[CentOS] IPv6 token with /60 and prefix delegation

Mon May 9 20:00:56 UTC 2022
Kenneth Porter <shiva at sewingwitch.com>

--On Monday, May 09, 2022 12:16 PM -0500 Ian Pilcher <arequipeno at gmail.com> 
wrote:

> So right now, you're assigning a /60 address to your LAN interface?  If
> so, you almost certainly shouldn't do that.  Instead, you should (as you
> say) pick a /64 from within the delegated /60 and use that subnet.  (The
> other /64 subnets within the /60 can be used for other VLANs.)

Agreed. So should I just hard-code all 128 bits of the public address? 
That's not a terrible thing, since I have to update the DNS anyway if the 
prefix changes.

It sounds like the real problem is simply that this /64 requirement isn't 
documented anywhere in using "ip token" or the other automatic address 
modes. I had to find it in the source code to find out why it wasn't 
working. There's a line to log when the prefix isn't 64, but it's only 
printed when that line is explicitly enabled to log for debugging, so 
nobody would see it in normal operation and realize what was wrong.

> The details of doing this are going to be dependent on what software
> you're using to manage the network - NetworkManager, ISC DHCP client,
> etc.

Right now it's a CentOS 8 system running NetworkManager. The LAN side is 
going to run the Kea DHCP server but for now I'm just trying to get the WAN 
side going.

It seems there's not much machinery for automatically delegating and I'll 
have to hard-code it all in NetworkManager and Kea. Did I miss any magic 
for making a gateway work without lots of manual configuration?