Configure DHCP Option 108 on Windows DHCP Server for IPv6-Mostly

IPv6

While enterprise adoption of IPv6 has been slow, it is still moving forward. For example, the U.S. federal government has mandated [M-21-07 – PDF] the transition to IPv6 to modernize its networks and enhance security, scalability, and interoperability. During the migration to IPv6, most systems will be configured with both IPv4 and IPv6, a configuration referred to as dual stack. Ultimately, the goal is the elimination of IPv4 entirely and the use of IPv6 exclusively. However, IPv6-only presents some unique challenges.

Access to IPv4

Although an organization can successfully migrate to IPv6-only networks internally, it does not control networks outside its boundaries. In some cases, a host on an IPv6-only network may need to communicate with an IPv4 resource. Administrators must deploy an IPv6 transition technology to support this scenario.

464XLAT

464XLAT, defined in RFC 6877, is a network architecture that facilitates the transition from IPv4 to IPv6 by enabling IPv4 traffic to operate over an IPv6-only network. It combines two translation mechanisms: a customer-side translator (CLAT) on the user device, which converts IPv4 packets to IPv6, and a provider-side translator (PLAT) at the network edge, which converts the IPv6 packets back to IPv4 to communicate with IPv4-only internet services. This dual-translation approach allows devices in an IPv6-only environment to access both IPv6 and IPv4 resources without native IPv4 connectivity, making it an efficient solution for networks transitioning to IPv6 while maintaining compatibility with legacy IPv4 systems. On Windows, Windows CLAT (WinCLAT) provides the CLAT component.

CLAT for Windows

Windows has long included CLAT support for cellular network interfaces. Windows CLAT (WinCLAT) extends this support to Wi-Fi and Ethernet interfaces and is generally available on Windows 11 version 25H2, starting with build 26200.9550. WinCLAT is disabled by default on non-cellular interfaces and must be permitted before it can operate. Windows also honors DHCP option 108 only while WinCLAT is permitted. WinCLAT is not available on Windows Server. For configuration details, see Windows CLAT (WinCLAT) Overview and Configuration.

IPv6-Mostly

An IPv6-mostly network, as defined in RFC 8925, provides NAT64 alongside native IPv4 and allows IPv6-only, dual-stack, and IPv4-only devices to coexist on the same network segment. Devices that can operate without IPv4 forgo an IPv4 address, while devices that still require IPv4 continue to receive one. This approach reduces IPv4 address consumption and allows organizations to move toward IPv6-only incrementally, with 464XLAT providing IPv4 access for applications that still need it.

DHCP Option 108

DHCPv4 option 108, called IPv6-Only Preferred, allows an IPv6-mostly network to signal to capable clients that they can operate without a native IPv4 address. Only clients that can operate without IPv4, usually because they include a CLAT or because all of their applications work over IPv6, request the option. When the DHCP scope is configured for IPv6-mostly operation, the server includes option 108 in its response, along with a wait time. The client then stops DHCPv4 configuration for that period, or until it reconnects to a network, and relies on IPv6 and NAT64 for connectivity. Disabling the IPv4 stack entirely during that time is optional. Clients that do not request the option obtain an IPv4 address as usual.

Option 108 and Windows Server DHCP

Commercial DHCP appliances like Infoblox and many open source DHCP platforms natively support DHCP option 108. However, no supported version of Windows Server, including the latest release (Windows Server 2025), supports DHCP option 108 natively. To enable DHCP option 108 on Windows DHCP servers, administrators can create a custom predefined option.

Custom Predefined Option

To create a custom predefined option for DHCP option 108 on a Windows DHCP server, open the DHCP management console (dhcpmgmt.msc) and perform the following steps.

  1. Right-click IPv4 and choose Set Predefined Options.
  2. Click Add.
  3. Enter IPv6 Only Preferred in the Name field.
  4. Select Long from the Data type drop-down list.
  5. Enter 108 in the Code field.
  6. Click Ok.
DHCP management console creating custom option 108 IPv6 Only Preferred with data type Long

Assigning DHCP Option 108

Once complete, perform the following steps to assign DHCP option 108 to a DHCP scope.

  1. Select an IPv4 DHCP scope.
  2. Right-click Scope Options and choose Configure Options.
  3. Select 108 IPv6 Only Preferred from the Available Options list.
  4. Enter a value in seconds, in hexadecimal format. This value is the period during which a client stops DHCPv4 configuration and operates without native IPv4. RFC 8925 sets a minimum of 300 seconds (clients treat lower values as 300) and a default of 1800 seconds. For example, 86,400 seconds (1 day) is 0x15180.
  5. Click Ok.
DHCP scope options with 108 IPv6 Only Preferred set to 0x15180

PowerShell

Custom predefined options can also be configured using PowerShell.

Custom Predefined Option

To create a custom predefined option for DHCP option 108, open an elevated PowerShell command on a Windows DHCP server and run the following command.

Add-DhcpServerv4OptionDefinition -Name 'IPv6 Only Preferred' -OptionId 108 -Type DWORD -PassThru
PowerShell output of Add-DhcpServerv4OptionDefinition creating DHCP option 108

Assigning DHCP Option 108

To assign the custom predefined DHCP option 108 to a DHCP scope, run the following PowerShell command.

Set-DhcpServerv4OptionValue -ScopeId 172.16.5.0 -OptionId 108 -Value 0x15180 -PassThru
PowerShell output of Set-DhcpServerv4OptionValue assigning option 108 to a DHCP scope

DHCP Offer

Once configured, if the client requests DHCP option 108 in its DHCP Discover, the DHCP server includes it in the DHCP Offer, as shown here. Windows DHCP Server does not send option 108 to clients that do not request it, as required by RFC 8925.

Packet capture of a DHCP Offer containing option 108 IPv6-Only Preferred

Learn More

If you are interested in learning more about IPv6-mostly and DHCP option 108, be sure to listen to the following episodes of the IPv6 Buzz Podcast.

Summary

As organizations continue their transition toward IPv6, DHCP option 108 provides administrators with a simple and effective way to reduce reliance on legacy IPv4 by signaling clients to prefer IPv6-only operation if they can support it. While Windows Server does not natively support this option, creating a custom predefined setting ensures administrators can take advantage of this important feature.

Additional Information

M-21-07 – Completing the Transition to IPv6 for U.S. Federal Government Agencies [PDF]

Windows CLAT (WinCLAT) Overview and Configuration

How Windows CLAT (WinCLAT) Discovers the NAT64 Prefix

When Windows CLAT (WinCLAT) Is Used on IPv6-Mostly and IPv6-Only Networks

What is 464XLAT? CLAT and PLAT Explained

What is an IPv6-Mostly Network?

464XLAT: Combination of Stateful and Stateless Translation (RFC 6877)

IPv6-Only Preferred Option for DHCPv4 (RFC 8925)

IPv6 Buzz Podcast on PacketPushers.Net

Windows CLAT (WinCLAT) Resources

Absolute Secure Access and IPv6

Absolute Secure Access (formerly NetMotion Mobility) is a premium enterprise secure remote access solution with deep user and application insight supporting Windows, Mac, iOS (iPhone and iPad), and Android devices. Although Absolute Secure Access supports IPv6 for remote network connections and client IP address assignment, the latter is not enabled by default. Administrators must make additional changes to the configuration to assign IPv6 addresses to their clients so they can access resources inside the tunnel using IPv6.

DHCPv6 and SLAAC

Absolute Secure Access supports DHCPv6 and Stateless Address Autoconfiguration (SLAAC) methods for assigning IPv6 addresses to connected clients. Although IPv6 client addressing is not enabled by default, it is quick and easy to configure.

Note: Absolute Secure Access does not currently support static IPv6 prefix assignment.

Enable IPv6

To enable IPv6 global support for all Absolute Secure Access clients, open the Secure Access management console and navigate to Configure > Client Settings > Virtual Address > Allocation Method: IPv6. Administrators can choose to support either DHCPv6 alone or DHCPv6 and SLAAC. After making a selection, click the Apply button to save the changes.

Once configured, Absolute Secure Access clients will be assigned an IPv6 address and can access IPv6 resources over the Secure Access tunnel.

Split Tunneling

If you have configured the Absolute Secure Access policy for split tunneling, ensure you have included your internal IPv6 prefix(es) defined in the split tunneling policy.

Additional Information

NetMotion Mobility is now Absolute Secure Access

Absolute Secure Access Zero Trust Network Access (ZTNA)

What’s New in Absolute Secure Access v13

Absolute Secure Access Features and Capabilities

Absolute Secure Access Advanced Features In Depth

Enterprise Zero Trust Network Access (ZTNA) and VPN

Always On VPN Static IP Address Assignment

A question that occasionally arises when I’m conducting an Always On VPN planning and design workshop for a customer is static IP address assignment options for VPN connections. Typically, the use case is a specific user that requires special access to a sensitive system internally. Assigning a static IP address to the user allows administrators to create firewall rules restricting access to this connection.

Static IP Assignment

Assigning a static IP address to a user is accomplished by editing the properties of their user account in Active Directory. Open the Active Directory Users and Computers console (dsa.msc), navigate to the Dial-in tab on the target individual’s Active Directory user account, and check the box next to Assign Static IP Addresses.

Next, click the Static IP Addresses button, check the box next to Assign a Static IPv4 address, and enter an IP address. Optionally, check the box next to Assign a static IPv6 address and enter a prefix and Interface ID, if required.

NPS Configuration

Once the user account in Active Directory is configured with a static IP address assignment, each NPS server in the organization must be registered in Active Directory. More details on Active Directory registration for NPS servers can be found here.

Caveats

Assigning static IP addresses to VPN users has many drawbacks and limitations. Consider the following.

Device IP

Assigning a static IP address to a device is not supported. You can only assign a static IP address to a user in Active Directory.

Address Assignment

The IP address you assign to the user must be from the same subnet as the VPN server’s internal network interface. If there is more than one VPN server, all VPN servers must be on the same subnet.

Multisite

Assigning static IP addresses to users is not supported when VPN servers are deployed in multiple locations.

Concurrent Sessions

Users with a static IP address assignment must only log on to one device at a time. If a user attempts to log in to multiple devices simultaneously, subsequent connections will fail due to the duplicate IP address assignment.

NPS

Always On VPN administrators may have discovered the option to assign a static IP address using NPS policy. Unfortunately, this option is severely limited. A separate NPS policy is needed for each user that requires a static IP address. However, NPS does not support assigning NPS policies to users, only groups. Technically speaking, you could create a separate group for each user needing a static IP address, but that’s not scalable. Also, it offers no real advantage over using the Active Directory method described above.

Summary

Although it’s possible to assign a static IP address to a user, there is currently no option to assign a static IP address to a device. In addition, static IP address assignment imposes other limitations that make the option challenging. Also, the inability to connect to geographically dispersed VPN servers is severely limiting.

Additional Information

Always On VPN and NPS Active Directory Registration

Always On VPN Client IP Address Assignment Methods

Always On VPN and IPv6