What is dual stack, and what problems do you hit running it?
Show the answer
Say this first
Dual stack means every interface, host and service runs IPv4 and IPv6 side by side, each with its own addresses, routing and policy. It is the standard way to deploy IPv6. Hosts prefer IPv6 when a name has both A and AAAA records, and Happy Eyeballs (RFC 8305) races the two so a broken IPv6 path costs a fraction of a second instead of a long timeout. The usual problems are security policy that exists only for IPv4, partly broken IPv6 paths, and twice the things to monitor.
Go deeper
On Cisco
ipv6 unicast-routing
!
interface GigabitEthernet0/0/0
ip address 10.10.10.1 255.255.255.0
ipv6 address 2001:db8:acad:10::1/64
ipv6 address fe80::1 link-localWithout ipv6 unicast-routing the router will not forward IPv6 or send RAs.
How hosts choose
- RFC 6724 orders destinations; native IPv6 beats IPv4 by default.
- Happy Eyeballs v2 starts the IPv6 attempt, waits about 250 ms, then starts IPv4 in parallel and keeps whichever connects first.
Problems that come up
| Problem | Effect |
|---|---|
| Firewall rules only for IPv4 | IPv6 wide open, or IPv6 blocked and apps fall back slowly |
| IPv6 path broken (rogue RA, PMTUD, missing route) | slow page loads, some sites fail |
| Monitoring and logs only for IPv4 | half of the traffic invisible |
| DNS AAAA records published before the service listens on IPv6 | clients try IPv6 first and wait |
| Two routing tables, two sets of ACLs | more config and more mistakes |
Order of rollout
Core and routing first, then security policy and monitoring, then server and DNS, then users. Publishing AAAA records is the last step, not the first.
They will ask next
How do you test whether a client really uses IPv6?
Check it has a global address and a default route (
ip -6 addr,ip -6 route), thencurl -6to a known dual-stack site andcurl -4for comparison. Packet captures settle any doubt.What is the alternative to dual stack?
IPv6-only with translation for the remaining IPv4: NAT64 and DNS64 in the network, 464XLAT on clients. Mobile carriers and some large enterprises already run it.
Traps
- Forgetting to give IPv6 the same firewall policy as IPv4.
- Publishing AAAA records for services that do not answer on IPv6.