manual ipv6 address assignment

Stack Exchange Network

Stack Exchange network consists of 183 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

How do I assign IPv6 addresses manually?

So I'm still rather clueless with IPv6, but I wanted to try something with my network today. Currently, I assign IPv4 LAN addresses manually, so that my router is 192.168.0.1 , then my first computer is 192.168.0.2 , and so on.

So far, I haven't been able to figure out how to do this with IPv6. Or is the process completely different that this is not how it would work?

Router is an Archer C4000, and my main system runs Ubuntu 19.04

EDIT: To clarify with how I manually set network IP addresses, my router has a page where I can set an address of my choosing to a MAC address. No configuration is done outside of the router.

• Please edit question and indicate how you assign LAN addesses manually. (On the router only? On your first computer as well?) I suspect you just set a network range on the router, and then addresses are not assigned "manually", but by DHCP from the router. On IPv6 then your router needs to advertise a subnet. On Ubuntu, you can set both IPv4 and IPv6 address manually with ip addr add ... . –  dirkt Sep 10, 2019 at 11:22
• Edited. I'm going to guess then that it is assigned from a range, but then I limit what can be assigned based on MAC addresses. If I'm setting the IP address manually on each device, is there any further configuration that needs to be done (apart from avoiding duplicates), or will the router just accept that device A is going to use its own configured address? –  hiigaran Sep 10, 2019 at 12:00
• If there's a page where you can assign an IPv4 address based on a MAC address, then this is for static addresses assigned via DHCP from the router. IPv6 works differently. While there is DHCPv6, the normal way is to use SLAAC , and let each computer pick an IPv6 address based on the announced subnet prefix.So this page won't help you to assign IPv6 addresses... –  dirkt Sep 10, 2019 at 12:05

2 Answers 2

To clarify with how I manually set network IP addresses, my router has a page where I can set an address of my choosing to a MAC address. No configuration is done outside of the router

This usually isn't called "manual configuration" to avoid confusion (from the LAN hosts' point of view, it is still automatic configuration). The usual terms are "static DHCP lease" or "DHCP reservation".

Overall, the process in IPv6 is usually completely different.

In IPv6 primary address auto-configuration mechanism (SLAAC) is completely stateless: the router does not issue individual addresses; it only periodically advertises the subnet address prefix and each host just combines it with its own chosen suffix. The router cannot limit hosts to just a specific sub-range; in fact the router does not receive any feedback about hosts' chosen address at all.

(Depending on each device's OS, the suffix might be a MAC address in traditional RFC4862 SLAAC; it might be a static hash value in RFC7217; it might be completely random in RFC4941 "Privacy Extensions"; and it might even be a user-provided value if the OS allows that.)

For example, the router advertises 2001:db8:123:456::/64 as the LAN address prefix; client A combines it with its own MAC address and begins using 2001:db8:123:456:6af2:68fe:ff7c:e25c .

That said, DHCP does exist in the IPv6 world and handles address leases in much the same way as IPv4 DHCP does. That means you can create DHCPv6 address pools, you can configure static address leases in DHCPv6, and so on. But not all clients support DHCPv6 at all (e.g. Android does not), so having SLAAC alongside is almost unavoidable.

So if you have a DHCPv6-capable client on a DHCPv6-capable network, chances are it'll have both a nice DHCPv6-assigned address and a longer SLAAC-autoconfigured address.

If I'm setting the IP address manually on each device, is there any further configuration that needs to be done (apart from avoiding duplicates), or will the router just accept that device A is going to use its own configured address?

As you can see above, that's how IPv6 address configuration works anyway .

Your router's manual is found in User Guide and contains for IPv6 only an option for entering a static IPv6 address for the router itself (as received from the ISP).

The section about specifying the IP addresses that the router assigns by MAC address does not say whether they are IPv4 or IPv6, but I think it is highly unlikely that this will work for IPv6. And here is why.

IPv6 is quite unlike IPv4 in the sense that the long IPv6 address is made up of two parts. The first (the prefix) is assigned by the ISP. The second is assigned locally by the router or by each computer and is usually a random value based on the MAC address.

This means that the router does not control the IPv6 prefix which the ISP can change whenever it likes. You can force your computer to use a static IPv6 address, but only if it agrees with the ISP. You may be able to ask the ISP for a static IPv6 address, but that is a bad idea.

The reason it's a bad idea, is that all your devices are visible to the entire Internet by their IPv6 address (unless the router intervenes). Therefore having a fixed IPv6 address just makes tracking you that much easier.

If you wish, you would in Windows set a computer's static IPv6 inside Start > Network > Network and Sharing Center > Change Adapter Setting , right-click on the Ethernet connection IPv6 and choose Properties, right-click "Internet Protocol Version 6 (TCP/IPv6)" and click on Properties, the set "Use the following IPv6 address".

But the fact you can does not mean you should. The only place that static IPv6 addresses makes sense is inside a local network which is not connected to the Internet.

• What about if I wanted to run a web server? I'm constantly traveling for work, and I would love to have access to one of the computers at home which runs 24/7. I'd need to set a static IPv6 for this to work, wouldn't I? –  hiigaran Sep 10, 2019 at 19:23
• A general solution would require an IPv6 dynamic DNS provider. See for that the article dynv6.com: IPv6 dynamic DNS done right . –  harrymc Sep 10, 2019 at 19:29
• @harrymc Help me understand your logic, why would a server in a data center have a static IP but a server at home a dynamic one? In what world does that make any sense? –  Chazy Chaz Jul 29, 2022 at 12:40
• In a world where the ISP attributes to users dynamic IP addresses. –  harrymc Jul 29, 2022 at 12:51

You must log in to answer this question.

Not the answer you're looking for browse other questions tagged networking router ipv6 ..

• The Overflow Blog
• How do mixture-of-experts layers affect transformer models?
• What a year building AI has taught Stack Overflow
• Featured on Meta
• New Focus Styles & Updated Styling for Button Groups
• Upcoming initiatives on Stack Overflow and across the Stack Exchange network
• Google Cloud will be Sponsoring Super User SE

Hot Network Questions

• another Tic-Tac-Toe Game
• How can I make a custom header in less? Or alternatively, how can I open two files simultaneously in less?
• Sampling with specified covariance matrix and distribution
• Is Central Limit Theorem about multiple samples or just one?
• Any practical use for the underscore variable?
• An algebra student wants to learn to type commutative diagrams on LaTeX?
• Hydrogen bonding autocorrelations
• Difference between deviation of ray and wavefront
• Homotopy equivalent but non-homeomorphic high-dimensional manifolds
• USB-C Splitter for external SSD enclosure
• A small board-puzzle
• What are examples of "Official Observations" in a passport?
• Is it possible to have a stable black hole that does not evaporate?
• Nothingness: What philosophical concept relates to how the empty set is a subset of every set?
• Why did the US and Israel vote against making food a human right?
• Regressors Became Statistically Insignificant Upon Correcting for Autocorrelation
• Center of group of order 3773
• Can religions die?
• Can definitions in the Oxford Dictionary of the English Language be considered definitive in informal philosophical presentations?
• Can I fly within the US on an expired ESTA?
• Residual finiteness and a gluing problem
• Can You Train A Neural Network By Simply Giving It Ratings Each Time It Runs?
• ESTA unnecessary anxiety
• "You are in emergency mode"

Windows and EUI-64

Prior to Windows Vista and Windows Server 2008, Windows hosts used only MAC addresses to create Interface Identifiers (EUI-64). Globally unique addresses and Link-local ones were created using the segment's prefix plus the EUI-64 identifier which is generated from the physical address of the host. With the rise of network security, this was found to be a security vulnerability because an IPv6 address can be easily tied to a MAC address, which uniquely identifies physical equipment.

For example, imagine a user with a laptop connecting to an IPv6 network with global prefix X:X:X:X::/64. Via SLAAC, the user's laptop will generate a globally unique address X:X:X:X:EUI-64. Let's say the user goes to another place and connects to another IPv6 network with a global prefix Y:Y:Y:Y::/64. Well, the user's laptop will generate a global unicast address Y:Y:Y:Y:EUI-64, if the user connects to a network Z:Z:Z:Z::/64 it will get IPv6 address Z:Z:Z:Z::EUI-64 and so on. You can clearly see that this creates an opportunity to track the user , because wherever he goes and to whichever network he connects, the second half of the globally unique IPv6 address his laptop generates is always the same. The user can not connect anonymously to any network if someone knows the EUI-64 interface identifier of his laptop. This can be easily exploited in many different ways, for example, websites and apps associating different IPv6 addresses to a particular device or user.

Companies realized that and introduced two concepts that help to improve user's privacy -  Random Interface Identifiers and  Temporary IPv6 addresses . Let's start by looking at what the first term is.

Randomize Identifiers

Randomize Identifiers feature has been introduced as a part of the privacy extension for SLAAC (Stateless Address Auto-configuration). After Windows Vista, this feature is enabled by default, so wherever a Windows host generates an IPv6 address with SLAAC, it always uses a Random Interface ID.

Let's look at part of the output of ipconfig /all command that displays the Physical address and the Link-local address of a Windows 10 host. You can see that the MAC address is 00-0A-12-34-56-78 and therefore if PC1 uses EUI-64 to generate a link-local address, it should have been fe80::20a:12ff:fe34:5678. 

Well, obviously the current link-local address is not created using the MAC address but rather a Random Interface Identifier. This is because the Randomize Identifiers feature is enabled by default. We can check this using the PowerShell command get-netipv6protocol or using netsh interface ipv6 show global in the Windows Command Prompt

We can use the following command in PowerShell to change the default behavior of a Windows host and disable the Randomize Identifiers. Disabling this feature forces Windows to use EUI-64 for Interface ID as you can see in the following example.

Note that now the link-local address is generated from the MAC address and is exactly the value we expected.

Temporary IPv6 addresses

Another important concept, part of the Privacy Extension for SLAAC, is the use of Temporary IPv6 addresses. The idea behind temporary addresses is to have a public randomized IPv6 address that has a relatively short lifetime and can be used for anonymous outgoing connections. At every reboot, or IPv6 stack on/off, or when the Preferred-Lifetime expires this temporary address is re-generated using a Random Interface Identifier. Therefore, different outgoing connections can be initiated from different Temporary IPv6 addresses which minimize the risk of someone tracking the user by associating the global IPv6 address to physical equipment/user.

Of course, the incoming connections are made to the real Public IPv6 address that doesn't change. However, in a typical Internet user scenario, all connections are initiated by the user's machine towards an Internet service (client-server communication).

You can verify that this feature is enabled by default using either PowerShell's command get-netipv6protocol or Command Prompt netsh interface ipv6 show privacy command.

In some cases, you will see multiple Temporary IPv6 Addresses at a time (could be hundreds). This happens when the Maximum Preferred Lifetime of an address expires but there is a connection still opened using this particular address. In this case, another Temporary IPv6 address is created but the old one is not deleted until all opened connections are closed. More information on what the different lifetimes means can be seen in figure 3.

Configuring Global IPv6 Address on Windows 10

There are three methods to configure a Windows 10 hosts with an IPv6 address:

• Method 1 : Configure the host manually.
• Method 2 : Using SLAAC and a Stateless DHCPv6 server.
• Method 3 : Using a Stateful DHCPv6 server.

Manual Address Assignment

The manual configuration is pretty straightforward. We go to Network Adapters Setting and under Internet Protocol Version 6 Properties we configure everything as shown in Figure 4. This approach is applicable for SOHO networks but it is not a scalable solution for large network environments.

Dynamic Addressing

To enable Windows to automatically decide how to configure its IPv6 settings, we just leave it on default settings " Obtain an IPv6 address automatically ". When using this approach, the type of dynamic addressing is decided by the Router Advertisements sent by the Default Router on the segment. Depending on the Autoconfig Flags, the host knows whether to use SLAAC plus Stateless DHCPv6 or to use Stateful DHCPv6.

Keep in mind that, it is up to the network administrators and the company's policy to decide which addressing method t use. From a Windows perspective, it can generate an IPv6 address using SLAAC and obtain another address using DHCPv6 at the same time. This means that the host will have at least to global unicast addresses. Such an example is shown in figure 6. 

The first GUA address is generated via SLAAC and the second one has been obtained from a DHCPv6 server.

Lauren Malhoit

Planning ipv6 address assignment.

Understanding how IPv6 addresses are assigned to hosts manually and dynamically on your enterprise network.

Dec 9th, 2021

Dynamic allocation of an IPv6 address is a bit different than in IPv4. We’ll go over some of the available methods of address assignment via manual, SLAAC, and DHCPv6 to help you plan your IPv6 migration and the best method for your networks.

Let’s start off with what’s most familiar to server admins, which is the manual assignment of an IP address, in this case an IPv6 address. You’ll use this method if you’re not using DHCP reservations to assign permanent IP addresses likely to servers on your network.

This is very similar to IPv4. On a Windows machine we just need to go into our network card properties, check the Use the following IPv6 address radio button, and type in the address, subnet prefix length, and default gateway. Typically, with IPv6 addressing you’ll have a 64-bit subnet prefix length.

Notice that the major difference here is that with IPv4 we would generally put in the entire 32-bit IP address as well as the entire 32-bit default gateway IP address. This will be done in a similar way on a Mac GUI, or it may be done on the Mac terminal or Linux/Unix command line always specifying the prefix length.

Stateless Address Auto Configuration (SLAAC)

In the case of SLAAC, which is new with IPv6, a device will be connected to a router (or Layer 3 switch more likely) and that layer 3 device will send out a Router Advertisement with its IPv6 network. This is called Neighbor Discovery Protocol (NDP). In the case of a Windows machine, it will pick its own random interface identifier (or host part of the address). Then add that on to the network address learned from the Router Advertisement.

Regarding a Unix/Linux/Mac machine it’s a similar process, except the host will use its MAC address in the creation of the Modified EUI (Extended Unique Identifier, or host part of the address) to create a unique IPv6 address. So, it will receive the network address from the router and then take the 48-bit MAC and modify it so that it becomes 64-bits. The way this is done is by breaking the MAC address in half and then adding an FF:FE in the middle. So if the MAC were 70:CF:49:B3:F2:0D it would become 00:CF:49:FF:FE:B3:F2:0D.

Then it will take the first 8 bits, in the case 00, and convert the seventh bit into the opposite of what it is currently. For 0000 0000, the seventh bit would change to a 1. Now we have 0000 0010, which becomes 02:CF:49:FF:FE:B3:F2:0d ultimately in hex.

A quick recap of the math for creating a Modified EUI:

SLAAC is probably the simplest way to configure automatic IP addressing, but doesn’t give us all the benefits of DHCP, the biggest being centralized visibility and management. Also since many companies are still using IPv4 along with IPv6 it adds yet another layer of management complexity.

DHCP gives centralized control for enterprise network management. There are two ways to use DHCP with IPv6 address allocation: Stateless and Stateful.

DHCPv6 (Stateless) still uses SLAAC in the same way described above. However, it will change a flag when sending the Router Advertisement for the client to check with the DHCP server for configuration options. So, you can specify things like which DNS server to go to, the domain name, and lease time. This is referred to as stateless because the DHCP server is not in charge of IP configuration, it’s only giving the extra options which are so often used in an enterprise environment for more automated and consistent configuration.

In the case of DHCPv6 (Stateful) the client will still try to get information from a Router Advertisement, but in this case the Router Advertisement will tell it not to use SLAAC at all and will be sent to a DHCP server for both IP configuration as well as the other options discussed above. This is very similar to how DHCP works in IPv4 environments and gives complete control to the DHCP servers.

In both Stateless and Stateful use cases, a DDI solution will be able to gather more information for a contextual view as well as control of DHCP for the entire environment.

For More Information

If you’d like to learn more about IPv6 and DCHPv6 check out our Fundamentals on-demand webinar .

Enjoyed the article?

Ansible and micetro ddi, finding your true ip count.

Share on Social Media

• school Campus Bookshelves
• menu_book Bookshelves
• perm_media Learning Objects
• login Login
• how_to_reg Request Instructor Account
• hub Instructor Commons
• Download Page (PDF)
• Download Full Book (PDF)
• Periodic Table
• Physics Constants
• Scientific Calculator
• Reference & Cite
• Tools expand_more
• Readability

selected template will load here

This action is not available.

8.8: IPv6 Host Address Assignment

• Last updated
• Save as PDF
• Page ID 11173

• Peter Lars Dordal
• Loyola University of Chicago

IPv6 provides two competing ways for hosts to obtain their full IP addresses. One is DHCPv6 , based on IPv4’s DHCP ( 7.10 Dynamic Host Configuration Protocol (DHCP) ), in which the entire address is handed out by a DHCPv6 server. The other is StateLess Address AutoConfiguration , or SLAAC, in which the interface-identifier part of the address is generated locally, and the network prefix is obtained via prefix discovery. The original idea behind SLAAC was to support complete plug-and-play network setup: hosts on an isolated LAN could talk to one another out of the box, and if a router was introduced connecting the LAN to the Internet, then hosts would be able to determine unique, routable addresses from information available from the router.

In the early days of IPv6 development, in fact, DHCPv6 may have been intended only for address assignments to routers and servers, with SLAAC meant for “ordinary” hosts. In that era, it was still common for IPv4 addresses to be assigned “statically”, via per-host configuration files. RFC 4862 [ https://tools.ietf.org/html/rfc4862.html] states that SLAAC is to be used when “a site is not particularly concerned with the exact addresses hosts use, so long as they are unique and properly routable.”

SLAAC and DHCPv6 evolved to some degree in parallel. While SLAAC solves the autoconfiguration problem quite neatly, at this point DHCPv6 solves it just as effectively, and provides for greater administrative control. For this reason, SLAAC may end up less widely deployed. On the other hand, SLAAC gives hosts greater control over their IPv6 addresses, and so may end up offering hosts a greater degree of privacy by allowing endpoint management of the use of private and temporary addresses (below).

When a host first begins the Neighbor Discovery process, it receives a Router Advertisement packet. In this packet are two special bits: the M (managed) bit and the O (other configuration) bit. The M bit is set to indicate that DHCPv6 is available on the network for address assignment. The O bit is set to indicate that DHCPv6 is able to provide additional configuration information ( eg the name of the DNS server) to hosts that are using SLAAC to obtain their addresses. In addition, each individual prefix in the RA packet has an A bit, which when set indicates that the associated prefix may be used with SLAAC.

8.7.1 Duplicate Address Detection

Whenever an IPv6 host obtains a unicast address – a link-local address, an address created via SLAAC, an address received via DHCPv6 or a manually configured address – it goes through a duplicate-address detection (DAD) process. The host sends one or more Neighbor Solicitation messages (that is, like an ARP query), as in 8.6 Neighbor Discovery , asking if any other host has this address. If anyone answers, then the address is a duplicate. As with IPv4 ACD ( 7.9.1 ARP Finer Points ), but not as with the original IPv4 self-ARP, the source-IP-address field of this NS message is set to a special “unspecified” value; this allows other hosts to recognize it as a DAD query.

Because this NS process may take some time, and because addresses are in fact almost always unique, RFC 4429 [ https://tools.ietf.org/html/rfc4429.html] defines an optimistic DAD mechanism. This allows limited use of an address before the DAD process completes; in the meantime, the address is marked as “optimistic”.

Outside the optimistic-DAD interval, a host is not allowed to use an IPv6 address if the DAD process has failed. RFC 4862 [ https://tools.ietf.org/html/rfc4862.html] in fact goes further: if a host with an established address receives a DAD query for that address, indicating that some other host wants to use that address, then the original host should discontinue use of the address.

If the DAD process fails for an address based on an EUI-64 identifier, then some other node has the same Ethernet address and you have bigger problems than just finding a working IPv6 address. If the DAD process fails for an address constructed with the RFC 7217 [ https://tools.ietf.org/html/rfc7217.html] mechanism, 8.2.1 Interface identifiers , the host is able to generate a new interface identifier and try again. A counter for the number of DAD attempts is included in the hash that calculates the interface identifier; incrementing this counter results in an entirely new identifier.

While DAD works quite well on Ethernet-like networks with true LAN-layer multicast, it may be inefficient on, say, MANETs ( 3.7.8 MANETs ), as distant hosts may receive the DAD Neighbor Solicitation message only after some delay, or even not at all. Work continues on the development of improvements to DAD for such networks.

8.7.2 Stateless Autoconfiguration (SLAAC)

To obtain an address via SLAAC, defined in RFC 4862 [ https://tools.ietf.org/html/rfc4862.html] , the first step for a host is to generate its link-local address (above, 8.2.2 Link-local addresses ), appending the standard 64-bit link-local prefix fe80::/64 to its interface identifier ( 8.2.1 Interface identifiers ). The latter is likely derived from the host’s LAN address using either EUI-64 or the RFC 7217 [ https://tools.ietf.org/html/rfc7217.html] mechanism; the important point is that it is available without network involvement.

The host must then ensure that its newly configured link-local address is in fact unique; it uses DAD (above) to verify this. Assuming no duplicate is found, then at this point the host can talk to any other hosts on the same LAN, eg to figure out where the printers are.

The next step is to see if there is a router available. The host may send a Router Solicitation (RS) message to the all-routers multicast address. A router – if present – should answer with a Router Advertisement (RA) message that also contains a Prefix Information option; that is, a list of IPv6 network-address prefixes ( 8.6.2 Prefix Discovery ).

As mentioned earlier, the RA message will mark with a flag those prefixes eligible for use with SLAAC; if no prefixes are so marked, then SLAAC should not be used. All prefixes will also be marked with a lifetime, indicating how long the host may continue to use the prefix. Once the prefix expires, the host must obtain a new one via a new RA message.

The host chooses an appropriate prefix, stores the prefix-lifetime information, and appends the prefix to the front of its interface identifier to create what should now be a routable address. The address so formed must now be verified through the DAD mechanism above.

In the era of EUI-64 interface identifiers, it would in principle have been possible for the receiver of a packet to extract the sender’s LAN address from the interface-identifier portion of the sender’s SLAAC-generated IPv6 address. This in turn would allow bypassing the Neighbor Solicitation process to look up the sender’s LAN address. This was never actually permitted, however, even before the privacy options below, as there is no way to be certain that a received address was in fact generated via SLAAC. With RFC 7217 [ https://tools.ietf.org/html/rfc7217.html] -based interface identifiers, LAN-address extraction is no longer even potentially an option.

A host using SLAAC may receive multiple network prefixes, and thus generate for itself multiple addresses. RFC 6724 [ https://tools.ietf.org/html/rfc6724.html] defines a process for a host to determine, when it wishes to connect to destination address D, which of its own multiple addresses to use. For example, if D is a unique-local address, not globally visible, then the host will likely want to choose a source address that is also unique-local. RFC 6724 [ https://tools.ietf.org/html/rfc6724.html] also includes mechanisms to allow a host with a permanent public address (possibly corresponding to a DNS entry, but just as possibly formed directly from an interface identifier) to prefer alternative “temporary” or “privacy” addresses for outbound connections. Finally, RFC 6724 [ https://tools.ietf.org/html/rfc6724.html] also defines the sorting order for multiple addresses representing the same destination; see 8.11 Using IPv6 and IPv4 Together .

At the end of the SLAAC process, the host knows its IPv6 address (or set of addresses) and its default router. In IPv4, these would have been learned through DHCP along with the identity of the host’s DNS server; one concern with SLAAC is that it originally did not provide a way for a host to find its DNS server. One strategy is to fall back on DHCPv6 for this. However, RFC 6106 [ https://tools.ietf.org/html/rfc6106.html] now defines a process by which IPv6 routers can include DNS-server information in the RA packets they send to hosts as part of the SLAAC process; this completes the final step of autoconfiguration.

How to get DNS names for SLAAC-configured IPv6 hosts into the DNS servers is an entirely separate issue. One approach is simply not to give DNS names to such hosts. In the NAT-router model for IPv4 autoconfiguration, hosts on the inward side of the NAT router similarly do not have DNS names (although they are also not reachable directly, while SLAAC IPv6 hosts would be reachable). If DNS names are needed for hosts, then a site might choose DHCPv6 for address assignment instead of SLAAC. It is also possible to figure out the addresses SLAAC would use (by identifying the host-identifier bits) and then creating DNS entries for these hosts. Finally, hosts can also use Dynamic DNS ( RFC 2136 [ https://tools.ietf.org/html/rfc2136.html] ) to update their own DNS records.

8.7.2.1 SLAAC privacy

A portable host that always uses SLAAC as it moves from network to network and always bases its SLAAC addresses on the EUI-64 interface identifier (or on any other static interface identifier) will be easy to track: its interface identifier will never change. This is one reason why the obfuscation mechanism of RFC 7217 [ https://tools.ietf.org/html/rfc7217.html] interface identifiers ( 8.2.1 Interface identifiers ) includes the network prefix in the hash: connecting to a new network will then result in a new interface identifier.

Well before RFC 7217 [ https://tools.ietf.org/html/rfc7217.html] , however, RFC 4941 [ https://tools.ietf.org/html/rfc4941.html] introduced a set of privacy extensions to SLAAC: optional mechanisms for the generation of alternative interface identifiers, based as with RFC 7217 on pseudorandom generation using the original LAN-address-based interface identifier as a “seed” value.

RFC 4941 goes further, however, in that it supports regular changes to the interface identifier, to increase the difficulty of tracking a host over time even if it does not change its network prefix. One first selects a 128-bit secure-hash function F(), eg MD5 ( 22.6 Secure Hashes ). New temporary interface IDs (IIDs) can then be calculated as follows

\[(IID_{new},seed_{new}) = F(seed_{old}, IID_{old})\]

where the left-hand pair represents the two 64-bit halves of the 128-bit return value of F() and the arguments to F() are concatenated together. (The seventh bit of IID new must also be set to 0; cf 8.2.1 Interface identifiers where this bit is set to 1.) This process is privacy-safe even if the initial IID is based on EUI-64.

The probability of two hosts accidentally choosing the same interface identifier in this manner is vanishingly small; the Neighbor Solicitation mechanism with DAD must, however, still be used to verify that the address is in fact unique within the host’s LAN.

The privacy addresses above are to be used only for connections initiated by the client; to the extent that the host accepts incoming connections and so needs a “fixed” IPv6 address, the address based on the original EUI-64/RFC-7217 interface identifier should still be available. As a result, the RFC 7217 mechanism is still important for privacy even if the RFC 4941 mechanism is fully operational.

RFC 4941 stated that privacy addresses were to be disabled by default, largely because of concerns about frequently changing IP addresses. These concerns have abated with experience and so privacy addresses are often now automatically enabled. Typical address lifetimes range from a few hours to 24 hours. Once an address has “expired” it generally remains available but deprecated for a few temporary-address cycles longer.

DHCPv6 also provides an option for temporary address assignments, again to improve privacy, but one of the potential advantages of SLAAC is that this process is entirely under the control of the end system.

Regularly ( eg every few hours, or less) changing the host portion of an IPv6 address should make external tracking of a host more difficult, at least if tracking via web-browser cookies is also somehow prevented. However, for a residential “site” with only a handful of hosts, a considerable degree of tracking may be obtained simply by observing the common 64-bit prefix.

For a general discussion of privacy issues related to IPv6 addressing, see RFC 7721 [ https://tools.ietf.org/html/rfc7721.html] .

8.7.3 DHCPv6

The job of a DHCPv6 server is to tell an inquiring host its network prefix(es) and also supply a 64-bit host-identifier, very similar to an IPv4 DHCPv4 server. Hosts begin the process by sending a DHCPv6 request to the All_DHCP_Relay_Agents_and_Servers multicast IPv6 address ff02::1:2 (versus the broadcast address for IPv4). As with DHCPv4, the job of a relay agent is to tag a DHCPv6 request with the correct current subnet, and then to forward it to the actual DCHPv6 server. This allows the DHCPv6 server to be on a different subnet from the requester. Note that the use of multicast does nothing to diminish the need for relay agents. In fact, the All_DHCP_Relay_Agents_and_Servers multicast address scope is limited to the current LAN; relay agents then forward to the actual DHCPv6 server using the site -scoped address All_DHCP_Servers.

Hosts using SLAAC to obtain their address can still use a special Information-Request form of DHCPv6 to obtain their DNS server and any other “static” DHCPv6 information.

Clients may ask for temporary addresses. These are identified as such in the “Identity Association” field of the DHCPv6 request. They are handled much like “permanent” address requests, except that the client may ask for a new temporary address only a short time later. When the client does so, a different temporary address will be returned; a repeated request for a permanent address, on the other hand, would usually return the same address as before.

When the DHCPv6 server returns a temporary address, it may of course keep a log of this address. The absence of such a log is one reason SLAAC may provide a greater degree of privacy. SLAAC also places control of the cryptographic mechanisms for temporary-address creation in the hands of the end user.

A DHCPv6 response contains a list (perhaps of length 1) of IPv6 addresses. Each separate address has an expiration date. The client must send a new request before the expiration of any address it is actually using.

In DHCPv4, the host portion of addresses typically comes from “address pools” representing small ranges of integers such as 64-254; these values are generally allocated consecutively. A DHCPv6 server, on the other hand, should take advantage of the enormous range (2 64 ) of possible host portions by allocating values more sparsely, through the use of pseudorandomness. This is to make it very difficult for an outsider who knows one of a site’s host addresses to guess the addresses of other hosts, cf 8.2.1 Interface identifiers .

The Internet Draft draft-ietf-dhc-stable-privacy-addresses [tools.ietf.org/id/draft-ietf...resses-00.txt] proposes the following mechanism by which a DHCPv6 server may generate the interface-identifier bits for the addresses it hands out; F() is a secure-hash function and its arguments are concatenated together:

\[F(prefix, client_DUID, IAID, DAD_counter, secret_key)\]

The prefix, DAD_counter and secret_key arguments are as in 8.7.2.1 SLAAC privacy . The client_DUID is the string by which the client identifies itself to the DHCPv6 server; it may be based on the Ethernet address though other options are possible. The IAID, or Identity Association identifier, is a client-provided name for this request; different names are used when requesting temporary versus permanent addresses.

Some older DHCPv6 servers may still allocate interface identifiers in serial order; such obsolete servers might make the SLAAC approach more attractive.

Assigning IPv6 addresses

When you are assigning IPv6 addresses, use the following guidelines.

Defining the interface ID for physical interfaces

If you do not manually configure the interface ID, the system selects an interface ID by using one of the following values:

• A random value on an MPCPTP6 interface
• A value that is derived from the MAC address on an IPAQENET6 interface
• A value that is derived from the IQD CHPID on an IPAQIDIO6 interface

The interface ID is used to form the link-local address for the interface. The interface ID is also appended to any manually configured prefixes for the interface, to form complete IPv6 addresses on the interface. If you do not configure manual IP addresses on the interface, the interface ID is appended to any prefixes that are learned over this interface by way of router advertisements, to form public IPv6 addresses on the interface.

To simplify the configuration effort, let the system select the interface ID. However, controlling all IPv6 addresses that are assigned to a physical adapter might be useful if other IPv6 nodes need to define static routes to this host, or if you use IPv6 addresses in multilevel security policies.

Use stateless address autoconfiguration for physical interfaces

IPv6 addresses for physical interfaces can be manually defined or can be automatically assigned by stateless address autoconfiguration. Use the stateless address autoconfiguration for this assignment. Using stateless address autoconfiguration reduces the amount of definition required to enable IPv6 support, while making future site renumbering easier.

Using static VIPAs removes hardware as a single point of failure for connections being routed over the failed hardware. If you are not using dynamic routing, configure at least one static VIPA for each LAN to which z/OS® Communications Server TCP/IP is connected. Each VIPA configured this way should be associated with all physical adapters connected to that same LAN.

Dynamic VIPAs (DVIPAs) can also be used in an IPV6 network. The decision to use DVIPAs in an IPv6 network is similar to the decision to use DVIPAs in an IPv4 network. For detailed information, see z/OS Communications Server: IP Configuration Guide .

Selecting the network prefix

z/OS Communications Server TCP/IP does not perform duplicate address detection for VIPAs, because they are not assigned to a physical interface attached to the LAN.

If either the IPv6 OSPF or IPv6 RIP dynamic routing protocol of OMPROUTE is being used, the network prefix for a static VIPA should not be the same as any prefix defined as on-link on a physical link. The VIPA can then be associated with interfaces attached to any physical link, thus enabling maximum redundancy. This association between VIPAs and interfaces attached to physical links is accomplished using the SOURCEVIPAINTERFACE parameter of the INTERFACE statement for the interface attached to the physical link.

If IPv6 OSPF or IPv6 RIP dynamic routing protocol of OMPROUTE is not being used, the network prefix for a static VIPA should be selected from the set of prefixes which are advertised by way of router discovery by one or more routers attached to the LAN. The prefix should be advertised as on-link and not to be used for address autoconfiguration. By using an on-link prefix, hosts and routers attached to the LAN use neighbor discovery address resolution to obtain a link-layer address for the VIPA. z/OS Communications Server TCP/IP selects a link-layer address of an attached physical interface when responding to the query, and the attached host or router forwards the packet to z/OS Communications Server TCP/IP. This eliminates the need to define static routes for VIPAs at hosts and routers attached to the same LAN as z/OS Communications Server TCP/IP. By using a prefix that is not being used for address autoconfiguration, the network prefix is not used by hosts for autoconfiguring addresses for physical interfaces.

Selecting the interface identifier

The VIPA interface identifier must be unique among all IP addresses that are created using the combination of network prefix and interface identifier. Any scheme can be used in generating the interface identifiers, as long as they are unique. By using a network prefix that is not used by stateless address autoconfiguration, it is necessary only to ensure the interface identifier is unique among all VIPAs that are sharing the same network prefix.

Effects of site renumbering on static VIPAs

When renumbering a site, new network prefixes are assigned to subnetworks. The existing network prefixes are marked as deprecated, during which time either the new prefixes or the old, deprecated prefixes can be used. After some time period, the deprecated network prefixes are deleted, along with all IPv6 addresses which use the network prefix.

For autoconfigured addresses, this process is automatically managed by stateless address autoconfiguration algorithms. For manually defined addresses, including all VIPAs, the process must be managed manually. When a prefix is to be deprecated, addresses that use the prefix should be deprecated using the INTERFACE DEPRADDR statement. After the prefix has expired, addresses that use the prefix should be deleted using the INTERFACE DELADDR statement.

PacketMania

Technology | Knowledge | Sharing

IPv6 Dynamic Address Allocation Mechanism Illustrated

IPv6 supports multiple addresses, making address assignments more flexible and convenient. Unlike IPv4, which relied solely on the DHCP protocol for address assignment, IPv6 incorporates a native Stateless Address AutoConfiguration SLAAC) protocol. SLAAC can either work alone to provide IPv6 addresses to hosts, or it can work with DHCPv6 to generate new assignment schemes. Here is a comprehensive analysis of the dynamic address allocation mechanism for IPv6.

Who the hell knew how much address space we needed? — Vint Cerf (American Internet pioneer and one of "the fathers of the Internet")

IPv6 Address Overview

Address formats.

The interface identifier can be generated in several ways:

• Static manual setting
• Converted from the interface's MAC address using the modified EUI-64 format
• Obtained from a DHCPv6 server
• Automatically established randomly or cryptographically

IETF recommends a canonical textual representation format for ease of writing. It includes leading zeros suppression and compression of consecutive all-zero fields. With the network prefix length at the end, the above address can be shortened to 2001:db8:130f :: 7000: 0 :140b/ 64 .

Address Types

RFC 4291 defines three types of addresses:

• Unicast: A network address corresponds to a single network node, point-to-point connection.
• Anycast: The target address corresponds to a group of receiving nodes, but only the "nearest" one receives.
• Multicast: The target address corresponds to a group of nodes that can receive replicated messages.

Note that there are no broadcast addresses in IPv6, their function being superseded by multicast addresses. Anycast addresses are syntactically indistinguishable from unicast addresses and have very limited applications. A typical application for anycast is to set up a DNS root server to allow hosts to look up domain names in close proximity. For unicast and multicast addresses, they can be identified by different network prefixes:

• All Nodes Addresses on the local link — ff02::1
• All Routers Addresses on the local link — ff02::2
• Solicited-Node Address on local link — ff02::1:ffxx:xxxx

Dynamic Allocation Schemes

Ndp protocol.

IPv6 dynamic address assignment depends on Neighbor Discovery Protocol (NDP). NDP acts at the data link layer and is responsible for discovering other nodes and corresponding IPv6 addresses on the link and determining available routes and maintaining information reachability to other active nodes. It provides the IPv6 network with the equivalent of the Address Resolution Protocol (ARP) and ICMP router discovery and redirection protocols in IPv4 networks. However, NDP adds many improvements and new features. NDP defines five ICMPv6 message types:

• Router Solicitation (RS)
• Router Advertisement (RA)
• Neighbor Solicitation (NS)
• Neighbor Advertisement (NA)

The first two message types here, RS and RA, are the keys to implementing dynamic IPv6 address assignment. The host sends an RS message to the multicast address ff02::2 of all routers in the local network segment to request routing information. When the router receives the RS from the network node, it sends an immediate RA in response. The message format of the RA is as follows

It defines two special bits, M and O, with the following meaning:

• M — "Managed address configuration" flag, set to 1 when the address is obtained from DHCPv6.
• O — "Other configuration" flag, set to 1 to indicate that other configuration information is available via DHCPv6

The RA message ends with the Options section, which originally had three possible options: Source Link-Layer Address, MTU, and Prefix Information. Later, RFC 8106 (which replaced RFC 6106) added the Recursive DNS Server (RDNSS) and DNS Search List (DNSSL) options. The Prefix Information option directly provide hosts with on-link prefixes and prefixes for Address Autoconfiguration, and it has the following format

Here the Prefix Length and the Prefix jointly determine the network prefix of the IPv6 address. In addition, the Prefix Information option also defines two special bits, L and A:

• L — on-link flag. When set, indicates that this prefix can be used for on-link determination.
• A — autonomous address-configuration flag. When set, indicates that this prefix can be used for SLAAC.

Similar to the IPv4 subnet mask feature, the purpose of the "on-link" determination is to allow the host to determine which networks an interface can access. By default, the host only considers the network where the link-local address is located as "on-link". If the "on-link" status of a destination address cannot be determined, the host forwards the IPv6 datagram to the default gateway (or default router) by default. When the host receives an RA message, if the "on-link" flag for a prefix information option is set to 1 and the Valid Lifetime is also a non-zero value, the host creates a new prefix network entry for it in the prefix list. All unexpired prefix network entries are "on-link".

Message Sequence

After understanding the NDP protocol and the information conveyed by the RA messages, let's see how they guide the network nodes to achieve dynamic address assignment.

Routers in the network periodically send RA messages to the multicast addresses (ff02::1) of all nodes in the local subnet. However, to avoid latency, the host sends one or more RS messages to all routers in the local subnet as soon as it has finished booting. The protocol requires the routers to respond to the RA messages within 0.5 seconds. Then, based on the values of the M/O/A bits in the received RA messages, the host decides how to dynamically configure the unique local and global unicast addresses of the interface and how to obtain other configuration information. With certain combinations of bit fetch values, the host needs to run DHCPv6 client software to connect to the server to obtain address assignment and/or other configuration information. The entire process is shown in the following message sequence diagram.

Note: Unlike the IPv4 DHCP protocol, DHCPv6 clients use UDP port 546 and servers use UDP port 547.

Next explain in detail three dynamic allocation schemes determined by the combination of the M/O/A-bit values:

SLAAC + Stateless DHCPv6

Stateful dhcpv6.

SLAAC is the simplest automatic IPv6 address assignment scheme and does not require any server. It works by sending an RS message request after the host starts up and the router sends back RA messages to all nodes in the local network segment. If the RA message contains the following configuration

• M-bit and O-bit all clear in the message header
• L-bit and A-bit all set in Prefix Information option

Then the host receives this RA message and performs the following operations to implement SLAAC:

• Combine the network prefix with the local interface identifier to generate a unique local address or global unicast address.
• Install the default gateway (or default route) to point to the router address (source address of the RA message).
• Set this interface as the "on-link" corresponding to the network prefix, which is also the next-hop interface of the default gateway above.
• If the RDNSS and/or DNSSL options are included, install the name servers and domain name suffixes.

This way, the host gets one or more IPv6 unique local addresses or global unicast addresses, plus the default gateway and domain name service information to complete various Internet connections.

The following is an example of the SLAAC configuration on a Cisco Catalyst 9300 Multilayer Access Switch:

The Layer 3 interface of the Cisco Multilayer Switch provides routing functionality. As you can see, when IPv6 is activated on the Layer 3 interface in VLAN 10, its default address auto-assignment scheme is SLAAC. the control bits of RA messages from this interface are all set according to the SLAAC scheme, and the network prefixes for each IPv6 address it configures are automatically added to the RA prefix information options list. Of course, the network administrator can also exclude certain network prefixes with a separate interface configuration command. The last two lines of the example configuration command specify RDNSS and DNSSL, which are also added to the RA message options.

If a host connects to a port in VLAN 10, it immediately gets a global unicast address with the network prefix of 2001:ABCD:1000::/64, and its default gateway address is set to 2001:ABCD:1000::1. Open a browser and enter a URL, and it will send a message to the specified domain name server 2001:4860:4860::8888 (Google's public name server address) to obtain the IPv6 address of the destination URL to establish a connection.

SLAAC automatic address assignment is fast and easy, providing a plug-and-play IPv6 deployment solution for small and medium-sized network deployments. However, if a network node needs access to additional configuration information, such as NTP/SNTP server, TFTP server, and SIP server addresses, or if its functionality relies on certain Vendor-specific Information Options, it must choose SLAAC + stateless DHCPv6 scheme.

This scenario still uses SLAAC automatic address assignment, but the router instructs the host to connect to a DHCPv6 server for additional configuration information. At this point, the RA message sent back by the router has

• M-bit clear and O-bit set in the message header

After receiving this RA message, the host performs the following actions:

• Install a default gateway (or default route) pointing to the router address (source address of the RA message).
• Start the DHCPv6 client and connect to the DHCPv6 server to request additional configuration information .
• Save the additional configuration information replied by the DHCPv6 server .

As you can see, SLAAC + stateless DHCPv6 is not different from SLAAC in terms of address assignment. DHCPv6 only provides additional configuration information and does not assign IPv6 addresses. So the DHCPv6 server does not track the address assignment status of network nodes, which is what "stateless" means.

The corresponding configuration commands on the Catalyst 9300 switch are as follows.

The difference with the SLAAC example is that the VLAN 10 interface configuration command ipv6 nd other-config-flag explicitly specifies to set the O-bit of the RA message. Its next command, ipv6 dhcp server vlan-10-clients , activates the DHCPv6 server response feature of the interface, corresponding to the server's pool name of vlan-10-clients . The DHCPv6 server is configured above the interface configuration, starting at ipv6 dhcp pool vlan-10-clients , and contains the DNS server address, DNS domain name, and SNTP server address.

If you are using a separate DHCPv6 server located on a network segment, you can remove the ipv6 dhcp server command and enable the ipv6 dhcp relay destination command on the next line of the example to specify the address to forward DHCPv6 requests to the external server.

Many large enterprises use DHCP to manage the IPv4 addresses of their devices, so deploying DHCPv6 to centrally assign and manage IPv6 addresses is a natural preference. This is where Stateful DHCPv6 comes into play. This scenario also requires RA messages sent by the router but does not rely solely on network prefixes for automatic address assignment. The control bits of the RA messages are configured to

• M-bit set in the message header, O-bit does not matter
• L-bit and A-bit can be set or clear as desired in Prefix Information option

Upon receiving this RA message, the host performs the following actions:

• Generate a unique local address or a global unicast address if there is a Prefix Information option with the A-bit set.
• If there is a Prefix Information option with the L-bit set, set this interface to "on-link" with the corresponding network prefix.
• If the RDNSS and/or DNSSL options are included, install the name servers and domain suffixes.
• Start the DHCPv6 client and connect to the server to request addresses and other configuration information .
• Set the address assigned by the DHCPv6 server to this interface .
• Save additional configuration information from the DHCPv6 server response .

An example of the Stateful DHCPv6 configuration command on a Catalyst 9300 switch is as follows.

Compared to SLAAC + Stateless DHCPv6 , the interface configuration here removes the ipv6 nd other-config-flag and replaces it with the ipv6 nd managed-config-flag command. This corresponds to setting the M-bit of the RA message header. The DHCPv6 server configuration adds two address prefix commands to set the network prefix. Also, the ipv6 nd prefix 2001:ABCD:1:1::/64 no-advertise configured for the interface specifies that the router does not include the 2001:ABCD:1:1::/64 prefix information option into the RA. So, this example host interface will not generate SLAAC addresses, but only two addresses from DHPCv6: a unique local address with the network prefix FD09:9:5:90::/64, and a global unicast address with the network prefix 2001:9:5:90::/64. The interface identifier for each of these two addresses is also specified by DHPCv6.

How to distinguish the source of dynamically assigned addresses for host interfaces? The method is simple. One thing to remember is that DHPCv6 does not send the network prefix length to the requestor, so the network prefix length of the addresses received from DHPCv6 is 128, while the network prefix length of the addresses generated by SLAAC will not be 128. See the following example of the wired0 interface on a Linux host:

We can immediately determine that the interface is using Stateful DHCPv6 address assignment, but also generates the SLAAC address with the same network prefix 2001:20::/64 received.

• 2001:20::53c7:1364:a4d8:fd91/128 — DHCPv6 address, random interface identifer
• 2001:20::a2ec:f9ff:fe6c:d930/64 — SLAAC addeess, interface identifer is MAC in EUI-64 format
• fe80::a2ec:f9ff:fe6c:d930/64 — Link-local address, interface identifer is MAC in EUI-64 format

Note: DHPCv6 server also does not provide any IPv6 default gateway information. The host needs to be informed of the dynamic default gateway from the RA message.

Summary and Comparison

The following table shows the control bit combinations of RA messages concerning different address allocation and other configuration acquisition methods.

Summarize three dynamic allocation schemes:

Note: Since IPv6 network interfaces can have multiple addresses (a link-local address, plus one or more unique local addresses and/or global unicast addresses), it becomes important how the source address is selected when establishing an external connection. RFC 6724 gives detailed IPv6 source address selection rules. In the development of embedded systems, the control plane and the data plane connected to the same remote device are often implemented by different functional components. For example, the control plane directly calls a Linux userspace socket to establish the connection, and the IPv6 source address used for the connection is selected by the TCP/IP stack, while the data plane directly implements data encapsulation processing and transmission in kernel space. In this case, the IPv6 source address selected by the control plane has to be synchronized to the data plane in time, otherwise, the user data might not be delivered to the same destination.

Troubleshooting Guide

The common IPv6 dynamic address assignment debugging and troubleshooting commands on Cisco routers and switches are listed in the following table.

The following console NDP protocol debug log shows that the router received an RS message from host FE80::5850:6D61:1FB:EF3A and responded with an RA message to the multicast address FF02::1 of all nodes in this network:

And the next log shows an example of Stateless DHCPv6 observed after entering the debug ipv6 dhcp debug command. Host FE80::5850:6D61:1FB:EF3A sends an INFORMATION-REQUEST message to the DHCPv6 server, which selects the source address FE80::C801:B9FF:FEF0:8 and sends a response message.

The following debug log of Stateful DHCPv6 shows the complete process of two message exchanges (SOLICIT/ADVERTISE, REQUEST/REPLY) on lines 1, 15, 16, and 26.

For complex cases where it is difficult to identify whether the problem is with the host, router, or DHCPv6 server, we recommend using the free open-source network packet analysis software Wireshark to capture packets of the entire process for analysis. While analyzing packets with Wireshark, you can apply the keyword filtering function.

We can either run Wireshark directly on the host side, or we can use the Switched Port Analyzer (SPAN) provided with the switch. Running on the network side, SPAN can collectively redirect packets from a given port to the monitor port running Wireshark for capturing. Cisco Catalyst 9300 Series switches also directly integrate with Wireshark software to intercept and analyze filtered packets online, making it very easy to use.

Sample packet capture files for three allocation scheme are available here for download and study: slaac.pcap ， stateless-dhcpv6.pcap ， stateful-dhcpv6.pcap

IPv6 Product Certification Test

Accurate and effective testing of IPv6 products is key to ensuring high interoperability, security, and reliability of IPv6 infrastructure deployments. The IPv6 Ready logo is an IPv6 testing and certification program created by the IPv6 Forum . Its goals are to define IPv6 conformance and interoperability test specifications, provide a self-testing toolset, establish Global IPv6 Test Centers and provide product validation services, and finally, issue IPv6 Ready logo.

In May 2020, IPv6 Ready Logo Program published new version 5.0 test specifications ：

• IPv6 Core Protocols Test Specification (Conformance)
• IPv6 Core Protocols Interoperability Test Specification (Interoperability)

Along with these two new test specifications, the project team also affirmed two permanent changes:

• Testing must be done in an IPv6-only environment, without any IPv4 being used for the device to function.
• The device under test must have IPv6 on and enabled on all IP interfaces by default.

Not surprisingly, the new version 5.0 core protocols test specification has a section dedicated to defining SLAAC test cases to validate this core IPv6 protocol.

IPv6 Core Protocol RFC List

In the list below, the RFCs shown in bold are directly covered by the IPv6 Ready Version 5.0 Core Protocol Test Specification:

• RFC 4191 Default Router Preferences and More-Specific Routes
• RFC 4193 Unique Local IPv6 Unicast Addresses
• RFC 4291 IP Version 6 Addressing Architecture
• RFC 4443 Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification
• RFC 4861 Neighbor Discovery for IP version 6 (IPv6)
• RFC 4862 IPv6 Stateless Address Autoconfiguration
• RFC 4941 Privacy Extensions for Stateless Address Autoconfiguration in IPv6
• RFC 5095 Deprecation of Type 0 Routing Headers in IPv6
• RFC 6724 Default Address Selection for Internet Protocol Version 6 (IPv6)
• RFC 6980 Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery
• RFC 7217 A Method for Generating Semantically Opaque Interface Identifiers with IPv6 Stateless Address Autoconfiguration (SLAAC)
• RFC 8064 Recommendation on Stable IPv6 Interface Identifiers
• RFC 8106 IPv6 Router Advertisement Options for DNS Configuration
• RFC 8200 Internet Protocol, Version 6 (IPv6) Specification
• RFC 8201 Path MTU Discovery for IP version 6
• RFC 8415 Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
• Gitalk Comments
• Utterances Comments
• Disqus Comments

• Settings Profile and security information

IPv6 Information

On this page.

Scroll for more

What is IPv6?

Internet Protocol version 6 (IPv6) is the latest IP revision, developed as a successor to IPv4. IPv6 provides a much larger address pool so that many more devices can be connected to the Internet. It also improves addressing and routing of network traffic. Because the free pool of IPv4 addresses has been depleted, customers will want to request IPv6 address space for new networks, and eventually transition their networks from IPv4 to IPv6.

For a more complete understanding of IPv6, the video below provides a walkthrough of many of the finer details of IPv6.

Why Do You Need IPv6?

Now that IPv4 is depleted, there are extra costs associated with staying IPv4-only, which will likely increase over time. On the other hand, it is easy to get IPv6 from ARIN, there are generally no additional costs for ISPs, and fees were recently reduced for end users.

Don’t forget that we also have a reserve IPv4 block that is dedicated for IPv6 transition support, which you can read more about in ARIN’s Number Resource Policy Manual (Section 4.10) . You can receive one /24 every six months to support your IPv6 transition effort.

Preparing for IPv6

Before you implement IPv6, it’s a good idea to make sure your equipment, software, and staff are ready. Think about how many network addresses you’ll need, and how you’ll set up your network.

To learn more about how to determine how much IPv6 address space you need, visit Your First IPv6 Request .

Get advice from those who have already adopted IPv6, and ask questions! You can read case studies from organizations that have already adopted IPv6 including ISPs, hosting providers, enterprise businesses, universities, and governments.

How Do I Get IPv6?

It’s easy! Follow these steps:

• Research and plan (see above).
• Decide how much space you’ll need to request. Your First IPv6 Request will help.
• Submit your request through ARIN Online.

What Do I Do Next?

• Implement IPv6 on your network’s hardware and applications, using our IPv6 Case Studies for implementation advice and shared experiences from other organizations who have already implemented IPv6.

For More Information

For more information, see:

• Guide to Internet Number Resources
• Your First IPv6 Request
• IPv6 Case Studies
• IP Address Blocks from which ARIN Issues Resources
• IPv6 Wiki Archive
• IPv6 Consulting and Training Services
• IPv6 Hosting and DNS Providers

How ARIN uses IPv6

• How ARIN Adopted IPv6
• Video Part 1 | Part 2

How is IPv6 Different than IPv4?

IPv6 differs from IPv4 in many ways, including address size, format, notation, and possible combinations.

An IPv6 address consists of 128 bits (as opposed to the 32-bit size of IPv4 addresses) and is expressed in hexadecimal notation. The IPv6 anatomy graphic below represents just one possible configuration of an IPv6 address, although there are many different possibilities.

Determining the Netmask and Gateway of an IPv6 Address

As with IPv4, in IPv6 there is no way to definitively calculate the netmask and gateway using only a given address. Both are established when a person sets up a network, and you would need to contact your network administrator to determine what they are. However, when given an address and a prefix, one can compute the starting and ending addresses of a subnet, just like in IPv4.

To conform to typical conventions about IPv6 addressing of network interfaces, most networks use a /64 prefix. This prefix length accommodates stateless address autoconfiguration (SLAAC). Note that the length of a given IPv6 network prefix cannot be shorter than the registered IPv6 allocation or assignment.

There is no strong convention as to where to number the gateway; although choosing the smallest number in the network is common.

• The History of IPv6 @ ARIN
• IP Addresses & ASNs
• Quick Guide to Requesting Resources
• Preparing Applications for IPv6
• CIDR Chart: IP Address Block Size Equivalents in Classful Addressing, IPv4, and IPv6

Registration Services Help Desk 7:00 AM to 7:00 PM ET Phone: +1.703.227.0660 Fax: +1.703.997.8844

Tips for Calling the Help Desk

Introduction to IPv6

In this lesson, I’ll give you an introduction to IPv6 and you will learn the differences between IPv4 and IPv6. Let’s start with a nice picture:

This picture is old already but it shows you the reason why we need IPv6…we are running out of IPv4 addresses!

So what happened to IPv4? What went wrong? We have 32 bits which gives us 4,294,467,295 IP addresses. Remember our Class A, B, and C ranges? When the Internet started, you would get a Class A, B, or C network. Class C gives you a block of 256 IP addresses, class B is 65.535 IP addresses, and a class A even 16,777,216 IP addresses. Large companies like Apple, Microsoft, IBM, and such got one or more Class A networks. Did they really need > 16 million IP addresses? Many IP addresses were just wasted.

We started using VLSM (Variable Length Subnet Mask), so we could use any subnet mask we like and create smaller subnets, we longer had to use the class A, B, or C networks. We also started using NAT and PAT so we can have many private IP addresses behind a single public IP address.

Nevertheless, the Internet has grown in a way nobody expected 20 years ago. Despite all our cool tricks like VLSM and NAT/PAT we really need more IP addresses, and that’s why we need IPv6.

What happened to IPv5? Good question…IP version 5 was used for an experimental project called “Internet Stream Protocol”. It’s defined in an RFC if you are interested.

IPv6 has 128-bit addresses and has a much larger address space than 32-bit IPv4 which offered us a bit more than 4 billion addresses. Keep in mind every additional bit doubles the number of IP addresses…so we go from 4 billion to 8 billion, 16,32,64, etc. Keep doubling until you reach 128 bits. With 128 bits, this is the largest value you can create:

• 340,282,366,920,938,463,463,374,607,431,768,211,456

Can we even pronounce this? Let’s try this:

• 340- undecillion
• 282- decillion
• 366- nonillion
• 920- octillion
• 938- septillion
• 463- sextillion
• 463- quintillion
• 374- quadrillion
• 607- trillion
• 431- billion
• 768- million
• 211- thousand

That’s mind-boggling… This gives us enough IP addresses for networks on earth, the moon, mars, and the rest of the universe. To put this in perspective, let’s put the entire IPv6 and IPv4 address space next to each other:

• IPv6: 340282366920938463463374607431768211456
• IPv4: 4294467295

Some other nice numbers: the entire IPv6 address space is 4294467295 times the size of the complete IPv4 address space. Or, if you like percentages, the entire IPv4 address space is only 0.000000000000000000000000001.26% of the entire IPv6 address space.

The main reason to start using IPv6 is that we need more addresses, but it also offers some new features:

• No Broadcast traffic : that’s right, we don’t use broadcasts anymore. We use multicast instead. This means some protocols like ARP are replaced with other solutions.
• Stateless Autoconfiguration : this is like a “mini DHCP server.” Routers running IPv6 are able to advertise the IPv6 prefix and gateway address to hosts so that they can automatically configure themselves and get access outside of their own network.
• Address Renumbering : renumbering static IPv4 addresses on your network is a pain. If you use stateless autoconfiguration for IPv6, you can easily swap the current prefix with another one.
• Mobility : IPv6 has built-in support for mobile devices. Hosts will be able to move from one network to another and keep their current IPv6 address.
• No NAT / PAT : we have so many IPv6 addresses that we don’t need NAT or PAT anymore. Every device in your network can have a public IPv6 address.
• IPsec : IPv6 has native support for IPsec, you don’t have to use it, but it’s built-in the protocol.
• Improved header : the IPv6 header is simpler and doesn’t require checksums. It also has a flow label that is used to quickly see whether certain packets belong to the same flow.
• Migration Tools : IPv4 and IPv6 are incompatible, so we need migration tools. We can use multiple tunneling techniques to transport IPv6 over IPv4 networks (or the other way around). Running IPv4 and IPv6 simultaneously is called “dual stack.”

What does an IPv6 address look like? We use a different format than IPv4:

X:X:X:X:X:X:X:X where X is a 16-bit hexadecimal field

We don’t use decimal numbers like for IPv4. We are using hexadecimal now. Here’s an example of an actual IPv6 address:

2041:1234:140F:1122:AB91:564F:875B:131B

Now imagine you have to call one of your users or colleagues and ask him or her to ping this IPv6 address when you are trying to troubleshoot something…sounds like fun, right?

To make things a bit more convenient, it’s possible to shorten IPv6 addresses , which I discuss in this lesson . Running a local DNS server is also a good idea. Remembering hostnames is easier than these IPv6 addresses.

That’s all I have for now. I hope this introduction has given you an idea of why we need IPv6, what the address looks like, and some of the new features. The next lessons cover everything, including addressing, routing protocols, tunneling, and more.

That’s all for now! You should now have an idea of how IPv6 works. In future lessons, I will show you how to configure routing for IPv6 and some other things. If you have any questions, just leave a comment.

Tags: EUI-64

Forum Replies

Probably little mistake on last picture. On picture above is mac adress starting with CC0A and on the last picture is IPv6 address with CE0A. Anyway, thanks for great lesson.

In reality the router does one more thing when creating the IPv6 address using EUI-64. The MAC address is chopped in two pieces but it will also “flip” the 7th bit. When it’s a 0 it will make it a 1 and the other way around. Here’s an example for the MAC address I used in this tutorial:

CC0A.180E.0000

Each hexadecimal character represents 4 binary bits:

C = 1100 C = 1100 0 = 0000 A = 1010

Let’s put “CC” in binary behind each other:

EUI-64 will flip the 7th bit of this address so it will become:

Let’s calculate that back to hexadecim

If you want an example for EUI-64, I created a lesson that explains it in detail:

https://networklessons.com/ipv6/ipv6-eui-64-explained

Hello, Nice job at the introduction, I never new what anything past a trillion was called =). I’m sure i’ll have questions as I read through the following IPv6 lessons though.

Thanks again,

If you have any questions, just let me know…

21 more replies! Ask a question or join the discussion by visiting our Community Forum

Manual:IPv6/Address

Applies to RouterOS: v3, v4 +

• 3.1.1 Link-local address
• 3.1.2 Special purpose address
• 3.1.3 Compatibility address
• 3.2 Multicast address
• 3.3 Anycast address
• 5 Properties
• 6.1 Manual address configuration

Sub-menu: /ipv6 address Standards: RFC 4291

IPv6 uses 16 bytes addresses compared to 4 byte addresses in IPv4. IPv6 address syntax and types are described in RFC 4291.

There are multiple IPv6 address types, that can be recognized by their prefix. RouterOS distinguishes the following:

• multicast (with prefix ff00::/8)
• link-local (with prefix fe80::/10)
• loopback (the address ::1/128)
• unspecified (the address ::/128)
• other (all other addresses, including the obsoleted site-local addresses, and RFC 4193 unique local addresses; they all are treated as global unicast).

One difference between IPv6 and IPv4 addressing is that IPv6 automatically generates a link-local IPv6 address for each active interface that has IPv6 support.

Address Expression

IPv6 addresses are represented a little bit different than IPv4 addresses. For IPv6, the 128-bit address is divided in eight 16-bit blocks, and each 16-bit block is converted to a 4-digit hexadecimal number and separated by colons. The resulting representation is called colon-hexadecimal .

In example above IPv6 address in binary format is converted to colon-hexadecimal representation

IPv6 address can be further simplified by removing leading zeros in each block:

As you can see IPv6 addresses can have long sequences of zeros. These contiguous sequence can be compressed to ::

Note: Zero compression can only be used once. Otherwise, you could not determine the number of 0 bits represented by each instance of a double-colon

IPv6 prefix is written in address/prefix-length format. Compared to IPv4 decimal representation of network mask cannot be used. Prefix examples:

Address Types

Several IPv6 address types exist:

As you can see there are no Broadcast addresses in ipv6 network, compared to IPv4 broadcast functionality was completely replaced with multicast.

Unicast Addresses

Packets addressed to a unicast address are delivered only to a single interface. To this group belong:

• globally unique addresses and can be used to connect to addresses with global scope anywhere.
• link-local addresses
• site-local addresses (FEC0::/48) - deprecated
• special purpose addresses
• compatibility addresses

Global unicast address can be automatically assigned to the node by Stateless Address auto-configuration . Read More >> .

Link-local address

A link-local address is required on every IPv6-enabled interface, applications may rely on the existence of a link-local address even when there is no IPv6 routing, that is why link-local address is generated automatically for every active interface using it's interface identifier (calculated EUI-64 from MAC address if present). Address prefix is always FE80::/64 and IPv6 router never forwards link-local traffic beyond the link.

These addresses are comparable to the auto-configuration addresses 169.254.0.0/16 of IPv4.

A link-local address is also required for Neighbor Discovery processes.

Note: If interface is set as bridge port, interface specific link-local address is removed leaving only bridge link-local address

Special purpose address

Compatibility address, multicast address.

Most important multicast aspects are:

• traffic is sent to a single address but is processed by multiple hosts;
• group membership is dynamic, allowing hosts to join and leave the group at any time;
• in IPv6, Multicast Listener Discovery (MLD) messages are used to determine group membership on a network segment, also known as a link or subnet;
• host can send traffic to the group's address without belonging to the corresponding group.

A single IPv6 multicast address identifies each multicast group. Each group's reserved IPv6 address is shared by all host members of the group who listen and receive any IPv6 messages sent to the group's address.

Multicast address consists of the following parts: [1]

• The first 8 bits in multicast address is always 1111 1111 (which is FF in hexadecimal format).
• Flag uses the 9th to 12th bit and shows if this multicast address is predefined (well-known) or not. If it is well-known, all bits are 0s.
• Scope ID indicates to which scope multicast address belongs, for example, Scope ID=2 is link-local scope.
• Group ID is used to specify a multicast group. There are predefined group IDs, such as Group ID=1 - all nodes. Therefore, if multicast address is ff02::1, that means Scope ID=2 and Group ID=1, indicating all nodes in link-local scope. This is analogous to broadcast in IPv4.

Here is the table of reserved IPV6 addresses for multicasting:

The following table is a partial list of IPv6 multicast addresses that are reserved for IPv6 multicasting and registered with the Internet Assigned Numbers Authority (IANA). For complete list of assigned addresses read IANA document .

Multicast addresses can be used to discover nodes in a network. For example, discover all nodes

discover all routers

Anycast address

Anycast address is a new type of address incorporated in IPv6.

Anycasting is a new networking paradigm supporting service–oriented Addresses where an identical address can be assigned to multiple nodes providing a specific service. An anycast packet (i.e., one with an anycast destination address) is delivered to one of these nodes with the same anycast address.

Anycast address is not assigned a specific address range. It is assigned from unicast address range.

Interface Identifier

The last 64 bits of an IPv6 address are the interface identifier that is unique to the 64-bit prefix of the IPv6 address. There are several ways how to determine interface identifier:

• randomly generated to provide a level of anonymity;
• manually configured.

Traditional interface identifiers for network adapters are 48-bit MAC address. This address consists of a 24-bit manufacturer ID and a 24-bit board ID.

IEEE EUI-64 is a new standard for network interface addressing. The company ID is still 24-bits in length, but the extension ID is 40 bits, creating a much larger address space for network adapters.

To create an EUI-64 address from the interface MAC address:

• 0xFFFE is inserted into the MAC address between the manufacturer ID and the board ID.
• seventh bit of the first byte is reversed.

In RouterOS, if the eui-64 parameter of an address is configured, the last 64 bits of that address will be automatically generated and updated using interface identifier. The last bits must be configured to be zero for this case. Example:

Read-only properties

Manual address configuration

This example shows how to set up simple addressing with global IPv6 addresses between two routers.

R1 configuration:

R2 configuration:

Check address list

Notice that our added address has G flag indicated that this address can be globally routed. We also have link local address on the interface which is created automatically for every IPv6 capable interface.

Test connectivity

[ Top | Back to Content ]

Navigation menu

• Skip to content
• Skip to search
• Skip to footer

IPv6 Addressing and Basic Connectivity Configuration Guide, Cisco IOS XE 17 (Cisco ASR 920)

Bias-free language.

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

• IPv6 Addressing and Basic Connectivity
• IPv6 Switching: Cisco Express Forwarding Support
• Unicast Reverse Path Forwarding for IPv6
• IPv6 MTU Path Discovery
• ICMP for IPv6
• IPv6 ICMP Rate Limiting
• ICMP for IPv6 Redirect
• IPv6 Neighbor Discovery
• IPv6 Neighbor Discovery Cache

IPv6 Stateless Autoconfiguration

Chapter: IPv6 Stateless Autoconfiguration

Simplified network renumbering for ipv6 hosts, enabling ipv6 stateless autoconfiguration, example: displaying ipv6 interface statistics, additional references.

The IPv6 stateless autoconfiguration feature can be used to manage link, subnet, and site addressing changes.

Information About IPv6 Stateless Autoconfiguration

All interfaces on IPv6 nodes must have a link-local address, which is usually automatically configured from the identifier for an interface and the link-local prefix FE80::/10. A link-local address enables a node to communicate with other nodes on the link and can be used to further configure the node.

Nodes can connect to a network and automatically generate global IPv6 addresses without the need for manual configuration or help of a server, such as a Dynamic Host Configuration Protocol (DHCP) server. With IPv6, a device on the link advertises any global prefixes in Router Advertisement (RA) messages, as well as its willingness to function as a default device for the link. RA messages are sent periodically and in response to device solicitation messages, which are sent by hosts at system startup.

A node on the link can automatically configure global IPv6 addresses by appending its interface identifier (64 bits) to the prefixes (64 bits) included in the RA messages. The resulting 128-bit IPv6 addresses configured by the node are then subjected to duplicate address detection to ensure their uniqueness on the link. If the prefixes advertised in the RA messages are globally unique, then the IPv6 addresses configured by the node are also guaranteed to be globally unique. Device solicitation messages, which have a value of 133 in the Type field of the ICMP packet header, are sent by hosts at system startup so that the host can immediately autoconfigure without needing to wait for the next scheduled RA message.

The strict aggregation of the global routing table requires that networks be renumbered when the service provider for the network is changed. When the stateless autoconfiguration functionality in IPv6 is used to renumber a network, the prefix from a new service provider is added to RA messages that are sent on the link. (The RA messages contain both the prefix from the old service provider and the prefix from the new service provider.) Nodes on the link automatically configure additional addresses by using the prefix from the new service provider. The nodes can then use the addresses created from the new prefix and the existing addresses created from the old prefix on the link. Configuration of the lifetime parameters associated with the old and new prefixes means that nodes on the link can make the transition to using only addresses created from the new prefix. During a transition period, the old prefix is removed from RA messages and only addresses that contain the new prefix are used on the link (the renumbering is complete) (see the figure below).

How to Configure IPv6 Stateless Autoconfiguration

Configuration examples for ipv6 stateless autoconfiguration.

In the following example, the show ipv6 interface command is used to verify that IPv6 addresses are configured correctly for GigabitEthernet interface 0/0/0. Information is also displayed about the status of IPv6 neighbor redirect messages, IPv6 neighbor discovery messages, and stateless autoconfiguration.

Related Documents

Standards and rfcs, technical assistance, was this document helpful.

Contact Cisco

• (Requires a Cisco Service Contract )