IPv6 Complete Guide for Network Admins

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

How IPv6 addressing is put together

IPv6 addresses are 128 bits, written in hex and compressed with :: once in an address. 2001:db8:10:1::1 and 2001:0db8:0010:0001:0000:0000:0000:0001 are the same address. You may compress one run of zeros. You may not compress two runs and hope the reader knows which one was longer. In a design document, write the prefix in full enough that a stranger can expand it.

This guide uses 2001:db8::/32 because that prefix is reserved for documentation. Do not advertise it, do not put it on a production interface, and do not treat a lab that used it as ready for production until you have swapped in the prefix your provider or your registry actually assigned. The shape of the plan can stay. The digits must change.

A practical enterprise plan is a /48 per site. Inside the site, a /64 per VLAN. That is not because other lengths are illegal. It is because neighbour discovery, SLAAC, and most operational tools assume a /64 on a LAN. Point-to-point links can be /127. Loopback and router IDs can be /128. Everything a host sits on should be /64.

Link-local addresses live in fe80::/10 and stay on the link. You will see them on every interface even when global addressing is wrong. They are how routers talk to each other on a segment. They are not a substitute for a global or unique-local plan, and they are not routed across a normal enterprise. If a host has only a link-local address, it does not have a working IPv6 network.

Unique local addresses, fd00::/8 with a random 40-bit global id, are the private space of IPv6. Use them when a network must never be reached from the Internet and you do not have a global prefix yet. Do not use them as an excuse to NAT IPv6 into IPv4 as the permanent design. Translation exists for edges. It is not the addressing plan.

Multicast uses ff00::/8. ff02::1 is all nodes on the link. ff02::2 is all routers on the link. You do not subnet multicast the way you subnet a LAN, and you do not paste a multicast address into a host as if it were a gateway. The gateway is a unicast address.

What the common prefix lengths mean

From /32 to /48 is 16 bits, which is 65536 networks of the longer length inside one network of the shorter length. a provider allocation down to a site. Sixteen bits between them is 65536 sites, which is a registry-sized plan, not an office plan. Count in hex nibbles when you can. Four bits is one hex digit. A boundary that lands in the middle of a hex digit is legal and miserable to read. 2001:db8:10:1::/64 is readable. A prefix that splits the last digit of 2001:db8:10:1 is a prefix you will mistype at 2 a.m.

From /48 to /56 is 8 bits, which is 256 networks of the longer length inside one network of the shorter length. a site down to a building or a department. Eight bits is 256 blocks of /56, which is a comfortable enterprise site plan. Count in hex nibbles when you can. Four bits is one hex digit. A boundary that lands in the middle of a hex digit is legal and miserable to read. 2001:db8:10:1::/64 is readable. A prefix that splits the last digit of 2001:db8:10:1 is a prefix you will mistype at 2 a.m.

From /48 to /64 is 16 bits, which is 65536 networks of the longer length inside one network of the shorter length. a site down to a subnet. Sixteen bits is 65536 subnets of /64 inside one site. You will not use them all. You will use the readable ones. Count in hex nibbles when you can. Four bits is one hex digit. A boundary that lands in the middle of a hex digit is legal and miserable to read. 2001:db8:10:1::/64 is readable. A prefix that splits the last digit of 2001:db8:10:1 is a prefix you will mistype at 2 a.m.

From /56 to /64 is 8 bits, which is 256 networks of the longer length inside one network of the shorter length. a department down to a subnet. Eight bits is 256 subnets of /64. A /56 is also what many residential providers hand a customer, who then has room for VLANs. Count in hex nibbles when you can. Four bits is one hex digit. A boundary that lands in the middle of a hex digit is legal and miserable to read. 2001:db8:10:1::/64 is readable. A prefix that splits the last digit of 2001:db8:10:1 is a prefix you will mistype at 2 a.m.

From /64 to /128 is 64 bits, which is 18446744073709552000 networks of the longer length inside one network of the shorter length. a subnet down to a single address. Sixty-four bits of interface identifier is the length SLAAC expects. Do not chop a user LAN into something longer than /64. Count in hex nibbles when you can. Four bits is one hex digit. A boundary that lands in the middle of a hex digit is legal and miserable to read. 2001:db8:10:1::/64 is readable. A prefix that splits the last digit of 2001:db8:10:1 is a prefix you will mistype at 2 a.m.

From /127 to /128 is 1 bits, which is 2 networks of the longer length inside one network of the shorter length. a point-to-point link. A /127 has two addresses and is the IPv6 equivalent of a careful /31. Use it on routed links, not on a LAN that will run SLAAC. Count in hex nibbles when you can. Four bits is one hex digit. A boundary that lands in the middle of a hex digit is legal and miserable to read. 2001:db8:10:1::/64 is readable. A prefix that splits the last digit of 2001:db8:10:1 is a prefix you will mistype at 2 a.m.

A site plan you can read in hex

VLAN 10 (users) is numbered into the prefix on purpose. Give it 2001:db8:10:a::/64. The gateway can be 2001:db8:10:a::1. desktops and phones that should receive addresses by SLAAC or DHCPv6. The hex value a matches the VLAN id so a traceroute and a switch config tell the same story. Do not also put an IPv4 /24 of an unrelated number on that VLAN without writing both down. Dual stack is two plans, not one plan with a hope. RA should announce this /64. A /65 or a /80 on this VLAN will break SLAAC even if the router forwards packets for the few hosts you configured by hand.

VLAN 20 (voice) is numbered into the prefix on purpose. Give it 2001:db8:10:14::/64. The gateway can be 2001:db8:10:14::1. a voice VLAN if you keep phones separate, still a /64, not a tiny prefix. The hex value 14 matches the VLAN id so a traceroute and a switch config tell the same story. Do not also put an IPv4 /24 of an unrelated number on that VLAN without writing both down. Dual stack is two plans, not one plan with a hope. RA should announce this /64. A /65 or a /80 on this VLAN will break SLAAC even if the router forwards packets for the few hosts you configured by hand.

VLAN 30 (devices) is numbered into the prefix on purpose. Give it 2001:db8:10:1e::/64. The gateway can be 2001:db8:10:1e::1. printers and building devices that you may want on static DHCPv6 reservations. The hex value 1e matches the VLAN id so a traceroute and a switch config tell the same story. Do not also put an IPv4 /24 of an unrelated number on that VLAN without writing both down. Dual stack is two plans, not one plan with a hope. RA should announce this /64. A /65 or a /80 on this VLAN will break SLAAC even if the router forwards packets for the few hosts you configured by hand.

VLAN 40 (guests) is numbered into the prefix on purpose. Give it 2001:db8:10:28::/64. The gateway can be 2001:db8:10:28::1. a guest VLAN with its own /64 and a firewall policy that does not trust the user VLAN. The hex value 28 matches the VLAN id so a traceroute and a switch config tell the same story. Do not also put an IPv4 /24 of an unrelated number on that VLAN without writing both down. Dual stack is two plans, not one plan with a hope. RA should announce this /64. A /65 or a /80 on this VLAN will break SLAAC even if the router forwards packets for the few hosts you configured by hand.

VLAN 50 (servers) is numbered into the prefix on purpose. Give it 2001:db8:10:32::/64. The gateway can be 2001:db8:10:32::1. servers that should have stable addresses you typed, not temporary privacy addresses. The hex value 32 matches the VLAN id so a traceroute and a switch config tell the same story. Do not also put an IPv4 /24 of an unrelated number on that VLAN without writing both down. Dual stack is two plans, not one plan with a hope. RA should announce this /64. A /65 or a /80 on this VLAN will break SLAAC even if the router forwards packets for the few hosts you configured by hand.

VLAN 99 (management) is numbered into the prefix on purpose. Give it 2001:db8:10:63::/64. The gateway can be 2001:db8:10:63::1. switch and firewall management, reachable only from an admin prefix. The hex value 63 matches the VLAN id so a traceroute and a switch config tell the same story. Do not also put an IPv4 /24 of an unrelated number on that VLAN without writing both down. Dual stack is two plans, not one plan with a hope. RA should announce this /64. A /65 or a /80 on this VLAN will break SLAAC even if the router forwards packets for the few hosts you configured by hand.

Put the site at 2001:db8:10::/48 in the lab notes. VLAN 10 becomes 2001:db8:10:a::/64 because 10 in hex is a. VLAN 20 becomes 2001:db8:10:14::/64 because 20 in hex is 14. If you would rather keep the VLAN id in decimal inside the address, you can use 2001:db8:10:10::/64 for VLAN 10 and accept that the hex is a coincidence. Pick one rule. Mixing decimal VLAN 20 with hex 14 on the next VLAN is how a firewall object gets the wrong prefix.

Write the reverse of the plan too. Given 2001:db8:10:1e::/64, the fourth hextet is 1e, which is 30 in decimal, which in this plan is VLAN 30. If you cannot do that conversion from the address alone, the plan is not documented. A comment in the router is not the spreadsheet, and the spreadsheet is not the ticket. All three should match before the change.

How a host gets an address

SLAAC lets a host build an address from the prefix in a router advertisement. The prefix must be /64 for the usual implementation. The host may use a stable interface identifier or a temporary privacy address. Servers should not depend on a temporary address. Give servers a reservation or a static address and say so in DNS.

DHCPv6 can hand out addresses, options, or both. Router advertisements still matter, because a host learns that it is allowed to use DHCPv6 from flags in the advertisement. Turning on a DHCP server and leaving advertisements off produces a quiet failure. Turning on advertisements with the wrong prefix length produces hosts that configure themselves outside the firewall object you wrote.

Privacy addresses change. That is their point. Logging, firewalls, and inventory that assume one IPv6 address per person will be wrong. Identify users by authentication, not by a long-lived host address, on any VLAN where privacy extensions are on. On a management VLAN, prefer stable addresses so an allow-list stays meaningful.

DNS for IPv6 is AAAA records, not a second copy of the A record with colons. A dual-stack name can have both. If the AAAA record points at an address that is filtered and the A record works, users will call the application slow or broken depending on whether their stack falls back. Test both families on purpose. Do not publish an AAAA record until the path works.

Neighbour discovery replaces ARP. It can be poisoned on a LAN the same way ARP can, which is a reason to keep untrusted devices off the management VLAN, not a reason to disable IPv6. Filtering rogue router advertisements on access ports is part of the switching design. A host that accepts the wrong advertisement will leave the prefix you planned.

Checks before you call a site dual-stack

Confirm the prefix you will use is assigned to you, or that you are still in a lab using 2001:db8::/32 and the lab cannot leak routes. Confirm every LAN is a /64. Confirm point-to-point links are /127 or /64 on purpose, and that both ends match. Confirm firewall objects were written in IPv6 and not copied from the IPv4 /24 with a colon added.

Confirm DNS. The name users type needs a correct AAAA record, and the reverse record should exist for servers. Confirm monitoring polls the IPv6 address or you will watch the IPv4 path and miss a dead neighbour. Confirm the VPN and the WAN actually forward IPv6. A perfect LAN prefix behind a router that only has IPv4 upstream is a lab, not a rollout.

The calculators linked from this page plan prefixes and subnets in the browser. They do not configure a router. Use them to check the hex and the length, then put the result in the ticket next to the VLAN id.

Take the assigned site prefix or, in a lab, 2001:db8:10::/48.
Give every VLAN its own /64 on a boundary you can read back from the address.
Set the gateway to the ::1 address of that /64 unless the site has a different written rule.
Decide which VLANs use SLAAC, which use DHCPv6, and which servers are static.
Write matching firewall objects and DNS records before you enable router advertisements.
Test one host for address, gateway, AAAA resolution, and a real application.
Only then enable the prefix on the rest of the access ports.

A dual-stack weekend on one VLAN

Take VLAN 10, IPv4 198.51.100.0/24 gateway 198.51.100.1, and the IPv6 prefix 2001:db8:10:a::/64 gateway 2001:db8:10:a::1. Write both on the same ticket line. The IPv4 mask is 255.255.255.0. The IPv6 length is 64. They are not translations of each other. A host can be 198.51.100.25 and 2001:db8:10:a:1::25 if you chose that static pair. A laptop using privacy addresses will not keep the ::25 shape. Do not build an inventory rule that demands it.

On Friday, lower nothing in IPv6 yet. Confirm the router can forward a test prefix in the lab, confirm the firewall object 2001:db8:10:a::/64 exists, and confirm the AAAA record you intend to publish is not already live. Give one test server the static address 2001:db8:10:a::25 and a AAAA record with a 300 second TTL. From a test laptop, confirm the laptop got an address in 2001:db8:10:a::/64, can ping the gateway, and can open the service by name.

If the laptop has an address and cannot reach the gateway, the VLAN is probably right and the gateway or the router advertisement is wrong. If the laptop has only fe80::, advertisements are missing or the prefix length is wrong. If the laptop reaches the gateway and not the server, the server is on another VLAN or the firewall dropped the prefix. Those three failures have three owners. Do not reboot the laptop as the first action.

After the test host works, enable advertisements on the access VLAN and watch one more real client. Leave the old IPv4 path in place. Dual stack means IPv4 keeps working while IPv6 starts. Removing IPv4 on the same weekend is a second project. Publish the remaining AAAA records only for services you have opened over IPv6. Keep the short TTL until Monday, then raise it when you are willing to live with the answers.

Compression practice belongs in the same ticket so the on-call can read the addresses. 2001:db8:10:a::1 expands with the :: standing for the missing zeros between a and 1. 2001:db8:0:0:0:0:0:1 can be written 2001:db8::1. 2001:db8:0:10::1 cannot move the :: to hide the 10, because the 10 is not inside the compressed run you chose if you also need to keep it visible. When two people expand an address to two different full forms, the ticket is ambiguous and the firewall object will be wrong. Expand it once in the ticket and stop arguing in hex.

Keep a one-page map beside the ticket. Site 2001:db8:10::/48. VLAN 10 is 2001:db8:10:a::/64. VLAN 20 is 2001:db8:10:14::/64. VLAN 30 is 2001:db8:10:1e::/64. VLAN 99 is 2001:db8:10:63::/64 because 99 in hex is 63. The gateway on each is ::1. Point-to-point links, if you have them, come out of a separate /64 such as 2001:db8:10:ff::/64 broken into /127s, and they do not reuse a user VLAN prefix. If a later site arrives, it is 2001:db8:11::/48, not a random /64 stolen from site 10. The map is the part a calculator cannot invent. Read the map aloud once before you enable advertisements: site, VLAN, prefix, gateway. If you stumble on the hex, fix the map, not the host.

Mistakes that look like an addressing bug

Putting a /48 on a LAN because the provider assigned a /48. The /48 is the site. The LAN is a /64 inside it.

Using 2001:db8::/32 in production because the lab worked.

Compressing an address with two :: sequences so nobody can expand it.

Numbering VLAN 20 as 2001:db8:10:20::/64 and VLAN 10 as 2001:db8:10:a::/64. Pick decimal-looking or hex, not a mixture.

Forgetting that a /64 has a huge host field. You do not conserve addresses inside a LAN by choosing /80, and you break SLAAC if you try.

Publishing AAAA records for services that are not reachable over IPv6.

Allowing router advertisements on guest and user ports from any device. The first wrong advertisement wins a host.

Treating link-local reachability as proof that global IPv6 works.

Enabling a prefix on every VLAN because one VLAN worked. Each VLAN needs its own /64, its own firewall object, and its own test host.

Copying an IPv4 ACL and replacing dots with colons. IPv6 neighbour discovery and router advertisements need their own explicit policy on a firewall that does not already allow them.

Leaving a lab prefix in a monitoring alert so that production pages the on-call when 2001:db8:: stops answering.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.