SRX

Hi,

I'm wondering if anyone can help with a DHCPv6 client configuration issue I'm having.  There isn't a lot of information out there regarding this specific issue and I can't help but wonder if i'm doing something wrong (clearly I am!).

I have set flow-based mode on the forwarding options (rebooted the SRX) and allowed dhcpv6 under the security zones interface. I.E:

# set security forwarding-options family inet6 mode flow-based

# set security zones security-zone untrust interfaces fe-0/0/0.10 host-inbound-traffic system-services

Config:

interfaces {
 fe-0/0/0 {
  vlan-tagging;
   unit 10 {
    vlan-id 10;
    family inet {
     dhcp;
    }
    family inet6 {
     ##
     ## Warning: Incompatible with the client configured under 'family inet6 dhcpv6-client'
     ##
     dhcpv6-client {
      client-type statefull;
      client-ia-type ia-pd;

      client-ia-type ia-na;

      client-identifier duid-type duid-ll;
     }
    }
   }
  }.....

# commit check
[edit interfaces fe-0/0/0 unit 10 family inet6]
 'dhcpv6-client'
  Incompatible with the client configured under 'family inet6 dhcpv6-client'
error: configuration check-out failed: (statements constraint check failed)

This is a somewhat confusing error to me.

It's required as my ISP expects DHCPv6 Prefix Delegation and DHCPv6 IA_NA to be set to obtain the IPv6 address.

I'm running firmware version 12.1X46-D20.5.  I have tried prior versions also!

Cheers

What I can see that the error is coming only when you configure both family inet and inet6 as dhcp clients.

I dont see this error when the configure only inet6 or configure family inet with an IP address instead of dhcp client.

Error when DHCP client enabled for inet and inet6

root@SRX220H2-1# show interfaces                                          
ge-0/0/0 {
    unit 0 {
        family inet {
            address 10.204.0.5/22;
        }
    }
}
ge-0/0/1 {
    unit 0 {
        family inet {
            dhcp;
        }
        family inet6 {
            ##
            ## Warning: Incompatible with the client configured under 'family inet6 dhcpv6-client'
            ##
            dhcpv6-client {
                client-type statefull;
                client-ia-type ia-pd;
                client-ia-type ia-na;
                client-identifier duid-type duid-ll;
            }
        }
    }
}

No ERROR when only inet6 is enabled as dhcp client.

root@SRX220H2-1# show interfaces
ge-0/0/0 {
    unit 0 {
        family inet {
            address 10.204.0.5/22;
        }
    }
}
ge-0/0/1 {
    unit 0 {
        family inet {
            address 1.1.1.1/30;
        }
        family inet6 {
            dhcpv6-client {
                client-type statefull;
                client-ia-type ia-pd;
                client-ia-type ia-na;
                client-identifier duid-type duid-ll;
            }
        }
    }
}

++++++++++++++++++++++++++++++++++++

root@SRX220H2-1# show interfaces
ge-0/0/0 {
    unit 0 {
        family inet {
            address 10.204.0.5/22;
        }
    }
}
ge-0/0/1 {
    unit 0 {
        family inet6 {
            dhcpv6-client {
                client-type statefull;
                client-ia-type ia-pd;
                client-ia-type ia-na;
                client-identifier duid-type duid-ll;
            }
        }
    }
}

Need to check if this is a limitation.

Thanks,

Suraj

Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too

Thanks - I can commit the config now.  Now I just need to work out why i'm not getting an IPv6 address from my ISP.

Cheers

Further to the above, this config works and allows DHCP for both IPv4 and IPv6:

interfaces {
 fe-0/0/0 {
  vlan-tagging;
   unit 10 {
    vlan-id 10;
    family inet {
     dhcp-client;
    }
    family inet6 {
     dhcpv6-client {
      client-type statefull;
      client-ia-type ia-pd;

      client-ia-type ia-na;

      client-identifier duid-type duid-ll;
     }
    }
   }
  }.....

# commit check

configuration check succeeds

It would seem that Juniper have changed the DHCP client config and I've missed it in the release notes somewhere!