ASA: DHCPv6 Relay configuration example and troubleshooting

Available Languages

Updated:September 10, 2015

Document ID:200138

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Prerequisites

Requirements

Components Used

Stateful vs Stateless DHCPv6

Network Diagram

DHCPv6 vs DHCPv4 Message Types

Stateless DHCPv6 Relay

Configuration

Packet Flow

Verify

Debugs

Wireshark Snapshots

Stateful DHCPv6

Configuration

Packet Flow

Verify

Debugs

Wireshark Snapshots

Troubleshoot

DHCP Relay Outputs

Release Addresses

Debugs

Related Information

Introduction

The document describes how to configure a Cisco Adaptive Security Appliance (ASA) as a DHCPv6 relay agent and also covers some basic troubleshooting. In ASA Code Version 9.0 and later, the ASA supports

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

IPv6 basic concepts
IPv6 addressing mechanism
DHCPv6 packet flow
DHCP relay concepts

Components Used

The information in this document is based on the ASA 5500 Version 9.1.2.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Stateful vs Stateless DHCPv6

If you understand the different method of address allocation in IPv6, it helps you understand how the DHCPv6 relay feature works on the ASA. Refre to Dynamic address assignment in IPv6 using SLAAC and DHCP for a introduction to Stateless Address Autoconfiguration (SLAAC) and DHCPv6.

Network Diagram

This sample configuration describes how to configure the ASA as a DHCPv6 relay agent. In this configuration, CLIENT is the interface where the IPv6 client is connected. SERVER is the interface through which the DHCPv6 server 2001:db8:200:2/64 is reachable.

DHCPv6 vs DHCPv4 Message Types

Stateless DHCPv6 Relay

Configuration

Here is the basic configuration for Stateless DHCPv6 relay configuration on the ASA:

interface GigabitEthernet0/1
 nameif CLIENT
 security-level 100
ipv6 address 2001:db8:100::1/64
 ipv6 enable
 ipv6 nd other-config-flag
!
interface GigabitEthernet0/0
 nameif SERVER
 security-level 0
ipv6 address 2001:db8:200:1/64
 ipv6 enable
!
ipv6 dhcprelay server 2001:db8:200:2 inside
ipv6 dhcprelay enable outside

Packet Flow

With stateless DHCPv6, here is the packet flow from the client:

The ASA intercepts these packets and wraps them into the DHCP relay format:

Verify

Debugs

If you enable debug ipv6 dhcprelay and debug ipv6 dhcp, then relevant output prints to the screen. This output is taken from a working scenario:

IPv6 DHCP: Received INFORMATION-REQUEST from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type INFORMATION-REQUEST(11), xid 1588088
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 6
    DNS-SERVERS,DOMAIN-LIST,UNKNOWN
IPv6 DHCP_RELAY: Relaying INFORMATION-REQUEST from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 34
    type INFORMATION-REQUEST(11), xid 1588088
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 6
      DNS-SERVERS,DOMAIN-LIST,UNKNOWN
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 67
    type REPLY(7), xid 1588088
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 1588088
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com

In the INFORMATION-REQUEST request packet, the client only requests DNS-Server and Domain, which is expected since the cilent is configured for stateless DHCPv6.

Wireshark Snapshots

DHCP Client Request

DHCP Request Relayed by ASA

DHCP Reply From Server

Reply Forwarded to Client

Stateful DHCPv6

Configuration

Here is the basic configuration for Stateful DHCPv6 relay configuration on the ASA:

interface GigabitEthernet0/1
 nameif CLIENT
 security-level 100
ipv6 address 2001:db8:100::1/64
 ipv6 enable
!
interface GigabitEthernet0/0
 nameif SERVER
 security-level 0
ipv6 address 2001:db8:200:1/64
 ipv6 enable
!
ipv6 dhcprelay server 2001:db8:200:2 inside
ipv6 dhcprelay enable outside

Packet Flow

With stateful DHCPv6, here is the packet flow from the client:

The ASA intercepts these packets and wraps them into the DHCP relay format:

Verify

Debugs

IPv6 DHCP: Received SOLICIT from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type SOLICIT(1), xid 2490681
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 4
    DNS-SERVERS,DOMAIN-LIST
    option IA-NA(3), len 12
    IAID 0x00040001, T1 0, T2 0
IPv6 DHCP_RELAY: Relaying SOLICIT from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 48
    type SOLICIT(1), xid 2490681
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 4
      DNS-SERVERS,DOMAIN-LIST
    option IA-NA(3), len 12
      IAID 0x00040001, T1 0, T2 0
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 111
    type ADVERTISE(2), xid 2490681
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option IA-NA(3), len 40
      IAID 0x00040001, T1 43200, T2 69120
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: ADVERTISE
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending ADVERTISE to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type ADVERTISE(2), xid 2490681
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option IA-NA(3), len 40
    IAID 0x00040001, T1 43200, T2 69120
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com
IPv6 DHCP: Received REQUEST from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type REQUEST(3), xid 2492842
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option ORO(6), len 4
    DNS-SERVERS,DOMAIN-LIST
    option SERVERID(2), len 10
    00030001002414a33c94
    option IA-NA(3), len 40
    IAID 0x00040001, T1 0, T2 0
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
IPv6 DHCP_RELAY: Relaying REQUEST from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 90
    type REQUEST(3), xid 2492842
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option ORO(6), len 4
      DNS-SERVERS,DOMAIN-LIST
    option SERVERID(2), len 10
      00030001002414a33c94
    option IA-NA(3), len 40
      IAID 0x00040001, T1 0, T2 0
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 111
    type REPLY(7), xid 2492842
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option IA-NA(3), len 40
      IAID 0x00040001, T1 43200, T2 69120
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
      2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
      cisco.com
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 2492842
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option IA-NA(3), len 40
    IAID 0x00040001, T1 43200, T2 69120
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
    option DNS-SERVERS(23), len 16
    2001:db8:1000::1
    option DOMAIN-LIST(24), len 11
    cisco.com

Wireshark Snapshots

SOLICIT (1)

A DHCPv6 client sends a Solicit message in order to locate DHCPv6 servers.

The ASA relays the Solicit message.

ADVERTISE (2)

A server sends an Advertise message in order to indicate that it is available for DHCP service, in response to a Solicit message received from a client.

REQUEST (3)

A client sends a Request message in order to request configuration parameters, which include IP addresses or delegated prefixes, from a specific server.

REPLY (7)

A server sends a Reply message that contains assigned addresses and configuration parameters in response to a Solicit, Request, Renew, or Rebind message received from a client. A server sends a Reply message that contains configuration parameters in response to an Information-request message. A server sends a Reply message in response to a Confirm message that confirms or denies that the addresses assigned to the client are appropriate to the link to which the client is connected. A server sends a Reply message in order to acknowledge receipt of a Release or Decline message.

Troubleshoot

Confirm connectivity with DHCPv6 Server.

ciscoasa# show ipv6 neighbor
IPv6 Address                              Age Link-layer Addr State Interface

2001:db8:200::2                             0 0024.14a3.3c98  REACH SERVER

Confirm that you receive packets from the client when it requests an IPv6 address. The packet sent by the client will depend on the address assignment settings (that is, stateful vs stateless).

When the client begins the DHCPv6 process, it sends a Router Solicit message in order to discover the presence of IPv6 routers on the link. It sends a multicast Router Solicitation message in order to prompt the IPv6 routers to respond. In the Ethernet header of the Router Solicitation message, these fields display:

The Source Address field is the MAC address of the host that requests the IPv6 address.
The Destination Address field is set to 33-33-00-00-00-02.

In the IPv6 header of the Router Solicitation message, these fields display.

The Source Address field is set to either a link-local IPv6 address assigned to the sending interface or the IPv6 unspecified address (::).
The Destination Address field is set to the link-local scope all-routers multicast address (FF02::2).
The Hop Limit field is set to 255.

In Response, the IPv6 routers send unsolicited Router Advertisement messages The Router Advertisement message contains the information required by hosts in order to determine the link prefixes, the link Maximum Transmission Unit (MTU), and specific routes.

ciscoasa(config)# show capture capin detail

      fe80::c671:feff:fe93:b51a.546 > ff02::1:2.547:  [udp sum ok] udp 42
      [hlim 255] (len 100)---->Request from client

      fe80::219:7ff:fe24:2e44.547 > fe80::c671:feff:fe93:b51a.546:  [udp sum ok]
      udp 75 [class 0xe0] (len 133, hlim 255)

      
ciscoasa(config)# show capture capout detail 
2 packets captured

   1: 12:06:52.700799       2001:db8:200:1.547 > 2001:db8:200:2.547:  udp 88
    [class 0xe0]---->ASA forwards request to DHCPv6 router

   2: 12:06:53.289047      2001:db8:200:2.547 > 2001:db8:200:1.547:  udp 121
   [class 0xe0]----> Reply from DHCPV6 server.

DHCP Relay Outputs

ciscoasa# show ipv6 dhcprelay binding
1 in use, 1 most used

Client: fe80::c671:feff:fe93:b51a (CLIENT)
  DUID: 00030001c471fe93b516, Timeout in 56 seconds

Note: The binding is deleted by the ASA after a short period. This is seen in debug ipv6 dhcprelay.

IPv6 DHCP_RELAY: Deleting binding for fe80::c671:feff:fe93:b51a at interface CLIENT

ciscoasa# show ipv6 dhcprelay statistics

Relay Messages:
  SOLICIT                                       2
  ADVERTISE                                     2
  REQUEST                                       2
  CONFIRM                                       0
  RENEW                                         0
  REBIND                                        0
  REPLY                                         9
  RELEASE                                       1
  DECLINE                                       0
  RECONFIGURE                                   0
  INFORMATION-REQUEST                           6
  RELAY-FORWARD                                 11
  RELAY-REPLY                                   11

Relay Errors:
  Malformed message:                            0
  Block allocation/duplication failure:         0
  Hop count limit exceeded:                     0
  Forward binding creation failure:             0
  Reply binding lookup failure:                 0
  No output route:                              0
  Conflict relay server route:                  0
  Failed to add server input rule:              0
  Unit or context is not active:                0

Total Relay Bindings Created:                   8

Release Addresses

Clients can release their DHCPv6 assigned address after they are done using it for the network. The next section shows the debug output associated with address release in Stateful DHCPv6.

Debugs

IPv6 DHCP: Received RELEASE from fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::c671:feff:fe93:b51a (CLIENT)
    dst ff02::1:2
    type RELEASE(8), xid 3180815
    option ELAPSED-TIME(8), len 2
    elapsed-time 0
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option SERVERID(2), len 10
    00030001002414a33c94
    option IA-NA(3), len 40
    IAID 0x00040001, T1 0, T2 0
    option IAADDR(5), len 24
      IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
      preferred INFINITY, valid INFINITY
IPv6 DHCP_RELAY: Relaying RELEASE from fe80::c671:feff:fe93:b51a on CLIENT
IPv6 DHCP_RELAY: Creating relay binding for fe80::c671:feff:fe93:b51a at interface CLIENT
IPv6 DHCP_RELAY:   to 2001:db8:200::2 via 2001:db8:200::2 using SERVER
IPv6 DHCP: Sending RELAY-FORWARD to 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::1
    dst 2001:db8:200::2 (SERVER)
    type RELAY-FORWARD(12), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 82
    type RELEASE(8), xid 3180815
    option ELAPSED-TIME(8), len 2
      elapsed-time 0
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option SERVERID(2), len 10
      00030001002414a33c94
    option IA-NA(3), len 40
      IAID 0x00040001, T1 0, T2 0
      option IAADDR(5), len 24
        IPv6 address 2001:db8:300:0:48ae:5f5d:8290:e926
        preferred INFINITY, valid INFINITY
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP: Received RELAY-REPLY from 2001:db8:200::2 on SERVER

IPv6 DHCP: detailed packet contents
    src 2001:db8:200::2 (SERVER)
    dst 2001:db8:200::1
    type RELAY-REPLY(13), hop 0
    link 2001:db8:100::1
    peer fe80::c671:feff:fe93:b51a
    option RELAY-MSG(9), len 45
    type REPLY(7), xid 3180815
    option SERVERID(2), len 10
      00030001002414a33c94
    option CLIENTID(1), len 10
      00030001c471fe93b516
    option STATUS-CODE(13), len 9
      status code SUCCESS(0)
      status message: SUCCESS
    option INTERFACE-ID(18), len 4
    0x00000015
IPv6 DHCP_RELAY: Relaying RELAY-REPLY from 2001:db8:200::2 on SERVER
IPv6 DHCP_RELAY:   relayed msg: REPLY
IPv6 DHCP_RELAY:   to fe80::c671:feff:fe93:b51a
IPv6 DHCP: Sending REPLY to fe80::c671:feff:fe93:b51a on CLIENT

IPv6 DHCP: detailed packet contents
    src fe80::219:7ff:fe24:2e44
    dst fe80::c671:feff:fe93:b51a (CLIENT)
    type REPLY(7), xid 3180815
    option SERVERID(2), len 10
    00030001002414a33c94
    option CLIENTID(1), len 10
    00030001c471fe93b516
    option STATUS-CODE(13), len 9
    status code SUCCESS(0)
    status message: SUCCESS