IPv6 for Network Admins: Addressing, SLAAC, DHCPv6 and a Practical Transition Plan

IPv6 is not a future project. Every modern operating system enables it by default, most mobile networks and many residential ISPs already run it at scale, and a growing share of internet traffic uses it. If you have not deployed IPv6 deliberately, your endpoints are still using it on every LAN segment, at least with link-local addresses, which means it is already part of your attack surface. This guide gives network admins the practical knowledge to take control: address types and their prefixes, a sensible addressing plan, how SLAAC and DHCPv6 really interact, working Cisco IOS configuration, essential security controls, and a phased transition plan.

Why IPv6 deserves your attention now

The regional internet registries have long since exhausted their free pools of IPv4 addresses. Organizations now buy IPv4 space on a transfer market or share addresses behind carrier-grade NAT, which complicates logging, geolocation and inbound services. Meanwhile, IPv6 delivers a virtually unlimited supply of globally routable addresses and removes the need for NAT as an addressing workaround.

For network admins, three practical reasons stand out:

• It is already on your network. Windows, macOS, Linux, iOS and Android all prefer IPv6 when it is available. An unauthorized device sending Router Advertisements can quietly become the IPv6 default gateway for an entire VLAN.
• Your users may already be on IPv6 at home and on mobile. Remote access, cloud services and customer-facing applications need to work for them.
• It is a career skill. IPv6 appears on certification blueprints and in design interviews, and engineers who can plan and deploy it confidently are in short supply.

IPv6 address format and notation

An IPv6 address is 128 bits long, written as eight groups of four hexadecimal digits separated by colons. Each group, sometimes called a hextet, represents 16 bits. Two rules shorten addresses, and RFC 5952 defines the canonical text form that tools and documentation should use:

1. Leading zeros in each group can be omitted: 0db8 becomes db8, 0000 becomes 0.
2. One run of two or more consecutive all-zero groups can be replaced with ::. If there are several runs, compress the longest; if they tie, compress the first. Use :: only once per address.
3. Write hexadecimal letters in lowercase.

So 2001:0db8:0000:0000:0000:ff00:0042:8329 becomes 2001:db8::ff00:42:8329. Consistent formatting matters more than it seems: searching logs, IPAM and firewall configurations for an address only works if everyone writes it the same way.

Every address splits into a network prefix and an interface identifier. On a LAN the split is almost always at bit 64: the first 64 bits identify the subnet, and the last 64 bits identify the interface. Prefix lengths use the same CIDR notation as IPv4, for example 2001:db8:acad:20::/64. If CIDR still feels shaky, revisit subnetting made simple; the concepts carry over directly, only the numbers are bigger and the arithmetic is in hexadecimal.

IPv6 address types and prefixes

IPv6 has no broadcast addresses. Functions that used broadcast in IPv4, such as ARP, use multicast instead. The address architecture is defined in RFC 4291, with several later RFCs adding special-purpose ranges. These are the types you will meet daily:

A few points trip people up. Every IPv6 interface always has a link-local address, even when it also has one or more global addresses, and having multiple addresses per interface is normal, not a misconfiguration. Site-local addresses (fec0::/10) were deprecated by RFC 3879 and should not be used. Anycast addresses have no special prefix; they are ordinary unicast addresses assigned to more than one interface.

Multicast addresses you should recognize

• ff02::1: all nodes on the link.
• ff02::2: all routers on the link; hosts send Router Solicitations here.
• ff02::1:ff00:0/104: solicited-node multicast, built from the last 24 bits of a unicast address and used by Neighbor Discovery instead of ARP broadcasts.
• ff02::1:2: all DHCPv6 relay agents and servers.
• ff02::5 and ff02::6: OSPFv3 routers and designated routers, covered in our OSPF fundamentals article.

The ff02 prefix means link-local scope; such packets never leave the segment. Other scopes exist, such as ff05 for site-local multicast.

Building an IPv6 addressing plan

The biggest mental shift with IPv6 is that you stop conserving addresses and start designing for clarity. In IPv4 you size each subnet to the number of hosts. In IPv6 every LAN gets a /64, regardless of whether it holds three devices or three thousand, and you plan for readable, summarizable structure instead.

How much space you get

RFC 6177 recommends that end sites receive enough space for multiple subnets and leaves the exact size to operators; in practice businesses typically receive a /48 and smaller sites or residential customers often receive a /56. The arithmetic is simple because each 4-bit nibble is one hexadecimal digit:

Multi-site organizations usually request provider-independent space from their regional internet registry, then assign a /48 per site so each location can be summarized as a single route.

Design on nibble boundaries

Assign meaning to hexadecimal digits so that an address tells you where it lives. With a /48 per site, the fourth hextet gives you 16 bits to structure subnets. A readable scheme for a site with prefix 2001:db8:acad::/48 could be:

• 2001:db8:acad:0::/64: reserved; not used for hosts.
• 2001:db8:acad:10::/64, :20::/64, :30::/64: user, voice and server VLANs 10, 20 and 30. The hextet is hexadecimal, but writing the VLAN number there makes it instantly readable.
• 2001:db8:acad:99::/64: management VLAN 99.
• 2001:db8:acad:fff0::/64: loopbacks, assigned as /128s.
• 2001:db8:acad:ffff::/64 range: point-to-point links, each configured as a /127 per RFC 6164, with a full /64 reserved per link for simplicity.

Record the plan in your IPAM from day one, alongside the IPv4 plan. Our network documentation guide covers how to keep that IPAM accurate.

Neighbor Discovery and SLAAC

IPv6 hosts learn almost everything about their network from the router, through the Neighbor Discovery Protocol (NDP) defined in RFC 4861. NDP uses ICMPv6 messages that replace ARP, router discovery and redirects:

How SLAAC works

Stateless Address Autoconfiguration, specified in RFC 4862, lets a host build its own global address with no server involved:

1. The host creates a link-local address and verifies it is unique with Duplicate Address Detection (DAD), sending a Neighbor Solicitation from the unspecified address ::.
2. It sends a Router Solicitation to ff02::2, or waits for the next periodic Router Advertisement.
3. The RA contains a Prefix Information option, for example 2001:db8:acad:20::/64, with the autonomous (A) flag set.
4. The host combines that prefix with a 64-bit interface identifier it generates, runs DAD again, and starts using the address.
5. The router’s link-local source address in the RA becomes the host’s default gateway.

The interface identifier used to be derived from the MAC address using modified EUI-64: the MAC is split in half, fffe is inserted in the middle and the universal/local bit is inverted. Because that exposes the hardware address and allows tracking across networks, modern operating systems instead use stable, opaque identifiers per RFC 7217 and additional temporary addresses for outbound connections per RFC 8981. Expect to see several global addresses on a typical client, some of which change daily.

DNS server information can be delivered in the RA itself through the RDNSS option defined in RFC 8106, which most modern clients support. That makes pure SLAAC viable on many networks without any DHCPv6 at all.

DHCPv6: stateless, stateful and prefix delegation

DHCPv6, now consolidated in RFC 8415, uses UDP port 546 on clients and 547 on servers and relays. It is not just DHCP with longer addresses, and two differences matter. First, DHCPv6 never provides the default gateway; that always comes from Router Advertisements. Second, clients identify themselves with a DHCP Unique Identifier (DUID), not their MAC address, which affects reservations and how you correlate logs.

Two flags in the Router Advertisement tell hosts what to do, and the A flag in the prefix option controls SLAAC:

Stateful DHCPv6 is attractive to admins who want a lease table showing which device has which address, but be aware that client support is not universal. Notably, Android does not implement stateful DHCPv6 address assignment, so a segment that relies on it alone will leave Android devices without a global address. A common compromise is SLAAC with stateless DHCPv6 on user and guest VLANs, and static or stateful addressing on server and infrastructure segments where you control the operating systems.

Prefix delegation

DHCPv6 Prefix Delegation (DHCPv6-PD) lets a router request an entire prefix, such as a /56 or /48, from an upstream router. ISPs use it to hand prefixes to customer edge routers, which then carve /64s for their LANs. If your branch internet service is IPv6-enabled, prefix delegation is often how you receive your space, so check whether the delegated prefix is static or can change; changing prefixes complicate firewall rules and DNS.

Configuring IPv6 on Cisco IOS

The configuration below enables IPv6 routing, sets up a user VLAN with SLAAC plus stateless DHCPv6, a managed VLAN with stateful DHCPv6, and a static default route to the ISP. On some Catalyst switches you must first select an SDM template that allocates hardware resources for IPv6, followed by a reload.

ipv6 unicast-routing
!
ipv6 dhcp pool USERS-STATELESS
 dns-server 2001:db8:acad:99::53
 domain-name corp.example.com
!
ipv6 dhcp pool MANAGED-STATEFUL
 address prefix 2001:db8:acad:30::/64
 dns-server 2001:db8:acad:99::53
 domain-name corp.example.com
!
interface Vlan20
 description USERS - SLAAC plus stateless DHCPv6
 ipv6 address 2001:db8:acad:20::1/64
 ipv6 nd other-config-flag
 ipv6 dhcp server USERS-STATELESS
!
interface Vlan30
 description MANAGED - stateful DHCPv6
 ipv6 address 2001:db8:acad:30::1/64
 ipv6 nd managed-config-flag
 ipv6 nd prefix 2001:db8:acad:30::/64 no-autoconfig
 ipv6 dhcp server MANAGED-STATEFUL
!
interface GigabitEthernet0/0/0
 description WAN - ISP
 ipv6 address 2001:db8:ffff:1::2/64
!
ipv6 route ::/0 2001:db8:ffff:1::1

If the DHCPv6 server is elsewhere, replace the ipv6 dhcp server line on the SVI with ipv6 dhcp relay destination followed by the server’s address. Verify with these commands:

show ipv6 interface brief
show ipv6 interface Vlan20
show ipv6 neighbors
show ipv6 route
show ipv6 dhcp binding
show ipv6 dhcp pool

On the client side, ipconfig /all on Windows or ip -6 addr and ip -6 route on Linux show which addresses were configured and which link-local address is being used as the default gateway.

IPv6 security essentials

IPv6 is not inherently more or less secure than IPv4, but it is different, and controls designed for IPv4 do not automatically cover it. Focus on these areas:

• RA Guard (RFC 6105). Block Router Advertisements on access ports so only legitimate routers can become a default gateway. Pair it with DHCPv6 Guard to stop rogue DHCPv6 servers.
• Do not block all ICMPv6. Neighbor Discovery depends on it, and routers never fragment IPv6 packets in transit, so Path MTU Discovery relies on ICMPv6 Packet Too Big (type 2) messages. RFC 4890 gives detailed recommendations for filtering ICMPv6 at firewalls.
• Firewall parity. Every IPv4 rule needs an IPv6 equivalent. A stateful policy that allows outbound and blocks unsolicited inbound traffic protects hosts just as well as NAT did. Our firewall hardening checklist applies to both protocols.
• Logging and monitoring. Make sure your syslog, flow collection and security tools parse IPv6 addresses and that your monitoring platform polls and alerts over IPv6 as well.

A basic RA Guard configuration on a Catalyst access switch looks like this:

ipv6 nd raguard policy HOST-PORTS
 device-role host
!
ipv6 nd raguard policy UPLINKS
 device-role router
!
interface range GigabitEthernet1/0/1 - 48
 ipv6 nd raguard attach-policy HOST-PORTS
!
interface TenGigabitEthernet1/1/1
 ipv6 nd raguard attach-policy UPLINKS

A practical IPv6 transition plan

For most organizations, the right strategy is dual-stack: run IPv4 and IPv6 side by side on the same interfaces, as described in RFC 4213, and let applications prefer IPv6 where it works. Clients implement Happy Eyeballs (RFC 8305), which races IPv6 and IPv4 connection attempts so a broken IPv6 path does not stall users. Translation technologies such as NAT64 (RFC 6146) with DNS64 (RFC 6147), and 464XLAT (RFC 6877) on the client side, become relevant when you start building IPv6-only segments.

Phase 1: Assess and learn

• Inventory every network device, firewall, load balancer and critical application for IPv6 support, including management features such as SNMP, syslog and AAA over IPv6.
• Build IPv6 into your lab first; our home network lab guide works perfectly for dual-stack practice.
• Enable RA Guard and DHCPv6 Guard and add IPv6 rules to firewalls, even before routing it.

Phase 2: Obtain space and plan

• Request address space from your ISP or registry and decide between provider-assigned and provider-independent space.
• Write the addressing plan, choose SLAAC, stateless or stateful DHCPv6 per segment type, and record everything in IPAM.

Phase 3: Edge and public services

• Enable IPv6 on internet links and firewalls, then dual-stack public services such as websites, mail and VPN, adding AAAA records only after testing.

Phase 4: Core and infrastructure

• Enable IPv6 on core and distribution layers, run OSPFv3 or add IPv6 address families to existing routing protocols, and make monitoring and logging fully IPv6-aware.

Phase 5: Users and beyond

• Roll out to user VLANs one site or one segment at a time, measuring help-desk tickets and application issues.
• Once dual-stack is stable, evaluate IPv6-only segments with NAT64 and DNS64 for new environments where every component supports it.

Each phase delivers value on its own, and you can pause between them without leaving the network in a fragile state.

Key takeaways

• IPv6 is already active on your endpoints; manage it deliberately rather than ignoring it.
• Know the key prefixes: 2000::/3 global, fe80::/10 link-local, fc00::/7 unique local, ff00::/8 multicast, and 2001:db8::/32 for documentation.
• Use a /64 on every LAN, /127 on point-to-point links and /128 for loopbacks, and design on nibble boundaries for readability.
• Router Advertisements always provide the default gateway; the M, O and A flags decide between SLAAC, stateless DHCPv6 and stateful DHCPv6.
• Deploy RA Guard, allow essential ICMPv6 and keep IPv4 and IPv6 firewall policies in parity.
• Transition in phases with dual-stack as the foundation, starting with the edge and public services.

Planning IPv6 is much easier with a clear picture of your current network and its readiness. Our Network Health Assessment includes an IPv6 readiness review covering devices, firewalls and addressing. You can also practice prefix math with the calculators in our network tools, or contact us to discuss your transition plan.