Dhcpv6 relay question

RouterOS General
1

Hi

I am trying to setup a dhcpv6 relay, mimicking the dhcp (ipv4) relay behaviour. while the dhcp relay works as expected, the dhcpv6 relay creates some head scratching.

setup is as follows

i use multiple vlan (208-211) in a dedicated vrf (vrf_sio-lan), with vlan 208 acting as an upstream vlan to a firewall.
management is on vlan 213 and using the main vlan.

while on ipv4, the dhcp relay uses the vlan interface configured on vlan 208 as source (or the indivdual local address if local-address-as-src-ip=yes is set) , on dhcpv6 relay, the management ip on vlan 213 and main vrf is used. is this behaviour expected?
i seem to have no possibility to set a vrf in the dhcv6 relay config, opposed to the dhcp relay config.

while i managed to get the forwarded dhcp requests to the dhcp server, I will not issue an address, as the link address field is empty (or rather having :: as content).

tryling to set the link address manually to a global ipv6 address ends in an error “interface does not have such an address assigned (6)”. using the link local address (fe80::/64) works, as it can be assigned, but will not get the a dhcp server reply, as it does not match the requested subnet.

find below the relevant config snippets


/interface vlan 

add interface=bridge name=bridge.208 vlan-id=208 

add interface=bridge name=bridge.209 vlan-id=209 

add disabled=yes interface=bridge name=bridge.210 vlan-id=210 

add interface=bridge name=bridge.211 vlan-id=211 

add interface=bridge name=bridge.213 vlan-id=213

/ip vrf 

add interfaces=bridge.209,bridge.208,bridge.210,bridge.211 name=vrf_sio-lan

/ip address 

add address=10.95.13.12/24 comment=brigde.213 interface=bridge.213 network=10.95.13.0 

add address=10.95.8.30/27 comment=bridge.208 interface=bridge.208 network=10.95.8.0 

add address=10.95.9.1/24 comment=bridge.209 interface=bridge.209 network=10.95.9.0 

add address=10.95.10.1/24 interface=bridge.210 network=10.95.10.0 

add address=10.95.11.1/24 interface=bridge.211 network=10.95.11.0 

/ip dhcp-relay 

add dhcp-server=10.95.15.234,10.95.15.235 dhcp-server-vrf=vrf_sio-lan disabled=no interface=bridge.209 local-address=10.95.9.1 local-address-as-src-ip=yes name=dhcp-r_bridge.209 

add dhcp-server=10.95.15.234,10.95.15.235 dhcp-server-vrf=vrf_sio-lan interface=bridge.210 local-address=10.95.10.1 local-address-as-src-ip=yes name=dhcp-r_bridge.210 

add dhcp-server=10.95.15.234,10.95.15.234 dhcp-server-vrf=vrf_sio-lan disabled=no interface=bridge.211 local-address=10.95.11.1 local-address-as-src-ip=yes name=dhcp-r_bridge.211

/ipv6 address 

add address=2a02:121e:41c0:40d0::1:8 comment=bridge.213 interface=bridge.213 

add address=2a02:121e:41c0:4080::2:8 comment=bridge.208 interface=bridge.208 

add address=2a02:121e:41c0:4090::1 comment=bridge.209 interface=bridge.209 

add address=2a02:121e:41c0:40a0::1 comment=bridge.210 interface=bridge.210 

add address=fe80::6f4:1cff:fe58:1442 advertise=no interface=bridge.208 

/ipv6 dhcp-relay 

add dhcp-server=2a02:121e:41c0:40f0::1:3%bridge.209,2a02:121e:41c0:40f0::1:4%bridge.209 interface=bridge.209 name=dhcp6-r_bridge.209 

add dhcp-server=2a02:121e:41c0:40f0::1:3%bridge.210,2a02:121e:41c0:40f0::1:4%bridge.210 interface=bridge.210 name=dhcp6-r_bridge.210

if more or different info is needed, please let me know

2

Please use three backticks to quote code instead off 3x -.
You can add RouterOS after these backticks to get even better formatting

image
image663×596 63.2 KB

3

I recently upgraded to 7.21. and 7.21.1
and it seems that I got it to work - sort of. see config below.

it still complains, that the dhcp relay uses an IP not assigned to the interface in question.

BUT, I get now an SLAAC IP as well as one from the relayed dhcpv6 server.

is there a way to suppress the SLAAC IP? i.e. that the device only gets an address via dhcpv6. see below

/interface bridge
add admin-mac=04:F4:1C:58:14:42 auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=bridge.208 vlan-id=208
add interface=bridge name=bridge.209 vlan-id=209
add interface=bridge name=bridge.210 vlan-id=210
add interface=bridge name=bridge.211 vlan-id=211
add interface=bridge name=bridge.213 vlan-id=213
/interface bonding
add comment=ch01sw06 lacp-rate=1sec mode=802.3ad name=bond06 slaves=sfp-sfpplus24,sfp-sfpplus23 transmit-hash-policy=layer-2-and-3
add comment=ch01sw07 mode=802.3ad name=bond07 slaves=sfp-sfpplus21,sfp-sfpplus22 transmit-hash-policy=layer-2-and-3
add comment=ch01fw05 mode=802.3ad name=bond15 slaves=sfp-sfpplus1,sfp-sfpplus2 transmit-hash-policy=layer-2-and-3
add comment=ch01pm06 mode=802.3ad name=bond26 slaves=sfp-sfpplus3,sfp-sfpplus4 transmit-hash-policy=layer-2-and-3
/interface ethernet switch port
set 0 l3-hw-offloading=no
set 1 l3-hw-offloading=no
set 4 l3-hw-offloading=no
set 5 l3-hw-offloading=no
set 6 l3-hw-offloading=no
set 7 l3-hw-offloading=no
set 8 l3-hw-offloading=no
set 9 l3-hw-offloading=no
set 10 l3-hw-offloading=no
set 11 l3-hw-offloading=no
set 12 l3-hw-offloading=no
set 13 l3-hw-offloading=no
set 14 l3-hw-offloading=no
set 15 l3-hw-offloading=no
set 16 l3-hw-offloading=no
set 17 l3-hw-offloading=no
set 18 l3-hw-offloading=no
set 19 l3-hw-offloading=no
set 20 l3-hw-offloading=no
set 21 l3-hw-offloading=no
set 22 l3-hw-offloading=no
set 23 l3-hw-offloading=no
set 24 l3-hw-offloading=no
set 25 l3-hw-offloading=no
set 26 l3-hw-offloading=no
set 27 l3-hw-offloading=no
set 28 l3-hw-offloading=no
set 29 l3-hw-offloading=no
set 30 l3-hw-offloading=no
set 31 l3-hw-offloading=no
/interface list
add name=WAN
add name=LAN
/ip vrf
add interfaces=bridge.209,bridge.208,bridge.210,bridge.211 name=vrf_sio-lan
/ipv6 dhcp-server option
add code=24 name=search_sio value=0x0873696f696e74726104636f7270000c73686c756d62657267657202696f00
add code=23 name=dns6_sio value=0x2a02121e41c040f000000000000100032a02121e41c040f00000000000010004
/ipv6 dhcp-server option sets
add name=opt_sio options=dns6_sio,search_sio
/ipv6 pool
add name=pl6_209 prefix=2a02:121e:41c0:4090::/64 prefix-length=120
add name=pl6_210 prefix=2a02:121e:41c0:40a0::/64 prefix-length=120
/routing ospf instance
add disabled=no name=ospf2_sio-lan originate-default=if-installed redistribute=connected router-id=vrf_sio-lan routing-table=vrf_sio-lan vrf=vrf_sio-lan
add disabled=no name=ospf3_sio-lan originate-default=if-installed redistribute=connected router-id=vrf_sio-lan routing-table=vrf_sio-lan version=3 vrf=vrf_sio-lan
/routing ospf area
add disabled=no instance=ospf2_sio-lan name=ospf2_backbone-sio
add disabled=no instance=ospf3_sio-lan name=ospf3_backbone-sio
/routing table
add disabled=yes fib name=vrf_sio-lan
add disabled=yes fib name=vrf_sio-mgmt
/interface bridge port
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=qsfpplus1-1
add bridge=bridge comment=defconf interface=qsfpplus1-2
add bridge=bridge comment=defconf interface=qsfpplus1-3
add bridge=bridge comment=defconf interface=qsfpplus1-4
add bridge=bridge comment=defconf interface=qsfpplus2-1
add bridge=bridge comment=defconf interface=qsfpplus2-2
add bridge=bridge comment=defconf interface=qsfpplus2-3
add bridge=bridge comment=defconf interface=qsfpplus2-4
add bridge=bridge comment=defconf interface=sfp-sfpplus5
add bridge=bridge comment=defconf interface=sfp-sfpplus6
add bridge=bridge comment=defconf interface=sfp-sfpplus7
add bridge=bridge comment=defconf interface=sfp-sfpplus8
add bridge=bridge comment=defconf interface=sfp-sfpplus9
add bridge=bridge comment=defconf interface=sfp-sfpplus10
add bridge=bridge comment=defconf interface=sfp-sfpplus11
add bridge=bridge comment=defconf interface=sfp-sfpplus12
add bridge=bridge comment=defconf interface=sfp-sfpplus13
add bridge=bridge comment=defconf interface=sfp-sfpplus14
add bridge=bridge comment=defconf interface=sfp-sfpplus15
add bridge=bridge comment=defconf interface=sfp-sfpplus16
add bridge=bridge comment=defconf interface=sfp-sfpplus17
add bridge=bridge comment=defconf interface=sfp-sfpplus18
add bridge=bridge comment=defconf interface=sfp-sfpplus19
add bridge=bridge comment=defconf interface=sfp-sfpplus20
add bridge=bridge comment=ch01fw05 frame-types=admit-only-vlan-tagged interface=bond15
add bridge=bridge comment=ch01sw07 interface=bond07
add bridge=bridge comment=ch01sw06 interface=bond06
add bridge=bridge comment=ch01pm06 interface=bond26 pvid=212
/interface ethernet switch l3hw-settings
set autorestart=yes ipv6-hw=yes
/ipv6 settings
set accept-router-advertisements=yes
/interface bridge vlan
add bridge=bridge comment=sio-mgmt tagged=bridge,bond07,bond06,bond26 untagged=ether1 vlan-ids=213
add bridge=bridge comment=sio-cns tagged=bond15,bond07,bond06,bridge untagged=bond26 vlan-ids=212
add bridge=bridge comment=sio-dmzo tagged=bond15,bond06,bond26,bridge vlan-ids=202
add bridge=bridge comment=sio-lan tagged=bond15,bond07,bond06,bridge vlan-ids=210
add bridge=bridge comment=sio-gst tagged=bond15,bond07,bond06,bridge vlan-ids=200
add bridge=bridge comment=wan:internet tagged=bond15,bond06,bridge vlan-ids=299
add bridge=bridge comment=wan:pwan tagged=bond15,bond07,bond06,bridge vlan-ids=298
add bridge=bridge comment=sio-transit tagged=bond15,bond07,bond06,bond26,bridge vlan-ids=208
add bridge=bridge comment=sio-srv tagged=bond15,bond07,bond06,bond26,bridge vlan-ids=214
add bridge=bridge comment=sio-priv tagged=bond15,bond07,bond06,bond26,bridge vlan-ids=215
add bridge=bridge comment=sio-lan3 tagged=bond15,bond07,bond06,bridge vlan-ids=209
add bridge=bridge comment=sio-lan2 tagged=bond15,bond07,bond06,bridge vlan-ids=211
add bridge=bridge comment=sio-dmzi tagged=bond15,bond06,bond26,sfp-sfpplus5,bridge vlan-ids=203
add bridge=bridge comment=sio-iot tagged=bond07,bond06,bridge vlan-ids=204
add bridge=bridge comment=sio-hab tagged=bond07,bond06,bridge vlan-ids=205
/interface ethernet switch
set 0 l3-hw-offloading=yes
/interface list member
add interface=ether1 list=WAN
add interface=sfp-sfpplus1 list=LAN
add interface=sfp-sfpplus2 list=LAN
add interface=sfp-sfpplus3 list=LAN
add interface=sfp-sfpplus4 list=LAN
add interface=sfp-sfpplus5 list=LAN
add interface=sfp-sfpplus6 list=LAN
add interface=sfp-sfpplus7 list=LAN
add interface=sfp-sfpplus8 list=LAN
add interface=sfp-sfpplus9 list=LAN
add interface=sfp-sfpplus10 list=LAN
add interface=sfp-sfpplus11 list=LAN
add interface=sfp-sfpplus12 list=LAN
add interface=sfp-sfpplus13 list=LAN
add interface=sfp-sfpplus14 list=LAN
add interface=sfp-sfpplus15 list=LAN
add interface=sfp-sfpplus16 list=LAN
add interface=sfp-sfpplus17 list=LAN
add interface=sfp-sfpplus18 list=LAN
add interface=sfp-sfpplus19 list=LAN
add interface=sfp-sfpplus20 list=LAN
add interface=sfp-sfpplus21 list=LAN
add interface=sfp-sfpplus22 list=LAN
add interface=sfp-sfpplus23 list=LAN
add interface=sfp-sfpplus24 list=LAN
add interface=qsfpplus1-1 list=LAN
add interface=qsfpplus1-2 list=LAN
add interface=qsfpplus1-3 list=LAN
add interface=qsfpplus1-4 list=LAN
add interface=qsfpplus2-1 list=LAN
add interface=qsfpplus2-2 list=LAN
add interface=qsfpplus2-3 list=LAN
add interface=qsfpplus2-4 list=LAN
/ip address
add address=10.95.13.12/24 comment=bridge.213 interface=bridge.213 network=10.95.13.0
add address=10.95.8.30/27 comment=bridge.208 interface=bridge.208 network=10.95.8.0
add address=10.95.9.1/24 comment=bridge.209 interface=bridge.209 network=10.95.9.0
add address=10.95.10.1/24 comment=bridge.210 interface=bridge.210 network=10.95.10.0
add address=10.95.11.1/24 comment=bridge.211 interface=bridge.211 network=10.95.11.0
/ip dhcp-relay
add dhcp-server=10.95.15.234,10.95.15.235 dhcp-server-vrf=vrf_sio-lan disabled=no interface=bridge.209 local-address=10.95.9.1 local-address-as-src-ip=yes name=dhcp-r_bridge.209
add dhcp-server=10.95.15.234,10.95.15.235 dhcp-server-vrf=vrf_sio-lan disabled=no interface=bridge.210 local-address=10.95.10.1 local-address-as-src-ip=yes name=dhcp-r_bridge.210
add dhcp-server=10.95.15.234,10.95.15.234 dhcp-server-vrf=vrf_sio-lan disabled=no interface=bridge.211 local-address=10.95.11.1 local-address-as-src-ip=yes name=dhcp-r_bridge.211
/ip dns
set servers=10.95.15.234,10.95.15.235
/ipv6 route
add disabled=no dst-address=::/0 gateway=2a02:121e:41c0:40d0::1 routing-table=main suppress-hw-offload=no
/ip service
set www-ssl certificate=crt_ch01sw08_20251012 disabled=no tls-version=only-1.2
set api-ssl certificate=crt_ch01sw08_20251012 tls-version=only-1.2
/ip ssh
set host-key-type=ed25519 strong-crypto=yes
/ipv6 address
add address=2a02:121e:41c0:40d0::1:8 advertise=no comment=bridge.213 interface=bridge.213
add address=2a02:121e:41c0:4080::2:8 advertise=no interface=bridge.208
add address=2a02:121e:41c0:4090::1 interface=bridge.209
add address=2a02:121e:41c0:40a0::1 interface=bridge.210
/ipv6 dhcp-relay

Interface does not have such address assigned!

add dhcp-options="" dhcp-server=2a02:121e:41c0:40f0::1:3%bridge.208,2a02:121e:41c0:40f0::1:4%bridge.208 interface=bridge.210 link-address=2a02:121e:41c0:40a0::1 name=dhcp6-r_bridge.210
store-relayed-bindings=yes

Interface does not have such address assigned!

add dhcp-options="" dhcp-server=2a02:121e:41c0:40f0::1:3%bridge.208,2a02:121e:41c0:40f0::1:4%bridge.208 interface=bridge.209 link-address=2a02:121e:41c0:4090::1 name=dhcp6-r_bridge.209
store-relayed-bindings=yes
/ipv6 dhcp-server
add address-lists=2a02:121e:41c0:40a0::1:0/120 dhcp-option=opt_sio disabled=yes interface=bridge.210 lease-time=1h name=dhcp6_210 use-reconfigure=yes
add address-lists=2a02:121e:41c0:4090::1:0/120 dhcp-option=dns6_sio disabled=yes interface=bridge.209 lease-time=1h name=dchp6_209 use-reconfigure=yes
/ipv6 nd
set [ find default=yes ] advertise-mac-address=no managed-address-configuration=yes other-configuration=yes
add dns=2a02:121e:41c0:40f0::1:3,2a02:121e:41c0:40f0::1:4 interface=bridge.209 managed-address-configuration=yes other-configuration=yes
add advertise-mac-address=no dns=2a02:121e:41c0:40f0::1:3,2a02:121e:41c0:40f0::1:4 interface=bridge.210 managed-address-configuration=yes other-configuration=yes
/routing bfd configuration
add disabled=no interfaces=bridge.208 vrf=vrf_sio-lan
/routing ospf interface-template
add area=ospf2_backbone-sio disabled=no interfaces=bridge.208 use-bfd=yes
add area=ospf3_backbone-sio disabled=no interfaces=bridge.208 use-bfd=yes
add area=ospf2_backbone-sio comment="ospf2 stub zones" disabled=no interfaces=bridge.209,bridge.210,bridge.211 passive
add area=ospf2_backbone-sio comment="ospf3 stub zones" disabled=no interfaces=bridge.209,bridge.210 passive
/system clock
set time-zone-name=Europe/Zurich
/system identity
set name=ch01sw08
/system ntp client
set enabled=yes
/system ntp client servers
add address=ch01dc03.siointra.corp
add address=ch01dc04.siointra.corp
/system routerboard settings
set enter-setup-on=delete-key
/tool sniffer
set file-name=br.208_ipv6 filter-interface=bridge filter-ipv6-address=::/0 filter-vlan=209 only-headers=yes

and yes, there is some superfluous config snippets in there.

sample output from ifconfig in macOS.


en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
	options=6460<TSO4,TSO6,CHANNEL_IO,PARTIAL_CSUM,ZEROINVERT_CSUM>
	ether 5c:e9:1e:ae:c9:7b
	inet6 fe80::188a:594c:b961:51db%en0 prefixlen 64 secured scopeid 0xe 
	inet 10.95.10.49 netmask 0xffffff00 broadcast 10.95.10.255
	inet6 2a02:121e:41c0:40a0:14:307c:d336:24fb prefixlen 64 autoconf secured 
	inet6 2a02:121e:41c0:40a0:61f7:b7eb:a37:95a2 prefixlen 64 autoconf temporary 
	inet6 2a02:121e:41c0:40a0::1:b5 prefixlen 64 dynamic 
	nd6 options=201<PERFORMNUD,DAD>
	media: autoselect
	status: active
4

From 7.21 you can create interface list containing only the interfaces where you want the router to listen from RA messages, and specify it under

/ipv6 settings set accept-router-advertisements-on=THE_INTERFACE_LIST

In that list, do not include bridge.208.

Clear the link-address parameter of the relay entries, it's not needed. Or set it to the link-local (fe80:...) address of the router on the interface if you want.

Also, you've disabled these two entries already:

so it's not important, but address-lists is not the parameter where you put the subnet. The parameter is where you put the name of an IPv6 firewall address list. The addresses given out by the DHCPv6 servers to the clients will be added automatically to that address list, and you can refer to them in firewall rules.

Use the parameter address-pool to specify the pool of /128 addresses, and prefix-pool to specify the pool for PD.