DHCPv6 server MAC address logging
One of the
differences between DHCPv6 and DHCPv4 is that it uses DUID as an identifier
instead of a MAC address.
As you probably know, DUID's are for the majority of OS (ie Windows) based on a timestamp suffixed by a MAC address
As you probably know, DUID's are for the majority of OS (ie Windows) based on a timestamp suffixed by a MAC address
For some of our
internal systems we use a MAC as an identifier, for now we will also be needing this for IPv6. The default ISC DHCPv6
daemon isn't logging a MAC address by default. One way to have it print out is
by adding this to your DHCP config.
option dhcp6.macaddr code 193 = string;
option dhcp6.leased-address code 194 = string;
option dhcp6.macaddr = binary-to-ascii(16, 8, ":", suffix(option dhcp6.client-id, 6));
option dhcp6.leased-address = binary-to-ascii(16,16, ":", substring(suffix(option dhcp6.ia-na, 24),0,16));
log (info, concat ("Lease for ",config-option dhcp6.leased-address, " leased to ", config-option dhcp6.macaddr));
Above code will only work for DUID-LLT and DUID-LL (so not DUID-EN, but I don't know anyone using this at the moment)
More info over DUID on http://tools.ietf.org/html/rfc6355
Other great blogpost
about DHCPv6 at http://ipv6friday.org/blog/2011/12/dhcpv6/
DHCPv6 relay configuration on Cisco equipment
Overview of the configuration we're using on our routers.
(1) We're using
FE80:: as our IPv6 default gateway everywhere, seems to work for me for now ;) any best practices for this? (update: because of issues with linux and fe80:: (linux responds to fe80:: if it's specified on any link, this has now changed to FE80::1)
(2) Asking the hosts
on the subnet to not do SLAAC please, we're asking you nicely.
(3) Letting the
hosts know we're managing the config, that they must use DHCPv6.
(4) Just to be sure
also set this flag, tell them to use DHCPv6 not only for getting an IP but also
for getting e.g. DNS servers
(5) We're the boss
on this subnet.
(6) relay DHCPv6
requests to our server and use (7) the loopback as a source for this.
We're using
link-local addresses for routing, so if we don't specifiy an source-interface,
the relay agents would try to use a link-local address which obviously can not
be routed.
Interface vlan42
ipv6 address FE80::1 link-local (1)
ipv6 address 2001:0db8:100:4200::1/64
ipv6 nd prefix default 2592000 604800 no-autoconfig (2)
ipv6 nd managed-config-flag (3)
ipv6 nd other-config-flag (4)
ipv6 nd router-preference High (5)
ipv6 dhcp relay destination 2001:0db8:0:40::547:1 (6)
ipv6 dhcp relay source-interface Loopback0 (7)
interface Loopback0
ipv6 address 2001:0db8:300::63/128
