Overview
IPv6 solves address exhaustion with 128-bit addresses, simplified header, and native IPSec support. CCNA covers addressing, SLAAC, DHCPv6, transition mechanisms, and OSPFv3 at awareness level.
For a full dual-stack Packet Tracer lab (parallel IPv4/IPv6 addressing, floating static failover, and NDP/RA observation), see Dual-Stack IPv4 & IPv6 Lab.
Why IPv6
IPv4's ~4.3 billion addresses are exhausted. IPv6 uses 128-bit addresses (~3.4 × 10³⁸) — enough for every device with no need for NAT at scale. The OSI model is unchanged except the network layer moves from 32-bit to 128-bit addressing.
Address format
IPv6 addresses are written as eight 16-bit hexadecimal fields:
2001:0DB8:0000:0001:0000:0000:0000:0001
Shortening rules (exam-critical):
- Remove leading zeros in each field:
0DB8→DB8 - Replace one consecutive all-zero field group with
:::2001:DB8:0:1::1 ::can appear only once per address
| Address | Meaning |
|---|---|
::1 | Loopback (like 127.0.0.1) |
:: | Unspecified / unknown (source during autoconfig) |
::/0 | Default route (like 0.0.0.0/0) |
In URLs, bracket the address: http://[2001:db8::1]:8080/
Prefer FQDNs for users; hexadecimal addresses are mainly for diagnostics and configuration.
Address types
| Type | Scope | Range / prefix | Routed on Internet? |
|---|---|---|---|
| Global unicast | Unique, routable | 2000::/3 | Yes |
| Unique local (ULA) | Private org use | FC00::/7 | No (like RFC 1918) |
| Link-local | Single link only | FE80::/10 | No — routers don't forward |
| Multicast | One-to-many | FF00::/8 | Scoped |
| Anycast | One-to-nearest | From unicast space | Yes — same address on multiple nodes |
No broadcast addresses in IPv6. Broadcasts are replaced by multicast (e.g., FF02::1 all nodes on link).
Site-local (FEC0::/10) is deprecated. Exam questions about "private IPv6 not routable on Internet" expect Unique Local (FC00::/7).
Global unicast structure
A common enterprise assignment is /48 from an ISP. With /64 per subnet (standard for all interfaces including point-to-point), 16 bits remain for internal subnets → 65,536 subnets.
2001:DB8:1234:0001::/64
|---- /48 org ----|--subnet--|
|------ 64-bit network prefix ------|-- 64-bit interface ID --|
IPv6 address types — global unicast, unique local, and link-local ranges.
Supplementary figure from Panagiss CCNAmd
EUI-64 interface IDs
The interface ID (last 64 bits) can be derived from the MAC address:
- Split the 48-bit MAC in half
- Insert FF:FE in the middle → 64 bits
- Flip the 7th bit (U/L bit) of the first octet for global uniqueness
ipv6 unicast-routing ! interface GigabitEthernet0/0 ipv6 address 2001:DB8:1:1::/64 eui-64
Modern OS hosts often randomize the interface ID for privacy instead of strict EUI-64.
Link-local addresses
Mandatory on every IPv6-enabled Cisco interface. Used for:
- Routing protocol neighbor relationships (OSPFv3, EIGRPv6, RIPng)
- Next-hop for default gateway (host uses router's link-local, not global)
- NDP (Neighbor Discovery — IPv6's ARP replacement)
interface GigabitEthernet0/0 ipv6 address FE80::1 link-local ipv6 address 2001:DB8:1:1::1/64
Link-local addresses don't change when global addresses are renumbered — stable router reference for hosts.
Enable IPv6 routing
IPv4 routing is on by default; IPv6 routing is off until enabled.
ipv6 unicast-routing ! interface GigabitEthernet0/0 ipv6 address 2001:DB8:1:1::1/64 ! show ipv6 interface brief show ipv6 route
Without ipv6 unicast-routing, the router won't forward IPv6 between interfaces (though it can still have addresses).
SLAAC — Stateless Address Autoconfiguration
SLAAC lets hosts generate their own global address without a DHCP server tracking assignments ("stateless").
Process
- Host sends Router Solicitation (RS) to
FF02::2(all routers) from its link-local address - Router replies with Router Advertisement (RA) — ICMPv6 type 134 to
FF02::1(all nodes) - RA contains the /64 prefix and default gateway (router's link-local)
- Host combines prefix + interface ID (EUI-64 or random) → global address
- Host runs Duplicate Address Detection (DAD) via solicited-node multicast
SLAAC provides address and default gateway but not DNS by default. DNS still needs DHCPv6 (stateless options) or manual config — "stateless DHCPv6."
| Method | Address from | Options (DNS) from | Stateful? |
|---|---|---|---|
| SLAAC | RA prefix + host ID | Optional DHCPv6 | No |
| SLAAC + DHCPv6 | RA | DHCPv6 (stateless) | Partial |
| DHCPv6 only | DHCPv6 server | DHCPv6 | Yes |
Router advertisements are sent periodically when a global unicast address is configured on an interface (default on Cisco).
DHCPv6
Stateful DHCPv6 assigns addresses like IPv4 DHCP — server tracks leases. Used when more control is needed (VoIP option 150 equivalent, renumbering, no RA).
DHCPv6 relay forwards requests to a remote server (like ip helper-address):
interface GigabitEthernet0/1 ipv6 dhcp relay destination 2001:DB8:20::10
Hosts and relays listen on multicast FF02::1:2 (all DHCP servers/agents).
If DHCPv6 is unavailable, hosts fall back to SLAAC.
Neighbor Discovery (NDP)
NDP replaces ARP using ICMPv6:
| IPv4 | IPv6 equivalent |
|---|---|
| ARP Request/Reply | Neighbor Solicitation / Advertisement |
| ARP broadcast | Solicited-node multicast FF02::1:FFxx:xxxx |
Solicited-node multicast — auto-created per unicast address; used for DAD and address resolution without broadcasts.
Do not blanket-deny ICMPv6 in IPv6 ACLs — NDP, RA, and path MTU discovery depend on it. See IPv6 ACL section below.
IPv6 transition mechanisms
Organizations run IPv4 and IPv6 simultaneously during migration.
Dual stack
Run both IPv4 and IPv6 on the same interfaces. Hosts and routers communicate using whichever protocol the peer supports. Preferred long-term approach.
Host ──IPv4──► IPv4 server
Host ──IPv6──► IPv6 server
Tunneling (IPv6 over IPv4)
When IPv6 islands are separated by IPv4-only infrastructure, encapsulate IPv6 inside IPv4 headers (protocol 41).
| Method | Description |
|---|---|
| Manual 6in4 | Admin configures tunnel source/dest IPv4 endpoints |
| 6to4 | Automatic prefix 2002:WWXX:YYZZ::/48 from public IPv4 (e.g., 192.168.99.1 → 2002:C0A8:6301::/48) |
| ISATAP | Host-to-router tunnel across site IPv4 infrastructure |
| Teredo | Host-to-host through NAT (awareness) |
interface Tunnel0 ipv6 address 2003::1/64 tunnel source 10.1.2.1 tunnel destination 10.1.2.2 tunnel mode ipv6ip ! ipv6 route 2001:1:1:3::/64 Tunnel0
NAT64 / NAT-PT (awareness)
Translates between IPv4 and IPv6 protocols and addresses — allows IPv4-only hosts to reach IPv6-only services. Less common than dual stack; know it exists for exam awareness.
IPv6 routing protocols
IPv6 uses separate processes and routing tables from IPv4. Enable ipv6 unicast-routing first.
| Protocol | IPv4 equivalent | Key CCNA notes |
|---|---|---|
| RIPng | RIP v2 | UDP 521; multicast FF02::9; per-interface ipv6 rip PROCESS enable |
| OSPFv3 | OSPFv2 | Different process; uses link-local next-hops; needs router-id (IPv4 format) |
| EIGRP for IPv6 | EIGRP | Separate address family; ipv6 eigrp AS on interfaces |
| MP-BGP4 | BGP | Carries multiple protocols (beyond CCNA config depth) |
OSPFv3 configuration
ipv6 unicast-routing ! ipv6 router ospf 1 router-id 1.1.1.1 ! interface GigabitEthernet0/0 ipv6 ospf 1 area 0 ! interface Serial0/0/0 ipv6 ospf 1 area 0 ! show ipv6 route ospf show ipv6 ospf neighbor
OSPFv3 requires a router-id in IPv4 dotted-decimal format. If no IPv4 address exists on the router, set router-id manually or add a loopback with an IPv4 address.
EIGRP for IPv6 (awareness)
ipv6 unicast-routing ! ipv6 router eigrp 100 eigrp router-id 1.1.1.1 ! interface GigabitEthernet0/0 ipv6 eigrp 100
RIPng and OSPFv3 advertise using link-local addresses, not global unicast.
IPv6 ACLs
IPv6 ACLs are separate from IPv4 ACLs — independent, can coexist on the same interface.
| Feature | IPv4 ACL | IPv6 ACL |
|---|---|---|
| Identification | Number or name | Name only |
| Wildcard | Wildcard mask (can be non-contiguous) | Prefix length (contiguous bits only) |
| Implicit rules | Implicit deny only | Implicit permits for NDP/RA above implicit deny |
| Match fields | Precedence, ToS, TTL | Flow label, DSCP, extension headers |
ipv6 access-list BLOCK-WEB deny tcp any any eq www permit ipv6 any any ! interface GigabitEthernet0/0 ipv6 traffic-filter BLOCK-WEB in
Apply with ipv6 traffic-filter (not ip access-group). Prefer inbound on perimeter interfaces.
Blocking all ICMPv6 breaks NDP, RA, and path MTU discovery. IPv6 ACLs include implicit permits for essential ICMPv6 types — but be careful with explicit deny icmp statements.
Interface ACLs do not filter traffic originated by the router itself (same as IPv4).
Static IPv6 routes
ipv6 route 2001:DB8:2::/64 2001:DB8:1::2 ipv6 route ::/0 2001:DB8:1::2
Verification commands
show ipv6 interface brief show ipv6 address show ipv6 route show ipv6 protocols show ipv6 ospf neighbor show ipv6 access-list debug ipv6 packet (lab only)
Exam checklist
| Trap | Key fact |
|---|---|
:: usage | Only once per address |
| Link-local prefix | FE80::/10 — not forwarded by routers |
| ULA vs site-local | ULA = FC00::/7; site-local deprecated |
| SLAAC DNS | Needs DHCPv6 or manual — RA alone doesn't give DNS |
| OSPFv3 router-id | IPv4 format required |
| IPv6 ACL apply | ipv6 traffic-filter NAME in/out |
| No broadcast | Use multicast (FF02::1, solicited-node) |
| Enable forwarding | ipv6 unicast-routing required |
| /64 everywhere | Standard subnet size — no VLSM-style conservation |
| ICMPv6 deny | Breaks NDP — critical exam trap |
Quick lab progression
ipv6 unicast-routing- Assign global unicast
/64and link-local on interfaces - Verify connectivity with
ping ipv6 - Add static routes or OSPFv3
- Test SLAAC from a host (RA enabled by default on router LAN interfaces)
- Optional: DHCPv6 pool or relay for DNS options