IPv6, DHCP and Prefix Delegation (Need help to troubleshoot)

[nibbles]

Greetings.

I should be able to get a /56 via DHCP from my ISP and be able to delegate this to my 2 LAN networks and also get an adress to my WAN interface.
Coming from a Unifi which was very much Plug and Play so i am quite sure i am doing something wrong.

WAN DHCP and the rest as default, except prefix size that is set to 56
LAN is Tracking WAN and i have assigned prefix id 1 (have also tried with different numbers)

Where should I start to look? I have done some packet captures that shows DHCP traffic being sent but my dhcp6-foo is not good enough to be able to see anything specifically wrong with it.

Is there a nice logfile I can look in? After activaing debug logging in interface an checking in Service/Log/General i only see this when filtering for dhcp6c

Code Select Expand


2024-11-08T14:34:59 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T14:34:59 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T14:34:23 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T14:34:23 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T13:59:03 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T13:59:03 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T12:46:16 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T12:46:15 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T12:42:10 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T12:42:10 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c
2024-11-08T12:42:07 Error dhcp6c transmit failed: Can't assign requested address
2024-11-08T12:42:06 Error dhcp6c transmit failed: Can't assign requested address
2024-11-08T12:39:17 Notice dhcp6c RTSOLD script - Sending SIGHUP to dhcp6c


[meyergru]

You should first look at your WAN interface to see if it gets 0, 1 or 2 IPv6 addresses.

If your ISP conforms to standard, it should be two:

1. One IPv6 GUA with a /128 netmask for your WAN interface (IA-NA).
2. One IPv6 GUA prefix with a /56 netmask (IA-PD) to be able to delegate to your LAN(s) with an 8-bit prefix ID in order to have /64 for SLAAC on your LAN(s)

If you have none or only one, it depends. None often means that your ISP is only capable of doing #2 from above. You should indicate that by checking the "request IPv6 prefix only", maybe then your ISP will give you a IA-PD prefix at least.

With an assigned /56 prefix (IA-PD), you should be able to track your LAN interface(s) like you described. You should then set your LAN interface to use router advertisements (SLAAC).

Your WAN can be used either if it already has a /128 GUA (IA-NA) or you can use one of the available prefix IDs to assign an IPv6 from your IA-PD range.

[nibbles]

I tried to request only prefix but still no luck. I.e I get no adress other than link-local (fe80::::)

Is there a logfile I can check to see what the system thinks is going on?

Checking a packet capture i get the following. Notice the error in the bottom

Code Select Expand


DHCPv6
    Message type: Reply (7)
    Transaction ID: 0x843891
    Client Identifier
    Server Identifier
    Identity Association for Non-temporary Address
        Option: Identity Association for Non-temporary Address (3)
        Length: 40
        IAID: 00000000
        T1: 5400
        T2: 10800
        IA Address
            Option: IA Address (5)
            Length: 24
            IPv6 address: 2a00:x:x::x:x
            Preferred lifetime: 21600
            Valid lifetime: 21600
    DNS recursive name server
        Option: DNS recursive name server (23)
        Length: 32
         1 DNS server address: 2a00:1598:53:1::2
         2 DNS server address: 2a00:1598:53:4::2
    Identity Association for Prefix Delegation
        Option: Identity Association for Prefix Delegation (25)
        Length: 41
        IAID: 00000000
        T1: 5400
        T2: 10800
        IA Prefix
            Option: IA Prefix (26)
            Length: 25
            Preferred lifetime: 21600
            Valid lifetime: 21600
            Prefix length: 56
            Prefix address: 2a00:x:x:x::
    Status code
        Option: Status code (13)
        Length: 2
        Status Code: UnspecFail (1)


[dseven]

Where are you looking for the address? Under Interfaces -> Overview, click the magnifier for WAN ("Commands" column) - do you see any "Dynamic IPv6 prefix received"?

[nibbles]

Code Select Expand


x@x:~ # ifconfig igb5
igb5: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
        description: WAN (wan)
        options=4902028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,NETMAP,HWSTATS,MEXTPG>
        ether 00:90:27:e4:91:d9
        inet <ipv4> netmask 0xffffff00 broadcast x.x.x.x
        inet6 fe80::290:27ff:fee4:91d9%igb5 prefixlen 64 scopeid 0x6
        media: Ethernet autoselect (1000baseT <full-duplex>)
        status: active
        nd6 options=23<PERFORMNUD,ACCEPT_RTADV,AUTO_LINKLOCAL>



Nothing under "Dynamic IPv6 prefix recieved"

I am curious though why it doesnt like the DHCP reply above.
Is it because of the error code?

[nibbles]

Found /var/log/system/latest.log

Code Select Expand


<29>1 2024-11-08T18:19:19+01:00  Sending Solicit
<29>1 2024-11-08T18:19:19+01:00  set client ID (len 14)
<29>1 2024-11-08T18:19:19+01:00  set elapsed time (len 2)
<29>1 2024-11-08T18:19:19+01:00  set option request (len 4)
<29>1 2024-11-08T18:19:19+01:00  set IA_PD
<29>1 2024-11-08T18:19:19+01:00  send solicit to ff02::1:2%igb5
<29>1 2024-11-08T18:19:19+01:00  reset a timer on igb5, state=SOLICIT, timeo=19, retrans=108480
<29>1 2024-11-08T18:19:19+01:00  receive advertise from fe80::2022:ff:fe01:1%igb5 on igb5
<29>1 2024-11-08T18:19:19+01:00  get DHCP option client ID, len 14
<29>1 2024-11-08T18:19:19+01:00    DUID: 00:01:00:01:2e:8b:27:36:00:90:27:e4:91:d4
<29>1 2024-11-08T18:19:19+01:00  get DHCP option server ID, len 14
<29>1 2024-11-08T18:19:19+01:00    DUID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1
<29>1 2024-11-08T18:19:19+01:00  get DHCP option DNS, len 32
<29>1 2024-11-08T18:19:19+01:00  get DHCP option IA_PD, len 41
<29>1 2024-11-08T18:19:19+01:00    IA_PD: ID=0, T1=5400, T2=10800
<29>1 2024-11-08T18:19:19+01:00  get DHCP option IA_PD prefix, len 25
<29>1 2024-11-08T18:19:19+01:00    IA_PD prefix: 2a00:x:x:x::/56 pltime=21600 vltime=21600
<29>1 2024-11-08T18:19:19+01:00  get DHCP option status code, len 2
<29>1 2024-11-08T18:19:19+01:00    status code: unspec failure
<29>1 2024-11-08T18:19:19+01:00  XID mismatch


The last 2 lines looks wierd. Is this opnsense or the isp?

[meyergru]

How did you get the packet capture? From OpnSense itself or did you connect anything else to the WAN?

The XID mismatch says that there was a different XID for the DHCP SOLICIT that for the REPLY. If you have another device (like your PC with Wireshark) on the interface, it might itself request a DHCP address and then things get tough...

See: https://docs.netgate.com/pfsense/en/latest/troubleshooting/dhcpv6-xid-mismatch.html


You obviously get an IA-PD prefix of correct size, so you should be well apart from that last error.

[nibbles]

I am using opnsense packet capture to get the capture.

There was however 2 dhcp6c running but it did however not help with killing one of them

To me it looks like there is a mismatch somewhere in the parameters of the request, hence the unspec failure.

Code Select Expand


Sending Solicit
a new XID (65a4fc) is generated
set client ID (len 14)
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD
send solicit to ff02::1:2%igb5
reset a timer on igb5, state=SOLICIT, timeo=0, retrans=1068
receive advertise from fe80::2022:ff:fe01:1%igb5 on igb5
get DHCP option client ID, len 14
   DUID: 00:01:00:01:2e:8b:27:36:00:90:27:e4:91:d4
get DHCP option server ID, len 14
   DUID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1
get DHCP option identity association, len 40
   IA_NA: ID=0, T1=5400, T2=10800
get DHCP option IA address, len 24
   IA_NA address: 2a00:x:x::x:x pltime=21600 vltime=21600
get DHCP option DNS, len 32
get DHCP option IA_PD, len 41
   IA_PD: ID=0, T1=5400, T2=10800
get DHCP option IA_PD prefix, len 25
   IA_PD prefix: 2a00:x:x:x::/56 pltime=21600 vltime=21600
get DHCP option status code, len 2
   status code: unspec failure
server ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1, pref=-1
reset timer for igb5 to 0.987857
receive advertise from fe80::2022:ff:fe01:1%igb5 on igb5
get DHCP option client ID, len 14
   DUID: 00:01:00:01:2e:8b:27:36:00:90:27:e4:91:d4
get DHCP option server ID, len 14
   DUID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1
get DHCP option identity association, len 40
   IA_NA: ID=0, T1=5400, T2=10800
get DHCP option IA address, len 24
   IA_NA address: 2a00:x:x::x:x pltime=21600 vltime=21600
get DHCP option DNS, len 32
get DHCP option IA_PD, len 41
   IA_PD: ID=0, T1=5400, T2=10800
get DHCP option IA_PD prefix, len 25
   IA_PD prefix: 2a00:x:x:x::/56 pltime=21600 vltime=21600
get DHCP option status code, len 2
   status code: unspec failure
server ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1, pref=-1
duplicated server (ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1)
picked a server (ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1)
Sending Request
a new XID (f92bb1) is generated
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=0, retrans=1075
receive reply from fe80::2022:ff:fe01:1%igb5 on igb5
get DHCP option client ID, len 14
   DUID: 00:01:00:01:2e:8b:27:36:00:90:27:e4:91:d4
get DHCP option server ID, len 14
   DUID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1
get DHCP option identity association, len 40
   IA_NA: ID=0, T1=5400, T2=10800
get DHCP option IA address, len 24
   IA_NA address: 2a00:x:x::x:x pltime=21600 vltime=21600
get DHCP option DNS, len 32
get DHCP option IA_PD, len 41
   IA_PD: ID=0, T1=5400, T2=10800
get DHCP option IA_PD prefix, len 25
   IA_PD prefix: 2a00:x:x:x::/56 pltime=21600 vltime=21600
get DHCP option status code, len 2
   status code: unspec failure
XID mismatch
Sending Request
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=1, retrans=2195
Sending Request
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=2, retrans=4582
Sending Request
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=3, retrans=9183
Sending Request
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=4, retrans=17667
Sending Request
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=5, retrans=32318
Sending Request
set client ID (len 14)
set server ID (len 14)
set IA address
set identity association
set elapsed time (len 2)
set option request (len 4)
set IA_PD prefix
set IA_PD
send request to ff02::1:2%igb5
reset a timer on igb5, state=REQUEST, timeo=6, retrans=30886


[nibbles]

Anyone with any thoughts on the issue?

[marjohn56]

Two dhcp6c instances? I thought we'd fixed that years ago! That used to be an issue in about 2017/18 but haven't seen it since. OK, try this, we're testing not fixing. Kill any dhcp6c instance and then leave the system alone for about thirty minutes.
From the shell restart dhcp6c, if you didn't do a full grep here's the command:

# /usr/local/sbin/dhcp6c -c /var/etc/dhcp6c.conf -p /var/run/dhcp6c.pid -D

I added the -D for full debug, does it now get the addresses?
The thirty minutes is important as it might be an ISP issue, I've seen it before.

[nibbles]

Unfortunately it did not work.
I see in the logs I get an offer but it doesnt look like its accepted.

Code Select Expand


<29>1 2024-11-10T17:22:00+01:00 Sending Solicit
<29>1 2024-11-10T17:22:00+01:00 a new XID (56e882) is generated
<29>1 2024-11-10T17:22:00+01:00 set client ID (len 14)
<29>1 2024-11-10T17:22:00+01:00 set identity association
<29>1 2024-11-10T17:22:00+01:00 set elapsed time (len 2)
<29>1 2024-11-10T17:22:00+01:00 set option request (len 4)
<29>1 2024-11-10T17:22:00+01:00 set IA_PD
<29>1 2024-11-10T17:22:00+01:00 send solicit to ff02::1:2%igb5
<29>1 2024-11-10T17:22:00+01:00 reset a timer on igb5, state=SOLICIT, timeo=0, retrans=1029
<29>1 2024-11-10T17:22:00+01:00 receive advertise from fe80::2022:ff:fe01:1%igb5 on igb5
<29>1 2024-11-10T17:22:00+01:00 get DHCP option client ID, len 14
<29>1 2024-11-10T17:22:00+01:00   DUID: 00:01:00:01:2e:8b:27:36:00:90:27:e4:91:d4
<29>1 2024-11-10T17:22:00+01:00 get DHCP option server ID, len 14
<29>1 2024-11-10T17:22:00+01:00   DUID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1
<29>1 2024-11-10T17:22:00+01:00 get DHCP option identity association, len 40
<29>1 2024-11-10T17:22:00+01:00   IA_NA: ID=0, T1=5400, T2=10800
<29>1 2024-11-10T17:22:00+01:00 get DHCP option IA address, len 24
<29>1 2024-11-10T17:22:00+01:00   IA_NA address: 2a00:x:x::x:x pltime=21600 vltime=21600
<29>1 2024-11-10T17:22:00+01:00 get DHCP option DNS, len 32
<29>1 2024-11-10T17:22:00+01:00 get DHCP option IA_PD, len 41
<29>1 2024-11-10T17:22:00+01:00   IA_PD: ID=0, T1=5400, T2=10800
<29>1 2024-11-10T17:22:00+01:00 get DHCP option IA_PD prefix, len 25
<29>1 2024-11-10T17:22:00+01:00   IA_PD prefix: 2a00:x:x:x::/56 pltime=21600 vltime=21600
<29>1 2024-11-10T17:22:00+01:00 get DHCP option status code, len 2
<29>1 2024-11-10T17:22:00+01:00   status code: unspec failure
<29>1 2024-11-10T17:22:00+01:00 server ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1, pref=-1
<29>1 2024-11-10T17:22:00+01:00 reset timer for igb5 to 0.923724
<29>1 2024-11-10T17:22:00+01:00 receive advertise from fe80::2022:ff:fe01:1%igb5 on igb5
<29>1 2024-11-10T17:22:00+01:00 get DHCP option client ID, len 14
<29>1 2024-11-10T17:22:00+01:00   DUID: 00:01:00:01:2e:8b:27:36:00:90:27:e4:91:d4
<29>1 2024-11-10T17:22:00+01:00 get DHCP option server ID, len 14
<29>1 2024-11-10T17:22:00+01:00   DUID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1
<29>1 2024-11-10T17:22:00+01:00 get DHCP option identity association, len 40
<29>1 2024-11-10T17:22:00+01:00   IA_NA: ID=0, T1=5400, T2=10800
<29>1 2024-11-10T17:22:00+01:00 get DHCP option IA address, len 24
<29>1 2024-11-10T17:22:00+01:00   IA_NA address: 2a00:x:x::x:x pltime=21600 vltime=21600
<29>1 2024-11-10T17:22:00+01:00  get DHCP option DNS, len 32
<29>1 2024-11-10T17:22:00+01:00  get DHCP option IA_PD, len 41
<29>1 2024-11-10T17:22:00+01:00    IA_PD: ID=0, T1=5400, T2=10800
<29>1 2024-11-10T17:22:00+01:00  get DHCP option IA_PD prefix, len 25
<29>1 2024-11-10T17:22:00+01:00    IA_PD prefix: 2a00:x:x:x::/56 pltime=21600 vltime=21600
<29>1 2024-11-10T17:22:00+01:00  get DHCP option status code, len 2
<29>1 2024-11-10T17:22:00+01:00    status code: unspec failure
<29>1 2024-11-10T17:22:00+01:00  server ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1, pref=-1
<29>1 2024-11-10T17:22:00+01:00  duplicated server (ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1)
<29>1 2024-11-10T17:22:01+01:00  picked a server (ID: 00:01:00:01:27:0f:3a:f4:00:50:56:86:c9:a1)
<29>1 2024-11-10T17:22:01+01:00  Sending Request
<29>1 2024-11-10T17:22:01+01:00  a new XID (a0112c) is generated
<29>1 2024-11-10T17:22:01+01:00  set client ID (len 14)
<29>1 2024-11-10T17:22:01+01:00  set server ID (len 14)
<29>1 2024-11-10T17:22:01+01:00  set IA address
<29>1 2024-11-10T17:22:01+01:00  set identity association
<29>1 2024-11-10T17:22:01+01:00  set elapsed time (len 2)
<29>1 2024-11-10T17:22:01+01:00  set option request (len 4)
<29>1 2024-11-10T17:22:01+01:00  set IA_PD prefix
<29>1 2024-11-10T17:22:01+01:00  set IA_PD
<29>1 2024-11-10T17:22:01+01:00  send request to ff02::1:2%igb5
<29>1 2024-11-10T17:22:01+01:00  reset a timer on igb5, state=REQUEST, timeo=0, retrans=1045
<29>1 2024-11-10T17:22:02+01:00  Sending Request
<29>1 2024-11-10T17:22:02+01:00  set client ID (len 14)
<29>1 2024-11-10T17:22:02+01:00  set server ID (len 14)
<29>1 2024-11-10T17:22:02+01:00  set IA address
<29>1 2024-11-10T17:22:02+01:00  set identity association
<29>1 2024-11-10T17:22:02+01:00  set elapsed time (len 2)
<29>1 2024-11-10T17:22:02+01:00  set option request (len 4)
<29>1 2024-11-10T17:22:02+01:00  set IA_PD prefix
<29>1 2024-11-10T17:22:02+01:00  set IA_PD
<29>1 2024-11-10T17:22:02+01:00  send request to ff02::1:2%igb5
<29>1 2024-11-10T17:22:02+01:00  reset a timer on igb5, state=REQUEST, timeo=1, retrans=2129
<29>1 2024-11-10T17:22:04+01:00  Sending Request
<29>1 2024-11-10T17:22:04+01:00  set client ID (len 14)
<29>1 2024-11-10T17:22:04+01:00  set server ID (len 14)
<29>1 2024-11-10T17:22:04+01:00  set IA address
<29>1 2024-11-10T17:22:04+01:00  set identity association
<29>1 2024-11-10T17:22:04+01:00  set elapsed time (len 2)
<29>1 2024-11-10T17:22:04+01:00  set option request (len 4)
<29>1 2024-11-10T17:22:04+01:00  set IA_PD prefix
<29>1 2024-11-10T17:22:04+01:00  set IA_PD
<29>1 2024-11-10T17:22:04+01:00  send request to ff02::1:2%igb5
<29>1 2024-11-10T17:22:04+01:00  reset a timer on igb5, state=REQUEST, timeo=2, retrans=4417
<29>1 2024-11-10T17:22:09+01:00  Sending Request
<29>1 2024-11-10T17:22:09+01:00  set client ID (len 14)
<29>1 2024-11-10T17:22:09+01:00  set server ID (len 14)
<29>1 2024-11-10T17:22:09+01:00  set IA address
<29>1 2024-11-10T17:22:09+01:00  set identity association
<29>1 2024-11-10T17:22:09+01:00  set elapsed time (len 2)
<29>1 2024-11-10T17:22:09+01:00  set option request (len 4)
<29>1 2024-11-10T17:22:09+01:00  set IA_PD prefix
<29>1 2024-11-10T17:22:09+01:00  set IA_PD
<29>1 2024-11-10T17:22:09+01:00  send request to ff02::1:2%igb5
<29>1 2024-11-10T17:22:09+01:00  reset a timer on igb5, state=REQUEST, timeo=3, retrans=9059
<29>1 2024-11-10T17:22:18+01:00  Sending Request
<29>1 2024-11-10T17:22:18+01:00  set client ID (len 14)
<29>1 2024-11-10T17:22:18+01:00  set server ID (len 14)
<29>1 2024-11-10T17:22:18+01:00  set IA address
<29>1 2024-11-10T17:22:18+01:00  set identity association
<29>1 2024-11-10T17:22:18+01:00  set elapsed time (len 2)
<29>1 2024-11-10T17:22:18+01:00  set option request (len 4)
<29>1 2024-11-10T17:22:18+01:00  set IA_PD prefix
<29>1 2024-11-10T17:22:18+01:00  set IA_PD
<29>1 2024-11-10T17:22:18+01:00  send request to ff02::1:2%igb5
<29>1 2024-11-10T17:22:18+01:00  reset a timer on igb5, state=REQUEST, timeo=4, retrans=18907
<29>1 2024-11-10T17:22:37+01:00  Sending Request
<29>1 2024-11-10T17:22:37+01:00  set client ID (len 14)
<29>1 2024-11-10T17:22:37+01:00  set server ID (len 14)
<29>1 2024-11-10T17:22:37+01:00  set IA address
<29>1 2024-11-10T17:22:37+01:00  set identity association
<29>1 2024-11-10T17:22:37+01:00  set elapsed time (len 2)
<29>1 2024-11-10T17:22:37+01:00  set option request (len 4)
<29>1 2024-11-10T17:22:37+01:00  set IA_PD prefix
<29>1 2024-11-10T17:22:37+01:00  set IA_PD
<29>1 2024-11-10T17:22:37+01:00  send request to ff02::1:2%igb5
<29>1 2024-11-10T17:22:37+01:00  reset a timer on igb5, state=REQUEST, timeo=5, retrans=28923


[nibbles]

So now its working.......

What I did was that I disabled the KEA Dhcp server and went back to ISC.
Then I disabled IPv6 on both LAN interfaces (one physical and one VLAN)

Selected send prefix hint, request prefix only and selected prefix 0 on the want interface.
Save Apply and tada. I got my self an IPv6 adress on the WAN interface.

Went back to the LAN interfaces and activated tracking and chose prefix 1 and 2 and it worked like a charm.

Unclear if it was something on the ISP side or if the KEA DHCP interferes somehow with IPv6