Configuring IPv6 DHCP Relay on Security Gateways

You can configure IPv6 DHCP Relay on the Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. in either Gaia PortalClosed Web interface for the Check Point Gaia operating system. or Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell)..

You can configure each interface to send requests to a different set of DHCPv6 servers.

Best Practice: Management Servers R80.10 and higher include pre-defined DHCPv6 services. These built-in services perform stateful inspection of DHCPv6 traffic for enhanced security. Upgrade your older management servers before you configure DHCPv6 relay.

Important - In a ClusterClosed Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must configure all the Cluster Members in the same way.

Configuring IPv6 DHCP Relay in Gaia Portal

  1. With a web browser, connect to GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Portal at:

    https://<IP address of Gaia Management Interface>

    If you changed the default port of Gaia Portal from 443, then you must also enter it (https://<IP address>:<Port>).

  2. From the left navigation tree, click Advanced Routing > IPv6 DHCP Relay.

  3. Click Add.

  4. Select Enable.

  5. In the Interface field, select the interface, on which you want to enable BOOTP/DHCP Relay.

  6. Optional: Select Send Interface-ID to send the Interface-ID option with DHCPv6 Relay requests.

    This option tells the DHCPv6 server to copy the interface ID from a relay request to a relay reply message.

    The relay agent uses this value to identify on which interface the DHCPv6 request was originally received.

    Best Practice - Enable this option in situations where the global link address of the interface that runs the DHCPv6 Relay is not sufficient to uniquely identify the interface.

    The relay agent uses this value to identify on which interface the DHCPv6 request was originally received.

  7. Optional: In the Wait Time field, enter the wait time for this interface.

    If a DHCPv6 client indicates that it waited for a server response for shorter than this wait time, the DHCPv6 Relay drops the request instead of forwarding it.

    This delay provides an opportunity for a local DHCPv6 server to respond before attempting to relay to a remote server.

    Note - The actual delay is in increments of 0.01 seconds. Setting this value to 100 configures a wait time of 1 second.

  8. In the Relays section, define the IPv6 address of each relay, to which you want to forward DHCPv6 requests.

    You can configure a different list of DHCPv6 servers for each interface, which receives DHCPv6 requests.

    Configuring different servers for different interfaces provides load balancing.

    Configuring multiple servers on a single interface provides redundancy.

    Configuring different servers on different interfaces provides load balancing, while configuring multiple servers on a single interface provides redundancy.

    You can configure relay to multiple configuration servers independently on each interface.

    Note - This IPv6 address cannot be an address that belongs to the local machine.

    For each relay:

    1. Click Add

    2. In the Relay To field, enter the IPv6 address of the relay.

    3. Click OK.

  9. Click Save.

  1. From the left navigation tree, click Advanced Routing > IPv6 DHCP Relay.

  2. Select the interface.

  3. Click Edit.

  4. In the Relays section:

    1. Select the server.

    2. Click Delete.

  5. Click Save.

  1. From the left navigation tree, click Advanced Routing > IPv6 DHCP Relay.

  2. Select the interface.

  3. Click Delete.

  4. Click Save.

Configuring IPv6 DHCP Relay in Gaia Clish

  • To see the available "set" commands for IPv6 DHCP Relay, enter in Gaia Clish:

    set ipv6 dhcp6relay[Esc][Esc]

  • To see the available "show" commands for IPv6 DHCP Relay, enter in Gaia Clish:

    show ipv6 dhcp6relay[Esc][Esc]

set ipv6 dhcp6relay interface <Name of Interface>

      interface-id {off | on}

      {off | on}

      relay-to <Destination IPv6 Address> {off | on}

      wait-time {<1-65535> | default}

Parameter

Description

<Name of Interface>

Specifies the interface, on which you want to enable IPv6 DHCP Relay.

interface-id {off | on}

This option tells the DHCPv6 server to copy the interface ID from a relay request to a relay reply message.

The relay agent uses this value to identify on which interface the DHCPv6 request was originally received.

Best Practice - Enable this option in situations where the global link address of the interface that runs the DHCPv6 Relay is not sufficient to uniquely identify the interface.

Default: off

{off | on}

Disables (off) or enables (on) IPv6 DHCP Relay on the specified interface.

relay-to <Destination IPv6 Address> {off | on}

Specifies the IPv6 address of each relay, to which you want to forward DHCPv6 requests.

You can configure a different list of DHCPv6 servers for each interface, which receives DHCPv6 requests.

Configuring different servers for different interfaces provides load balancing.

Configuring multiple servers on a single interface provides redundancy.

Configuring different servers on different interfaces provides load balancing, while configuring multiple servers on a single interface provides redundancy.

You can configure relay to multiple configuration servers independently on each interface.

Note - This IPv6 address cannot be an address that belongs to the local machine.

wait-time {<1-65535> | default}

If a DHCPv6 client indicates that it waited for a server response for shorter than this wait time, the DHCPv6 Relay drops the request instead of forwarding it.

This delay provides an opportunity for a local DHCPv6 server to respond before attempting to relay to a remote server.

Note - The actual delay is in increments of 0.01 seconds. Setting this value to 100 configures a wait time of 1 second.

Range: 1-65535 (units of 1/100th of 1 second)

Default: 0

  1. Connect to the command line.

  2. Log in to Gaia Clish.

  3. Configure the interface, on which you want to enable BOOTP/DHCP Relay:

    set ipv6 dhcp6relay interface <Name of Interface> on

  4. Configure the IPv6 address of each relay, to which you want to forward DHCPv6 requests:

    set bootp interface <Name of Interface> relay-to <Destination IPv6 Address> on

  5. Optional: Configure values for one or more of these parameters:

    • Interface-ID

    • Wait Time

    set ipv6 dhcp6relay interface <Name of Interface>

          interface-id on

          wait-time {<1-65535> | default}

  6. Save the configuration:

    save config

  1. Connect to the command line.

  2. Log in to Gaia Clish.

  3. Disable the IPv6 DHCP Relay destination on the interface:

    set ipv6 dhcp6relay interface <Name of Interface> relay-to <Destination IPv6 Address> off

  4. Save the configuration:

    save config

  1. Connect to the command line.

  2. Log in to Gaia Clish.

  3. Disable the IPv6 BOOTP/DHCP Relay on the interface:

    set ipv6 dhcp6relay interface <Name of Interface> off

  4. Save the configuration:

    save config