OPNsense Forum

English Forums => 26.1 Series => Topic started by: tgurr on January 29, 2026, 11:50:48 PM

Title: Identity Association IPv6 mode impossible to apply
Post by: tgurr on January 29, 2026, 11:50:48 PM
QuoteTo accommodate the change away from ISC-DCHP defaults the "Track interface" IPv6 mode now has a sibling called "Identity Association" which does the same except it is not automatically starting ISC-DHCPv6 and Radvd router advertisements to allow better interoperability with Kea and Dnsmasq setups. Dnsmasq is now the default for DHCPv4 and DHCPv6 as well as RA out of the box. One thing that the upstream software cannot cover is prefix delegation so that is no longer offered by default. Use another DHCPv6 server in this case.

I'm trying to figure out what I've to change in my setup related to the statements above. When it was first mentioned that ISC-DHCP will be deprecated I already moved my stuff over to using "Dnsmasq DNS & DHCP" like the DHCP ranges for my home and guest vlans as well as the reservations / host overrides. So after updating to 26.1 today I uninstalled the os-isc-dhcp plugin, so far so good, things still appear to work as intended. However when trying to change the "IPv6 Configuration Type" in either my home or guest vlan/interface from "Track Interface (legacy)" to  the new "Identity association" and try to save the changes I get an error message:

QuoteThe following input errors were detected:

The DHCPv6 Server is active on this interface and it can be used only with a static IPv6 configuration. Please disable the DHCPv6 Server service on this interface first, then change the interface configuration.

which makes me wonder what the actual problem is since "Track Interface (legacy)" works without any issue, is it because I use "Dnsmasq DNS & DHCP"? I can't seem to find an option to do what I'm instructed by "disable the DHCPv6 Server service on this interface first" like in only use Dnsmasq DNS & DHCP for IPv4, like there was for ISC-DHCP and probably also is for Kea with its two separate Kea DHCPv4 & Kea DHCPv6 services to enable/disable. But that would somehow contradict to the statement of

Quote[...] to allow better interoperability with Kea and Dnsmasq setups


On another more or less unrelated note, some parts of the release notes are harder to read/understand for me than they maybe could be, for example:

QuoteOne thing that the upstream software cannot cover is prefix delegation so that is no longer offered by default. Use another DHCPv6 server in this case.

"the upstream software": which one? supposedly Dnsmasq? Why not call it by it's name?
"Use another DHCPv6 server in this case": when Dnsmasq doesn't work in this case and Kea is the new alternative to the now deprecated ISC-DHCP, why not just write "Use Kea DHCPv6" in this case? Or doesn't Kea work here as well, or are there too many other alternatives to mention them?

And another thing I was kind of scared is because the talk is all about DHCP and IPv6, I was afraid that removing the ISC plugin would also remove the option for the WAN interface to select "DHCPv6" in its "IPv6 Configuration Type" option, so a small mention that it doesn't touch that part and/or that they're completely unrelated and this option will stay would've probably been reassuring as well.
Title: Re: Identity Association IPv6 mode impossible to apply
Post by: nero355 on January 30, 2026, 04:18:49 AM
Quote from: tgurr on January 29, 2026, 11:50:48 PMSo after updating to 26.1 today I uninstalled the os-isc-dhcp plugin, so far so good, things still appear to work as intended.

However when trying to change the "IPv6 Configuration Type" in either my home or guest vlan/interface from "Track Interface (legacy)" to  the new "Identity association" and try to save the changes I get an error message:

QuoteThe following input errors were detected:

The DHCPv6 Server is active on this interface and it can be used only with a static IPv6 configuration. Please disable the DHCPv6 Server service on this interface first, then change the interface configuration.

which makes me wonder what the actual problem is since "Track Interface (legacy)" works without any issue, is it because I use "Dnsmasq DNS & DHCP"? I can't seem to find an option to do what I'm instructed by "disable the DHCPv6 Server service on this interface first" like in only use Dnsmasq DNS & DHCP for IPv4, like there was for ISC-DHCP and probably also is for Kea with its two separate Kea DHCPv4 & Kea DHCPv6 services to enable/disable.
There were some reports of the option "Track Interface (legacy)" not properly disabling I believe in another topic so maybe the fix for that bug didn't work out completely as it should have ?!

My guess is it still thinks you are using ISC DHCPv6 for some reason...

QuoteOn another more or less unrelated note, some parts of the release notes are harder to read/understand for me than they maybe could be, for example:

QuoteOne thing that the upstream software cannot cover is prefix delegation so that is no longer offered by default. Use another DHCPv6 server in this case.

"the upstream software": which one? supposedly Dnsmasq? Why not call it by it's name?
"Use another DHCPv6 server in this case": when Dnsmasq doesn't work in this case and Kea is the new alternative to the now deprecated ISC-DHCP, why not just write "Use Kea DHCPv6" in this case? Or doesn't Kea work here as well, or are there too many other alternatives to mention them?

And another thing I was kind of scared is because the talk is all about DHCP and IPv6, I was afraid that removing the ISC plugin would also remove the option for the WAN interface to select "DHCPv6" in its "IPv6 Configuration Type" option, so a small mention that it doesn't touch that part and/or that they're completely unrelated and this option will stay would've probably been reassuring as well.
I was wondering the same and totally agree with you :)
Title: Re: Identity Association IPv6 mode impossible to apply
Post by: bazineta on January 30, 2026, 04:27:38 AM
I think this to be a bug, as I believe you'll find that you can't set the IPv6 Configuration Type to 'None' on the affected interface, either. In short, you're pretty much stuck with whatever settings that interface has at the moment, it seems.