Junos OS

I use dhcp for delegate a prefix for clients.

Using radius parameter: Delegated-IPv6-Prefix

Configuration:

set system services dhcp-local-server dhcpv6 group group-pppoe overrides multi-address-embedded-option-response
set system services dhcp-local-server dhcpv6 group group-pppoe interface pp0.0

For CPE Wan I use router advertisement

Using Radius parameter: Framed-IPv6-Prefix

Configuration:

set dynamic-profiles PPPOE-PROFILE protocols router-advertisement interface "$junos-interface-name" prefix $junos-ipv6-ndra-prefix

I've a lot of CPE prefering the NDRA address using DHCP insted of SLAAC. So I have to many dhcp solicits flood:

12:55:37.613430 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:37.613634 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise
12:55:38.625374 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 request
12:55:38.625536 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 reply
12:55:38.805517 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:38.806129 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise
12:55:39.816850 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 request
12:55:39.817002 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 reply
12:55:42.121527 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:42.122034 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise
12:55:42.886552 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 request
12:55:42.886719 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 reply
12:55:43.630131 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:43.630886 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise
12:55:44.414257 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 request
12:55:44.414446 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 reply
12:55:45.548878 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:45.549601 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise
12:55:46.265599 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 request
12:55:46.265750 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 reply
12:55:46.473938 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:46.474152 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise
12:55:47.485372 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 request
12:55:47.485548 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 reply
12:55:48.643573 In IP6 fe80::yyyy:yyyy:yyyy:yyyy.546 > ff02::1:2.547: dhcp6 solicit
12:55:48.643867 Out IP6 fe80::xxxx:xxxx:xxxx:xxxx.547 > fe80::yyyy:yyyy:yyyy:yyyy.546: dhcp6 advertise

Instead of changing all my CPEs for RA - SLAAC is that possible to use DHCP for Framed-IPv6-Prefix parameter? Or use RA and DHCP, whenever the CPE preference?

HI,

You can use DHCPv6 IANA for CPE WAN and IAPD for LAN.

Please note IANA you need to use /128. Framed-IPv6-Prefix as /128 or configure pool with prefix-length as /128.

Regards,
Rahul

Hi,

Please find the below link.

https://www.juniper.net/documentation/en_US/junos/topics/concept/subscriber-management-dual-stack-dhcpv6-iana-plus-pd.html

Regards,

Rahul

I'm testing it and when I use /128  the CPE interface won't get fe80 gateway, so can't access any ipv6 address.

Hi,

How are you assigning the address? In case you're using pool, loopback address should match the subnet like we do for DHCPv4.

Are you seeing access and access-internal route under inet6.0?

Regards,

Rahul

Yes,

I can see routes

Working for router advertisement Framed-IPv6-Prefix /64 and ipv4 /32

If I change radius Framed-IPv6-Prefix to a /128 route I also get the correct internal routes:

show route | match Access | count
Count: 2 lines

but remote end (cpe) doesn't get the gateway. 

The thing is:

If I use dhcp ia-na the default gateway is not advertised. I think that protocol just is able to advertise address and dns.

set system services dhcp-local-server dhcpv6 group group-pppoe overrides multi-address-embedded-option-response
set system services dhcp-local-server dhcpv6 group group-pppoe interface pp0.0

So I enabled router advertisement.

set dynamic-profiles PPPOE-PROFILE protocols router-advertisement interface "$junos-interface-name" managed-configuration
set dynamic-profiles PPPOE-PROFILE protocols router-advertisement interface "$junos-interface-name" other-stateful-configuration

Now I get a default gateway but after I get a dhcp address from ia-na the default gateway continues but I can't ping any ipv6 anymore neither the junos lo0 inet6.

set access address-assignment pool v6-ia-na-pool family inet6 prefix 2001:db8:1000:0000::/64
set access address-assignment pool v6-ia-na-pool family inet6 range v6-range-0 low 2001:db8:1000::2/128
set access address-assignment pool v6-ia-na-pool family inet6 range v6-range-0 high 2001:db8:1000::ffff:ffff/128

set interfaces lo0 unit 0 family inet6 address 2001:db8:1000::1/128 primary
set interfaces lo0 unit 0 family inet6 address 2001:db8:1000::1/128 preferred

show route 2001:db8:1000::17/128 

2001:db8:1000::17/128
*[Access-internal/12] 00:01:56
Private unicast

I capture packets and CPE receives juniper ping echo request but can't send back the echo reply.

When you're using DHCPv6 PD, there is no need to configure router-advertisement under the dynamic-profile as it is used for IPv6 NDRA.

Do you have below configuration?

But if the CPE is a direct station like a windows or linux machine can't get ipv6 default route since dhcp client will not solicit a pd

Example:

CPE link local:
fe80::285d:ae27:22da:c301

Juniper dhcp needs advertise the ipv6 address 2001:db8:1000:0000:285d:ae27:22da:c301/128

For test I have done:

set access address-assignment pool v6-ia-na-pool family inet6 prefix 2001:db8:1000:0000::/64
set access address-assignment pool v6-ia-na-pool family inet6 range v6-range-0 low 2001:db8:1000:0000:285d:ae27:22da:c301/128
set access address-assignment pool v6-ia-na-pool family inet6 range v6-range-0 high 2001:db8:1000:0000:285d:ae27:22da:c301/128

So now we have to find a way that juniper dhcp server advertise a ia-na address generated from the CPE mac address to match the CPE link local.

finally working! 

The workaround is to use both methods with a trick.

For a windows operating system if we have multiple addresses the choice will be the greater one.

For instance 2001:db8 is greater than 2002:db8. So windows will prefer 2002:db8 address. Since my public prefix ($junos-ipv6-ndra-prefix) is greater, so will be the one to take precedence over dhcp address. 

set dynamic-profiles PPPOE-PROFILE protocols router-advertisement interface "$junos-interface-name" no-managed-configuration
set dynamic-profiles PPPOE-PROFILE protocols router-advertisement interface "$junos-interface-name" other-stateful-configuration
set dynamic-profiles PPPOE-PROFILE protocols router-advertisement interface "$junos-interface-name" prefix $junos-ipv6-ndra-prefix

set access address-assignment pool v6-ia-na-pool family inet6 prefix 2001:db8:1000:0000::/64
set access address-assignment pool v6-ia-na-pool family inet6 range v6-range-0 low 2001:db8:1000::2/128
set access address-assignment pool v6-ia-na-pool family inet6 range v6-range-0 high 2001:db8:1000::ffff:ffff/128

Now time to test for others devices and operating systems 🙂