Skip to content
Networking
ASD ISMISM-1430

ASD ISM 1430 Configure IPv6 addresses with DHCPv6 in stateful mode

What it says

Dynamically assigned IPv6 addresses are configured with Dynamic Host Configuration Protocol version 6 in a stateful manner with lease data stored in a centralised event logging facility.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use DHCPv6 to manage and log IPv6 addresses centrally for enhanced network organisation.

This control is about using a system called DHCPv6 to automatically assign IP addresses to devices on your network. Think of it like giving each device a unique phone number that lets it communicate in the digital world. By managing these addresses centrally, it helps keep track of which devices are using which addresses, making your network smoother and more secure. If you don't do this, your network could become disorganised, harder to manage, and vulnerable to attacks.

Why it matters

Without stateful DHCPv6 with centralised lease logging, IPv6 address assignment becomes inconsistent, reducing traceability and enabling spoofing or unauthorised access.

How to implement

  1. The IT team should configure a stateful DHCPv6 server on the network.

    This means setting up a central system that automatically manages IP addresses, ensuring each device gets a unique address. This helps prevent address conflicts and makes managing devices much easier.

  2. Network administrators should monitor and log IP address assignments.

    Set up a system that keeps track of which device has which IP address and for how long. This record-keeping is essential for troubleshooting and security investigations.

  3. System owners should ensure devices are configured to use DHCPv6.

    This involves setting up each device's network settings to 'automatic', allowing them to request an IP address from the DHCPv6 server. This step ensures all devices are correctly integrated into the network.

  4. IT managers should implement centralised logging of DHCPv6 activity.

    Use a secure log management tool to gather and store logs from the DHCPv6 server. These logs provide a record of network activity and can be vital for security audits.

  5. The security team should regularly review DHCPv6 lease logs.

    Conduct periodic reviews to understand network usage patterns and ensure that only authorised devices are connecting. This helps in early detection of unauthorised access attempts.

Keep it running

Validate DHCPv6 is stateful and forwarding/sending lease events to centralised logging; review leases for anomalies and stale entries after network changes.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The DHCPv6 server configuration documentation: Verify the network settings and ensure stateful configuration is implemented as described in organisation policy.

    Look at

    Correct assignment ranges and central logging settings.

    Good evidence

    : Up-to-date configuration scripts or screenshots confirming correct setup.

  2. Check 2 of 5What an auditor asks for

    Ask for

    To see DHCPv6 lease records: Request logs that show current and past IP address assignments to ensure logging is active.

    Look at

    Records that show issue and expiry times of addresses.

    Good evidence

    : Review logs containing timestamped entries for address issuance and release.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Network device configuration policies: Verify the policies for device network settings.

    Look at

    Instructions setting devices to use DHCPv6 automatically.

    Good evidence

    Policy documents outlining DHCPv6 settings with instructions for all device types.

  4. Check 4 of 5What an auditor asks for

    Ask for

    To review a sample DHCPv6 log file: Check that log files are being properly retained and can be traced to specific events.

    Look at

    Detailed entries on address assignments and changes.

    Good evidence

    : Log entries detailing device IPs, timestamps, and lease times.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Security review meeting records: Verify discussions around reviewing DHCPv6 setup and effectiveness occur.

    Look at

    Meeting notes on network usage reviews and any identified issues.

    Good evidence

    : Minutes from recent meetings showing evidence of review and planned improvements.

Mappings

Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.8.20Network and network devices securityPartially meets
  • A.8.16Monitoring networks and systems for anomalous behaviourSupports

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.