Configure and verify IPv6 addressing and prefix

IPv6 is the replacement for IPv4, created because IPv4’s 32-bit address space ran out (the last free blocks were allocated to the regional registries in 2011). An IPv6 address is 128 bits long, which gives about 340 undecillion addresses, enough that every device can have a globally unique public address and NAT becomes unnecessary. IPv6 is not backward compatible with IPv4; the two run side by side (dual stack) on most networks today.

Beyond the bigger address space, IPv6 simplifies several things: the header is a fixed 40 bytes with no checksum and no router fragmentation, hosts can configure their own addresses without a DHCP server (SLAAC), there is no broadcast (multicast is used instead), and ICMPv6 absorbs the jobs of ARP and IGMP through the Neighbor Discovery Protocol.

Writing IPv6 addresses

A 128-bit address is written as eight groups of 16 bits, each group shown as up to four hexadecimal digits and separated by colons. Cisco calls the groups hextets (you may also see “quartets” or “fields”). Hex digits are 0 to 9 and a to f, where a = 10 and f = 15; each hex digit is 4 bits. The full form of an address looks like this:

2001:0db8:0000:0000:0000:ff00:0042:8329

Nobody writes that. Two rules shorten it:

1. Drop leading zeros in each hextet. 0db8 becomes db8, 0000 becomes 0, 0042 becomes 42. Trailing zeros are not dropped: ff00 stays ff00. Result: 2001:db8:0:0:0:ff00:42:8329.
2. Replace one run of consecutive all-zero hextets with a double colon ::. This may be done only once per address, because otherwise it would be impossible to tell how many zeros each :: stands for. If there are two runs of zeros, shorten the longer one; if they are the same length, shorten the first. Result: 2001:db8::ff00:42:8329.

To expand a shortened address, count the hextets present, subtract from 8, and insert that many 0000 groups at the ::. 2001:db8::1 has 3 hextets shown, so :: stands for 5 zero hextets: 2001:0db8:0000:0000:0000:0000:0000:0001.

More examples:

Hex letters are case-insensitive; RFC 5952 recommends lowercase.

Prefixes

IPv6 uses CIDR prefix lengths only; there are no dotted-decimal masks. An address is written 2001:db8:acad:1::1/64, meaning the first 64 bits identify the network (the prefix) and the last 64 bits identify the interface (the interface ID). Almost every LAN subnet in IPv6 is a /64; this is required for SLAAC and EUI-64 to work. Point-to-point router links are commonly /64 too, though /127 is also used.

A typical enterprise receives a /48 from its ISP (or a /56 for a small site), which gives 16 bits of subnetting between /48 and /64, or 65,536 /64 subnets. The address structure is:

Because hextet boundaries fall every 16 bits, prefixes that are multiples of 16 (/16, /32, /48, /64) are easy to read: the prefix is simply the first N hextets. To find the /64 prefix of 2001:db8:acad:1:20c:29ff:fe12:3456/64, keep the first four hextets and zero the rest: 2001:db8:acad:1::/64. For a /56, take the first three hextets plus the first two hex digits of the fourth: 2001:db8:acad:1200::/56 contains subnets 2001:db8:acad:1200::/64 through 2001:db8:acad:12ff::/64.

Configuring IPv6 on Cisco IOS

Three commands matter most. First, IPv6 routing is off by default on a router; without ipv6 unicast-routing the router will accept IPv6 addresses on its interfaces and act like a host (it will not forward packets between interfaces, and will not send Router Advertisements). Second, addresses are assigned with ipv6 address. Third, ipv6 enable puts IPv6 on an interface with only an automatically generated link-local address.

! Enable IPv6 packet forwarding globally (required on routers)
R1(config)# ipv6 unicast-routing
!
R1(config)# interface gigabitethernet 0/0
! A full global unicast address, typed manually
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# no shutdown
!
R1(config)# interface gigabitethernet 0/1
! Give only the /64 prefix; IOS builds the interface ID from the MAC (EUI-64)
R1(config-if)# ipv6 address 2001:db8:acad:2::/64 eui-64
! Override the automatic link-local with an easy-to-read one
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# no shutdown
!
R1(config)# interface gigabitethernet 0/2
! Link-local only: no global address, but IPv6 runs on the interface
R1(config-if)# ipv6 enable
R1(config-if)# no shutdown
!
R1(config)# interface gigabitethernet 0/3
! Learn a global address from a neighboring router via SLAAC
R1(config-if)# ipv6 address autoconfig
! Or, obtain a global address from a DHCPv6 server
R1(config-if)# ipv6 address dhcp

Configuring any global address automatically enables IPv6 on that interface and creates a link-local address, so ipv6 enable is only needed when you want IPv6 without a global address. Multiple global addresses per interface are normal in IPv6 and need no secondary keyword.

Verifying IPv6

R1# show ipv6 interface brief
GigabitEthernet0/0     [up/up]
    FE80::20C:29FF:FE12:3456
    2001:DB8:ACAD:1::1
GigabitEthernet0/1     [up/up]
    FE80::1
    2001:DB8:ACAD:2:20C:29FF:FE12:3457
GigabitEthernet0/2     [up/up]
    FE80::20C:29FF:FE12:3458
GigabitEthernet0/3     [administratively down/down]
    unassigned

Every enabled interface shows its link-local address (FE80::...) first, then any global addresses. G0/1’s global address ends in 20c:29ff:fe12:3457, the EUI-64 interface ID built from the MAC 000c.2912.3457; the process is explained in section 1.9.d.

R1# show ipv6 interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::20C:29FF:FE12:3456
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:ACAD:1::1, subnet is 2001:DB8:ACAD:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:1
    FF02::1:FF12:3456
  MTU is 1500 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds (using 30000)
  ND advertised reachable time is 0 (unspecified)
  ND advertised retransmit interval is 0 (unspecified)
  ND router advertisements are sent every 200 seconds
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.

The joined group list is instructive: the interface listens on ff02::1 (all nodes), ff02::2 (all routers, because ipv6 unicast-routing is on), and one solicited-node multicast address for each of its unicast addresses (ff02::1:ff00:1 for ...::1 and ff02::1:ff12:3456 for the link-local). These are covered in 1.9.c.

R1# show ipv6 route
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, ...
C   2001:DB8:ACAD:1::/64 [0/0]
     via GigabitEthernet0/0, directly connected
L   2001:DB8:ACAD:1::1/128 [0/0]
     via GigabitEthernet0/0, receive
C   2001:DB8:ACAD:2::/64 [0/0]
     via GigabitEthernet0/1, directly connected
L   2001:DB8:ACAD:2:20C:29FF:FE12:3457/128 [0/0]
     via GigabitEthernet0/1, receive
L   FF00::/8 [0/0]
     via Null0, receive

R1# show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
2001:DB8:ACAD:1::10                         0 0050.56be.1a2b  REACH Gi0/0
FE80::250:56FF:FEBE:1A2B                    2 0050.56be.1a2b  STALE Gi0/0

R1# ping 2001:db8:acad:1::10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:ACAD:1::10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/2 ms

show ipv6 neighbors is the IPv6 equivalent of show ip arp (there is no ARP in IPv6). When pinging a link-local address you must also tell IOS which interface to use, because the same link-local address can exist on every link: after ping fe80::1, IOS prompts for the “Output Interface” and you type the interface name (for example GigabitEthernet0/0).