Windows Server, DHCP, IPv6, & multiple subnets

---

What is the recommended way to configure Windows Server IPv6 DHCP on a 3 subnet network?

I had Windows Server 2012 DCs on 1 subnet and workstations on 2 other subnets. Until I watched your 70-410 DHCP episodes, our pfSense router that connected the 3 subnets was performing DHCP for both IPv4 and stateful IPv6 on all subnets. I now have DHCPv4 running on the Win Servers and pfsense relay agents configured for v4, but stateful DHCP v6 is still running from pfsense.

I'd like to have DHCPv6 running from the Win Servers as well, but after lots of searching I've come away with more questions than answers. If all clients are Windows 7, should I be using stateful or stateless DHCPv6? Why? Does DHCPv6 support relay agents for stateless? or isn't it needed? Should the pfsense router or the Windows Servers be doing the V6 DNS server address advertisements?

On a related note, I'm currently only running IPv6 internally, using a FDxx:: address range. When I set that up our ISPs didn't provide V6; I think they do now. I think I've read that V6 doesn't support NAT. Is that correct? How do I assign my servers static V6 addresses and give them Internet access over V6? I work at a small company with about 50 computers. We have 5 static IPv4 addresses from each of our 2 ISPs.

Any resources you could refer me to that clearly explain all of this would be greatly appreciated.

Thanks!

Hi Matthew,

Full disclosure, I won't be able to answer all of your questions with out quite a bit of research myself. Just curious, if you are not quite comfortable with IPv6 why not just use IPV4 private addressing internally and NAT it on the router? Why use IPV6 internally if you are provided ipv4 addresses from the ISP? I'm not familar with pfense can it translate between ipv4 and ipv6, but once again, why bother at all.

Also, It is NOT recommended to NAT IPV6. I believe that it is technically possible to NAT IPV6, but There is no reason to do this as there are an unfathomable number of available addresses. I can't even imagine the headache that would present.

Why not give the servers static IPV4 addresses? I don't believe it is common practice to assign DHCP to servers.

Are you employees using laptops at the workstations, i.e. are they taking them home? If not then you could use Stateless Auto Configuration, which does away with the need of DHCP. . Essentially the workstations will decide upon what IPV6 address to use by seeing what is available through NDP (neighbor discovery protocol). Please see this link text .

Alternatively, if you did want to assign static IPV6 to the server then you would do so just as you would with IPV4 on the NIC. Then just make sure you have the IPV6 gateway address set. I know im not providing all the answers, but I hope this helps. Just curious why you are not using IPV4 for the entire network.?

Thanks!

@Matthew-Horvay said in Windows Server, DHCP, IPv6, & multiple subnets:

What is the recommended way to configure Windows Server IPv6 DHCP on a 3 subnet network?

I had Windows Server 2012 DCs on 1 subnet and workstations on 2 other subnets. Until I watched your 70-410 DHCP episodes, our pfSense router that connected the 3 subnets was performing DHCP for both IPv4 and stateful IPv6 on all subnets. I now have DHCPv4 running on the Win Servers and pfsense relay agents configured for v4, but stateful DHCP v6 is still running from pfsense.

I'd like to have DHCPv6 running from the Win Servers as well, but after lots of searching I've come away with more questions than answers. If all clients are Windows 7, should I be using stateful or stateless DHCPv6? Why?

DHCPv6 stateful is probably only required when you need to control the address space. For example, if you're going to choose to subnet your DHCPv6 Address space internally.

Does DHCPv6 support relay agents for stateless? or isn't it needed? Should the pfsense router or the Windows Servers be doing the V6 DNS server address advertisements?

I'm not sure what you're trying to do here. Are you providing a subnet in between your pfsense firewall and your Winodws server acting as a router so that pfsense is your DHCPv6 server and your router is becoming a relay agent? Sorry not of any real help here.

On a related note, I'm currently only running IPv6 internally, using a FDxx:: address range. When I set that up our ISPs didn't provide V6; I think they do now. I think I've read that V6 doesn't support NAT. Is that correct?

Yes, IPv6 doesn't support NAT natively and shouldn't need to do NAT. If you're using some type of transition technology then it will support it but it doesn't do it if you're running IPv6 and the other side is running IPv6.

How do I assign my servers static V6 addresses and give them Internet access over V6? I work at a small company with about 50 computers. We have 5 static IPv4 addresses from each of our 2 ISPs.

You'll have to talk to your ISP to find out if they want you to put static IPv6 Address on public facing NICs or are they going to assign them with DHCPv6 from their end. If you're allowed to, you just need your /32 address space and make sure you assign it properly on each interface.

Any resources you could refer me to that clearly explain all of this would be greatly appreciated.

Thanks!

Thank you for your replies.

Our pfsense has 6 ethernet ports and is acting as a router, firewall, snort ips, VPN, & DHCPv6. 2 ethernet ports are connected to 2 different ISP's modems. The remaining 4 ports are 192.168.4.1/24, 192.168.5.1/24, 192.168.6.1, & 192.168.7.1. Each of those 4 LAN ports connects do a different VLAN on a 50-port switch. The Windows Servers are on 192.168.5.x. The desktops are on .6 and .7. I used a similar IPv6 addressing scheme with the 4 LANs being fdf0:df44:cd65:4::1/64, fdf0:df44:cd65:5::1/64, fdf0:df44:cd65:6::1, & fdf0:df44:cd65:7::1. The Windows DCs have static v4 & v6 addresses. We don't have any laptops as part of the domain.

I use gateway groups for load balancing and fault tolerance between our 2 internet connections. Since each internet connection is from a different provider, with a different set of IPs, I don't understand how I would achieve the same result in IPv6 without using NAT. I can't assign 2 public IPs to each client can I?

Is DHCPv6 Relay only used for stateful address assignment? How do the IPv6 Server Options get to clients on different subnets from the servers (does the relay send them or should they be configured on the router)?

What I have now has been functioning for a couple years. I learned from the ITPro.TV videos that doing DHCPv4 on the pfsens was the wrong way and fixed that. In the process I read that Server 2012 DHCP only supports failover for V4, not V6 because they expect V6 to be stateless, so I know my current V6 config is "wrong" and would like to make it "right."

I started using IPv6 when I transitioned the company from Server 2003 & XP to Server 2012 & 7. This quote from a technet blog explains why:

"From Microsoft’s perspective, IPv6 is a mandatory part of the Windows operating system and it is enabled and included in standard Windows service and application testing during the operating system development process. Because Windows was designed specifically with IPv6 present, Microsoft does not perform any testing to determine the effects of disabling IPv6. If IPv6 is disabled on Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008, or later versions, some components will not function. Moreover, applications that you might not think are using IPv6—such as Remote Assistance, HomeGroup, DirectAccess, and Windows Mail—could be."

Alex, thank you for that link to ipv6.com. There's lots of helpful stuff there that I've only started reading through.

Ronnie, a series of episodes on IPv6 would make a great addition to the Technical Skills section of your course library IMO.

Again, thanks for any help.
-Matt

@Matthew-Horvay,

Make sure you make a course request from the course library!