UniFi - How to Implement IPv6 with DHCPv6 and Prefix Delegation on USG


Overview


This article will provide guidance on how to provision IPv6 on a UniFi Security Gateway (USG). The article will explain how DHCPv6-PD and Static IPv6 are implemented, along with explaining how  LAN clients obtain a IPv6 address. 

NOTES & REQUIREMENTS:
  • Applicable to UniFi Controller v5.7+
  • DHCPv6-PD will not work with the USG behind another router that does not provide prefix delegation or sub-delegation.
  • Will not work with 6RD, DS-Lite, or other non-native IPv6 technologies. 

Table of Contents


  1. Introduction
  2. Steps: How to Implement IPv6 on a USG
  3. Testing & Verification
  4. Manual Configuration (for UniFi Controllers prior to v5.7)

Introduction


Back to Top

Depending on how the ISP has their IPv6 environment structured, the USG will either need to be configured with a static IPv6 address or receive an address via DHCPv6 on WAN. 

On the LAN side of this configuration the setup may vary on the factors listed in the table above. If the USG has received a prefix delegation (PD) from the ISP, it will advertise the prefix that clients will use with stateless address auto-configuration (SLAAC) and the EUI-64 process. The static IPv6 addressing assumes you know the block of addressing that the clients are supposed to be using.  


Steps: How to Implement IPv6 on a USG


Back to Top

WAN configuration:

  1. In the UniFi Controller, navigate to Devices and select the USG in question. 
  2. In the Properties panel that will appear, go to the config tab. There will be a WAN 1 and WAN 2 section. 
  3. The IPv6 section is where the USG is configured for either DHCPv6-PD or static IPv6 addressing. 
  4. After all of the selections have been made, provision the changes. 

LAN Configuration:

  1. Under each individual network will be a "configure IPv6 network" section.
  2. If DHCPv6 was selected on WAN then prefix delegation will be used for "IPv6 Interface Type". 
  3. Make sure the correct WAN interface and IPv6 router advertisement are applied. 
  4. If static was chosen on WAN, the options for IPv6 gateway/subnet must be filled in along with applying the correct DHCPv6 range if desired. 
  5. After each selection has been made click save and the USG will be provisioned. 

Testing & Verification


Back to Top

1. SSH into the USG

2. Input the following commands:

show ipv6 route : will show IPv6 connected networks for both global and link-local address types.

show interfaces : will show IPv6 addressing under the configured interfaces. 

ping6 google.com : will respond with icmp6 replies if configured correctly. 

When enabled, the clients should not need intervention to complete the SLAAC process. If the clients do not have an address then disabling/enabling the NIC should bring the addressing up. A test of connectivity from a client would be to "ping6 google.com" (OS X, Linux, BSD) or "ping -6 google.com" (Windows)


Manual Configuration with .JSON File (Controller Version Pre-5.7)


Back to Top

Click here to see manual configuration instructions for UniFi Controller versions prior to v5.7. We recommend to upgrade to the newest version available.

Overview


This article provides guidance on provisioning a UniFi Security Gateway (USG) and internal networks with basic IPv6 functionality with UniFi version 5.4.11+ for DHCPv6 WANs with prefix delegation.

NOTES & REQUIREMENTS:
  • This can only be done with a config.gateway.json file in stable release versions. Read this article for more information on the config.gateway.json file.
  • If your ISP uses a 56 or 48 PD size, the config.gateway.json should be changed accordingly.

Table of Contents


  1. Introduction
  2. Steps - How to Implement IPv6 on a USG
  3. Related Articles

Introduction


Back to Top

The USG WAN interface will be assigned an IPv6 address from DHCPv6, and the LAN will be assigned an IPv6 subnet from the ISP-provided Prefix Delegation (PD). This requires the user's ISP to have an IPv6 infrastructure as well as providing IPv6 to the user as a service, including with PD.

On the LAN side, SLAAC (Stateless Address Autoconfiguration) will be used. This enables autoconfiguration of IPv6 addresses on connected clients. Stateless autoconfiguration or SLAAC is where the host is assigned a 64-bit prefix, and then the last 64 bits of their address are obtained with help of the EUI-64 process, or obtained randomly for hosts with privacy-addressing enabled.


Steps - How to Implement IPv6 on a USG


Back to Top

  1. Download the corresponding config.gateway.json files here: USG or USG Pro
  2. Make the appropriate changes to the file if needed (see note below)
  3. Copy the config.gateway.json file to the UniFi controller and force a provision on the USG. Need help? reference our Related Articles for more information.
NOTE: If you have a VLAN-tagged WAN, the WAN interface will need to be changed accordingly in the file.

Related Articles


Back to Top