IPv6

The address problem

• 2^32 is about 4.3 billion, and a large part of that is reserved (multicast, private, loopback, class E).
• IANA allocated its last /8 blocks in February 2011. APNIC hit its final-block policy in 2011, RIPE NCC in 2012 and ARIN ran out in 2015. New IPv4 space now comes from the transfer market.

What the workarounds cost

• NAT and CGNAT need state on a box in the path, run out of ports, and force you to log every port block if you must trace a user later.
• Inbound connections, peer-to-peer, some VoIP and games need extra tricks (port forwarding, STUN, ALGs).
• Mergers collide: two companies both using 10.0.0.0/8 is a classic integration project.
• Cloud providers now charge for public IPv4 (AWS has billed every public IPv4 address since 2024).

What IPv6 changes

Where it stands

Mobile carriers run large IPv6-only networks with 464XLAT, and close to half of the users reaching Google do it over IPv6. Enterprises lag, mostly because IPv4 with NAT still works inside the building.

The pieces

2001:0db8:acad:0010:0000:0000:0000:0001/64
|-- global routing prefix --|subnet|----- interface ID -----|
     48 bits                 16 bits        64 bits

• Each hex digit is 4 bits (a nibble), so prefix lengths on multiples of 4 line up with digits. That is why address plans use /48, /52, /56, /60, /64.
• Letters are case-insensitive. Write them lowercase (RFC 5952). Cisco shows them uppercase anyway.
• There is no subnet mask. You always write the prefix length.

Where the notation bites

• URLs: wrap the address in brackets so the colons do not look like a port: http://[2001:db8::10]:8080/.
• Link-local: the same fe80:: address can exist on every interface, so hosts need a zone ID: ping fe80::1%eth0 on Linux, ping fe80::1%12 on Windows.
• IPv4 inside IPv6: the last 32 bits may be written dotted, as in ::ffff:192.0.2.1 or 64:ff9b::192.0.2.33.

Quick numbers

Worked example

2001:0db8:0000:0000:0000:ff00:0042:8329
2001:db8:0:0:0:ff00:42:8329      leading zeros removed
2001:db8::ff00:42:8329           longest zero run replaced with ::

Why :: only once

The reader rebuilds the address by counting the hextets that are written and filling the gap with zeros until there are eight. With two :: there is no way to know how many zeros go in each gap.

Expanding an address

Count the written hextets, then insert zeros for the rest.

2001:db8:0:a::b:0      6 hextets written, so :: stands for 2
2001:0db8:0000:000a:0000:0000:000b:0000

RFC 5952 canonical form

Any valid form is accepted as input. RFC 5952 defines the one form tools should print, so logs, configs and search results match:

• lowercase hex
• leading zeros removed
• :: on the longest run of two or more zero hextets, the first one on a tie
• no :: for a single 0 hextet: 2001:db8:0:1:1:1:1:1 stays as is

The main table

Special ranges worth knowing

Multiple addresses are normal

A typical laptop has a link-local, a stable global address, one or more temporary global addresses, and it has joined several multicast groups. Seeing five addresses on one interface is not a fault.

What replaced each broadcast use

The real saving

A solicited-node group is built from the last 24 bits of the address, so on a normal LAN only one or two hosts are in each group. The NIC is told which multicast MACs (33:33:ff:xx:xx:xx) to accept and drops the rest without bothering the operating system.

What does not change

A switch without MLD snooping still floods multicast to every port in the VLAN, the same way it floods a broadcast. The bandwidth on the wire is similar. The saving is in host CPU and in not waking up devices that do not care.

What uses link-local

• NDP: RS, RA, NS, NA and redirects are sourced from link-local addresses.
• Default gateway: a host's default route points at the router's link-local address, learned from the RA.
• Routing protocols: OSPFv3, EIGRP for IPv6 and RIPng form neighbors over link-local and install link-local next hops. BGP can too, though it usually peers on global addresses.
• DHCPv6: clients send from their link-local address.

Why next hops are link-local

The link-local stays the same when the global prefix is renumbered, so the routing table does not churn.

The zone ID

Every interface has an fe80:: address, so the destination alone does not say which link to use. Hosts need a zone: fe80::1%eth0 on Linux, fe80::1%12 on Windows. Routers need an exit interface for the same reason.

On Cisco

interface GigabitEthernet0/0/0
 ipv6 enable                         ! link-local only, built with EUI-64
 ipv6 address fe80::1 link-local     ! or set an easy one by hand

Setting fe80::1 on every router interface is common. It is unique per link, which is all it needs to be.

Step by step

MAC                  00:1a:2b | 3c:4d:5e
Insert fffe          00:1a:2b:ff:fe:3c:4d:5e
First byte 00        0000 0000
Flip the 7th bit     0000 0010  = 02
Interface ID         021a:2bff:fe3c:4d5e
Address              2001:db8:acad:10:21a:2bff:fe3c:4d5e

A second one you meet in labs

Lab routers often have MACs like aabb.cc00.0100.

aa = 1010 1010   flip   1010 1000 = a8
Interface ID   a8bb:ccff:fe00:0100
Link-local     fe80::a8bb:ccff:fe00:100

Flipping fast

Only the second hex digit changes: 0 and 2 swap, 1 and 3, 4 and 6, 5 and 7, 8 and a, 9 and b, c and e, d and f. So 02:50:56:aa:bb:cc gives 0050:56ff:feaa:bbcc: the bit goes from 1 to 0.

Why flip at all

In a MAC, the bit set to 0 means "universally administered". IPv6 inverts it so that 1 means universal. That way hand-made interface IDs such as ::1 carry a 0 and are correctly marked local.

On Cisco

interface GigabitEthernet0/0/0
 ipv6 address 2001:db8:acad:10::/64 eui-64

IOS also builds link-local addresses with EUI-64 unless you set one by hand.

Why hosts moved away from it

An EUI-64 address carries the MAC, so a laptop can be tracked across every network it joins. Windows uses random interface IDs, and many Linux and Apple systems use stable but opaque IDs (RFC 7217) plus temporary addresses. Routers and servers often still use EUI-64 or static IDs.

The usual sizes

Why not smaller LANs

A /120 on a LAN breaks SLAAC, and some devices and features assume /64. IPv6 does not need you to save addresses. It needs you to have enough subnets.

Why /127 on links

• NDP exhaustion: on a /64 link, a scan of nonexistent addresses makes the router create an incomplete neighbor entry for each one. A /127 has two addresses, nothing to scan.
• Looping: on point-to-point links, old implementations bounced packets for unused addresses back and forth until the hop limit ran out.
• The old worry, that one of the two addresses is the subnet-router anycast address, is handled by RFC 6164: routers do not use that anycast address on a /127.

Many teams reserve a whole /64 per link and configure the /127 from its start. The plan stays tidy and you can change your mind later.

The five messages

Useful details

• Hop limit 255. Every NDP message is sent with hop limit 255 and receivers drop any with less. A packet that crossed a router would have 254 or lower, so this proves the sender is on the link.
• NA flags. R says the sender is a router, S says the NA answers a solicitation, O says "override your cached MAC for me".
• Options. Source and target link-layer address, Prefix Information, MTU, Route Information, and RDNSS for DNS servers (RFC 8106).

Why this matters for filtering

NDP is ICMPv6. An ACL or firewall that drops all ICMPv6 drops address resolution with it and the link stops working. Cisco IPv6 ACLs carry implicit permits for NS and NA for this reason.

The packet

NS  src ::                           (no address yet)
    dst ff02::1:ff3c:4d5e            (solicited-node of the tentative address)
    target 2001:db8:acad:10:21a:2bff:fe3c:4d5e

Using :: as source means nobody caches a mapping for an address that may turn out to be someone else's.

Timing and knobs

• One NS by default (DupAddrDetectTransmits = 1), then wait RetransTimer, 1 second.
• IOS: ipv6 nd dad attempts 1 is the default; 0 disables DAD on the interface.
• Optimistic DAD (RFC 4429) lets a host use the address while DAD runs, with restrictions, to save time.
• Anycast addresses skip DAD.

When it fails on a router

IOS logs %IPV6_ND-4-DUPLICATE and marks the address [DUP] in show ipv6 interface. The address is not used. If the duplicate is a link-local built from the hardware address, RFC 4862 says IPv6 on that interface should be disabled, because the MAC itself is probably duplicated.

Common real causes

• Two routers configured with the same static address, or the same fe80::1 on one link.
• Copy-pasted VM templates with static addresses.
• A looped port, where the node hears its own NS. RFC 7527 adds a nonce so a node can recognize its own message.

The sequence

1. Interface comes up. The host builds fe80:: plus an interface ID and runs DAD.
2. Host sends an RS from its link-local address to ff02::2, instead of waiting for the next periodic RA.
3. Router answers with an RA. It contains:
   • flags M and O (whether to use DHCPv6)
   • router lifetime (non-zero means "use me as a default router")
   • Prefix Information Options: prefix, L (on-link) flag, A (autonomous) flag, valid and preferred lifetimes
   • optionally MTU and RDNSS (DNS servers)
4. For each /64 prefix with A=1, the host appends an interface ID: EUI-64, a stable opaque ID (RFC 7217) or a random one, plus temporary addresses if privacy extensions are on.
5. DAD for each new address.
6. Default route via the RA's source link-local address.

Lifetimes

• Preferred lifetime: while it runs, the address is used for new connections. After it, the address is deprecated, still valid for existing sessions.
• Valid lifetime: after it the address is removed.
• IOS defaults: valid 2,592,000 s (30 days), preferred 604,800 s (7 days). RAs every 200 s, router lifetime 1800 s.

Router side on Cisco

ipv6 unicast-routing
interface GigabitEthernet0/0/0
 ipv6 address 2001:db8:acad:10::1/64

That is enough. With ipv6 unicast-routing on, the interface sends RAs for its /64 with A=1.

Message flow

Identity

Clients identify themselves with a DUID (DHCP Unique Identifier) and an IAID per interface, not with a MAC. That makes MAC-based reservations awkward. RFC 6939 lets the first relay add the client's link-layer address for this reason.

Stateful on IOS

ipv6 dhcp pool LAN20
 address prefix 2001:db8:acad:20::/64
 dns-server 2001:db8:acad:100::53
 domain-name corp.example.com
!
interface GigabitEthernet0/0/1
 ipv6 address 2001:db8:acad:20::1/64
 ipv6 nd managed-config-flag
 ipv6 nd prefix default no-autoconfig
 ipv6 dhcp server LAN20

Stateless on IOS

ipv6 dhcp pool LAN10-INFO
 dns-server 2001:db8:acad:100::53
 domain-name corp.example.com
!
interface GigabitEthernet0/0/0
 ipv6 address 2001:db8:acad:10::1/64
 ipv6 nd other-config-flag
 ipv6 dhcp server LAN10-INFO

Choosing

Stateful gives you a lease table for audits and IPAM, but Android will not use it. Stateless with SLAAC works on every client; you then map addresses to devices from NDP tables or switch device tracking.

The fields

What changed and why

Consequences

• The UDP checksum, optional in IPv4, is mandatory in IPv6 (tunnel protocols have a narrow exception).
• Payloads above 65,535 bytes need the Jumbo Payload option in a Hop-by-Hop header. Almost nothing uses it.

On Cisco

ipv6 unicast-routing
!
interface GigabitEthernet0/0/0
 ip address 10.10.10.1 255.255.255.0
 ipv6 address 2001:db8:acad:10::1/64
 ipv6 address fe80::1 link-local

Without ipv6 unicast-routing the router will not forward IPv6 or send RAs.

How hosts choose

• RFC 6724 orders destinations; native IPv6 beats IPv4 by default.
• Happy Eyeballs v2 starts the IPv6 attempt, waits about 250 ms, then starts IPv4 in parallel and keeps whichever connects first.

Problems that come up

Order of rollout

Core and routing first, then security policy and monitoring, then server and DNS, then users. Publishing AAAA records is the last step, not the first.

Compress these

Spot the invalid ones

How I check out loud

"I count the hextets. If :: is there, it fills the gap up to eight. Then I check each group is at most four hex digits." Saying the method shows the interviewer you are not guessing.

Format

| 8 bits | 4 bits | 4 bits |       112 bits      |
|  ff    | flags  | scope  |      group ID       |

Flags: T=0 means a permanent, well-known group; T=1 a transient one. The P and R flags mark prefix-based and embedded-RP addresses used in multicast routing.

Groups worth knowing by heart

MAC mapping

33:33 followed by the last 32 bits of the group. ff02::1 becomes 33:33:00:00:00:01, and ff02::1:ff3c:4d5e becomes 33:33:ff:3c:4d:5e. Only 32 of the 112 group bits make it into the MAC, so several groups can share one MAC. The NIC lets them all in and the IP stack does the final check.

Derivation step by step

Unicast:         2001:db8:acad:10:21a:2bff:fe3c:4d5e
Last 24 bits:                              3c:4d5e
Prefix:          ff02::1:ff00:0/104
Group:           ff02::1:ff3c:4d5e
Ethernet MAC:    33:33:ff:3c:4d:5e

More examples

Write every hextet out to four digits before you take the last 24 bits. fe00:100 is fe00:0100, so the last 24 bits are 00:0100.

Why it exists

• Address resolution: to find the MAC of 2001:db8:acad:10::20, a host sends an NS to ff02::1:ff00:20. Only nodes whose addresses end in 00:0020 have joined that group.
• DAD: a node checks its tentative address by sending an NS to the same group.

On a router

show ipv6 interface lists the groups under "Joined group address(es)". A router with fe80::1 and 2001:db8:acad:10::1 shows a single FF02::1:FF00:1, because both addresses share the last 24 bits.

How it works

Several nodes advertise or are configured with the same address. Routing protocols pick the best path, so each client reaches the closest one by metric. That is how DNS resolvers, root servers and CDNs spread load and survive site failures, in IPv4 and IPv6 alike.

On Cisco

interface Loopback53
 ipv6 address 2001:db8:acad:ff::53/128 anycast

The anycast keyword tells IOS to skip DAD for this address. The loopback is then redistributed or advertised from every site that hosts the service.

Subnet-router anycast

RFC 4291 reserves the address with the interface ID all zeros on every subnet, and routers must answer to it. It is rarely used directly, but it explains two things:

• Why you should not assign prefix:: to a host on a /64.
• Why /127 links were once discouraged: one of the two addresses is the subnet-router anycast address. RFC 6164 settles it by saying routers do not use subnet-router anycast on /127 links.

What anycast is not

The "anycast gateway" in data center fabrics is a different idea: the same gateway IP and MAC on every leaf switch, each serving its own locally attached hosts.

The exchange

PC1 2001:db8:acad:10::10   wants   PC2 2001:db8:acad:10::20

NS  src 2001:db8:acad:10::10  dst ff02::1:ff00:20
    target 2001:db8:acad:10::20, source link-layer option = PC1's MAC
NA  src 2001:db8:acad:10::20  dst 2001:db8:acad:10::10
    flags S=1 O=1, target link-layer option = PC2's MAC

PC2 also learns PC1's MAC from the NS, so it can answer without asking back.

Neighbor cache states

Neighbor Unreachability Detection

Reachability is confirmed two ways: an NA in reply to a unicast NS, or a hint from the upper layer, such as TCP seeing its data acknowledged. The DELAY state exists to give TCP that chance before sending a probe.

What you see

R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:ACAD:10::20                        0 0050.56aa.bb20  REACH Gi0/0/0
FE80::250:56FF:FEAA:BB20                    3 0050.56aa.bb20  STALE Gi0/0/0

$ ip -6 neigh show dev eth0
fe80::1 lladdr a0:b4:3c:11:0a:01 router STALE
2001:db8:acad:10::20 lladdr 00:50:56:aa:bb:20 REACHABLE

The combinations

With M=1, O does not matter: the stateful exchange returns options as well.

Things that catch people

• DHCPv6 has no gateway option. Even a fully managed network needs RAs with a non-zero router lifetime.
• DHCPv6 gives no prefix length. Clients install the leased address as a /128. They learn which prefix is on-link from the RA's Prefix Information Option with L=1. Without it, a host sends traffic for its own subnet through the router.
• Android does not implement DHCPv6 address assignment. On an M=1, A=0 network Android devices get only a link-local address.
• Windows starts DHCPv6 when M or O is set. Linux depends on the network manager in use.

Setting the flags on IOS

interface GigabitEthernet0/0/0
 ipv6 nd managed-config-flag          ! M=1
 ipv6 nd other-config-flag            ! O=1
 ipv6 nd prefix default no-autoconfig ! A=0 for the prefixes on this interface

show ipv6 interface confirms with lines like "Hosts use DHCP to obtain routable addresses."

What the host stores

• Default router list: each router's link-local address and lifetime.
• The router lifetime in the RA, 1800 s by default on IOS, sets how long the entry lives without a new RA.
• A router lifetime of 0 means "I am not a default router", even though the RA can still carry prefixes.

Controls on IOS

interface GigabitEthernet0/0/0
 ipv6 nd router-preference high   ! RFC 4191, default is medium
 ipv6 nd ra lifetime 0            ! advertise prefixes but never be the gateway

Failover without an FHRP

A host only notices a dead router through NUD: the entry must leave REACHABLE (up to 45 s), then DELAY (5 s) and PROBE (3 s). Expect tens of seconds. For faster failover use HSRPv2 for IPv6 or VRRPv3, which give a virtual link-local address that moves between routers.

Servers and routers as hosts

• Static: ip -6 route add default via fe80::1 dev eth0 on Linux. A link-local next hop always needs the device.
• Linux ignores RAs when forwarding is on unless accept_ra is set to 2.

Relay

interface GigabitEthernet0/0/1
 ipv6 address 2001:db8:acad:20::1/64
 ipv6 nd managed-config-flag
 ipv6 nd prefix default no-autoconfig
 ipv6 dhcp relay destination 2001:db8:acad:100::10

• Relay-Forward carries the link-address (a global address of the client's link), the peer-address (the client's link-local), and often an Interface-ID option.
• The server answers with Relay-Reply. The relay unwraps it and sends the Reply to the client.
• You still set the RA flags on the relay interface. Without M=1 clients never start DHCPv6.

Prefix delegation

ISP router (delegating)  --->  CPE (requesting router)
IA_PD: 2001:db8:5600::/56       LAN1 2001:db8:5600:1::/64
                                LAN2 2001:db8:5600:2::/64

On an IOS CPE:

interface GigabitEthernet0/0/1
 description WAN to ISP
 ipv6 address autoconfig default
 ipv6 dhcp client pd FROM-ISP
!
interface GigabitEthernet0/0/0
 ipv6 address FROM-ISP ::1:0:0:0:1/64

FROM-ISP is a general prefix name. The LAN gets 2001:db8:5600:1::1/64 and follows automatically if the ISP changes the delegated prefix.

The return route

Something upstream must route the delegated /56 to the CPE. Broadband gear and many relays install that route when they see the delegation. If nothing does, the CPE gets its prefix and nothing comes back.

Two problems, two fixes

Defaults today

• Windows, macOS, iOS and Android create temporary addresses and use them for outgoing traffic.
• Linux: net.ipv6.conf.<if>.use_tempaddr (0 off, 1 create, 2 create and prefer) and addr_gen_mode for stable-privacy IDs. Desktop distributions usually turn both on through NetworkManager.
• Source address selection (RFC 6724, rule 7) prefers temporary addresses.

What changes for the network team

• Logging: the address in a firewall log may be gone tomorrow. Keep a history of NDP caches, or use switch device tracking (SISF on Cisco), to map address to MAC and port at any time.
• ACLs: write policies per /64 or per identity (802.1X, user-ID on the firewall), not per host address.
• Neighbor tables: more addresses per host means bigger NDP caches on gateways.
• Servers: give them static or stable addresses and turn temporary addresses off.

Why rogue RAs hurt

A laptop sharing its connection or a home router plugged in backwards sends RAs. Hosts add its link-local address as another default router and may build addresses from its prefix. Traffic either black-holes or goes through the attacker.

RA Guard on Cisco IOS-XE

ipv6 nd raguard policy HOSTS
 device-role host
!
ipv6 nd raguard policy UPLINK
 device-role router
!
interface range GigabitEthernet1/0/1 - 46
 ipv6 nd raguard attach-policy HOSTS
interface GigabitEthernet1/0/48
 ipv6 nd raguard attach-policy UPLINK

DHCPv6 Guard

ipv6 dhcp guard policy CLIENTS
 device-role client
!
interface range GigabitEthernet1/0/1 - 46
 ipv6 dhcp guard attach-policy CLIENTS

The rest

Evasion

Attackers hid RAs behind extension headers or fragments so the switch could not see the ICMPv6 type. RFC 7113 says RA Guard must parse the whole header chain and drop what it cannot parse, and RFC 7112 requires the whole chain in the first fragment. On Cisco a port ACL with deny ipv6 any any undetermined-transport closes the gap on older code.

Messages

Mapping to IGMP

How it plays out

• A router on the link acts as querier; the one with the lowest IPv6 address wins.
• Hosts answer queries with reports for every group they want, including their solicited-node groups.
• The Router Alert option in a Hop-by-Hop header makes routers look at reports for groups they are not members of.

On switches

MLD snooping lets a switch forward each group only to ports that asked for it. Like IGMP snooping it needs a querier on the VLAN to keep its state fresh. Enable snooping and a querier together, or leave both off.

The chain

IPv6 header    Next Header = 0   (Hop-by-Hop)
Hop-by-Hop     Next Header = 44  (Fragment)
Fragment       Next Header = 6   (TCP)
TCP segment

The headers

Recommended order (RFC 8200)

1. IPv6 header
2. Hop-by-Hop Options (must come first if present)
3. Destination Options (for the hops in the Routing header)
4. Routing
5. Fragment
6. AH
7. ESP
8. Destination Options (for the final destination)
9. Upper layer (TCP, UDP, ICMPv6)

Each appears at most once, except Destination Options, which may appear twice.

Routing header types

• Type 0: source routing through a list of hops. Deprecated by RFC 5095 because a packet could bounce between two hosts many times and amplify traffic.
• Type 2: Mobile IPv6.
• Type 4: the Segment Routing Header used by SRv6 (RFC 8754).

The Fragment header (8 bytes)

The Identification field is 32 bits, against 16 in IPv4, so it wraps much more slowly.

Rules worth quoting

• Minimum link MTU is 1280 bytes. A host that never wants to think about PMTUD can send 1280-byte packets.
• Path MTU Discovery is RFC 8201. Packet Too Big messages are sent even in reply to multicast.
• Overlapping fragments must be dropped (RFC 5722).
• The first fragment must hold the whole header chain up to the upper layer (RFC 7112).
• Atomic fragments (a Fragment header on an unfragmented packet) are deprecated (RFC 8021).

Where it hurts

• PMTUD black holes: a firewall drops Packet Too Big, the source keeps sending full-size packets, and the session hangs after the handshake.
• Tunnels: a 6in4 tunnel over a 1500-byte IPv4 path carries 1480 bytes of IPv6; GRE carries 1476.
• Large UDP: DNS answers that need fragments are often dropped. DNS Flag Day 2020 recommended an EDNS buffer of 1232 bytes, which is 1280 minus the 40-byte IPv6 and 8-byte UDP headers.

Mitigations

interface Tunnel0
 ipv6 mtu 1400
 ipv6 tcp adjust-mss 1340

MSS clamping hides the problem for TCP. Letting Packet Too Big through fixes it for everything.

What to allow (RFC 4890, simplified)

The Cisco ACL trap

Every IPv6 ACL on IOS ends with three implicit lines:

permit icmp any any nd-na
permit icmp any any nd-ns
deny ipv6 any any

If you write your own deny ipv6 any any log at the end, it matches before the implicit permits and kills neighbor discovery on that interface. Add the NS and NA permits above your deny.

An edge ACL that respects ICMPv6

ipv6 access-list EDGE-IN
 permit icmp any any destination-unreachable
 permit icmp any any packet-too-big
 permit icmp any any time-exceeded
 permit icmp any any parameter-problem
 permit icmp any any echo-request
 permit icmp any any echo-reply
 permit icmp any any nd-ns
 permit icmp any any nd-na
 permit tcp any 2001:db8:acad:100::/64 eq 443
 deny ipv6 any any log

The options

6in4 on IOS

interface Tunnel0
 description 6in4 to ISP1
 no ip address
 ipv6 address 2001:db8:ffff:100::2/64
 tunnel source GigabitEthernet0/0/1
 tunnel destination 203.0.113.9
 tunnel mode ipv6ip
!
ipv6 route ::/0 Tunnel0

The IPv6 MTU over a 1500-byte IPv4 path is 1480. For GRE (tunnel mode gre ip) it is 1476.

Things that go wrong

• NAT in the path: protocol 41 has no ports, so PAT cannot track it. 6in4 through a home router's NAT usually fails; Teredo exists for that case.
• Firewalls: protocol 41 and UDP 3544 tunnels can carry IPv6 straight past IPv4-only policy. Block them at the edge unless you use them.
• MTU: Packet Too Big messages from the tunnel ingress must reach the sender.

Side by side

New LSAs

Separating topology from prefixes means a prefix change does not force a full SPF run.

Config on IOS-XE

ipv6 unicast-routing
!
router ospfv3 1
 router-id 1.1.1.1
 address-family ipv6 unicast
  passive-interface GigabitEthernet0/0/0
 exit-address-family
!
interface GigabitEthernet0/0/1
 ospfv3 1 ipv6 area 0

The older form ipv6 router ospf 1 with ipv6 ospf 1 area 0 on the interface still works.

The three forms

! fully specified, link-local next hop
ipv6 route 2001:db8:acad:20::/64 GigabitEthernet0/0/1 fe80::2
! recursive, global next hop
ipv6 route 2001:db8:acad:20::/64 2001:db8:acad:ff::2
! interface only
ipv6 route 2001:db8:acad:20::/64 GigabitEthernet0/0/1

The interface-only trap

On Ethernet, an interface-only route makes the router treat every destination as on-link and send a Neighbor Solicitation for each one. The next router does not answer for addresses that are not its own, so the route fails. IPv4 often hides this mistake with proxy ARP; IPv6 does not. Use interface-only routes only on point-to-point interfaces like tunnels.

Floating static

ipv6 route ::/0 GigabitEthernet0/0/1 fe80::2
ipv6 route ::/0 GigabitEthernet0/0/2 fe80::3 200

The second route has administrative distance 200 and only installs when the first goes away.

Make next hops readable

Set link-local addresses by hand on router links (ipv6 address fe80::1 link-local, fe80::2 on the other end) so routes and neighbor tables are easy to read and do not change when a line card is swapped.

Other platforms

set routing-options rib inet6.0 static route 2001:db8:acad:20::/64 qualified-next-hop fe80::2 interface ge-0/0/1.0

ip -6 route add 2001:db8:acad:20::/64 via fe80::2 dev eth1

Why people ask

They want what RFC 1918 gave them: addresses that do not change when they change ISP, and a feeling of being hidden.

Better answers to the real needs

The address selection trap

RFC 6724's default policy table gives fc00::/7 a precedence of 3 and IPv4 (::ffff:0:0/96) 35. If a name has both an A record and a ULA AAAA record, hosts try IPv4 first. For internet destinations, a host with only a ULA source sees a label mismatch with the global destination and also prefers IPv4. So a ULA plus NAT66 design can be "deployed" and carry almost no traffic.

If you do use ULA

• Generate the 40-bit global ID randomly. fd00::/48 is what everyone types and will collide in a merger.
• Never advertise it to the internet, and filter fc00::/7 at the edge in both directions.
• Expect to tune the policy table (/etc/gai.conf on Linux, netsh interface ipv6 show prefixpolicies on Windows) if you need hosts to prefer it.

Myths

• IPsec: support was once a MUST for nodes, never use. It is a SHOULD now.
• Unscannable: a /64 is too big to sweep blindly, but addresses leak. Low numbers (::1, ::10), EUI-64 with a known vendor OUI, DNS records, and NDP caches on a compromised host all narrow the search.

New or changed attacks

The quiet one: IPv6 on an IPv4-only network

Windows prefers IPv6 and asks for DHCPv6 even when the network team never deployed IPv6. Tools such as mitm6 answer those requests, make themselves the DNS server and redirect traffic. Either deploy IPv6 properly with FHS, or block RAs and DHCPv6 server messages on access ports. Do not just hope it is unused.

Parity checklist

• Every IPv4 ACL and firewall rule has an IPv6 twin.
• Logging, NetFlow and IDS see IPv6.
• Management plane access lists cover IPv6 (VTY, SNMP, NTP).

Source address rules, in order

1. Prefer the same address as the destination.
2. Prefer the appropriate scope (link-local for link-local destinations, global for global).
3. Avoid deprecated addresses (preferred lifetime expired).
4. Prefer home addresses (Mobile IPv6).
5. Prefer addresses on the outgoing interface.
6. Prefer a matching label in the policy table.
7. Prefer temporary addresses.
8. Use the longest matching prefix.

Default policy table

Destination ordering

With several AAAA and A records, rules such as "prefer matching label" and "prefer higher precedence" put native IPv6 above IPv4, and IPv4 above Teredo, 6to4 and ULA. Happy Eyeballs then races the attempts so a broken path costs only a short delay.

Where to change it

• Linux (glibc): /etc/gai.conf.
• Windows: netsh interface ipv6 show prefixpolicies, and set prefixpolicy to change it.

Why routers struggle

• Parse depth. Line cards look at a fixed window of the packet. If the transport header is beyond it, the ACL sees "unknown" and has to pick between dropping and permitting blind.
• Hop-by-Hop. Processing options means the slow path. RFC 8200 now lets routers ignore Hop-by-Hop unless configured to process it, but older gear punts it.
• Fragments. Non-first fragments carry no port numbers at all.

What this means for a filter

On Cisco IOS a port or interface ACL entry deny ipv6 any any undetermined-transport drops packets whose upper-layer protocol cannot be determined.

Design consequences

• New protocols that rely on extension headers (SRv6, some in-band telemetry) work inside one operator's network, not reliably across the internet.
• Security devices must parse the full chain or fail closed.

The flow

1. Client asks DNS64 for AAAA of app.example.com
2. DNS64 finds no AAAA, finds A 192.0.2.33
3. DNS64 returns AAAA 64:ff9b::c000:221   (192.0.2.33 = c000:0221)
4. Client opens TCP to [64:ff9b::c000:221]:443
5. NAT64 translates to 198.51.100.7:40001 -> 192.0.2.33:443 and keeps the mapping

198.51.100.7 is the NAT64's IPv4 pool address.

What breaks

464XLAT (RFC 6877)

The client runs a CLAT: a local stateless translator that gives apps a private IPv4 address and turns their IPv4 packets into IPv6 toward the NAT64 (called the PLAT here). IPv4 literals and IPv4-only apps work again. Android has shipped a CLAT for years, and mobile carriers use this to run IPv6-only networks.

Finding the prefix

Clients can discover the NAT64 prefix by looking up ipv4only.arpa (RFC 7050) or from the PREF64 option in RAs. Operators may use their own network-specific prefix instead of 64:ff9b::/96.

Example: site prefix 2001:db8:a001::/48

The subnet ID is the fourth hextet, four hex digits: Z B V V.

VLAN 10 written as 10 in hex is really 16, but people read it as ten, which is the point.

Principles

• Nibble boundaries (/52, /56, /60, /64) keep prefixes readable and reverse DNS simple.
• Summarize by location so each building is one route in the core.
• Leave gaps: use 1, 2, 3 for buildings and keep the rest free.
• Do not embed IPv4 (...:10:20:30:40). It ties the plans together and looks clever only until renumbering.
• Gateways get ::1 on each VLAN, or a fixed scheme you document.
• Multi-site: a /48 per site from the organization's block (for example 2001:db8:a001::/48, 2001:db8:a002::/48) keeps sites summarizable.

What hosts do

• Preferred lifetime 0 on the old prefix: addresses become deprecated, kept for open sessions, not used for new ones. This is the graceful way.
• The two-hour rule (RFC 4862): an RA cannot reduce the remaining valid lifetime below two hours, so a forged RA cannot wipe addresses instantly. The old address stays valid at least that long.
• If the CPE simply stops advertising the old prefix (a reboot that forgets it), hosts keep using it until its preferred lifetime runs out. Outbound traffic from it is dropped upstream and users see failures.

What breaks in the network

Designing for it

• Ask the ISP for a stable, persistent delegation.
• Use provider-independent space (and BGP) at sites that cannot tolerate renumbering.
• Use link-local next hops, general prefixes on IOS (ipv6 address FROM-ISP ::1:0:0:0:1/64) and object groups.
• Use shorter lifetimes on prefixes you expect to change.
• Consider ULA alongside the global prefix for internal-only services that must not move.