4 ms·
Assuming anyone can send a DHCP request and the IPs handed out by the DHCP server are added to the allowlist, what does your audit data look like? Something lik
by yrro 2y ago
Assuming anyone can send a DHCP request and the IPs handed out by the DHCP server are added to the allowlist, what does your audit data look like? Something like:
2024-04-16 12:15:01 ac:de:48:00:00:01 uses address 192.168.2.255 for the next 72 hours
or is there more to it?
Regardless, you _can_ tell clients to _not_ use SLAAC, and you _can_ tell clients to use DHCPv6 to obtain addresses.
If you use the DHCPv6 server to control an allowlist then some clients who ignore the second request will be unable to use your network, but that's a problem for Android users. :)
- Already__Taken 2y agoNot much more, it's more inverted, I'm told out-of-bad the MAC to allow. But I didn't know you could disable SLAAC from an RA
- yrro 2y agoTo be precise, the prefixes advertised within an RA message have an 'autoconfig' flag; if you unset this flag then hosts won't do SLAAC. So if you set the M-flag on your RAs, and unset the A-flag then hosts will have to use DHCPv6 to obtain addresses. Of course, this won't stop hosts from unilaterally deciding to transmit packets using any source address that they choose to, but this is no different than with IPv4.