DHCPv6 and IAID+DUID or other means of selecting IPs by interface

jimp

[EDIT: Apologies if this seems disjointed, I split it off the other topic since the other was a trouble report and this is a separate discussion.]

There is little incentive to using a /48 directly on the LAN anyhow. A /64 is the best thing to do - it's not like you're going to run out of IPs in the /64.

Something tells me you'll have way more problems than running out of IPs if you really have more than 18,446,744,073,709,551,616 nodes on a single segment. :-)

yon

@jimp:

There is little incentive to using a /48 directly on the LAN anyhow. A /64 is the best thing to do - it's not like you're going to run out of IPs in the /64.

Something tells me you'll have way more problems than running out of IPs if you really have more than 18,446,744,073,709,551,616 nodes on a single segment. :-)

well.., So I use /48 ipv6 years. all server and service use /48 address. and I like short address. So I want to use /48 addrss. maybe I may setup lucky name for ip address. ;)

jimp

Not sure what you mean by that, /48 addresses have more parts that vary than /64's. The prefix is shorter but the host part of the address is longer.

From wikipedia:

An RFC 4291 compliant subnet always uses IPv6 addresses with 64 bits for the host portion.[10] It therefore has a /64 routing prefix (128−64 = the 64 most significant bits). Although it is technically possible to use smaller subnets,[11] they are impractical for local area networks based on Ethernet technology, because 64 bits are required for stateless address auto configuration.[12] The Internet Engineering Task Force recommends the use of /64 subnets even for point-to-point links, which consist of only two hosts.[13]

So if you decide to break the RFC and go against the IETF, you shouldn't be surprised to find things that don't work like you expect. :-)

I know plenty of people who have been doing the wrong thing "for years" it doesn't make it right.

yon

Such as 2001:470:15::2 use for my web server.

now I setup 2001:470:15::1/64 in LAN interface, just it is can get ipv6 address from DHCP6.

if setup 2001:470:15::1/48 in LAN interface, it can't support all client system.

yon

now I plan use fixed /48 address for web server etc. use /64 subnet for client system and winfi etc.

Could you tell me how setup static ipv6 address?

where are get the DUID ?

jimp

It still makes no sense to use a /48 for that - you can use the exact same prefix, just call it /64 - it will just assume all 0's in between, then use the xxx:1::/64, xxx:2::/64 and so on for other subnets.

DUID and IAID vary by OS, not sure we have any kind of guide. usually found in ifconfig or ipconfig output. Easiest way is to add them in the DHCP leases list and click "+" to make an entry from there so it gets the right bits. IIRC You can't set static via autoconf, only with DHCPv6 or by hardcoding the info.

yon

@jimp:

It still makes no sense to use a /48 for that - you can use the exact same prefix, just call it /64 - it will just assume all 0's in between, then use the xxx:1::/64, xxx:2::/64 and so on for other subnets.

DUID and IAID vary by OS, not sure we have any kind of guide. usually found in ifconfig or ipconfig output. Easiest way is to add them in the DHCP leases list and click "+" to make an entry from there so it gets the right bits. IIRC You can't set static via autoconf, only with DHCPv6 or by hardcoding the info.

because my two NIC get the same DUID, So I can use input IAID for setup static ipv6 address?

wallabybob

@yon:

because my two NIC get the same DUID,

Discussed in http://forum.pfsense.org/index.php/topic,47658.0.html

yon

just Different two MAC NIC still the same DUID. So if maybe can use the IAID for setup static ipv6 address.

jimp

It may be possible in the underlying software (isc-dhcpd) but not yet in our GUI.

Are these two NICs plugged into the same subnet? I'm just wondering what the use case is where you need two DHCP NICs on a single host.

yon

@jimp:

It may be possible in the underlying software (isc-dhcpd) but not yet in our GUI.

Are these two NICs plugged into the same subnet? I'm just wondering what the use case is where you need two DHCP NICs on a single host.

Because the my mail server has install two mail server software. one for ipv4 mail server, and other for ipv6 ipv4 mail server. such as: 192.168.101.3 NIC for ipv6 ipv4 mail server. 192.168.101.5 for ipv4 only mail server. its will has two 25 port can use in multi-wan.

jimp

That doesn't make any sense with respect to the DUID and DHCPv6. Does it have multiple interfaces? Do they both need unique DHCP IPs?

You should never, ever have multiple NICs in the same box on the same subnet just plugged into the same switch/vlan unless you're doing LAGG/LACP.

yon

@jimp:

That doesn't make any sense with respect to the DUID and DHCPv6. Does it have multiple interfaces? Do they both need unique DHCP IPs?

You should never, ever have multiple NICs in the same box on the same subnet just plugged into the same switch/vlan unless you're doing LAGG/LACP.

yes. I need stup static ipv4 and ipv6 address for client server. because its have running a lot A variety of services. and I will do network link Aggregation.

yon

just I need like ipv4 MAC bind fixed ip for each NIC. Can I use IAID or MAC for ipv6?

bardelot

The server has only one DUID, not one per network interface. The link layer address of a (any of the available) interface is however often encoded into the DUID to guarantee uniqueness.

jimp

But why "each nic"? The DUID would only be the same on a single machine. You shouldn't be trying to plug multiple interfaces from the same machine into the same network, so a DUID conflict shouldn't be an issue.

We're looking into how to get the dhcpv6 daemon to go by MAC like the v4 version does. The new version of ISC DHCPD is supposed to support that but we haven't seen an example of the syntax yet.

bardelot

It matches the MAC address in the DUID, not the interface MAC.

host otherclient {
        # This host entry is hopefully matched if the client supplies a DUID-LL
        # or DUID-LLT containing this MAC address.
        hardware ethernet 01:00:80:a2:55:67;

        fixed-address6 3ffe:501:ffff:100::4321;
}

jimp

Ah, so if a client still provides the same DUID, including the mac of whatever interface it decided that should come from, then it would still be useless.

Windows 7 does that - DUID is the same. It picks one MAC address from one NIC and then sends it along. It sends a different IAID for each one though, I believe. I didn't see that mentioned exactly in the docs though, presumably there is a way to match on IAID.

yon

I just see get the different IAID. what's IAID?

20120329052226.jpg_thumb

jimp

Identity association identifier. If I remember right it's meant to be an extra ID over and above the DUID to differentiate interfaces.

From RFC3315:

Identity association (IA) A collection of addresses assigned to
a client. Each IA has an associated
IAID. A client may have more than one
IA assigned to it; for example, one for
each of its interfaces.

Identity association identifier (IAID) An identifier for an IA,
chosen by the client. Each IA has an
IAID, which is chosen to be unique among
all IAIDs for IAs belonging to that
client.