DHCPv6 Support In Cisco IOS XE Fuji 16.9.1, DHCP Version 6 support is added to the Zero-Touch Provisioning feature. DHCPv6 is enabled by default, and will work on any device that boots without a startup configuration. DHCPv6 is only supported on Catalyst 9300 and 9500 Series Switches. Note DHCPv6 is supported by both TFTP and HTTP download of Python scripts. If this download fails, the device reverts to the initial or factory settings (without any configuration). For both DHCPv4 and DHCPv6 to work, the correct HTTP or TFTP file path must be available in the DHCP configuration.
There can be scenarios where the same interface can have both IPv4 and IPv6 addresses, or two different interfaces in a network—one can receive IPv4 traffic and the other, IPv6 traffic. We recommend that you use either the DHCPv4 or DHCPv6 option in your deployment. The following is a sample DHCPv4: {/etc/dhcp/dhcpd.conf:} host { hardware ethernet xx:xx:xx:xx:xx:xx; option dhcp-client-identifier "xxxxxxxxxxxxxx"; option host-name " ".
option log-servers x.x.x.x; fixed-address x.x.x.x; if option vendor-class-identifier = "..." { option vendor-class-identifier "..."; if exists user-class and option user-class = "iPXE" { filename "http://x.x.x.x/…/ "; } else { filename "http://x.x.x.x/…/ "; } } } The following is a sample ISC DHCPv6 server configuration: option dhcp6.bootfile-url "http://[2001:DB8::21]/sample_day0_script.py"; Secure ZTP As per RFC 8572, Secure ZTP is a technique to securely provision a device, while it is booting in a factory default state. The provisioning updates the boot image, commits an initial configuration, and runs customer-specific scripts.
The existing ZTP can download a configuration script from an HTTP or a TFTP server, and run it on the device, but it does not securely provision a device. To securely provision a device, the following requirements must be met: • The management system must validate that it is provisioning a valid device. • The device must validate that it is being deployed in the correct network. • The device must validate that the provisioning data has not been tampered with. • Provisioning must use a secure transport protocol for data communication. Zero-Touch Provisioning DHCPv6 Support Zero-Touch Provisioning 3