The ISP changes the prefix it delegates to your site. What happens to the hosts, and how do you design for it?
Show the answer
Say this first
The router starts advertising the new prefix, and hosts form new addresses at once. They keep the old ones until the old prefix's lifetimes run out, unless the router deprecates it by advertising it with a preferred lifetime of 0. A host cannot be forced to drop the old address fast: it ignores attempts to cut the valid lifetime below two hours. Design for it with stable PD from the ISP, provider-independent space for important sites, names instead of literal addresses in configs, and policies written against prefixes held in one place.
Go deeper
What hosts do
- Preferred lifetime 0 on the old prefix: addresses become deprecated, kept for open sessions, not used for new ones. This is the graceful way.
- The two-hour rule (RFC 4862): an RA cannot reduce the remaining valid lifetime below two hours, so a forged RA cannot wipe addresses instantly. The old address stays valid at least that long.
- If the CPE simply stops advertising the old prefix (a reboot that forgets it), hosts keep using it until its preferred lifetime runs out. Outbound traffic from it is dropped upstream and users see failures.
What breaks in the network
| Item | Problem |
|---|---|
| ACLs and firewall rules with literal addresses | stop matching |
| DNS AAAA records | point at old addresses |
| Static next hops with global addresses | dead |
| Monitoring targets | dead |
Designing for it
- Ask the ISP for a stable, persistent delegation.
- Use provider-independent space (and BGP) at sites that cannot tolerate renumbering.
- Use link-local next hops, general prefixes on IOS (
ipv6 address FROM-ISP ::1:0:0:0:1/64) and object groups. - Use shorter lifetimes on prefixes you expect to change.
- Consider ULA alongside the global prefix for internal-only services that must not move.
They will ask next
Why does the two-hour rule exist?
Without it, one forged RA with a valid lifetime of 0 would remove every host's address on the link. Unauthenticated RAs can only shorten the lifetime to two hours.
How does a general prefix help on IOS?
Interfaces reference a named prefix learned by DHCPv6-PD, so when the delegation changes, every interface built from it updates without touching the config.
Traps
- Assuming hosts drop the old address as soon as the new prefix appears.
- Hard-coding global addresses in ACLs at sites with PA space.