You get a /48 for a site. How do you lay out the IPv6 addressing plan?
Show the answer
Say this first
I split the 16 bits of subnet ID on nibble boundaries so each level is one hex digit and summarizes cleanly. One block for infrastructure (loopbacks as /128s from one /64, a reserved /64 per link with a /127 used), then blocks per building or zone, and inside them a /64 per VLAN. I encode something readable, like the VLAN number, in the last digits, leave room to grow, and never encode IPv4 addresses into IPv6 ones. Everything goes into IPAM before the first address is configured.
Go deeper
Example: site prefix 2001:db8:a001::/48
The subnet ID is the fourth hextet, four hex digits: Z B V V.
| Digit | Meaning |
|---|---|
| Z | zone: 0 infrastructure, 1 to 9 buildings, f data center |
| B | floor or block inside the zone |
| V V | VLAN or segment index |
| Prefix | Use |
|---|---|
2001:db8:a001:0::/64 | router and switch loopbacks, /128 each |
2001:db8:a001:1::/64 to 2001:db8:a001:ff::/64 | one /64 reserved per point-to-point link, /127 configured |
2001:db8:a001:1000::/52 | building 1, summarizable |
2001:db8:a001:1110::/64 | building 1, floor 1, VLAN 10 |
2001:db8:a001:1120::/64 | building 1, floor 1, VLAN 20 |
2001:db8:a001:2000::/52 | building 2 |
2001:db8:a001:f000::/52 | data center |
VLAN 10 written as 10 in hex is really 16, but people read it as ten, which is the point.
Principles
- Nibble boundaries (/52, /56, /60, /64) keep prefixes readable and reverse DNS simple.
- Summarize by location so each building is one route in the core.
- Leave gaps: use 1, 2, 3 for buildings and keep the rest free.
- Do not embed IPv4 (
...:10:20:30:40). It ties the plans together and looks clever only until renumbering. - Gateways get
::1on each VLAN, or a fixed scheme you document. - Multi-site: a /48 per site from the organization's block (for example 2001:db8:a001::/48, 2001:db8:a002::/48) keeps sites summarizable.
They will ask next
How many /64s does that give each building?
A /52 holds 2^(64-52) = 4,096 /64s. With 16 possible zones that uses the whole /48, so keep spare zones unassigned.
PI or PA space?
Provider-independent space from the RIR if you multihome or want to change ISPs without renumbering. It costs a membership fee and you run BGP. PA space is free with the circuit but ties you to the provider.
Traps
- Using anything but /64 for LANs.
- Designing on non-nibble boundaries that nobody can read at a glance.