CCNA IPv6 Addressing: Address Types, EUI-64, SLAAC and Prefix Sizing

An IPv6 address is 128 bits written as eight 16-bit hextets of four hex digits, separated by colons. Two rules shorten it, and both are reversible only if you apply them exactly (RFC 4291):

• Drop leading zeros inside any hextet: 0db8 becomes db8, 000a becomes a, 0000 becomes 0. Trailing zeros are never dropped: 0d40 can only shrink to d40.
• Replace one run of consecutive all-zero hextets with ::, and only once per address. Using :: twice is invalid because nobody could tell how many zeros each one stands for.

RFC 5952 adds a recommended (canonical) text form so that the same address is always written the same way: drop all leading zeros, compress the longest run of zero hextets, pick the first run when two runs tie, never use :: for a single zero hextet, and use lowercase. Cisco IOS displays addresses in uppercase; the value is identical.

Expanding is the reverse and is what most troubleshooting needs: count the hextets that are written, and the :: stands for exactly enough zero hextets to make eight, inserted at the position where it appears. Then pad every hextet on the left to four digits. 2001:DB8:0:93::C has five written hextets, so :: is three zero hextets after 93: 2001:0DB8:0000:0093:0000:0000:0000:000C. Padding a hextet on the right instead of the left, or placing the zeros anywhere other than where the :: sits, produces a different address.

You identify an IPv6 address type from its leading bits, which in practice means its first hextet. The interface ID never changes the type. IPv6 has no broadcast; one-to-all delivery uses multicast instead (and anycast addresses are drawn from unicast space, so they look like unicast).

Details worth knowing:

• Unique local addresses (RFC 4193) are in FC00::/7, but only the half with the L bit set (FD00::/8) is defined, and it is followed by a random 40-bit global ID so that two organisations that merge are unlikely to collide. ULA is the right choice for space that must route between internal subnets but must not be reachable from the internet.
• Site-local (FEC0::/10) was deprecated by RFC 3879 and replaced by unique local addressing. It is not a current choice.
• 2001:DB8::/32 is reserved for documentation (RFC 3849). It is technically inside 2000::/3 but is never used on a real network.
• Do not confuse the unspecified address :: with the default route ::/0. The first is a source address meaning "none"; the second is a routing-table prefix that matches everything.

Modified EUI-64 turns a 48-bit MAC address into the 64-bit interface ID (the last four hextets) in three steps (RFC 4291 appendix A):

1. Split the MAC into two halves of three bytes each: 0019.e8d4.7b3a becomes 00:19:e8 and d4:7b:3a.
2. Insert FFFE between the halves: 00:19:E8:FF:FE:D4:7B:3A.
3. Invert the universal/local (U/L) bit, the 7th bit of the first byte, which has the value 0x02. Flip it whatever its starting value: 00 becomes 02, A8 becomes AA, 02 becomes 00.

The result 0219:E8FF:FED4:7B3A is written 219:E8FF:FED4:7B3A after dropping the leading zero. With the prefix 2001:DB8:BEEF:20::/64 the address is 2001:DB8:BEEF:20:219:E8FF:FED4:7B3A.

The bit flip is where most mistakes happen. Work on the first byte in binary when it is not 00:

A quick way: the second hex digit of the first byte changes by 2. If the digit's 0x2 bit is clear, add 2 (0→2, 8→A, 4→6); if it is set, subtract 2 (2→0, E→C, 3→1).

Reversing EUI-64 is used to find which device owns an address, for example to search a switch's MAC address table. Take the interface ID, recognise FF:FE in the middle (bytes 4 and 5) and remove it, then flip the 0x02 bit of the first byte back. 2C4:10FF:FE6B:D917 is 02C4:10FF:FE6B:D917; removing FFFE leaves 02:C4:10:6B:D9:17, and flipping 02 back to 00 gives the MAC 00c4.106b.d917. An interface ID with no FFFE in that position was not built with EUI-64: it was typed by hand (such as ::1) or randomly generated.

Cisco IOS gives an interface its IPv6 addresses with the ipv6 address family of commands, and you verify them with show ipv6 interface. The methods you must tell apart:

Several global addresses can coexist on one interface. Unlike IPv4's ip address, which replaces the primary address unless you add secondary, each ipv6 address command adds an address, and there is no secondary keyword. This is how a LAN carries an old and a new prefix during renumbering; the router advertises both prefixes. Remove one with no ipv6 address followed by that exact address and length.

Verification commands:

• show ipv6 interface brief prints one short block per interface: its [status/protocol], then each IPv6 address, link-local first. An interface with no IPv6 configuration shows unassigned. An interface that lists only an FE80 address has IPv6 enabled but no global address.
• show ipv6 interface type number gives the detail: whether IPv6 is enabled, the link-local address, each global address with its subnet, DAD tags such as [TEN] or [DUP], the joined multicast groups and the ND/RA settings.
• show ipv6 neighbors lists other nodes (the neighbour cache), not the router's own addresses; show ipv6 route connected lists connected prefixes, not interface status or link-local addresses.

Reading show ipv6 interface brief output is a skill on its own: a short interface ID such as ::A or FE80::A means the address was typed, while FE80::21B:D4FF:FE5A:6C01 was generated by EUI-64 from MAC 001b.d45a.6c01 (remove FFFE, flip 02 back to 00).

A link-local address is an FE80::/10 address that is valid only on its own link and is required on every IPv6-enabled interface, because Neighbor Discovery, router advertisements and routing protocols all use it. Key behaviour:

• Created automatically the moment IPv6 is enabled on an interface, by ipv6 enable or by any ipv6 address command. On Ethernet, IOS builds it as FE80:: plus the interface's modified EUI-64 ID, so an interface configured with eui-64 has the same interface ID in its link-local and global addresses.
• Unique only per link. Routers never forward link-local traffic, so the same link-local address can be reused on every interface or VLAN subinterface of one router. Setting the same manual link-local address (for example ipv6 address FE80::A link-local) on each subinterface is a common, valid design that gives hosts an easy-to-read gateway. DAD checks each link separately.
• It is the hosts' default gateway. A router sends its router advertisements from its link-local address, and hosts install that source address as their default router. If you set a manual link-local such as FE80::A, hosts list FE80::A (on their interface) as the gateway, not the router's global address.
• When you need IPv6 on a link with no global address at all, such as some point-to-point links, ipv6 enable gives you an automatic link-local only.

Because a link-local address is ambiguous without a link, tools and routing tables pair it with the outgoing interface.

Hosts learn their prefix and default router from Router Advertisements (RAs), ICMPv6 messages that a router multicasts periodically to FF02::1 (all nodes) and also sends in response to a host's Router Solicitation (as a multicast or a unicast reply), which the host multicasts to FF02::2 (all routers) because it does not yet know any router's address. For a Cisco IOS router to play its part, two things must be true:

1. ipv6 unicast-routing is enabled globally. Without it, IOS behaves as an IPv6 host: it forwards no IPv6 packets and sends no RAs, so hosts get neither a prefix nor a default router. Interface commands such as ipv6 nd prefix or the RA flags only shape RAs that are being sent; they cannot fix missing RAs. Enabling routing also makes the interface join FF02::2.
2. The interface has an on-link prefix to advertise. By default IOS advertises the prefix of each global address configured on the interface (ipv6 nd prefix can add or change advertised prefixes). An interface with only ipv6 enable (link-local only) sends RAs that name the router as a default gateway but carry no prefix, so SLAAC hosts keep only their link-local addresses.

A router that should advertise is configured with addresses; ipv6 address autoconfig is the opposite role, making the router a client of someone else's RAs.

Two RA fields matter for troubleshooting: the router lifetime (non-zero means "use me as a default router"; ipv6 nd ra lifetime 0 tells hosts not to) and, per prefix, the autonomous (A) flag that allows SLAAC from that prefix.

SLAAC works only with a /64 because hosts append a 64-bit interface ID to the advertised prefix, and RFC 4862 hosts build an address only when prefix length plus interface ID length equals 128. A /56, /60 or any other length in an RA is ignored for address formation: hosts may still learn the router as default gateway from the same RA, which is a telling symptom (gateway present, no global address). If a LAN interface carries prefixes of several lengths, hosts form SLAAC addresses from the /64 prefixes only and ignore the others; several prefixes in one RA are normal. (Many hosts form more than one address per /64, for example a stable address plus temporary privacy addresses under RFC 8981, but all of them come from /64 prefixes.) Hosts may build the 64-bit ID with EUI-64 or, as most modern operating systems do, a random or stable-private value; either way it is 64 bits.

Common IPv6 prefix sizes:

Because IPv6 has no broadcast address, a /127 holds exactly the two router addresses of a point-to-point link; carrying over the IPv4 /30 habit as a /126 works but is not the RFC 6164 recommendation. Many networks still use a /64 per link for simplicity.

Counting subnets: the number of /64s in a block is 2 to the power of (64 minus the prefix length). Carving blocks: each hex digit is 4 bits (a nibble), so prefixes that end on a nibble boundary (/48, /52, /56, /60, /64) are easiest to read.

• Splitting a /48 into 16 equal blocks needs 4 more bits, so /52; those bits are the first hex digit of the fourth hextet, so a /48 such as 2001:DB8:6::/48 splits into 2001:DB8:6:0000::/52, 2001:DB8:6:1000::/52 and so on up to 2001:DB8:6:F000::/52. Counting the blocks from 0, block 11 is 2001:DB8:6:B000::/52.
• Splitting a /48 into /56s uses the high byte of the fourth hextet: block n is n in hex followed by 00. For 2001:DB8:F::/48, block 45 is 0x2D, so 2001:DB8:F:2D00::/56, holding /64s 2D00 to 2DFF. Convert decimal to hex first, and keep the trailing zeros: written without them, the value lands in the low byte and names a /64 inside the first /56.

Two addresses are in the same /64 when their first four hextets are identical after full expansion. Expand both addresses (place the zeros that :: stands for, pad each hextet on the left), then compare the first 64 bits:

• 2001:DB8:F3:7C::20 has fourth hextet 007C; 2001:DB8:F3:7C0::20 has 07C0. They look alike but are different /64s, because omitted digits are always leading zeros.
• In 2001:DB8:BEEF:3::2C:41 the :: sits after the fourth hextet, so the fourth hextet is 0003 and 2C belongs to the interface ID.
• A /64 covers four hextets, not three: hosts that share only their first three hextets are not necessarily on the same subnet.

For a prefix that does not end on a hextet boundary, work out how many bits of the partial hextet are fixed. A /58 fixes the first 10 bits of the fourth hextet and leaves 6 free, so it holds 64 /64s. 2001:DB8:9:C0::/58 therefore spans fourth-hextet values 00C0 to 00FF; a value just below or just above that range belongs to a neighbouring /58, and a value that only looks similar after a careless expansion may be far away.

The router signals the assignment method to hosts with flags in its RAs, and the default gateway always comes from the RA, never from DHCPv6. DHCPv6 has no default-gateway option (unlike DHCPv4 option 3).

Points the exam builds on:

• The M flag alone tells hosts to ask DHCPv6 for an address, but the prefix is still advertised with the A flag, so many hosts also create a SLAAC address. To make DHCPv6 the only source, clear the A flag with no-autoconfig on the prefix (or ipv6 nd prefix default no-autoconfig for all of them).
• Keep sending RAs with a non-zero router lifetime. Suppressing RAs or setting ipv6 nd ra lifetime 0 stops hosts from having any default gateway, so they reach only their own link even though DHCPv6 leases work.
• If the DHCPv6 server is on another subnet, the router's interface needs ipv6 dhcp relay destination server-address; relaying gets leases through but supplies no gateway either. (Client-side commands on PCs belong to the client-connectivity topic, and DHCPv4 to its own topic.)

Duplicate address detection (DAD) checks that a unicast address is unused on the link before the node uses it (RFC 4862). The node sends a Neighbor Solicitation for its new address from the unspecified source :: (it has no usable address yet) to that address's solicited-node group. While it waits, the address is tentative; if another node answers, the address is a duplicate.

IOS also logs a duplicate-address syslog message naming the address and interface in the form %IPV6_ND-4-DUPLICATE: Duplicate address address on interface. Which address is duplicated decides the impact. A duplicate global address is simply not used, and the interface keeps working on its other addresses. A duplicate link-local address is serious: Cisco IOS disables IPv6 processing on that interface, including its global addresses, because Neighbor Discovery and routing depend on the link-local. DAD runs on the node that is adding the address, so that node marks it duplicate; the node already using the address answers the solicitation and carries on. Fix it by configuring a unique link-local address.

Multicast groups an interface joins. IPv6 replaces broadcast with targeted multicast. show ipv6 interface lists the "Joined group address(es)":

• FF02::1, all nodes: joined by every IPv6 interface, host or router; periodic RAs go here.
• FF02::2, all routers: joined only when the device acts as a router (ipv6 unicast-routing); Router Solicitations go here.
• Solicited-node groups, FF02::1:FFxx:xxxx: one per distinct last-24-bits value of the interface's unicast addresses (link-local included). Take the last 24 bits (6 hex digits) and append them to FF02::1:FF. A target ending 00A4:D25E maps to FF02::1:FFA4:D25E.

Address resolution uses the solicited-node group as the Neighbor Solicitation's destination, so only nodes whose address ends in those 24 bits process it. Addresses that share their last 24 bits share one group: FE80::C, 2001:DB8:30:1::C and 2001:DB8:31:1::C all map to FF02::1:FF00:C, and the interface joins it once.