Recall that the router sends a Router Advertisement (RA) message, and the settings within that RA message decide whether a client can obtain its IPv6 address information automatically using SLAAC, DHCPv6, or a combination of both. This guide covers both methods, the three possible RA flag combinations, and how to configure and verify each on a Cisco router.
The RA message always contains the Managed Address Configuration flag (M flag) and the Other Configuration flag (O flag), in a specific combination. Together, these two flags tell the host how it should obtain its IPv6 address and related configuration information. The RA message presents three addressing options for IPv6-enabled devices, based on the combination of the M and O flags:
- SLAAC – SLAAC only
- Stateless DHCPv6 – SLAAC combined with DHCPv6 for supplementary configuration
- Stateful DHCPv6 – DHCPv6 server only
The RA message advertises these options, but the client isn’t strictly bound to follow them: a client can ignore the RA message entirely and use the services of a DHCPv6 server exclusively if configured to do so.
RFC 4861 defines the Neighbor Discovery mechanisms, including the Neighbor Solicitation and Neighbor Advertisement messages that Duplicate Address Detection (DAD) relies on. DAD is performed on any unicast address, including addresses configured via both SLAAC and DHCPv6, ensuring that all configured IPv6 addresses are unique on the local subnet.
How This Works, Step by Step
Before diving into the flag details below, it helps to see the actual sequence of events a client goes through when it joins an IPv6 network. [See Topology Diagram: The SLAAC/DHCPv6 Process] walks through this from the very beginning, for readers who are new to this topic.
- A client device connects to the network (for example, a laptop joining Wi-Fi) and needs an IPv6 address before it can communicate with anything.
- The client sends a Router Solicitation (RS) message, asking any router on the local network to identify itself and provide addressing instructions. A client doesn’t strictly have to do this: routers also send RA messages periodically on their own, but sending an RS speeds the process up.
- The router replies with a Router Advertisement (RA) message. This RA carries the M and O flags described below, along with the network prefix the client will need if it ends up building its own address.
- The client reads the M and O flags in the RA and follows exactly one of three paths from here:
- M=0, O=0 (SLAAC): the client builds its entire address itself, right now, using only what was in the RA. It never talks to a DHCPv6 server at all.
- M=0, O=1 (Stateless DHCPv6): the client builds its own address just like in SLAAC, but then sends a separate request to a DHCPv6 server asking only for extra details, like DNS server addresses, that weren’t included in the RA.
- M=1, O=1 (Stateful DHCPv6): the client doesn’t build anything itself. It sends a request to a DHCPv6 server and waits to be handed a complete address plus full configuration.
- Before actually using any new address, the client performs Duplicate Address Detection (DAD), sending a Neighbor Solicitation for its own tentative address to confirm no other device on the subnet already has it.
- The client is now fully configured and can begin sending and receiving traffic on the network.
This same six-step flow applies no matter which of the three options is in use, only step 4 branches differently depending on which M and O flags the router advertised.
Quick Reference: M and O Flag Combinations
| Option | M Flag | O Flag | What the Client Does |
|---|---|---|---|
| SLAAC | 0 | 0 | Self-generates its full address and configuration from the RA message alone; no DHCPv6 contact |
| Stateless DHCPv6 | 0 | 1 | Self-generates its address from the RA message, then contacts a DHCPv6 server for supplementary info (e.g., DNS) only |
| Stateful DHCPv6 | 1 | 1 | Contacts a DHCPv6 server for its address and all configuration information; the server tracks address state |
SLAAC Option
SLAAC is the default option on Cisco routers. Both the M flag and the O flag are set to 0 in the RA for this option. It simplifies IPv6 address management by providing plug-and-play connectivity without manually configuring hosts, allowing an IPv6 client to construct its own address using a combination of locally available information and information advertised by the router in the RA message.
In the SLAAC option, the client uses the information in the RA message exclusively; it does not contact a DHCPv6 server at all. The RA message includes the network prefix, prefix length, and, in many implementations, additional details such as the default gateway. The client’s full 128-bit IPv6 global unicast address is formed by combining the advertised global/network prefix (typically the first 64 bits) with a locally generated interface identifier (the remaining 64 bits), created either via the EUI-64 process or as a randomly generated value for privacy purposes. This is distinct from a link-local address, which a client always self-generates independently under the fe80::/10 prefix, regardless of any RA received.
The RA option is configured on an individual router interface. To reset an interface back to the SLAAC-only default after it has been configured with a different option, reset both flags to 0:
Router(config-if)# no ipv6 nd managed-config-flag
Router(config-if)# no ipv6 nd other-config-flagStateless DHCPv6 Option
DHCPv6 functions similarly to DHCP for IPv4: it runs between a client and a server, exchanging DHCPv6 packets over UDP. Because IPv6 has no broadcast mechanism, DHCPv6 uses multicast instead of the broadcast messages DHCPv4 relies on. DHCPv6 clients do not need to be manually configured with the IPv6 addresses of DHCPv6 servers; multicast discovery handles this.
In the stateless option, the client uses the RA message to build its own address, exactly as in SLAAC, but additionally contacts a DHCPv6 server for supplementary configuration parameters (such as DNS server addresses) that aren’t included in the RA. The client’s global unicast address is still formed from the RA’s advertised prefix combined with an interface identifier generated via EUI-64 or a randomly generated value.
This is called stateless DHCPv6 because the server does not track any per-client state, it maintains no record of which addresses are allocated to which clients, since it isn’t issuing addresses at all, only supplementary configuration data.
For this option, the O flag is set to 1 and the M flag remains 0. The O flag value of 1 signals to the client that additional configuration information is available from a stateless DHCPv6 server. To configure this on an interface:
Router(config-if)# ipv6 nd other-config-flagStateful DHCPv6 Option
Stateful DHCPv6 works much like DHCP does for IPv4 addressing: a device obtains its full addressing plan, including its global unicast address, prefix length, and DNS server addresses, entirely from a stateful DHCPv6 server. The RA message in this option effectively signals to the client that no address information is being provided via SLAAC, and that the client must contact a DHCPv6 server for everything it needs. This is called stateful DHCPv6 because the server actively tracks and maintains the state of every address it has allocated.
Both the M and O flags are set to 1 for stateful DHCPv6. To configure this on an interface:
Router(config-if)# ipv6 nd managed-config-flag
Router(config-if)# ipv6 nd other-config-flagVerifying the Configuration
Confirm the current RA flag configuration and behavior on an interface with:
Router# show ipv6 interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::1
ND DAD is enabled, number of DAD attempts: 1
ND managed config flag is set
ND other config flag is set
...Look specifically for the “ND managed config flag” and “ND other config flag” lines, they directly report whether the M and O flags are currently set or unset for that interface, confirming which of the three addressing options is actually active without needing to inspect a live packet capture.
On the client side, show ipv6 interface (or the operating system’s equivalent, such as ipconfig /all on Windows or ip -6 addr on Linux) confirms which address the client actually configured and whether it was derived via SLAAC or received from a DHCPv6 server.
CCNA Exam Pointers
- SLAAC: M=0, O=0 — client self-configures entirely from the RA, no DHCPv6 contact
- Stateless DHCPv6: M=0, O=1 — client self-configures its address from the RA, then contacts DHCPv6 only for supplementary info (e.g., DNS)
- Stateful DHCPv6: M=1, O=1 — client gets everything, including its address, from a DHCPv6 server that tracks allocation state
- The client’s global unicast address = advertised global/network prefix + interface identifier (EUI-64 or randomly generated) — never confuse this with the link-local address, which is always self-generated under fe80::/10 independent of any RA
- A client can bypass RA-advertised options entirely and use DHCPv6 exclusively if configured to
- DAD uses ICMPv6 Neighbor Solicitation/Neighbor Advertisement messages (defined under RFC 4861’s Neighbor Discovery framework) to confirm address uniqueness on the subnet
ipv6 nd managed-config-flag/other-config-flag(and theirnoforms) set the M and O flags on an interface;show ipv6 interfaceverifies the currently active flag state
Conclusion
SLAAC and DHCPv6 aren’t competing, mutually exclusive technologies, they’re two complementary tools that a network administrator combines via the RA message’s M and O flags to control exactly how much configuration responsibility falls to the client versus a centralized DHCPv6 server. Understanding all three combinations precisely, and being able to both configure and verify them with show ipv6 interface, is foundational CCNA knowledge and directly applicable to real-world IPv6 deployment decisions.
FAQs
What’s the difference between SLAAC and DHCPv6?
SLAAC allows a client to construct its own IPv6 address entirely from information in the Router Advertisement message, requiring no centralized server. DHCPv6 can either supplement SLAAC (in stateless mode, providing only additional configuration details like DNS servers) or fully replace it (in stateful mode, providing the address itself along with all configuration, tracked centrally by the DHCPv6 server), depending on which RA flags are set.
Can a host ignore RA messages and use DHCPv6 only?
Yes. Although the RA message advertises which addressing method the network intends for clients to use via its M and O flags, a host can be configured to bypass the RA’s guidance entirely and request full configuration directly from a DHCPv6 server regardless of what the RA advertises.
What does the M flag do?
The Managed Address Configuration flag tells the host whether it should obtain its IPv6 address from a DHCPv6 server. When set to 1, the host uses stateful DHCPv6 to get its address; when set to 0, the host constructs its own address via SLAAC instead.
What does the O flag do?
The Other Configuration flag signals whether additional configuration information beyond the address itself, such as DNS server addresses, is available from a DHCPv6 server. When set to 1 alongside M=0, this indicates stateless DHCPv6: the client self-configures its address via SLAAC but still contacts DHCPv6 for supplementary details.
How does DAD work?
Duplicate Address Detection uses ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages to confirm that a newly configured address, whether obtained via SLAAC or DHCPv6, is not already in use by another device on the same subnet. The client sends a Neighbor Solicitation for its own tentative address; if no Neighbor Advertisement response claims that address, the client considers it unique and safe to use.
