The following article is an excerpt from the APNIC Academy’s Juniper SLAAC/DHCPv6 Router Lab exercise. The APNIC Academy also features virtual labs for SLAAC/DHCPv6 using Cisco and Mikrotik routers, as well as full mesh routing environments for you to learn about BGP, OSPF, IS-IS, NetFlow, SNMP, NETCONF and much more.
Part 1: Setting up
The network topology for setting up SLAAC/DHCPv6 is below. We will only be dealing with the configuration of Router R1 and Linux host H1.
Note: Your vSRX needs to be running in packet mode (that is, as a router, not a firewall) for this exercise. You can check this with the following command:
> show security flow status Flow forwarding mode: Inet forwarding mode: packet based Inet6 forwarding mode: packet based MPLS forwarding mode: packet based ISO forwarding mode: packet based ...
If your vSRX isn’t in packet mode, issue this command to enable IPv6 (and any other address families as desired) then commit and reboot.
set security forwarding-options family inet6 mode packet-based
Your router should have a minimal operational configuration. If you need help getting your router up and running from scratch, consult the Juniper SLAAC/DHCPv6 Router Lab.
Part 2: Configuring SLAAC
There are multiple ways to assign an IPv6 address to a host interface. In this section, let’s look at using Stateless Address Auto-Configuration (SLAAC). The router will be configured to advertise an IPv6 prefix. The host uses the 64-bit prefix from the router, and assigns the rest randomly or using EUI-64 to complete the 128-bit address.
With your router in configure mode, assign an IPv6 address to physical and loopback interfaces.
edit interfaces ge-0/0/0 unit 0 family inet6 set address 2406:6400:0:100::1/64 top edit interfaces lo0 unit 0 family inet6 set address 2406:6400::1/128
Configure the router to send router advertisements (RA) for the /64 prefix via ge-0/0/0.
set protocols router-advertisement interface ge-0/0/0 prefix 2406:6400:0:100::/64
Now verify the changes.
show interfaces show protocols router-advertisement
Optional – Set a trace for neighbour discovery (ND) events to help with troubleshooting.
edit protocols router-advertisement traceoptions set file ipv6-nd-trace set flag all
You may want to limit how much is logged by altering the ‘all’ flag to something more specific.
Show your changes before you commit.
show | compare
If you’re happy with the changes, then commit.
commit check commit and-quit
View the updated configuration.
run show configuration
Part 3: Verifying SLAAC
From your connected host, check that your interface has an IPv6 address. The address should look something like 2406:6400:0:100:x:x:x:x where the x:x:x:x ( the 64-bit interface ID) is generated randomly, as per RFC 4941.
If your interface doesn’t have an IPv6 address, toggle it.
sudo ifconfig ens32 down sudo ifconfig ens32 up
Once you have your IPv6 address, try pinging the router.
Now check the output of the following show commands on the router. It should show some statistics on messages sent and received.
root@R1> show ipv6 neighbors IPv6 Address Linklayer Address State Exp Rtr Secure Interface 2406:6400:0:100:d9:fd58:b528:39d3 00:0c:29:51:30:1d stale 811 no no ge-0/0/0.0 2406:6400:0:100:e01b:f078:3c2:2926 00:0c:29:ba:5b:af stale 1005 no no ge-0/0/0.0 fe80:6829:826e:fcfe:85dc 00:0c:29:51:30:1d stale 775 no no ge-0/0/0.0 root@R1> show ipv6 router-advertisement Interface: ge-0/0/0.0 Advertisements sent: 4, last sent 00:07:38 ago Solicits received: 1, last received 00:07:38 ago Advertisements received: 0 Solicited router advertisement unicast: Disabled
Since you have enabled an IPv6 ND trace on the router, you should see ICMPv6 ND messages being exchanged between the router and the client hosts. Issue the following command from the operational mode to check.
show log ipv6-nd-trace
or from JunOS shell, run:
tail -f /var/log/ipv6-nd-trace
You should see something similar to the log below.
root@R1> show log ipv6-nd-trace Nov 10 05:27:32 trace_on: Tracing to "/var/log/ipv6-nd-trace" started Nov 10 05:27:32 369657 ipv6_ra_ifIchange(Router-Advertisement): ifl 0x9e44d80 ifl ge-0/0/0.0 72 change 0. intf 0x9de2280
Part 4: Configuring stateless DHCPv6
In this part, we will configure the router as the DHCP server. The client gets an IPv6 address using SLAAC, then looks for a DHCPv6 server to get other information such as a DNS server address.
In configuration mode, update the RA to tell the client to look for a DHCP server for additional information.
edit protocols router-advertisementset interface ge-0/0/0.0 other-stateful-configuration
Configure the router as a DHCPv6 server, with a DHCPv6 pool named STATELESS-DHCPV6.
edit system services dhcp-local-server dhcpv6 group STATELESS-DHCPV6 set overrides interface-client-limit 10 set overrides process-inform pool STATELESS-DHCPV6
Bind the DHCPv6 server to an interface.
edit system services dhcp-local-server dhcpv6 set group STATELESS-DHCPV6 interface ge-0/0/0
Add DHCPv6 attributes, including DNS and lease time. These attributes will be passed on to the client.
edit access address-assignment pool STATELESS-DHCPV6 family inet6 set prefix 2406:6400:0:100::/64set dhcp-attributes dns-server 2406:6400::53 set dhcp-attributes maximum-lease-time 120 grace-period 3600
Verify the changes.
show system services show protocols router-advertisement show access address-assignment
And commit when you are happy with the candidate configuration.
show | compare commit check commit
Part 5: Verify DHCPv6
Toggle your host’s interface.
sudo ifconfig downsudo ifconfig up
Check that you are still being assigned an address by SLAAC — the address should look something like 2406:6400:0:100:x:x:x:x.
Verify that other information such as a DNS server address is being received from the DHCPv6 server.
cat /var/lib/dhcp/dhclient.leases | grep dhcp-server-identifier
Make sure you can still ping the router.
From the router’s operational mode, display the address bindings.
root@R1> show dhcpv6 server binding Prefix Session Id Expires State Interface Clinet DUID 2406:6400:0:100:a9a3:ba70:bc37:1887/128 5 109 BOUND ge-0/0/0.0 LL_TIME0X1-0x2379336c-00:0c:29:7b:f4:45
Display the DHCPv6 statistics. Confirm that DHCPV6_INFORMATION_REQUEST messages were received.
root@R1> show dhcpv6 server statistics Dhcpv6 Packets dropped: Total 0 Messages received: DHCPV6_DECLINE 0 DHCPV6_SOLICIT 0 DHCPV6_INFORMATION_REQUEST 10 DHCPV6_RELEASE 0 DHCPV6_REQUEST 0 DHCPV6_CONFIRM 0 DHCPV6_RENEW 0 DHCPV6_REBIND 2 DHCPV6_RELAY_FORW 0 DHCPV6_LEASEQUERY 0 Messages sent: DHCPV6_ADVERTISE 0 DHCPV6_REPLY 0 DHCPV6_RECONFIGURE 0 DHCPV6_RELAY_REPL 0 DHCPV6_LEASEQUERY_REPLY 0 DHCPV6_LEASEQUERY_DATA 0 DHCPV6_LEASEQUERY_DONE 0
Congratulations! You’ve now configured SLAAC and DHCPv6 on your Juniper vSRX. For more hands-on virtual labs, visit the APNIC Academy.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.