Question

On an access switch, users on VLAN 40 report they are not receiving IPv6 addresses from the stateful DHCPv6 server, which resides upstream through interface GigabitEthernet1/0/24. You have configured IPv6 DHCP guard globally with a policy attached to all access ports and the uplink. The relevant configuration shows:

ipv6 dhcp guard policy CLIENT_POLICY
  device-role client
!
interface range GigabitEthernet1/0/1 - 23
  ipv6 dhcp guard attach-policy CLIENT_POLICY
interface GigabitEthernet1/0/24
  ipv6 dhcp guard attach-policy CLIENT_POLICY

DHCPv6 SOLICIT messages leave the clients, but DHCPv6 ADVERTISE/REPLY messages never reach them. What is the cause?

Accepted Answer

The uplink GigabitEthernet1/0/24 has a client-role policy attached, so it drops the server-sourced DHCPv6 ADVERTISE/REPLY messages arriving from the DHCP server.

Answer

IPv6 DHCP guard requires an IPv6 binding table entry for the server before it will forward REPLY messages, and none exists yet.

Answer

The device-role client setting causes the switch to drop client-originated SOLICIT messages, preventing the exchange from starting.

Answer

DHCP guard cannot inspect stateful DHCPv6 and must be replaced with RA guard on the uplink to permit server replies.