commit
save
```

### Issue: DHCPv6 works, but there is no DNS

**Cause**: DNS is delivered only via DHCPv6 or RDNSS in the RA.

**Solution**:

```bash
# Add name-server in DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888

# Or use RDNSS in Router Advertisement
set service router-advert interface eth1 name-server 2001:4860:4860::8888

commit
save
```

### Issue: Static reservation does not work

**Cause**: Incorrect DUID.

**Diagnostics**:

```bash
# Check the DUID in the logs
show log | match dhcpv6 | match DUID

# On the client (Linux)
cat /var/lib/dhcp/dhclient6.leases
```

**Solution**:

```bash
# Use the correct DUID from the logs
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 identifier <correct-duid>
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping server1 ipv6-address 2001:db8:1::10

commit
save

# Renew the lease on the client
# Linux: sudo dhclient -6 -r eth0 && sudo dhclient -6 eth0
```

### Issue: Prefix Delegation does not work

**Diagnostics**:

```bash
# On the server - check the PD configuration
show configuration service dhcpv6-server | match prefix-delegation

# On the client - check dhcpv6-options
show configuration interfaces ethernet eth0 dhcpv6-options

# Logs
show log | match "prefix delegation"
```

**Solution**:

```bash
# On the server - make sure PD is configured
set service dhcpv6-server shared-network-name WAN subnet 2001:db8::/48 prefix-delegation prefix 2001:db8:1000::/52 delegated-length 56

# On the client - configure PD
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 address 1
set interfaces ethernet eth0 dhcpv6-options prefix-delegation interface eth1 sla-id 0

commit
save
```

### Issue: DHCPv6 pool exhausted

**Diagnostics**:

```bash
# Check leases
show dhcpv6 server leases

# Utilization statistics
show dhcpv6 server statistics
```

**Solution**:

```bash
# Expand the address-range
delete service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::500

# Or reduce the lease time
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time default 3600  # 1 hour

commit
save
```

### Issue: Clients get addresses via SLAAC instead of DHCPv6

**Cause**: The managed flag is not set in the RA.

**Solution**:

```bash
# Set managed-flag
set service router-advert interface eth1 managed-flag

# Restart RA
restart router-advert

commit
save

# Refresh the configuration on the clients
# Linux: sudo dhclient -6 -r eth0 && sudo dhclient -6 eth0
```

## Best Practices

### 1. Choosing the right mode

```bash
# Managed DHCPv6 - for full control
set service router-advert interface eth1 managed-flag

# Stateless - for simplicity (SLAAC + DHCPv6 parameters)
set service router-advert interface eth1 other-config-flag
```

### 2. Reserving addresses for critical services

```bash
# Static reservations for servers
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping critical-server identifier <duid>
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping critical-server ipv6-address 2001:db8:1::10
```

### 3. Proper pool sizing

Plan the address-range size with some headroom:

```bash
# For 100 clients - a pool of 200-300 addresses
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::400
```

### 4. DNS configuration

Always configure DNS servers:

```bash
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8888
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:4860:4860::8844
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 domain-search example.com
```

### 5. Monitoring pool utilization

Check utilization regularly:

```bash
show dhcpv6 server statistics
```

### 6. Lease time for different scenarios

```bash
# Stable network - long lease time
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 lease-time default 86400  # 24 hours

# Guest network - short lease time
set service dhcpv6-server shared-network-name GUEST subnet 2001:db8:30::/64 lease-time default 3600  # 1 hour
```

### 7. Documenting static reservations

Document all static mappings:

```bash
# Comments in the configuration
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 static-mapping web-server ipv6-address 2001:db8:1::10
# Web server - Apache, production
```

### 8. Security

Use a firewall to protect DHCPv6:

```bash
set firewall ipv6 name LAN_LOCAL rule 100 action accept
set firewall ipv6 name LAN_LOCAL rule 100 protocol udp
set firewall ipv6 name LAN_LOCAL rule 100 destination port 546-547
```

### 9. Integration with DHCPv4

Maintain dual-stack:

```bash
# DHCPv4
set service dhcp-server shared-network-name LAN subnet 192.168.1.0/24 default-router 192.168.1.1

# DHCPv6
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 address-range start 2001:db8:1::100 stop 2001:db8:1::200
```

### 10. Logging and monitoring

Set up logging for auditing:

```bash
set system syslog file dhcpv6.log facility daemon level info
```

## Useful Commands

```bash
# Show DHCPv6 leases
show dhcpv6 server leases

# Statistics
show dhcpv6 server statistics

# DHCPv6 configuration
show configuration service dhcpv6-server

# Router Advertisement configuration
show configuration service router-advert

# Logs
show log | match dhcpv6
monitor log | match dhcpv6

# Restart DHCPv6 server
restart dhcpv6 server

# Restart Router Advertisement
restart router-advert

# Check IPv6 connectivity
ping 2001:db8:1::100

# IPv6 routing table
show ipv6 route

# Check interfaces
show interfaces
```

## Integration with Other Features

### DHCPv6 + DNS Forwarding

```bash
# DHCPv6 points to the local DNS
set service dhcpv6-server shared-network-name LAN subnet 2001:db8:1::/64 name-server 2001:db8:1::1

# DNS Forwarding on the router
set service dns forwarding listen-address 2001:db8:1::1
set service dns forwarding name-server 2001:4860:4860::8888
```

### DHCPv6 + Firewall

```bash
# Allow DHCPv6 traffic
set firewall ipv6 name WAN_LOCAL rule 100 action accept
set firewall ipv6 name WAN_LOCAL rule 100 protocol udp
set firewall ipv6 name WAN_LOCAL rule 100 source port 547
set firewall ipv6 name WAN_LOCAL rule 100 destination port 546
```

### DHCPv6 + High Availability

In an HA setup, the DHCPv6 pool must be split between routers or use failover (not yet supported directly in VyOS).

## Conclusion

The DHCPv6 Server in VyOS provides full-featured IPv6 addressing management for modern networks. Support for both stateful (managed) and stateless modes, prefix delegation, static reservations, and integration with Router Advertisement make VyOS a powerful platform for IPv6 deployments.

Key benefits of DHCPv6 in VyOS:
- Full control over IPv6 addressing
- Static reservations for critical devices
- Prefix Delegation for hierarchical networks
- Integration with SLAAC
- Centralized parameter management (DNS, NTP)

Recommendations for production:
- Choose the right mode (managed vs stateless)
- Plan the pool size with some headroom
- Use static reservations for servers
- Configure DNS and domain-search
- Monitor pool utilization
- Document all reservations
- Integrate with dual-stack (IPv4 + IPv6)
- Apply firewall rules for protection

DHCPv6 in VyOS delivers enterprise-grade management of IPv6 infrastructure with the configuration flexibility and reliability needed for production environments.