IPv6: Enterprise Deployment
·3 min read·568 words
IPv6 is essential in 2026: IANA exhausted its IPv4 address pool in 2011, Google reports 45% IPv6 traffic, and France has required IPv6 for new ISP offerings since 2024. This guide covers enterprise IPv6 deployment: addressing plans, DHCPv6, SLAAC, security, dual-stack vs. translation, and IPv6-only environments. 2026.
IPv6 Addressing
- 128 bits vs. 32 bits for IPv4 = 2^128 addresses
- Notation: 8 groups of 4 hexadecimal digits separated by colons
- Use :: to abbreviate consecutive zeros (only once)
- Prefix: /64 is the standard subnet size (never break this rule)
- Global prefix: /48 provided to the enterprise by the ISP
- /56 or /60 for residential customers
Address Types
- Global Unicast (2000::/3): Internet-routable
- Link-Local (fe80::/10): automatically generated and limited to the local segment
- Unique Local Address, ULA (fc00::/7): equivalent to private IPv4 addressing under RFC 1918
- Multicast (ff00::/8): IPv6 has no broadcast
- Anycast: shared by multiple hosts and routed to the nearest one
Enterprise Addressing Plan
The ISP provides a /48 (65,536 /64 subnets). Example plan:
- 2001:db8:100::/48 = enterprise
- 2001:db8:100:0000::/64 = VLAN 0 (management)
- 2001:db8:100:000a::/64 = VLAN 10 (data), 0x0a = 10
- 2001:db8:100:0014::/64 = VLAN 20 (voice)
- Convention: hexadecimal VLAN ID = fourth group
- Easy to remember and automate
SLAAC (Stateless Address Autoconfiguration)
- The host automatically configures its IPv6 address based on RA (Router Advertisement)
- No DHCP is required for a simple plan
- Privacy Extensions (RFC 4941): generate temporary addresses for outbound Internet traffic to prevent tracking
- DNS: provided through RA DNSSL + RDNSS (RFC 8106) or stateless DHCPv6
DHCPv6
- Stateful DHCPv6: assigns an address and options (DNS, NTP)
- Stateless DHCPv6: RA assigns the address, while DHCPv6 provides only DNS/NTP information
- DHCPv6 prefix delegation: the ISP delegates a /48 or /56 to the CPE router
- Comprehensive logging, equivalent to DHCPv4 for compliance purposes
Transition from v4 to v6
Dual-stack (recommended)
- Hosts and routers support v4 and v6 simultaneously
- Simple, phased migration
- Coexistence period of 5–10 years
NAT64 + DNS64
- IPv6-only clients can access IPv4 servers
- NAT64: IPv6-to-IPv4 translator
- DNS64: synthesizes AAAA records from A records
- Use case: iOS mobile networks (Apple has required IPv6-only support since 2016)
464XLAT
- Customer-side translator (CLAT)
- The IPv4 address is translated into IPv6 and then translated back to v4 by the ISP
- Transparent support for v4 applications
IPv6 Security
- RA Guard: blocks rogue RAs (equivalent to DHCPv6 Guard)
- DHCPv6 Guard
- ND inspection: DAD (Duplicate Address Detection) and NS/NA anti-spoofing
- IPv6 Source Guard
- Filter RH0 (Routing Header Type 0), which is deprecated and dangerous
- No broadcast means less DoS amplification
Firewall Impact
- FortiGate: native IPv6 support across all versions
- Palo Alto: native IPv6 support
- Cisco ASA/FTD: native IPv6 support
- Separate policy rules for v4 and v6, doubling the maintenance effort
- Some vendors provide limited IPv6 support for scanning/DLP; verify compatibility
IPv6 DNS
- AAAA records (vs. A records for v4)
- Reverse DNS: ip6.arpa (e.g., 2001:db8::1 → 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa)
- IPv6 DNS servers: Google 2001:4860:4860::8888, Cloudflare 2606:4700:4700::1111
- DHCPv6 option 23 configuration: IPv6 DNS servers
Basic Cisco IOS Configuration
- ipv6 unicast-routing
- ipv6 cef
- interface Vlan 10
- ipv6 address 2001:db8:100:a::1/64
- ipv6 nd prefix 2001:db8:100:a::/64 preferred-lifetime 86400 valid-lifetime 172800
- ipv6 nd managed-config-flag: managed DHCPv6 configuration
- ipv6 nd other-config-flag: other DHCPv6 information
IPv6 Routing
- OSPFv3: OSPF for IPv6 (or IPv4+IPv6 with multi-AF)
- IS-IS: native IPv6 support (single-topology or multi-topology)
- BGP: address-family ipv6 unicast
- Static: ipv6 route 2001:db8:200::/48 2001:db8:1::2
Order from OPTINOC
Enterprise IPv6 deployment: addressing plan, dual-stack, DHCPv6, migration, and security. Catalyst, FortiGate, and Palo Alto platforms configured for dual-stack operation. Quote within 48 hours.