This document focus on single ppp dual stack IPv4/IPv6 session for broadband customers. I am trying to update as I make more tests on IPv6 for PPP Broadband.

You may split process as between ISP/CPE and CPE/HOST. The deployment heavily depends on the CPE capabilities and end-user operating systems. This document mostly focus on communication between ISP and CPE. So enabling the IPv6 should be done per customer level. We have configured the IPv6 options under virtual-tempalte and used cisco-avpair=’lcp:interface-config#1=ipv6 enable’ per customer to enable IPv6.

Read before;

Best Current Operational Practice for Operators: IPv6 prefix assignment for end-users – persistent vs non-persistent, and what size to choose

Design Architecture Options for IPv6 Deployment in Broadband Access Networks

ISP-CPE IPv6 PPP Model :

• Single PPP dual stack IPv4 and IPv6 session

Using a single ppp session for IPv4 and IPv6 is much more efficient than using a different sessions which is widely supported on CPE and BNG. You may face problems while using different sessions for the subscriber network resources (aaa, radius, etc) also for the NG resources as it doubles the current ppp sessions. Currently IPv6 is disabled on most CPE, it should be also enabled on CPE. Aslo most of them configured to use dual stack by default.

• Static /64 prefixes for each customer

Broadforum suggest to use /60 for broadband customers however /64 is enough for consumers. But plan your IPv6 address plan for much more less to the /60. Static prefix assignment per customer is much more easy as you do not search audits for finding usage reports.

There can be problems with using dynamic, non-persistent, prefixes. When the IPv6 prefix is changed, dslam reboot etc, CPE should inform the local hosts about to lease the dhcp prefixes, currently which most cpe’s have problem about. Auditing can also be a problem. You may need to enable logging of these dynamic prefixes assigned to the customer separate from the session accounting. If you are using DHCPv6 on the BNG and local pool you should enable DHCPv6 logging as Delegated IPv6 prefix is not included in the accounting records. For cisco which will be included in the session’s accounting records. But DHCPv6 runs after session establishment and may not be included in the session start records. Accounting should be updated after dhcpv6 assignment.

aaa accounting update newinfo periodic 60 (periodic update may not be required in your case).

Static assignment resolves most of these obstacles. Note that there is no nat defined for IPv6 and not needed. Security should be left to the security functions like CPE firewall or features on the customer access devices. You may assign static prefix when you enable customer in your back office system. It’s not very feasible to map customer username, port etc to a prefix as this will lead to security issues. So some offset or etc should be used and do not forget to return the unused prefixes.

• SLAAC and Statefull DHCPv6 for address assignment

There are couple of ways to for IPv6 prefix assignment between ISP and CPE.

Host can use the IPv4 DNS in dual-stack environment. You may use RA messages to announce DNS to the CPE but its not fully supported on all CPE models. Also ND RA messages is need for CPE to install default route. DHCPv6 is needed for CPE for the lan side, as it gets the LAN prefix via DHCPv6 messages. Some of CPE’es have option to get this information from RA received prefix as well.

You may use different prefixes for the WAN side and LAN side of the CPE.

The radius attributes, Framed-Ipv6-Prefix generally defines for the prefix to be used by SLAAC on the link and Delegated-Ipv6-Prefix defines the prefix to be used by DHCPv6. Delegated-Ipv6-Prefix will not be included in the accounting messages as its supposed to use with dhcpv6. So DHCPv6 accounting must be enabled which then will be included in the accounting records of the session.

However Cisco ISG/IOS XE have a fall-back mechanism for built-in DHCPv6 server while using aaa for prefix delegation ;

If you configure AAA for DHCPv6 ( get the prefix from AAA server, or the name of the pool to be used) and if Delegated-Ipv6-Prefix returned via access-accept messages, it used as DHCPv6 prefix to be assigned. If you configure AAA for DHCPv6 and no prefix is returned via access-accept BNG makes another aaa request to the radius for the prefix to be assigned (look for cisco documentation for more information). Also you can use Framed-Ipv6-Prefix for this fallback scnerio, you need to disable adding this prefix to the nd queu with no ipv6 nd prefix framed-ipv6-prefix command. With this, the Framed-Ipv6-Prefix which is sent via ND RA messages can also be used by DHCPv6 server. With this configuration you can use single mechanism to assign wan and lan prefix for the user. If both of them are included in the access-accept message Delegated will be used by DHCPv6 server. Also you may send the prefixes pool name to be send via radius with Delegated-Ipv6-Prefix-Pool defined in RFC 6911.

• Framed-Interface-Id

As noted before CPE get’s its ipv6 prefix via ND or DHCPv6 but what it is the ipv6 address? From broadband forum TR-187;

In contrast with IPCP which provides other configuration information, IPV6CP only negotiates an interface identifier. Other configuration information is provided via Neighbor Discovery and DHCPv6.
The 64-bit interface identifier is used to derive the Link-local address on the WAN interface. Given that the Link-local address is derived by the RG for its WAN interface, Duplicate Address Detection is not required for the link-local address or any address derived from the interface identifier on the PPP link.

Framed-Interface-Id radius attribute indicates this interface identifier used on the link. If it’s included in the access-accept message as a reply from aaa, it will be send to remote side of the link to as an option to use on the link. And if the CPE supports it may use this interface-id as the lower 64 bit of it’s WAN IPv6 address.

With this feature you can assign a predefined /128 IPv6 address for the CPE. How to construct the interface-identifier depends on the ISP. A hash generator may be used based on customer information (beware of hash collision).

Tests for Cisco IOS XE, ASR1K

Our IPv4 model is build on radius. For dynamic customers, IPv4 address pools are defined on BNG’s. Static ipv4 customers addresses are defined in database/radius and returned to the BNG via Access-Accept message via Framed-Ip-Address avp. If there is no Framed-Ip-Address defined for the customer the generic pool name which is defined on every BNG is returned. We are not using radius based pools as its hard to track usage for larger number of customers (releasing the recourses). BNG’es are much more efficient as they can release the resource after ppp session disconnects, or handle reboot and etc issues.

For IPv6 CPE-WAN side may require IPv6 prefix and CPE-LAN side requires prefix. For both of them we decided to use static prefix assignment but enabled the dynamic option via using pools. There is couple of methods for using pools.

CPE-LAN : DHCPv6 used for assining prefixed to the CPE for LAN side.

• DHCPv6 local pool : Defined in the dhcpv6 server configuration. But then assigning static prefix per customer is non executable. As you can not mix local pool and AAA assignment you have define each static prefix on the device itself!
• DHCPv6 AAA : You can use AAA to assign prefix or prefix pool per customer.

CPE-WAN : CPE may use used DHCPv6 but generally ND is used. You may send the pool name via Framed-IPv6-Pool  or static assignment per customer via Framed-IPv6-Prefix.

The nanog document Building an IPv6 Address Management System may be good reference to this assigning static prefix.

Normally Cisco ISG sends authorisation request to the aaa server to get the dhcpv6 prefix. AAA server handles the DHCPv6 prefixes range. Static matching or dynamic assignment on the AAA depends on the configuration. But this means sending another request. As noted with the use of no ipv6 nd prefix framed-ipv6-prefix command and prefix returned in the access-accept message BNG no longer send another request to get prefix. With this you may use same prefix for WAN and LAN side of the CPE.

For the simplicity we have chosed to use same prefix for the WAN and LAN side for testing. However it may be different.

• IPv6 address assignment methods

  • Static
  • Stateless Address Auto-configuration SLAAC : Based on router advertisement nearly required for every local network for proper IPv6 communication. RA message includes IPv6 prefixes and lifetimes, some flags, and default router and lifetime. What about DNS? RFC 6106 DNS option is added to the RA messages. Check for the CPE and host features.
  • DHCPv6
    • Stateless : Still use SLAAC to get prefix and router information. Use DHCPv6 for DNS. Host starts with RS messages and the router response with RA message with other-config flag which tells host to config DNS with DHCPv6. Than host starts and crawls DHCPv6 server to get DNS.
      • Statefull : Still use SLAAC just for starting the process. Host starts with RS but this time router responds with RA with managed-config flag which tells host to configure prefix and DNS with DHCPv6. Also If no router is found on the link host may start DHCPv6 statefull process. Uses its link-local address.
    • DHCPv6-Prefix Delegation : Often used for between service provider and CPE. Its an extension to he DHCPv6. Instead of a single address assignment, DHCPv6-PD will assign a set of IPv6 “subnets” to the client.

Additionally the OS behaviour changes according to the combination of A bit and M,O flag. The ietf document DHCPv6/SLAAC Interaction Problems on Address and DNS Configuration explains these problems.

• logging :  ISP logs the assigned prefix of the customer which is /64 or lower.  It can be logged via radius avp or with static assignment to the customer.  For the end user, enterprise customers, logging can be much more difficult.  IPv6 Privacy Extensions makes this much more complicated which is enabled by the default in most of the operating systems. Basically operating system generates temporary address from the given IPv6 Prefix for every service that requested. These temporary IPv6 addresses means a lots of IPv6 addresses to be logged per user. Also the dynamic/hashed IPv6 address generation mechanism causes difficulties for troubleshooting. However it can be turned off in OS level. Search for newest information for your OS.
• address assignment : According to the Broadband forum /60 prefix assignment is suggested. You can assign up to /64 length prefix to the customers. Basically ipv6 address assignment can be done via SLAAC , DHCP or using both of them. SLAAC is based on RA messages that includes IPv6 prefixes and lifetimes, some flags, and default router and lifetime. However with RFC 6106 DNS option is added to the RA messages.