IPv6: Enterprise Deployment

April 15, 2026·3 min read·568 words

IPv6 is essential in 2026: IANA exhausted its IPv4 address pool in 2011, Google reports 45% IPv6 traffic, and France has required IPv6 for new ISP offerings since 2024. This guide covers enterprise IPv6 deployment: addressing plans, DHCPv6, SLAAC, security, dual-stack vs. translation, and IPv6-only environments. 2026.

IPv6 Addressing

128 bits vs. 32 bits for IPv4 = 2^128 addresses
Notation: 8 groups of 4 hexadecimal digits separated by colons
Use :: to abbreviate consecutive zeros (only once)
Prefix: /64 is the standard subnet size (never break this rule)
Global prefix: /48 provided to the enterprise by the ISP
/56 or /60 for residential customers

Address Types

Global Unicast (2000::/3): Internet-routable
Link-Local (fe80::/10): automatically generated and limited to the local segment
Unique Local Address, ULA (fc00::/7): equivalent to private IPv4 addressing under RFC 1918
Multicast (ff00::/8): IPv6 has no broadcast
Anycast: shared by multiple hosts and routed to the nearest one

Enterprise Addressing Plan

The ISP provides a /48 (65,536 /64 subnets). Example plan:

2001:db8:100::/48 = enterprise
2001:db8:100:0000::/64 = VLAN 0 (management)
2001:db8:100:000a::/64 = VLAN 10 (data), 0x0a = 10
2001:db8:100:0014::/64 = VLAN 20 (voice)
Convention: hexadecimal VLAN ID = fourth group
Easy to remember and automate

SLAAC (Stateless Address Autoconfiguration)

The host automatically configures its IPv6 address based on RA (Router Advertisement)
No DHCP is required for a simple plan
Privacy Extensions (RFC 4941): generate temporary addresses for outbound Internet traffic to prevent tracking
DNS: provided through RA DNSSL + RDNSS (RFC 8106) or stateless DHCPv6

DHCPv6

Stateful DHCPv6: assigns an address and options (DNS, NTP)
Stateless DHCPv6: RA assigns the address, while DHCPv6 provides only DNS/NTP information
DHCPv6 prefix delegation: the ISP delegates a /48 or /56 to the CPE router
Comprehensive logging, equivalent to DHCPv4 for compliance purposes

Transition from v4 to v6

Dual-stack (recommended)

Hosts and routers support v4 and v6 simultaneously
Simple, phased migration
Coexistence period of 5–10 years

NAT64 + DNS64

IPv6-only clients can access IPv4 servers
NAT64: IPv6-to-IPv4 translator
DNS64: synthesizes AAAA records from A records
Use case: iOS mobile networks (Apple has required IPv6-only support since 2016)

464XLAT

Customer-side translator (CLAT)
The IPv4 address is translated into IPv6 and then translated back to v4 by the ISP
Transparent support for v4 applications

IPv6 Security

RA Guard: blocks rogue RAs (equivalent to DHCPv6 Guard)
DHCPv6 Guard
ND inspection: DAD (Duplicate Address Detection) and NS/NA anti-spoofing
IPv6 Source Guard
Filter RH0 (Routing Header Type 0), which is deprecated and dangerous
No broadcast means less DoS amplification

Firewall Impact

FortiGate: native IPv6 support across all versions
Palo Alto: native IPv6 support
Cisco ASA/FTD: native IPv6 support
Separate policy rules for v4 and v6, doubling the maintenance effort
Some vendors provide limited IPv6 support for scanning/DLP; verify compatibility

IPv6 DNS

AAAA records (vs. A records for v4)
Reverse DNS: ip6.arpa (e.g., 2001:db8::1 → 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa)
IPv6 DNS servers: Google 2001:4860:4860::8888, Cloudflare 2606:4700:4700::1111
DHCPv6 option 23 configuration: IPv6 DNS servers

Basic Cisco IOS Configuration

ipv6 unicast-routing
ipv6 cef
interface Vlan 10
ipv6 address 2001:db8:100:a::1/64
ipv6 nd prefix 2001:db8:100:a::/64 preferred-lifetime 86400 valid-lifetime 172800
ipv6 nd managed-config-flag: managed DHCPv6 configuration
ipv6 nd other-config-flag: other DHCPv6 information

IPv6 Routing

OSPFv3: OSPF for IPv6 (or IPv4+IPv6 with multi-AF)
IS-IS: native IPv6 support (single-topology or multi-topology)
BGP: address-family ipv6 unicast
Static: ipv6 route 2001:db8:200::/48 2001:db8:1::2

Order from OPTINOC

Enterprise IPv6 deployment: addressing plan, dual-stack, DHCPv6, migration, and security. Catalyst, FortiGate, and Palo Alto platforms configured for dual-stack operation. Quote within 48 hours.