2

So I will start that I read this previous post here: Can link local addresses be used for transit networks without breaking routability?

But it's not fully registering in my brain I guess if this scenario is possible (but I'm thinking by the previous post, it might not be.)

Scenario - we have a Juniper SRX in basically a hub/spoke type configuration, firewall that also relay's DHCP requests.

so user-vlan/subnet -> (Lets say reth0.1) Juniper SRX (Relays DHCP) (we'll call this reth0.2) -> DHCP vlan/subnet

Currently this works for IPv4 just fine, and it works for v6 if the Juniper has a v6 GUA address assigned. However, for just about anything else that GUA really doesn't get used because most things would use the link-local as the default-gateway once on the network. So is there just a configuration I am missing that would allow the Juniper to forward/relay the DHCPv6 from the link-local address assigned to reth0.1 or is it just an absolute must for reth0.1 to have a GUA address assigned in order for DHCPv6 Relay to work? (Juniper documentation on this really really stinks).

I did do a packet capture from the DHCP server side, and it is not seeing the requests getting relayed from that interface on the firewall, so it's getting stopped at the Juniper.

Debug on the Juniper does not reveal much.

1
  • If a packet must cross a router, it cannot be addressed with a link-local address. A DHCP client will use its link-local address to the relay, but the relay is on the interface of the client, and the relay packet to the DHCP server will need to cross the router to get to a different network. This answer and comments may clarify how that works. The relay is on the interface of the client, so it is addressed in the network of the client, not the network of the DHCP server, so relay packets must be routed to the server network and back.
    – Ron Maupin
    Jun 27, 2023 at 18:53

2 Answers 2

3

So is there just a configuration I am missing that would allow the Juniper to forward/relay the DHCPv6 from the link-local address assigned to reth0.1 or is it just an absolute must for reth0.1 to have a GUA address assigned in order for DHCPv6 Relay to work?

DHCP relays should be able to use just about any src address for the given relayed packet towards the DHCP server, just as long as...

  • the DHCPv6 server can unicast its RELAY-REPLY back to the src address the relay had used for the RELAY-FORW message.
  • (as a corollary to the above) the DHCPv6 relay, for the RELAY-FORW messages, uses an ipv6 src address that is routeable/reachable from the given DHCPv6 server. A link local address not on a common segment with the DHCPv6 server (relay destination) can therefore not be used as src address for relay messages.
  • the DHCPv6 relay adds enough information to the RELAY-FORW message to allow the DHCPv6 server to match the client's messages (typically a SOLICIT or REQUEST) to a configured DHCPv6 scope.

It seems that for the latter, Junos has some options you can set explicitely:

See section "Inserting DHCPv6 Interface-ID Option (Option 18) In DHCPv6 Packets" in https://www.juniper.net/documentation/us/en/software/junos/dhcp/topics/topic-map/dhcpv6-relay-agent.html, from where:

You can configure DHCPv6 relay agent to insert the DHCPv6 Interface-ID (option 18) in the packets that the relay sends to a DHCPv6 server. You can configure the option 18 support at either the DHCPv6 global or group level.

When you configure option 18 support, you can optionally include the following additional information:

Prefix - Specify the prefix option to add a prefix to the interface identifier. The prefix can be any combination of hostname, logical system name, and routing instance name.

Interface description - Specify the use-interface-description option to include the textual interface description instead of the interface identifier. You can include either the device interface description or the logical interface description.

Option 82 Agent - Circuit ID suboption (suboption 1)—Specify the use-option-82 option to include the DHCPv4 Option 82 Agent Circuit ID suboption (suboption 1). This configuration is useful in a dual-stack environment, which has both DHCPv4 and DHCPv6 subscribers that reside over the same underlying logical interface. The router checks for the option 82 suboption 1 value and inserts it into the outgoing packets. If no DHCPv4 binding exists or if the binding does not have an option 82 suboption 1 value, the router sends the packets without adding an option 18.

So, on the SRX acting as DHCPv6 relay, you might want to check...

  • if you can force one of these options to be added to the RELAY-FORW message, and if setting them can be made independent of the given client facing interface's configuration (which is what you don't want to have in your case: an IPv6 GUA address on the client facing interface).
  • if you can force-set the src address for RELAY-FORW messages from the DHCPv6 relay to the DHCPv6 server, to avoid having to use the client facing interface's ipv6 address for that purpose.

A bit of speculation: As long as the relay has a GUA on its client facing interface, it propably adds that address to the relayed request automatically, and sends the RELAY-FORW messages with that address as src. The DHCPv6 server then knows which address scope to match and where to send the RELAY-REPLY to.

If the relay does not have a GUA on the client facing interface, there must be another way to give a hint to the DHCPv6 server for proper address scope selection.

1
  • Thank you! This gives me some good info to move forward on. I tried using the option-82 and that didn't seem to do the trick or at least by itself, but I can look into the option-18 or anything else I might be missing to go along with the option-82.
    – Ippy
    Jun 28, 2023 at 23:10
1

The short answer:

You can use a link-local address on the client-facing interface but

  • the DHCP relay must use a routable source address towards the DHCP server and
  • the DHCP relay must provide an option for the DHCP server to identify the subnet/"circuit".
1
  • Exactly. That "ID" is the GUA prefix for that segment. v6 is no different than v4 in this respect. Link-local is Link Local; it has zero meaning anywhere else.
    – Ricky
    Jun 28, 2023 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.