Set up and test a DHCPv6 server on Sophos Firewall

A DHCPv6 server on Sophos Firewall distributes IPv6 addresses and network parameters to clients. Configuration starts under Network > DHCP > Add > IPv6. Unlike DHCPv4, however, the server alone doesn’t provide a complete client network: Clients learn the IPv6 default gateway through Router Advertisement on Sophos Firewall, not through DHCPv6.

Quick procedure: Check the IPv6 prefix and Router Advertisement first, then choose the interface and dynamic lease range in the same /64, set Preferred time lower than Valid time, choose DNS deliberately and test with a real client. A static assignment uses the client’s DUID, not simply its MAC address.

⚠️ Sophos Firewall can’t run a DHCPv6 server and DHCPv6 relay at the same time. Before enabling the service, determine which role supplies the environment. An IPv6 prefix or visible lease also proves neither a default gateway nor working DNS or permitted application traffic.

Separate Router Advertisement from DHCPv6

With IPv4, DHCP normally provides the address, subnet mask and default gateway together. IPv6 separates these tasks. Router Advertisement, or RA, advertises the prefix and router. DHCPv6 can provide an address from a managed range as well as DNS servers and other options.

Three layers must therefore work together:

• The interface has the intended IPv6 prefix.
• Router Advertisement signals the planned client behaviour and provides the default router.
• DHCPv6 distributes the matching lease range and required additional values.

If the provider delegates a dynamic prefix to the firewall, planning begins with Configure IPv6 Prefix Delegation on Sophos Firewall. Sophos Firewall IPv6 support in SFOS 22 explains the general product limits for interfaces, routing, VPN, rules and DNS.

Plan the example network

The following lab network uses the IPv6 range 2001:db8::/32, which is reserved for documentation. These values don’t work as production internet addresses and must be replaced with the actual static or delegated prefix:

• Client interface: VLAN20 - 2001:db8:20::1/64
• Dynamic range: 2001:db8:20::100 to 2001:db8:20::1ff
• Static assignment: 2001:db8:20::20
• Internal DNS server: 2001:db8:10::53
• Example name: dhcpv6-vlan20-clients

The interface and dynamic range are in the same /64. Existing static addresses for the firewall, servers and infrastructure must not fall within the dynamic range. Before enabling the service, identify existing Router Advertisements, DHCPv6 servers and relay agents on the segment so that clients don’t receive conflicting information.

Configure the DHCPv6 server

1. Under Network > DHCP, click Add, then click IPv6.
2. Enter dhcpv6-vlan20-clients as the Name.
3. Under Interface, select VLAN20 - 2001:db8:20::1.
4. Leave Accept client request via relay turned off for directly connected clients.
5. Under Dynamic IP lease, add the range 2001:db8:20::100 to 2001:db8:20::1ff.
6. Set Preferred time and Valid time to suit the prefix and client lifecycle.
7. Under DNS server, enter the planned internal DNS server or deliberately select Use device’s DNS settings.
8. Add only the required DHCP options and static DUID mappings.
9. Click Save.

The selected lease range must match the client subnet. For clients behind a relay, the range belongs to the relay interface’s subnet. Turn on Accept client request via relay only if the server is actually accepting requests from a verified DHCPv6 relay agent.

According to Sophos, when Accept client request via relay is selected for a DHCPv6 server on a physical interface with a delegated IPv6 prefix, the DHCPv6 configuration file doesn’t show a change. Don’t assess this special case from the file alone; the topology, relay path, lease and packet flow must all agree.

Understand Preferred time and Valid time

Preferred time specifies in minutes how long an address remains preferred for new connections. It then becomes deprecated. Existing connections may continue to use it, but new connections should select an address that is still preferred.

Valid time determines how long the address remains valid in total. After that, the client must no longer use it. SFOS therefore requires Preferred time to be lower than Valid time.

There is no universal ideal value. With dynamically delegated provider prefixes, DHCPv6 times must not assume that the prefix is guaranteed to remain unchanged. Longer times can be useful in stable internal networks. Migrations or frequently changing prefixes need shorter but still operationally realistic values and a controlled renewal test.

Distribute DNS deliberately

With Use device’s DNS settings, the firewall provides clients with its configured DNS servers. This is suitable only if those servers can correctly resolve internal and external names for the client network. Alternatively, enter the actual IPv6 addresses of the intended DNS servers.

A successful lease without working name resolution isn’t an overall DHCPv6 success. After checking the address, perform an internal and an external DNS test. Configure DNS Request Routes on Sophos Firewall remains relevant for internal zones and split DNS.

Manage custom DHCPv6 options in Device Console

Device Console manages a custom DHCPv6 option in two stages. The option is first defined globally and is then bound to a DHCPv6 server selected by name. Before making a change, these commands show the existing definitions and the bindings of the target server:

system dhcpv6 dhcpv6-options list
system dhcpv6 dhcpv6-options binding show dhcpname <DHCPv6-server-name>

The SFOS 22 help accepts values from 1 to 65535 syntactically for optioncode. This doesn’t mean every code is supported by SFOS or interpreted by the client. The corresponding Sophos table lists codes 21, 22, 24, and 27 to 34. Check the option code, data type, RFC, and client support together before creating the definition.

⚠️ The online help only shows an abbreviated command grammar and doesn’t fully explain the values and data types required to create an option. On the affected firewall, use tab completion after system dhcpv6 dhcpv6-options add and system dhcpv6 dhcpv6-options binding add. Don’t copy a command blindly from a different SFOS build.

After binding the option, run binding show again and renew the lease on a test client. The packet capture must show the expected option with the correct value in the server reply. For rollback, remove the binding first and delete an unused global definition only afterwards. Because the binding deletion syntax published by Sophos only names dhcpname, treat it as a server-scope action and never run it without first recording the existing bindings.

Create a static DUID assignment

DHCPv6 identifies a client through its DHCP Unique Identifier, or DUID. Under Static IP DUID mapping, the IPv6 address is therefore assigned to the client’s actual DUID. A MAC address read from the chassis isn’t a reliable substitute.

First let the test client obtain a dynamic lease and identify its DUID from the client, lease view or packet capture. Then enter the static address 2001:db8:20::20 outside the dynamic range. After another lease request, that exact client must receive the intended address.

After an operating system change, a newly generated DUID or cloning a system from a template, the assignment may no longer match the client. In that case, don’t broaden the firewall rule; check the DUID that is actually being sent first.

Test the lease and data path

After saving, reconnect a controlled client on the intended VLAN or renew its IPv6 configuration. Under Network > DHCP > IPv6 lease, the expected address must appear with the matching client.

Then test each layer separately:

1. The client receives an address from the planned range or the static DUID address.
2. The client has an IPv6 default gateway from Router Advertisement.
3. The intended DNS servers are visible and resolve internal and external names.
4. The client reaches the firewall address and a deliberately selected IPv6 test target.
5. Log Viewer shows the expected IPv6 firewall rule for the application traffic.
6. A negative test confirms that unpermitted IPv6 services remain blocked.

An IPv4 rule doesn’t automatically allow IPv6. Plan the required zone-based rules separately and validate them with the Rule ID and real traffic. Configure Sophos Firewall rules explains the procedure.

No lease or incomplete IPv6 configuration

The client doesn’t receive a DHCPv6 address

First compare the interface prefix, DHCPv6 server status and dynamic range. Then check whether the client requests a managed DHCPv6 address in this operating mode and whether another server or relay is active on the segment.

A packet capture with this BPF filter shows client and server messages over UDP 546 and 547:

udp port 546 or udp port 547

If client messages are visible but no reply follows, inspect the server configuration and dhcpd6.log. If no client message is visible at all, the RA mode, client behaviour, VLAN or local network path is a more likely cause. Use Packet Capture in Sophos Firewall WebAdmin explains the capture fields.

The client has an address but no default gateway

DHCPv6 doesn’t distribute a default gateway. This symptom therefore leads directly to Router Advertisement, the interface and the client segment. Adding a second DHCPv6 server or changing lease times doesn’t restore the missing router information.

DNS or options are missing

First check what the client requests in its DHCPv6 message and what the firewall actually returns. Then inspect the data type, value and DHCPv6 server used. An entry from DHCP options on Sophos Firewall must not be copied blindly from DHCPv4 to DHCPv6; the option code, RFC and client support must match DHCPv6.

The static address isn’t assigned

Compare the transmitted DUID with Static IP DUID mapping. If they don’t match, the firewall can’t apply the assignment. If they do match, check the address range, duplicate servers and the new lease request.

Relay and server conflict

A DHCPv6 server and DHCPv6 relay can’t be active at the same time on Sophos Firewall. If a central external server is intended, don’t operate the local DHCPv6 server in parallel as a supposed fallback. Set up DHCP Relay on Sophos Firewall explains the relay path.

The dhcpd6.log file and other network logs are described in Check Sophos Firewall services and logs from the CLI. A single log entry doesn’t replace the lease view, packet capture and client test.

Roll back the change

Before production activation, document the previous RA state, DHCPv6 or relay role and existing client configuration. To roll back, disable or remove the new DHCPv6 server, restore the previous relay or addressing logic and establish a new client connection.

Then retest the address, default gateway, DNS and a real IPv6 data path. Don’t leave the old and new servers running in parallel without coordination just to make rollback appear easier.

Frequently asked questions