skip to content

A home gateway asks its ISP for a /56 with DHCPv6 prefix delegation; how does it obtain the prefix, and how does it use it on its LAN segments?

level: seniorimportance: should knowfreq 18%

answer

  1. IA_PD, not IA_NA
  2. a prefix-length hint
  3. two to the power eight
  4. lifetimes flow downstream
  5. someone must install the route

basics

~20 s

The gateway solicits with an IA_PD option, often hinting /56, and the ISP's server delegates a prefix with lifetimes. The gateway splits it into 256 /64s, one per LAN, and announces them; the ISP edge must route the /56 to it.

solid answer

~40 s

The gateway acts as a DHCPv6 client on its WAN side. It sends a `Solicit` with an `IA_PD` (option 25), optionally holding an `IA Prefix` (option 26) with `prefix-length` 56 and prefix `::` as a size hint. After `Advertise`, `Request` and `Reply`, it holds, say, `2001:db8:4400::/56` with preferred and valid lifetimes, renewed at T1 and rebound at T2. A /56 leaves 64 - 56 = 8 bits of subnet, so it holds 2^8 = 256 /64s. The gateway gives each LAN interface its own /64 and announces it in Router Advertisements, never with lifetimes longer than what remains on the delegation. It null-routes the unused part. DHCPv6 itself installs no route upstream: the ISP's delegating router or relay must add a route for the /56 toward the gateway (RFC 8987).

go deeper

for a junior

Know that a home gateway asks its ISP for a whole prefix with DHCPv6, then splits it into one /64 per home network.

for a middle

Explain IA_PD and IA Prefix, the prefix-length hint, and how to count /64s in a delegation: two to the power of 64 minus the delegated length.

for a senior

Trace why a delegated prefix fails to route: no relay route or wrong length upstream, missing null route, LAN lifetimes outliving the delegation, or a changed prefix not deprecated.

for a principal

Choose delegation sizes and lifetimes for a subscriber base, and decide how delegations become routes and survive relay restarts.

## What prefix delegation is **DHCPv6 prefix delegation** lets a server hand a client a whole IPv6 prefix instead of a single address. It was first specified in RFC 3633, merged into RFC 8415, and is now part of **RFC 9915**. The client asks with an **IA_PD** option (identity association for prefix delegation, option 25). Each delegated prefix arrives in an **IA Prefix** option (option 26) carrying a prefix length, the prefix, and a **preferred** and **valid lifetime**. The classic client is a home gateway (customer edge, or CE, router). RFC 7084, an Informational document listing IPv6 CE router requirements, calls the client the "requesting router" and the server the "delegating router". Unlike an `IA_NA`, which belongs to exactly one interface, an `IA_PD` can belong to the whole device, to a set of interfaces or to one interface (RFC 9915 §12.2). ## The exchange, step by step 1. **Trigger.** By default the gateway starts prefix delegation when a Router Advertisement on its WAN link has the M or O flag set (RFC 7084, WPD-4). 2. **Solicit.** It multicasts a Solicit with an `IA_PD`. It may include an IA Prefix option with `prefix-length` 56 and the prefix set to `::`, a hint about the size it wants. RFC 7084 WPD-2 says a hint should cover one /64 per interface, rounded up to the nearest nibble. It may also include an `IA_NA` for its own WAN address. 3. **Relay and server.** The ISP's aggregation device relays the Solicit to the ISP's server, or runs the server itself. The server picks a prefix by static assignment, from a pool, or from an external authority such as RADIUS. RFC 9915 leaves that choice to the server. 4. **Advertise, Request, Reply.** The Reply's `IA_PD` carries, for example, `2001:db8:4400::/56`, its lifetimes, and T1 and T2. RFC 9915 recommends 0.5 and 0.8 times the shortest preferred lifetime. 5. **Accept what arrives.** The gateway must accept a size different from its hint (WPD-3) and should log an error if the prefix is too small for its interfaces. If it asked for both, it must by default accept the `IA_PD` even when no `IA_NA` address comes back (WPD-6). 6. **Keep it alive.** Renew goes to the same server at T1 and Rebind to any server at T2, exactly as for addresses. ## Carving the delegated prefix A /64 is the subnet size SLAAC needs, so the arithmetic is two to the power of the bits between the delegated length and 64: | Delegated | Subnet bits | /64 segments | |---|---|---| | /48 | 16 | 65,536 | | /56 | 8 | 256 | | /60 | 4 | 16 | | /64 | 0 | 1 | From `2001:db8:4400::/56` the gateway can number `2001:db8:4400::/64` through `2001:db8:4400:ff::/64`. RFC 7084 L-2 requires a separate /64 for each LAN interface. The gateway announces each one in Router Advertisements so hosts can use SLAAC, and it may also run a DHCPv6 server on the LAN, passing along DNS settings it learned upstream. Two rules tie the LAN to the delegation: - **Lifetimes flow downstream.** Addresses and prefixes the gateway derives MUST NOT have preferred or valid lifetimes longer than what remains on the delegated prefix (RFC 9915 §6.3). - **Unused space is discarded.** Traffic for any part of the /56 not assigned to a LAN must be dropped, with the delegated prefix's next hop pointing to a null destination (WPD-5). Otherwise a packet for an unused /64 would bounce between the gateway's default route and the ISP's route until its hop limit ran out. ## The routing half that DHCPv6 does not do A DHCPv6 exchange moves a prefix to the client, but no router upstream learns where to send traffic for it. RFC 9915 §19.1.3 says only that the server "may need a protocol or other out-of-band communication" to set up routing. RFC 8987, a Standards Track document on prefix-delegating relays, closes the gap: - **R-1:** the relay keeps a routing entry for each delegated prefix, pointing at the client, and removes it when the delegation is released or expires; - **R-2:** the entry uses exactly the delegated prefix length; - **R-3:** ingress filters admit traffic sourced from the delegated prefix and block other sources; - **S-1:** delegations survive a relay restart, through bulk leasequery or persistent storage. The gateway itself must not start a dynamic routing protocol on its WAN interface by default (WPD-7). ## When the prefix changes RFC 9915 forbids the gateway from sending Release for a delegated prefix while any address space from it is still in use on the LAN. If a reconnect brings a different prefix, RFC 7084 L-13 has the gateway announce the old prefix at once with a preferred lifetime of 0, and a valid lifetime of 0 or the lower of its current value and two hours. Hosts then stop choosing the old addresses for new connections.

  • Why must the gateway null-route the part of its delegated prefix it has not assigned to any LAN?
    The ISP routes the whole /56 to the gateway, and the gateway's default route points back at the ISP. A packet for an unassigned /64 would otherwise loop between them until its hop limit expired. RFC 7084 WPD-5 makes the gateway drop such packets, ideally sending an ICMPv6 Destination Unreachable, so the null destination absorbs them.
  • What should the gateway do when a reconnection brings a different /56 from the ISP?
    It numbers its LANs from the new prefix and, per RFC 7084 L-13, at once announces the old LAN prefixes with a preferred lifetime of 0. The valid lifetime becomes 0 or the lower of its current value and two hours. Hosts stop using the old addresses for new connections. RFC 9915 also forbids releasing a delegated prefix while LAN addresses from it are still outstanding.
  • Why can one IA_PD serve several LAN interfaces when an IA_NA belongs to exactly one interface?
    An `IA_NA` carries addresses configured on one interface, so RFC 9915 ties it to that interface. An `IA_PD` carries a prefix the client subdivides itself, so it can belong to the whole device, a set of interfaces or a single interface. Operators usually prefer one larger delegation to several small ones.

saying these in an interview costs you the question

  • Prefix delegation just assigns a large address to the gateway's WAN interface.
  • The DHCPv6 exchange itself puts a route to the delegated prefix into the ISP's routers.
  • The gateway may advertise its LAN prefixes with any lifetime it likes.
  • If the ISP delegates a size other than the hint, the request has failed.
  • A delegated /56 gives the gateway 56 LAN subnets.