Configuring DHCPv6 client on a Juniper SRX isn't as straight forward as it should have been. I hit a couple of speed bumps during the configuration so thought I’d document the experience for anyone else using a Juniper SRX with Orcon.
This was written with my test environment in mind and is not a complete long term config that you should use. There are some issues which I discuss later on.
NOTE: I've used full configuration set lines for completeness. You can navigate down the configuration tree if you want.
This isn't a newbie guide (I.E.: you should know what the prompts "#" & ">" mean) but I can try to help if you get stuck.
Junos Software Release 12.1X45-D10 (the first Junos version to introduce the DHCPv6 client) has some issues, I suggest using 12.1X46-D20.5 (this is what I've used).
NOTE: At the time of writing, the JTAC recommended Junos version is Junos 12.1X44-D35.5.
Enable IPv6 flow mode (unless you really want to run in packet mode), otherwise it will just drop IPv6 traffic!
# set security forwarding-options family inet6 mode flow-based
You can see what mode you’re currently in with:
> show security flow status
Flow forwarding mode:
Inet forwarding mode: flow based
Inet6 forwarding mode: drop
MPLS forwarding mode: drop
ISO forwarding mode: drop
Advanced services data-plane memory mode: Default
Flow trace status
Flow tracing status: off
Flow session distribution
Distribution mode: RR-based
Flow ipsec performance acceleration: off
Flow packet ordering
Ordering mode: Hardware
As this firewall was (almost) fresh out of the box configuration wise. As you can see, IPv6 traffic is dropped by default (unlike IPv4 traffic which is set to flow based).
Reboot. You must do this when enabling or disabling IPv6 flow mode (in most instances).
> request system reboot
Configure our outward interface (in my example, fe-0/0/0.10 is the outward facing untrusted logical interface). Also note that vlan.0 is my inward facing (trusted) logical interface.
# set interfaces fe-0/0/0 unit 10 family inet6 dhcpv6-client client-type statefull
# set interfaces fe-0/0/0 unit 10 family inet6 dhcpv6-client client-ia-type ia-na
# set interfaces fe-0/0/0 unit 10 family inet6 dhcpv6-client client-ia-type ia-pd
# set interfaces fe-0/0/0 unit 10 family inet6 dhcpv6-client client-identifier duid-type duid-ll
# set interfaces fe-0/0/0 unit 10 family inet6 dhcpv6-client update-router-advertisement interface vlan.0
Our trusted interface vlan.0, is used to propagate IPv6 addresses.
Orcon offer global address assignment (IA_NA) and prefix delegation (IA_PD). Some ISP’s overseas don’t and only offer prefix delegation which is the cause of a few headaches for some Junos users.
You may strike an issue where you get the following message if your configuration looks like this:
vlan-tagging;
unit 10 {
vlan-id 10;
family inet {
dhcp;
}
family inet6 {
##
## Warning: Incompatible with the client configured under 'family inet6 dhcpv6-client'
##
dhcpv6-client {
client-type statefull;
client-ia-type ia-na;
client-ia-type ia-pd;
client-identifier duid-type duid-ll;
update-router-advertisement {
interface vlan.0;
}
}
}
}
It would appear that Juniper have changed the way they want you configure IPv4 DHCP since Junos 10 (which is what I was using), especially when using DHCPv6. The above message is a really obscure one and it’s really complaining about the family inet dhcp config item.
Either remove the “family inet” configuration (which means no dual stack. IE: no IPv4), or change the DHCP daemon you use (this is the preferred option).
To stop IPv4 on the logical interface:
# delete interfaces fe-0/0/0 unit 10 family inet
To change the DHCP daemon:
# delete interfaces fe-0/0/0 unit 10 family inet dhcp
# set interfaces fe-0/0/0 unit 10 family inet dhcp-client
NOTE: use "show dhcp client binding" rather than "show system services dhcp client". They show the same information but the later won’t work any more. You’ll get dhcp subsystem not running – not needed by configuration. It's a very badly worded warning message as with the configuration warning message!
The above DHCP configuration configure's different daemons. And that the two are mutually exclusive (but achieve the same result). Hence the message.
The dhcpd (family inet dhcp) daemon will only handle DHCPv4 whereas the jdhcpd (family inet dhcp-client) daemon will handle DHCP and DHCPv6.
Allow DHCPv6 on the outward facing logical interface
# set security zones security-zone untrust interfaces fe-0/0/0.10 host-inbound-traffic system-services dhcpv6
Commit your configuration and you should be looking good.
# commit and-quit
Your configuration will now look something like this:
vlan-tagging;
unit 10 {
vlan-id 10;
family inet {
dhcp-client;
}
family inet6 {
dhcpv6-client {
client-type statefull;
client-ia-type ia-na;
client-ia-type ia-pd;
client-identifier duid-type duid-ll;
update-router-advertisement {
interface vlan.0;
}
}
}
}
Find our route to the internet and set it.
NOTE: I couldn't find a way have the route injected automatically (whereas it just happens with DHCPv4). If anyone has any ideas……
> show ipv6 neighbors
IPv6 Address Linklayer Address State Exp Rtr Secure Interface
fe80::ea4:2ff:feed:555b 0c:a4:02:ed:55:5b stale 26 yes no fe-0/0/0.10
You can also find this information by typing:
> show dhcpv6 client binding detail
Client Interface: fe-0/0/0.10
Hardware Address: 28:c0:da:xx:xx:xx
State: BOUND(DHCPV6_CLIENT_STATE_BOUND)
ClientType: STATEFUL
Lease Expires: 2014-07-18 16:50:23 NZST
Lease Expires in: 630537 seconds
Lease Start: 2014-07-10 16:50:23 NZST
Bind Type: IA_NA IA_PD
Client Interface Vlan Id: 10
Client DUID: LL0xd-28:c0:da:xx:xx:xx
Rapid Commit: Off
Server Ip Address: fe80::ea4:2ff:feed:555b
Client IP Address: xxxx:xxxx:xxxx:xxxx::1/128
Client IP Prefix: xxxx:xxxx:xxxx:xxxx::/56
DHCP options:
Name: server-identifier, Value: LL0x1-0c:a4:02:ed:55:5b
Take the IPv6 address and use that as our next hop.
# set routing-options rib inet6.0 static route ::/0 next-hop fe80::ea4:2ff:feed:555b
Or you could just use the qualified-next-hop (which gives you a whole lot more control)
# set routing-options rib inet6.0 static route ::/0 qualified-next-hop fe80::ea4:2ff:feed:555b interface fe-0/0/0.10
There are ramifications with doing this and I'll try to find out why DHCPv6 isn't injecting the route and post an update.
Commit the config again.
You can test your connection by pinging Googles DNS servers:
> ping 2001:4860:4860::8888 (or 2001:4860:4860::8844)
That is the basics really.
NOTE: Original updated due to clarification of Static assignments from SoundDude.