How to Set Up IPv6 DHCP on Cisco Routers: Stateless and Stateful Configuration

IPv6 address assignment is one of those areas where I see a lot of confusion, mostly because IPv6 gives you multiple ways to get an address onto a host, and picking the right one depends heavily on what information you actually need to deliver beyond just the address itself. In this guide I am covering both DHCPv6 modes — stateless (SLAAC combined with stateless DHCPv6 for supplementary information) and stateful (full DHCPv6 address assignment) — along with how I configure and troubleshoot both on Cisco routers.

Networking Fundamentals: SLAAC, Stateless DHCPv6, and Stateful DHCPv6

Unlike IPv4, where DHCP is essentially the only common mechanism for automatic address assignment, IPv6 hosts can obtain an address in three different ways, and understanding the distinction is essential before configuring anything:

• SLAAC (Stateless Address Autoconfiguration): The host generates its own address using the prefix advertised in Router Advertisements (RAs) combined with an interface identifier (traditionally EUI-64, though privacy extensions are now common). No DHCPv6 server is involved in address assignment at all.
• Stateless DHCPv6: SLAAC still handles address assignment, but the host also queries a DHCPv6 server for additional information it needs — most commonly DNS server addresses — since RAs alone traditionally did not carry DNS information (though RDNSS options in RAs have reduced the need for this in many modern deployments).
• Stateful DHCPv6: The DHCPv6 server assigns the address itself, similar in spirit to how IPv4 DHCP works, giving the administrator full control over and visibility into address assignment, including maintaining a lease database.

Which mode to use is signaled to hosts through flags in the Router Advertisement: the M flag (Managed) tells hosts to use stateful DHCPv6 for addressing, and the O flag (Other) tells hosts to use DHCPv6 for supplementary information even if they self-assigned their address via SLAAC.

Configuring SLAAC (Baseline, No DHCPv6 Required)

This is the default behavior once IPv6 routing and an address are configured on an interface — the router automatically sends RAs advertising the prefix, and connected hosts self-assign addresses.

Router(config)# ipv6 unicast-routing
Router(config)# interface GigabitEthernet0/0/1
Router(config-if)# ipv6 address 2001:db8:1::1/64

At this point, hosts on the segment will already be receiving RAs and self-assigning addresses from the 2001:db8:1::/64 prefix. I always verify RAs are actually being sent as expected:

Router# show ipv6 interface GigabitEthernet0/0/1

Configuring Stateless DHCPv6 (SLAAC + DNS via DHCPv6)

This is the mode I use most often in enterprise networks where hosts self-assign addresses via SLAAC but still need DNS server information delivered via DHCPv6.

Router(config)# ipv6 dhcp pool DHCPV6-STATELESS-POOL
Router(config-dhcpv6)# dns-server 2001:db8:ffff::53
Router(config-dhcpv6)# domain-name example.com
Router(config-dhcpv6)# exit

Router(config)# interface GigabitEthernet0/0/1
Router(config-if)# ipv6 nd other-config-flag
Router(config-if)# ipv6 dhcp server DHCPV6-STATELESS-POOL

The ipv6 nd other-config-flag command sets the O flag in Router Advertisements, telling hosts to query DHCPv6 for supplementary configuration even though they are self-assigning their address via SLAAC.

Configuring Stateful DHCPv6 (Full Address Assignment)

For environments where I need full administrative control over address assignment — tracking, reservations, tighter security auditing — I configure stateful DHCPv6.

Router(config)# ipv6 dhcp pool DHCPV6-STATEFUL-POOL
Router(config-dhcpv6)# address prefix 2001:db8:1::/64
Router(config-dhcpv6)# dns-server 2001:db8:ffff::53
Router(config-dhcpv6)# domain-name example.com
Router(config-dhcpv6)# exit

Router(config)# interface GigabitEthernet0/0/1
Router(config-if)# ipv6 address 2001:db8:1::1/64
Router(config-if)# ipv6 nd managed-config-flag
Router(config-if)# ipv6 nd other-config-flag
Router(config-if)# ipv6 dhcp server DHCPV6-STATEFUL-POOL

The ipv6 nd managed-config-flag sets the M flag, instructing hosts to use stateful DHCPv6 for address assignment rather than SLAAC. I always set both the M and O flags together in stateful deployments, since the O flag ensures DNS and other supplementary options are also delivered via the same DHCPv6 exchange.

An important detail I always remember: even in stateful mode, I typically still suppress SLAAC-based addressing to avoid hosts ending up with both a SLAAC-derived address and a DHCPv6-assigned address simultaneously, unless that dual-addressing behavior is specifically desired:

Router(config-if)# ipv6 nd prefix 2001:db8:1::/64 no-autoconfig

Configuring the Cisco Router as a DHCPv6 Relay Agent

In larger enterprise designs, the DHCPv6 server is often centralized rather than running on every access-layer router, which means edge routers need to relay DHCPv6 requests to the central server.

Router(config)# interface GigabitEthernet0/0/2
Router(config-if)# ipv6 dhcp relay destination 2001:db8:ffff::100

This is functionally equivalent to the IPv4 ip helper-address concept, just implemented with IPv6-specific syntax. I always verify relay operation using:

Router# show ipv6 dhcp relay binding

Verification and Troubleshooting

Router# show ipv6 dhcp pool
Router# show ipv6 dhcp binding
Router# show ipv6 dhcp interface GigabitEthernet0/0/1

When troubleshooting a host that is not getting the expected address or configuration, I check:

1. Is the RA actually advertising the expected M/O flags? I capture RAs directly if needed, since a misconfigured flag is a very common cause of hosts behaving unexpectedly (e.g., self-assigning via SLAAC when stateful assignment was intended).
2. Is the DHCPv6 pool correctly bound to the interface, and does the prefix in the pool match the interface’s actual prefix?
3. For relay scenarios, is the relay destination reachable, and is the central DHCPv6 server actually listening and responding?

Router# debug ipv6 dhcp detail

I use this debug command sparingly and only during active troubleshooting, since it can generate significant output on a busy segment.

Real-World Enterprise Scenario: Migrating from Stateless to Stateful DHCPv6

I worked with an organization that initially deployed IPv6 using stateless DHCPv6 (SLAAC for addressing, DHCPv6 for DNS only) because it was the simplest path to get IPv6 running. As the network matured, the security team required full visibility into which specific host held which specific IPv6 address at any given time for compliance and incident response purposes — something SLAAC’s self-assigned addressing does not naturally provide with the same clarity as a centrally managed DHCPv6 lease database.

The migration involved:

1. Standing up stateful DHCPv6 pools scoped appropriately per VLAN/subnet.
2. Changing the M flag from unset to set on each access-layer interface, along with suppressing SLAAC via no-autoconfig to avoid dual-addressing during the transition.
3. Coordinating the change during a maintenance window, since flipping the M flag causes connected hosts to re-negotiate their addressing behavior, and depending on host OS DHCPv6 client implementation, this could cause a brief address change or renewal event.
4. Validating show ipv6 dhcp binding populated correctly and matched expected host counts per subnet before considering the migration complete.

This gave the security team the centralized, queryable lease database they needed for compliance, without sacrificing the automatic address management that made IPv6 deployment practical in the first place.

Common Configuration Mistakes

• Forgetting to set the M and/or O flag on the interface, leaving hosts to behave in SLAAC-only mode even though a DHCPv6 pool is configured
• Configuring a stateful DHCPv6 pool with a prefix that does not match the interface’s actual IPv6 prefix
• Not suppressing SLAAC when stateful addressing is intended, leading to hosts holding both a SLAAC and a DHCPv6-assigned address
• Forgetting the DHCPv6 relay configuration on edge routers when a centralized DHCPv6 server is used, leaving branch/access subnets without functioning stateful assignment
• Overlooking that many RA options (like RDNSS for DNS) can reduce or eliminate the practical need for stateless DHCPv6 in some modern host OS environments — worth evaluating before assuming DHCPv6 is required at all

Security Best Practices

• Enable IPv6 RA Guard on access-layer switches to prevent rogue or malicious Router Advertisements from being injected by unauthorized devices
• Enable DHCPv6 Guard similarly, to prevent rogue DHCPv6 servers from assigning incorrect or malicious configuration to hosts
• Restrict which VLANs/interfaces have DHCPv6 relay configured, minimizing the blast radius of a misconfigured or compromised central DHCPv6 server

Switch(config-if)# ipv6 nd raguard
Switch(config-if)# ipv6 dhcp guard

Performance Tuning

• Set reasonable RA intervals — very frequent RAs increase multicast traffic on the segment unnecessarily, while overly infrequent RAs slow down initial host configuration
• Size DHCPv6 lease/prefix pools appropriately for the subnet to avoid pool exhaustion in stateful deployments with high host churn (e.g., guest wireless networks)

Router(config-if)# ipv6 nd ra-interval 200

Frequently Asked Questions

What is the difference between stateless and stateful DHCPv6? In stateless DHCPv6, hosts self-assign their address via SLAAC and only use DHCPv6 for supplementary information like DNS; in stateful DHCPv6, the DHCPv6 server assigns the address itself, similar to how IPv4 DHCP works.

Why are my hosts not using DHCPv6 even though I configured a pool? Check whether the M and/or O flags are set on the interface — without them, hosts will default to SLAAC-only behavior regardless of DHCPv6 pool configuration.

Do I need a DHCPv6 relay agent if my DHCPv6 server is centralized? Yes, just as with IPv4 ip helper-address, edge routers need ipv6 dhcp relay destination configured to forward DHCPv6 requests to a centralized server not directly attached to the local segment.

Can a host end up with both a SLAAC address and a DHCPv6-assigned address? Yes, unless you explicitly suppress SLAAC using ipv6 nd prefix ... no-autoconfig when stateful DHCPv6 is intended to be the sole addressing mechanism.

Summary

IPv6 address assignment on Cisco routers gives you real flexibility through SLAAC, stateless DHCPv6, and stateful DHCPv6, and choosing the right mode comes down to whether you need centralized address tracking and control or are comfortable with self-assigned addressing supplemented by DHCPv6 for DNS and other options. Getting the M and O flags right, matching pool prefixes to actual interface prefixes, and securing the segment with RA Guard and DHCPv6 Guard will cover the overwhelming majority of real-world deployment and troubleshooting scenarios.

References

• Cisco IPv6 Configuration Guide: Implementing DHCP for IPv6 — cisco.com
• RFC 8415 — Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
• RFC 4861 — Neighbor Discovery for IP version 6 (IPv6)