RFC 9928
DHCPv4 over DHCPv6 with Relay Agent Support
Abstract 💖
Okay, bestie, RFC 9928 is called "DHCPv4 over DHCPv6 with Relay Agent Support" ✨ Here's the title block, with the important bits up front:
- Request for Comments: 9928
- Title: DHCPv4 over DHCPv6 with Relay Agent Support
- Authors: C. Porfiri (Ericsson), S. Krishnan (Cisco), J. Arkko (Ericsson), M. Kühlewind (Ericsson)
- Category: Standards Track
- ISSN: 2070-1721
- Date: March 2026
- Obsoletes/Updates: The title block doesn't list anything this one obsoletes or updates. 🙈
The big idea is about networks full of legacy IPv4-only clients that still need to get services from DHCPv4 over DHCPv6 🦋 [RFC7341] already covers DHCPv4 over DHCPv6, but only on the client side. This doc adds an approach built on RFC 7341 where a Relay Agent does the encapsulation and decapsulation of DHCPv4 messages inside DHCPv6 messages on behalf of a DHCPv4 client. The Relay Agent is doing the work for the client, which is so iconic 💅
Status of This Memo 🎀
This is an Internet Standards Track document. 🔥
It comes from the IETF (Internet Engineering Task Force) and represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). If you want more on Internet Standards, check Section 2 of RFC 7841 📚
For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc9928. 🌸
Copyright Notice 🌈
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. 💜
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please actually read these, bestie, because they describe your rights and restrictions for this document. Code Components pulled out of this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty as described in the Revised BSD License. ⚖️
Table of Contents 🦋
1. Introduction
1.1. Applicability Scope
2. Conventions and Definitions
3. DHCPv4-over-DHCPv6 Relay Agent (4o6RA)
3.1. Intermediate Relays
3.2. 4o6RA and Topology Discovery
4. Deployment Considerations
5. Security Considerations
6. IANA Considerations
7. References
7.1. Normative References
7.2. Informative References
Appendix A. Example Use Case: Topology Discovery for IPv4-Only
Radio Unit in 3GPP RAN with Switched Fronthaul
Acknowledgments
Authors' Addresses1. Introduction ✨
[RFC7341] is the transport mechanism that carries DHCPv4 [RFC2131] messages using DHCPv6 [RFC9915]. It's how you dynamically provision IPv4 addresses and other DHCPv4-specific config parameters across IPv6-only networks 🌐 Deploying [RFC7341] needs support in DHCP clients and at the DHCPv6 server. But if a client is embedded in a host that only supports IPv4 and can't easily be replaced or updated (for any number of technical or business reasons), this approach just doesn't work 😭
Similarly, the DHCPv6 Relay Agent spec in [RFC9915] also refers to [RFC6221] for the Lightweight DHCPv6 Relay Agent (LDRA) behavior. It doesn't offer any mechanism for legacy DHCPv4, unless the client implements the DHCPv4-over-DHCPv6 encapsulation and decapsulation itself. Not ideal, bestie 🙃
This document specifies a solution based on [RFC7341] that can live in intermediate nodes like switches or routers, without putting any requirements on clients 🧚 No new protocols or extensions are needed. Instead, it's a new use case for [RFC7341] that lets a Relay Agent do the DHCPv4-over-DHCPv6 encapsulation and decapsulation instead of the client. Main character energy for the Relay Agent 👑
1.1. Applicability Scope 🌸
This applies to the configuration phase of hosts that need an IPv4 address when a DHCP server for IPv4 [RFC2131] isn't directly reachable from the host. The host also can't implement a DHCP client conformant to [RFC7341], because it's connected to an IPv4-only network. BUT there is a DHCPv6 server that can hand out IPv4 addresses using the mechanisms in [RFC7341]. So close, yet so far 🥺
2. Conventions and Definitions 📚
These are the terms and abbreviations used in this document, so you can keep up 🫶
- DHCP: Refers to DHCPv4 and/or DHCPv6 if not otherwise specified.
- DHCP Relay Agent: A common concept across all of these protocols, although the details differ between them: the Bootstrap Protocol (BOOTP) [RFC0951] [RFC1542], DHCPv4 [RFC2131] [RFC2132], and DHCPv6 [RFC9915].
- DHCPv4: Refers to DHCP as defined in [RFC2131].
- DHCPv4 over DHCPv6 (DHCP 4o6): Refers to the architecture, the procedures, and the protocols specified in the DHCPv4-over-DHCPv6 document [RFC7341].
- DHCPv4-over-DHCPv6 Relay Agent (4o6RA): A Relay Agent that implements the DHCP 4o6 transport as specified in this document. 🎀
- Layer 3 Relay Agent (L3RA): A DHCP Relay Agent as specified in [RFC9915] that is not an LDRA.
- Lightweight DHCPv6 Relay Agent (LDRA): An extension of the original DHCPv6 Relay Agent specification that lets Layer 2 (L2) only devices act as a Relay Agent [RFC6221]. ✨
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174]. They only count when they show up in all capitals, exactly like that 💅
3. DHCPv4-over-DHCPv6 Relay Agent (4o6RA) 🔥
This document assumes a network where IPv4-only hosts connect to a network that supports IPv6 and only limited IPv4 services 🌈
To deal with that kind of setup, this document extends DHCPv6 Relay Agents with DHCPv4 over DHCPv6, as shown in Figure 1 🦋
.-----------. .-----------.
| | | |
+--------+-+ L2 +-+-----------+-+ IPv6 +-+--------+
| DHCPv4 | Network | DHCPv6 | Network | DHCP 4o6 |
| Client +---------+ Relay Agent +---------+ Server |
| | | with 4o6RA | | |
+--------+-+ +-+-----------+-+ +-+--------+
| | | |
'-----------' '-----------'Figure 1: Architecture Example with Legacy DHCP Client
This document specifies the encapsulation and decapsulation from [RFC7341], but it gets done in the Relay Agent without changing anything on the DHCPv4 client 🙌 The Relay Agent provides the full DHCP 4o6 support, and the legacy DHCPv4 client has no idea it's being served over a DHCP 4o6 service. Since the 4o6RA acts as a DHCP 4o6 client, all the prerequisites and configurations that apply to the DHCP client in Section 5 of [RFC7341] also apply to the 4o6RA 💖
Because the 4o6RA takes the client's role with respect to [RFC7341], it's responsible for picking a suitable interface where it acts as a DHCPv6 client. It's also responsible for finding a suitable DHCPv6 server or Relay Agent and getting the IPv6 configuration it needs. As specified in [RFC7341], the 4o6RA (acting as DHCP 4o6 client) therefore has to request the DHCP 4o6 Server Address option from the server, by sending the Option Request option as described in [RFC9915], before it can use the DHCP 4o6 transport 🧚
To keep interoperability with existing DHCPv6 relays and servers, the message format stays unchanged from [RFC9915]. The 4o6RA implements the same message types as a DHCPv6 Relay Agent (see Section 6 of [RFC7341]) 🫶
Here's the twist: in this specification, the 4o6RA (not the client) creates the DHCPV4-QUERY message and encapsulates the DHCP request message it received from the legacy DHCPv4 client 🍓
When the 4o6RA gets a DHCPV4-RESPONSE message, it looks for the DHCPv4 message option inside it. If that option isn't found, or the DHCPv4-RESPONSE message isn't well-formed, it MUST be discarded 🗑️ If the DHCPv4 message option is present and correct, the 4o6RA MUST extract the DHCPv4 message and forward the encapsulated DHCPv4-RESPONSE to the requesting DHCPv4 client. It only does that if the encapsulated DHCPv4-RESPONSE is correct and can actually be forwarded ✅
Layer 2 (L2) Relay Agents that receive DHCPV4-QUERY or DHCPV4-RESPONSE messages MUST handle them as specified in Section 6 of [RFC6221] 💜
In any given environment, the DHCPv6 servers that DHCPV4-QUERY requests get routed to are expected to be compliant with DHCP 4o6 according to [RFC7341]. This specification doesn't set any additional requirements on DHCPv6 servers 🌸
3.1. Intermediate Relays 🧚
Intermediate relays shall behave according to Section 10 of [RFC7341]. 🦋
Okay this is where I'll pick it up in the next part, bestie! 🌈
3.2. 4o6RA and Topology Discovery ✨
okay so some networks need a host's config to depend on the topology 👀 but when a brand new host shows up, it has zero clue what the topology looks like, so it's kinda lost 😭
DHCPv4 [RFC2131] and DHCPv6 [RFC9915] both describe how addresses can usually be handed out to clients based on the topology info a DHCP relay gives them 💅
Address and prefix allocation decisions are a huge part of how DHCP hands out addresses and prefixes, and [RFC7969] goes into all the juicy details 🧚 this spec's whole goal is making sure 4o6RA doesn't break any legacy capability when it's used for topology discovery 🫶
Topology discovery in [RFC7969] is lowkey different between IPv4 and IPv6:
- IPv4: when DHCP is running on IPv4, only the first Relay Agent SHOULD set the giaddr field (Section 3.1 of [RFC7969]). So if a network has more than one Relay Agent, only part of the topology gets carried over DHCPv4 💀
- IPv6: when DHCPv6 is in use, all Relay Agents SHOULD send link-address and Interface-ID options that describe the complete path between the DHCPv6 client and the DHCPv6 server to the DHCPv6 server 🌈
In Layer 2 networks, Lightweight DHCPv6 Relay Agents (LDRAs) [RFC6221] can be used 🦋
When the topology info is provided, the DHCPv6 server has it in the form of a sequence of the link-address field and Interface-ID option. Then topology info for a given IP address can be pulled from the DHCPv6 server and used for configuration or other purposes 🎀
[RFC7341] lets the client use DHCPv6 for topology discovery even inside a DHCPv4 context, since the DHCPv6 Relay Agent knows which interface the encapsulated DHCP request came in on 🙌 BUT, as Figure 2 shows, bringing DHCP 4o6 to the edge of the IPv6 network hides the Layer 2 network from the DHCPv6 RA 😩 so moving DHCP 4o6 to an intermediate node instead of doing it at the client breaks topology propagation, because 4o6RA-only solutions don't give any interface info in the encapsulated message. literally the tea 🍵
.-----------------. .-------------------------.
| L2 Network | | IPv6 Network |
+--------+-+ +---------+ +-+---+---+ +--------+ +-+--------+
| DHCPv4 | | L2 | | 4o6 | | DHCPv6 | | DHCP 4o6 |
| Client +--+ Switch +--+ Relay +----+ Relay +-------+ Server |
| | | | | Agent | | Agent | | |
+--------+-+ +---------+ +-+---+---+ +--------+ +-+--------+
| | | |
'-----------------' '-------------------------'Figure 2: Broken Topology Information
So to get the FULL topology info, it is RECOMMENDED that any 4o6RA implementation be paired with an LDRA implementation [RFC6221] in a back-to-back structure. The LDRA implementation should include a mechanism to get interface info that can fill the Interface-ID option in outgoing DHCPV4-QUERY messages, as specified in Section 5.3.2 of [RFC6221] 🫶
How the internal mechanisms exchange interface info, what format they use, and whether that info flags that a 4o6RA is involved are all out of scope for this document 🙈
Figure 3 shows the resulting architecture, where the Relay Agent implements both 4o6RA and LDRA and has an internal interface to pass topology info from 4o6RA over to the LDRA 🧚
.-----------------. .------------------------.
| L2 Network or | | IPv6 Network |
| IPv6-Only Link | | |
+--------+-+ +---------+ +-+---+--+---------+ +------+---+
| DHCPv4 | | L2 | | 4o6 | LDRA | | DHCP 4o6 |
| Client +--+ Switch +--+ Relay + RFC 6221+------+ Server |
| | | | | Agent | | | |
+--------+-+ +---------+ +-+---+--+---------+ +------+---+
| | | |
'-----------------' '------------------------'Figure 3: Topology Information Preserved with LDRA
In a simple case, where the same node runs both the 4o6RA and the DHCP 4o6 server, it might be enough to just use 4o6RA, as Figure 4 shows. (CPE here means "Customer Premises Equipment" 🏠)
.-----------.
| L2 Network |
+--------+-+ +-+------+----------+
| DHCP | | 4o6 | DHCP 4o6 |
| Client +---------+ Relay + Server |
| on CPE | | Agent | |
+--------+-+ +-+------+----------+
| |
'-----------'Figure 4: Topology Information Preserved by 4o6 Relay Agent in DHCP Server
4. Deployment Considerations 🍓
okay so clients have no idea 4o6RA exists 🙈 which means the network has to make sure ALL DHCPv4 broadcast and unicast messages to and from clients get steered through a 4o6RA. You can do that by putting the 4o6RA in a central spot that can catch all the client traffic, or by using Network Address Translation (NAT) with the 4o6RA address for unicast messages 💅
5. Security Considerations 💀
This document is all about applying DHCP 4o6 in a scenario where legacy IPv4 clients connect to DHCP 4o6 Relay Agents that do the encapsulation and decapsulation 🔥 It does not change anything else in the DHCP 4o6 specification [RFC7341], so the security considerations in that document still apply 😤 And since the legacy IPv4 client is totally unaware of the encapsulation and decapsulation, the 4o6RA has to provide the protections specified in Section 12 of [RFC7341]. no skipping this one, bestie 🚨
The mechanisms here differ from [RFC7341] because they let the DHCP client send AND receive DHCPv4 messages, whereas in [RFC7341] the client only sends DHCPv6 messages 👀 This means that in improperly configured networks, where the client sits on the same Layer 2 scope as a DHCPv4 server, DHCPv4 messages could reach that server WITHOUT going through the 4o6RA. Like, this can cause erroneous state in both clients and servers and could even lead to misconfigurations that hurt reachability 😭 Even so, it's seen as a deployment error rather than a security concern. And even though this mechanism could be used for attacks from inside the network, that's not a new concern introduced by this spec 🛡️
More generally, legacy IPv4 clients aren't aware of this mechanism. Even with DHCP 4o6 in play, though, the client has no control over the info the Relay Agent provides. So this change doesn't raise any additional security concerns ✨
6. IANA Considerations 🌸
This document has no IANA actions. nothing to see here for the registries 🧚
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC6221] Miles, D., Ed., Ooghe, S., Dec, W., Krishnan, S., and A.
Kavanagh, "Lightweight DHCPv6 Relay Agent", RFC 6221,
DOI 10.17487/RFC6221, May 2011,
<https://www.rfc-editor.org/info/rfc6221>.
[RFC7341] Sun, Q., Cui, Y., Siodelski, M., Krishnan, S., and I.
Farrer, "DHCPv4-over-DHCPv6 (DHCP 4o6) Transport",
RFC 7341, DOI 10.17487/RFC7341, August 2014,
<https://www.rfc-editor.org/info/rfc7341>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC9915] Mrugalski, T., Volz, B., Richardson, M., Jiang, S., and T.
Winters, "Dynamic Host Configuration Protocol for IPv6
(DHCPv6)", STD 102, RFC 9915, DOI 10.17487/RFC9915,
January 2026, <https://www.rfc-editor.org/info/rfc9915>.7.2. Informative References
[RFC0951] Croft, W. and J. Gilmore, "Bootstrap Protocol", RFC 951,
DOI 10.17487/RFC0951, September 1985,
<https://www.rfc-editor.org/info/rfc951>.
[RFC1542] Wimer, W., "Clarifications and Extensions for the
Bootstrap Protocol", RFC 1542, DOI 10.17487/RFC1542,
October 1993, <https://www.rfc-editor.org/info/rfc1542>.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol",
RFC 2131, DOI 10.17487/RFC2131, March 1997,
<https://www.rfc-editor.org/info/rfc2131>.
[RFC2132] Alexander, S. and R. Droms, "DHCP Options and BOOTP Vendor
Extensions", RFC 2132, DOI 10.17487/RFC2132, March 1997,
<https://www.rfc-editor.org/info/rfc2132>.
[RFC7969] Lemon, T. and T. Mrugalski, "Customizing DHCP
Configuration on the Basis of Network Topology", RFC 7969,
DOI 10.17487/RFC7969, October 2016,
<https://www.rfc-editor.org/info/rfc7969>.Appendix A. Example Use Case: Topology Discovery for IPv4-Only Radio Unit in 3GPP RAN with Switched Fronthaul ✨
okay so picture a 3GPP mobile network 📶. The User Equipment (UE), aka your phone 📱, connects through a Radio Access Network (RAN). The RAN is built from Baseband Units (BBUs) and Radio Units (RUs), and a radio Fronthaul (FH) network links the RUs and BBUs together. Each RU and BBU is an IP host, and they might support IPv4 only, IPv6 only, or both, depending on the vendor and the model. 💅
Every RU is one-of-a-kind 🦋 because it's tied to a set of antennas, and each antenna serves a specific Cell and Sector. The BBU configures each RU based on the Cell and Sectors it serves, but that relationship only lives in the cabling between RUs and antennas. BBUs can be cabled straight to RUs or go through a Layer 2 switched network. It's giving complicated, bestie 🙈
Figure 5: 3GPP RAN Where RUs Are Cabled Directly to BBUs
+--------+
| RU2 +-----+
| | |
+--------+ |
|
+--------+ |
| RU3 | |
| +--+ | +-----------+
+--------+ | +--+ |
+-----+ Baseband |
| |
+--------+ +-----+ Unit |
| RU4 +--+ +--+ |
| | | +-----------+
+--------+ |
|
+--------+ |
| RU2 +-----+
| |
+--------+In Figure 5, the BBU is directly cabled to a set of RUs, and the BBU can figure out which RUs go with which Cell/Sectors just by looking at the cabling between the RUs and antennas. Easy mode 🌸
When BBUs and RUs are connected through a Layer 2 switched network, things get messy fr fr 😭. The BBUs now need a much deeper knowledge of the topology so they can configure the RUs properly, and that means knowing about all the cabling in the switched network. 🍓
Examples of switched networks are in Section 3 of [RFC7969], and they show just how different the levels of complexity can get 👑. Here's an example of a FH:
Figure 6: 3GPP RAN with Layer 2 Switched Fronthaul Example
+--------+
| RU1 | P1 +-+------+ | |
| +--------+ | L2RA | | +----+------+ |
+--------+ | +------+ | | | L3RA | |
| L2 | +--+ +------+ |
+--------+ P2 | Switch | | | | |
| RU2 +--------+ #1 +-----+ | Router +----+
| | +--------+ | +-----------+ | +---------+
+--------+ | | | |
| +--+ DHCP |
+--------+ | | | Server |
| RU3 | P1 +-+------+ | | | #1 |
| +--------+ | L2RA | | +-----------+ | +---------+
+--------+ | +------+ | | | |
| L2 | +--+ Baseband | |
+--------+ P2 | Switch | | | Unit | |
| RU4 +--------+ #2 +-----+ | +----+
| | +--------+ | +-----------+ |
+--------+ | |If IPv6 is used and all RUs can do DHCPv6 in Figure 6, DHCP topology knowledge can be used to solve the RU configuration problem. That solution would use the topology discovery mechanisms described in Section 3.2 of [RFC7969]. Slay, that's clean ✨
If RUs only do IPv4 but implement a DHCP 4o6 client according to [RFC7341], the same topology discovery mechanisms still apply. 🎀
If RUs only do IPv4 and can't implement a DHCP 4o6 client according to [RFC7341], then the topology discovery mechanisms described in Section 3.2 of [RFC7969] can still be used, as long as you introduce 4o6RA into the switches as described in this document. This is the main character moment 🦋👑
Acknowledgments
The authors would like to acknowledge the interesting discussions in this problem space with Sarah Gannon, Ines Ramadza, and Siddharth Sharma 🫶. They also thank the people who reviewed and commented: Éric Vyncke, Mohamed Boucadair, David Lamparter, Michael Richardson, Alan DeKok, Dale Worley, Paul Wouters, Deb Cooley, Erik Kline, Ketan Talaulikar, Mike Bishop, and Roman Danyliw. Literally the dream team 💖🌈
Authors' Addresses
Here's who wrote this, bestie 🧚
Claudio Porfiri
Ericsson
Email: claudio.porfiri@ericsson.com
Suresh Krishnan
Cisco
Email: suresh.krishnan@gmail.com
Jari Arkko
Ericsson
Email: jari.arkko@ericsson.com
Mirja Kühlewind
Ericsson
Email: mirja.kuehlewind@ericsson.com📦 where this page comes from
- ietf: rfc9928 2026-03
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms