DHCPv6 server - Deny Unknown Clients ignored?

SteveITS

If I set "Deny Unknown Clients" to "Allow known clients from only this interface, only DUIDs listed in static mappings on this interface will get an IP address within this scope/range" other DUIDs are assigned an IP. In DHCPv4 Server, other requests are correctly refused (though "Ignore Denied Clients" instead of reject doesn't seem to always work...). Am I missing something or does this not work correctly in DHCPv6?

I'm using ISC DHCP on 24.03 but there are no changes in the release notes for DHCPv6 in 24.11.

I am trying to automate IPv6 delegation so inbound routes are set up automatically, but need to limit what routers receive IPv6.

Bob.Dig

@SteveITS I did a quick test and here it does work like it should (Windows).
Edit: Ops sry, I am using Kea on 24.11.

SteveITS

@Bob-Dig Hmmm. Not sure what would differ then. I can test again but would prefer to wait until the weekend, or maybe late at night.

I can set it up statically but per my other thread that you responded to, the route for the delegated subnet (pointing to the internal router) is lost if the ISP router restarts, either in that router or in my "outside"/building router.

SteveITS

@Bob-Dig said in DHCPv6 server - Deny Unknown Clients ignored?:

Ops sry, I am using Kea on 24.11.

Hmm, I didn't see the edit. That may be the important point. On ISC I have tried again and what I see is weird:

If I have it set to allow only known from this interface, and enter an incorrect DUID, no leases happen (during the time I had it running, a while).

If I have it set the same but enter the correct DUID, the lease happens but a route isn't set up. Other leases to other routers DO incorrectly happen and routes may or may not be set up (comparing the leases page to the routes page).

Now the last part might well be because it was running for an hour or so and not just a half hour but it seems like the other routers should have pulled leases at some point along the way. I have no control over those routers though.