IPv6 Address
IPv6 Subnets
The smallest subnet we normally use in IPv6 is /64, so here are examples of IPv6 Subnets
- fd11:1111:1111:1111:0000:0000:0000:0000/64
- fd12:3456:789a:0000::/64
- fd12:3456:789a:1111::/64
- Ethernet and Switching Limits (MAC address tables in switches)
- ARP/ND Table Limits (Even operating systems and routers can't store neighbor cache entries for millions of hosts)
- Collision Domains (Ethernet is still fundamentally a shared medium; physically and logically, it doesn’t scale infinitely)
So What Is the Practical Limit?
Most networks keep a few hundred to a few thousand devices per VLAN, depending on:
- Switch/router hardware
- Security policy
- Performance needs
Even
10,000 devices per VLAN is considered very large and rare. Back in the
days, there was a best practice to limit the number of devices within
the single broadcast domain (VLAN) to 250 or 300 devices, but the final
decision is up to Infrastructure Architect who should take all limits
and constraints into account.
- Point-to-point links (e.g. /127, /126)
- Routing-only environments
IPv6 Prefix size Use case
/64 Standard LAN subnet (use this unless you know better)
/126 or /127 Point-to-point links (e.g. router-router)
/128 Single host address
< /64 (e.g. /56, /48) Aggregated prefix blocks, not individual subnets
Local-link Addresses
Last address: febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
- EUI-64 (Extended Unique Identifier): 64-bit number derived from the MAC address of the network interface (for example 1111:2222:3333:4444)
- Randomized Interface Identifier (Privacy Extension): A typical random interface identifier might look something like fcb0:2b5a:bbf0:1001
SLAAC
SLAAC (Stateless Address Autoconfiguration) is an automatic method that allows devices to configure their own IPv6 addresses based on network prefixes advertised by routers. Link-local addresses play a crucial role here.
Steps in SLAAC (Involving Link-Local Addresses):
- Router Advertisements (RAs)
- Routers send Router Advertisement messages to tell hosts about the network's IPv6 prefix and configuration options.
- SLAAC Address Generation
- Neighbor Solicitation for Duplicate Address Detection (DAD)
- The device sends a Neighbor Solicitation (NS) to check if the generated address is already in use on the local link.
SLAAC can provide DNS:
- RDNSS Option in Router Advertisements:
- Modern IPv6 routers can include the RDNSS option inside their RA messages. This option tells the client which DNS servers to use, so the client doesn’t need DHCPv6 just to get DNS info.
- Support depends on Router and Client OS:
- Both the router and the client must support RDNSS in RA for this to work. Most modern OSes (like recent Linux, Windows, and macOS versions) support it.
DHCPv6
First of all, why there is DHCPv6 when IPv6 addresses can be assigned by SLAAC?
While SLAAC automatically assigns IPv6 addresses, it does not provide:
- DNS server addresses: SLAAC can provide DNS, but there can still be some IPv6 routers without RDNSS Option and DHCPv6 is the only way how to dynamically get DNS addresses.
- Other configuration settings: Devices may need additional configuration (aka DHCP options) for things like host names, domain names, NTP servers, etc.
That's why DHCPv6 could make sense in some IPv6 deployments.
What are IA_NA and IA_PD in DHCPv6?
- IA_NA for requesting a normal address.
- IA_PD for requesting a prefix.
- Purpose: Request a stable, public IPv6 address for the client.
- Typical use: Used by client devices to get a normal IPv6 address for an interface (like your laptop, server, or router WAN).
- Lifetime: Long-term, valid for as long as the lease allows.
- Analogy: Like getting a fixed IPv4 DHCP address.
- Purpose: Ask for a whole IPv6 prefix (subnet) to use for downstream devices.
- Typical use: Used by routers or firewalls to get a /56, /60, or /64 prefix that can be split and assigned to LAN interfaces.
- Example: If your ISP delegates a /56, your router can assign /64 subnets to different internal networks.
- Lifetime: Long-term, like IA_NA.
The minimal dhcp6c.conf just to get IA-NA is this
interface vmx0 {
send ia-na 0; # Request a non-temporary address
};
The dhcp6c.conf to get IA-NA and IA_PD is this
interface vmx0 {
send ia-na 0; # Request a non-temporary address
send ia-pd 1; # Request a delegated prefix
send rapid-commit; # Optional: speed up the handshake
send domain-name-servers;# Ask for DNS info if ISP provides it
};
id-assoc na 0 {
# No additional settings needed unless you want to override lifetimes
};
id-assoc pd 1 {
prefix-interface vmx2 { # Interface to assign a subnet of the delegated
prefix
sla-id 0; # Subnet ID (e.g., /64 within a /56)
};
};
Unigue Local Addresses
For IPv6 Unique Local Addresses (ULA), there is reserved range fc00::/7 reserved for private, non-routable addresses.
Range fc00::/7 is split into two /8 subnets:
- fc00::/8 — reserved for future use (currently unused)
- fd00::/8 — commonly used (locally generated)
So for private use, we should use subnets within fd00::/8 range.
These addresses:
- Are not routed on the public Internet
- Are safe to use in your LAN or data center
- Work well with SLAAC, DHCPv6, and static assignments
Documentation and Examples Addresses
There is another IPv6 prefix (2001:db8::/32) which is not globally routed.
It is reserved (RFC 3849) for documentation and example purposes. It should really be used just for examples, tutorials, and documentation. It is not routed on the public internet, and should not appear in real networks.
For local, non-routable subnets, a ULA prefix (fd00::/8) should be used.
IPv6 Public DNS Servers
In this section, I document publicly available IPv6 DNS servers.
Google's Public DNS Servers
Cloudflare's Public DNS Servers
Cloudflare is a U.S. based technology company that provides a suite of services to enhance website performance, security, and reliability. CDN (Content Delivery Network), Security, Performance, Networking and DNS.
Standard DNS Servers
Malware Blocking
Malware and Adult Blocking
Quad9's public DNS servers
Quad9 is a non-profit organization focused on security and privacy in DNS resolution.
Secure DNS Servers
Primary: 2620:fe::fe Equivalent to IPv4: 9.9.9.9
Secondary: 2620:fe::9 Equivalent to IPv4: 149.112.112.112
Secure DNS Servers + ECS-enabled (for CDNs)
Primary: 2620:fe::11 Equivalent to IPv4: 9.9.9.11
Secondary: 2620:fe::fe:11 Equivalent to IPv4: 149.112.112.11
No comments:
Post a Comment