DHCPv6 and IAID+DUID or other means of selecting IPs by interface

[jimp]

It may be possible in the underlying software (isc-dhcpd) but not yet in our GUI.

Are these two NICs plugged into the same subnet? I'm just wondering what the use case is where you need two DHCP NICs on a single host.

[yon]

@jimp:

It may be possible in the underlying software (isc-dhcpd) but not yet in our GUI.

Are these two NICs plugged into the same subnet? I'm just wondering what the use case is where you need two DHCP NICs on a single host.

Because the my mail server has install two mail server software. one for ipv4 mail server, and other for ipv6 ipv4 mail server.  such as: 192.168.101.3 NIC for ipv6 ipv4 mail server. 192.168.101.5 for ipv4 only mail server. its will has two 25 port can use in multi-wan.

[jimp]

That doesn't make any sense with respect to the DUID and DHCPv6. Does it have multiple interfaces? Do they both need unique DHCP IPs?

You should never, ever have multiple NICs in the same box on the same subnet just plugged into the same switch/vlan unless you're doing LAGG/LACP.

[yon]

@jimp:

That doesn't make any sense with respect to the DUID and DHCPv6. Does it have multiple interfaces? Do they both need unique DHCP IPs?

You should never, ever have multiple NICs in the same box on the same subnet just plugged into the same switch/vlan unless you're doing LAGG/LACP.

yes. I need stup static ipv4 and ipv6 address for client server.  because its have running a lot A variety of services. and I will do network link Aggregation.

[yon]

just I need like ipv4 MAC bind fixed ip for each NIC. Can I use IAID or MAC for ipv6?

[bardelot]

The server has only one DUID, not one per network interface. The link layer address of a (any of the available) interface is however often encoded into the DUID to guarantee uniqueness.

[jimp]

But why "each nic"? The DUID would only be the same on a single machine. You shouldn't be trying to plug multiple interfaces from the same machine into the same network, so a DUID conflict shouldn't be an issue.

We're looking into how to get the dhcpv6 daemon to go by MAC like the v4 version does. The new version of ISC DHCPD is supposed to support that but we haven't seen an example of the syntax yet.

[bardelot]

It matches the MAC address in the DUID, not the interface MAC.

host otherclient {
        # This host entry is hopefully matched if the client supplies a DUID-LL
        # or DUID-LLT containing this MAC address.
        hardware ethernet 01:00:80:a2:55:67;

        fixed-address6 3ffe:501:ffff:100::4321;
}

[jimp]

Ah, so if a client still provides the same DUID, including the mac of whatever interface it decided that should come from, then it would still be useless.

Windows 7 does that - DUID is the same. It picks one MAC address from one NIC and then sends it along. It sends a different IAID for each one though, I believe. I didn't see that mentioned exactly in the docs though, presumably there is a way to match on IAID.

[yon]

I just see get the different IAID. what's IAID?

[jimp]

Identity association identifier. If I remember right it's meant to be an extra ID over and above the DUID to differentiate interfaces.

From RFC3315:

Identity association (IA) A collection of addresses assigned to
                                a client.  Each IA has an associated
                                IAID.  A client may have more than one
                                IA assigned to it; for example, one for
                                each of its interfaces.

Identity association identifier (IAID) An identifier for an IA,
                                chosen by the client.  Each IA has an
                                IAID, which is chosen to be unique among
                                all IAIDs for IAs belonging to that
                                client.

[jimp]

FYI you can confirm an IAID on Windows by looking at "ipconfig /all" - it will show both the IAID and DUID for an interface.

[bardelot]

DHCPv6 allows in theory to configure multiple addresses and interfaces on a single host (unlike IPv4). However you may have to ask on the dhcp-users Mailinglist if it is already supported (e.g. using DUID+IAID to configure the addresses).

Edit:
Changed to DUID+IAID

[yon]

We should choose an Only and not repeat the identity identifier. For a variety of applications client.

Identity should not be repeated, whether in any environment.  ::)

[jimp]

For each client the DIUD is unique. For each interface the IAID is unique. So the only truly unique thing to use would appear to be IAID+DUID. The IAID is nowhere near long enough to be guaranteed unique across any two clients.

[yon]

@bardelot:

DHCPv6 allows in theory to configure multiple addresses and interfaces on a single host (unlike IPv4). However you may have to ask on the dhcp-users Mailinglist if it is already supported (e.g. using DUID+IAID to configure the addresses).

Edit:
Changed to DUID+IAID

I have post to that mail list now.  :)

[jimp]

@mdpugh:

I've been following the exchanges in dhcp-users@lists.isc.org and dhcwg@ietf.org for months now.  The first one is how I found this thread.  Please do not try to use the MAC address as a unique identifier for DHCPv6.  You will fundamentally break pfSense if you do and it will fly in the face of everything that has gone into DHCPv6 thus far.  The correct method is, as suggested, DUID and IAID.  I have been running IPv6 on three subnets for several months using Server 2008 as the DHCPv6 server and pfSense as the router with both Windows and FreeBSD clients.  All computers are multihomed to at least two of these subnets with no hitches on the DHCPv6 end (I still have router advertisement issues, which I hope is where you decide to focus your attention).

I would much prefer the DUID+IAID if we can find a way to make it feasible. Seeing as we already extract this info from the leases view surely there is a way to apply that to a fixed address.

@mdpugh:

The only real reason that I can discern for why people seem to want to use the MAC as a unique identifier in DHCPv6 is for provisioning; they want to know the host with this IPv4 address has that IPv6 address (and vice versa).  But I still haven't seen a sufficient reason to break DHCPv6 as it currently stands to accomplish this.

It would be nice to have a way to do that, yes, but it seems more to me that people want to use it because it's easy and familiar. You can read the MAC on a sticker on most cards but getting the DUID and IAID is not so cut and dry. Though as someone mentioned earlier in this thread the mac command for dhcpv6 seems to actually read the mac portion of the DUID so it would be worthless for distinguishing interfaces anyhow.

@mdpugh:

Incidentally, I gave an example of the syntax for IAID usage in the client configuration file in a much older post in this forum.  I've tested this, so I know it works.

It looks like the example you gave was for the dhcp6c client not the server unless I missed the post. Do you have a link?

If we can get the syntax hashed out then we just need to add another box to the GUI.

Or if it's as simple as prepending the IAID onto the DUID (we have to split them in the leases view) then it may be even easier.

[jimp]

http://osdir.com/ml/North-American-Network-Operators-Group/2012-01/msg00749.html implies it is not yet possible but a feature request now exists.

Seeing as the most current release of the ISC DHCP daemon is before that message, I highly doubt it's possible at this point in time.

[mdpugh]

Well, I'm not sure this is going into the right thread after the split but here goes.

DUID is indeed useless by itself.  The computer generates the DUID from the first NIC's MAC and the time.  If I remember correctly, for devices with fixed storage, the spec requires this method.  Don't quote me; I'll have to look it up to be sure.  From the moment of generation, the DUID is bound to the host.  You'll have to edit the registry for Windows, edit the /var/db/dhcp6c_duid file for FreeBSD (it's encrypted and I'm not positive that's the only place it's stored), or reinstall the OS to change it.  Even if you remove the NIC that was used to generate the DUID from the machine, the DUID does not change.

In Windows, each IAID is partially generated from each NIC's MAC.  The first 24 bits of the MAC become the last 24 bits of the IAID (not very ingenious since that's the manufacturer's portion of the MAC).  I have been unable to determine how the first 8 bits of the IAID are generated (although I'm about 99.9% positive I read it somewhere on the web).

I should have mentioned in the previous post that all of the machines on all of the subnets in my network are assigned reserved addresses by DHCPv6 (after all, getting a random address is easy).  They're all multihomed machines, including the DHCPv6 server which is distributing addresses on four subnets (essentially LAN, DMZ, wireless, and management), all based on DUID+IAID.

I did give client syntax in the earlier post (http://forum.pfsense.org/index.php/topic,43951.msg227931.html#msg227931).  At the time, as I remember, I couldn't find much in the way of examples for the client configuration, but there were several for the server end of things.

I confess that, having read the two threads, I'm not completely sure what the real question is, so I've got a few of my own.  The only need for the IAID in a configuration file (client or server) is for DHCPv6 reservations (addresses that persist) (right?).  Is this functionality in the pfSense DHCPv6 Server now?  I didn't think it was.  Are you going to add it if it isn't already there?

I see several mentions of the ISC distribution.  What's in there now?  I was under the impression you were using the WIDE distribution but were considering switching to ISC.  Is this correct or has something changed?  The syntax I got working was for the WIDE version, but I did experiment with ISC because Seth said that the WIDE distro used only one TCP/IP socket (problematic with multihomed computers).

[yon]

I think if we install two or more NIC in computer,then How setup static and assign ip address to each NIC or any client Terminal. maybe It is a virtual terminal or equipment.

I think we should consider the different applications and requirements. Our main purpose is in any environment, a variety of distribution does not produce conflict or duplication.

just like Authentication of a person's DNA, it is the only.

by the way, How to manage and assign an address in accordance with management purposes？For example, I which addresses is reserved not assigned.

Which addresses can be prohibited and freedom of management.
Which addresses can be assigned by group or press equipment.

such as:

2001:470:f188:15::18–25 only for A NIC or A group
2001:470:f188:15::50--100 disable for some NIC or groups.  or only for admin's some NIC.