Offensive Security Researcher & Quantum Cryptography Analyst

How to Set Up IPv6 on Cisco Routers: Complete Addressing and Configuration Guide

Abdul Wahab Junaid
How to Set Up IPv6 on Cisco Routers

How to Set Up IPv6 on Cisco Routers

Getting IPv6 running on a Cisco router involves more than typing an address and moving on. Between the different address types, autoconfiguration mechanisms, and interface-level nuances, there’s a lot that separates a working lab from a resilient production rollout. This guide walks through IPv6 fundamentals, addressing schemes, and the full configuration workflow needed to bring up IPv6 on Cisco IOS and IOS-XE routers.

IPv6 Address Types: The Foundation

Before configuring anything, it’s worth internalizing the address types you’ll be working with, since each serves a distinct purpose:

Step 1: Enable IPv6 Unicast Routing

Router(config)# ipv6 unicast-routing

This single command determines whether the router forwards IPv6 packets between interfaces at all. It’s the most commonly forgotten step in first-time IPv6 deployments.

Step 2: Assign Addresses to Interfaces

Manual Global Unicast Addressing

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ipv6 address 2001:db8:1:1::1/64
Router(config-if)# no shutdown

EUI-64 Addressing

EUI-64 automatically derives the interface identifier (the last 64 bits) from the interface’s MAC address, which is handy for consistent addressing without manually assigning host bits:

Router(config-if)# ipv6 address 2001:db8:1:1::/64 eui-64

Link-Local Only (No Global Address)

Sometimes you only need link-local connectivity, such as for a routing protocol adjacency on a point-to-point WAN link where global addressing isn’t required:

Router(config-if)# ipv6 enable

This enables IPv6 processing on the interface and auto-generates a link-local address without requiring a global unicast address.

Manually Setting the Link-Local Address

Router(config-if)# ipv6 address fe80::1 link-local

Useful for predictable addressing in lab environments or where you want human-readable link-local addresses for troubleshooting.

Step 3: Verify Interface Addressing

Router# show ipv6 interface brief
GigabitEthernet0/0    [up/up]
    fe80::1
    2001:DB8:1:1::1

Router# show ipv6 interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  Global unicast address(es):
    2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:1
  MTU is 1500 bytes
  ND DAD is enabled, number of DAD attempts: 1

SLAAC and Stateless DHCPv6

Routers frequently need to act as the source of autoconfiguration information for downstream hosts via Router Advertisements (RAs).

Enabling SLAAC (Default Behavior)

Once IPv6 unicast routing and an address are configured, the interface sends periodic and solicited RAs automatically. No additional command is required for basic SLAAC to function.

Configuring RA Parameters

Router(config-if)# ipv6 nd ra interval 60
Router(config-if)# ipv6 nd ra lifetime 1800
Router(config-if)# ipv6 nd prefix 2001:db8:1:1::/64 2592000 604800

Stateless DHCPv6 (Address via SLAAC, Options via DHCPv6)

Router(config-if)# ipv6 nd other-config-flag

This sets the “O-flag” in RAs, telling hosts to use SLAAC for addressing but query a DHCPv6 server for additional options like DNS servers.

Stateful DHCPv6 (Managed Addressing)

Router(config-if)# ipv6 nd managed-config-flag

This sets the “M-flag,” instructing hosts to obtain both address and configuration from a DHCPv6 server rather than SLAAC.

Configuring the Router as a DHCPv6 Server

Router(config)# ipv6 dhcp pool CLIENT-POOL
Router(config-dhcpv6)# address prefix 2001:db8:1:1::/64
Router(config-dhcpv6)# dns-server 2001:4860:4860::8888
Router(config-dhcpv6)# domain-name example.com

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ipv6 dhcp server CLIENT-POOL
Router(config-if)# ipv6 nd managed-config-flag

DHCPv6 Relay Configuration

When the DHCPv6 server lives elsewhere on the network:

Router(config-if)# ipv6 dhcp relay destination 2001:db8:99::10

Dual-Stack Configuration Example

Most enterprise migrations run IPv4 and IPv6 side by side rather than a hard cutover:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ipv6 address 2001:db8:1:1::1/64
 ipv6 enable
 no shutdown

Both protocol stacks forward independently; there’s no interaction required beyond having both ip route/ipv6 route (or dynamic protocol) configured for each address family.

Lab: Full Small Office Rollout

Topology: One router (R1) with a LAN interface and a WAN uplink, providing SLAAC-based addressing to a /64 LAN subnet, plus a static default route out the WAN.

ipv6 unicast-routing
!
interface GigabitEthernet0/0
 description LAN
 ipv6 address 2001:db8:aaaa:1::1/64
 ipv6 nd other-config-flag
 no shutdown
!
interface GigabitEthernet0/1
 description WAN
 ipv6 address 2001:db8:ffff::2/64
 no shutdown
!
ipv6 route ::/0 2001:db8:ffff::1
!
ipv6 dhcp pool LAN-DNS
 dns-server 2001:4860:4860::8888
 domain-name example.com
!
interface GigabitEthernet0/0
 ipv6 dhcp server LAN-DNS

This gives LAN hosts SLAAC-derived addresses from the RA prefix, while DNS server info comes from stateless DHCPv6, and outbound traffic follows the static default route toward the WAN.

Common Configuration Mistakes

Best Practices

  1. Standardize on /64 for all end-user segments unless you have a specific, well-understood reason to deviate.
  2. Use EUI-64 sparingly — while convenient, it embeds the MAC address in the IPv6 address, which has privacy implications; consider ipv6 nd ra privacy extensions or manual addressing for security-sensitive segments.
  3. Document your ULA prefix allocation the same way you’d document RFC 1918 space, to avoid overlap across sites during any future consolidation.
  4. Enable DHCPv6 relay centrally rather than deploying standalone DHCPv6 servers at every site, for easier management.
  5. Test SLAAC and DHCPv6 behavior on real client OSes (Windows, macOS, Linux, mobile) before wide rollout — flag handling has historically varied slightly between vendors.

Troubleshooting Checklist

FAQs

Do I need to configure a link-local address manually? No, it’s auto-generated as soon as IPv6 is enabled on an interface, either via ipv6 address ... or ipv6 enable.

What’s the difference between ipv6 enable and assigning a full address? ipv6 enable turns on IPv6 processing and generates only a link-local address — no global unicast address is assigned. This is common on point-to-point links where global addressing isn’t needed.

Can a router assign addresses to itself via SLAAC? Typically no — routers are usually configured with static global unicast addresses; SLAAC is aimed at end hosts, although a router interface configured as a “host” port could theoretically use it.

Is DHCPv6 required for IPv6 to work? No. SLAAC alone provides addressing. DHCPv6 (stateless or stateful) is optional and used when you need centralized control over options like DNS or full stateful address assignment.

Performance Tuning Notes

On platforms with hardware-accelerated forwarding (ASR1000 series, Catalyst 9000 series switches acting as routers), IPv6 forwarding is handled in dedicated ASICs once the FIB is programmed, so raw forwarding performance is generally comparable to IPv4. The areas actually worth tuning are control-plane related: RA interval (ipv6 nd ra interval) should be balanced between fast client re-convergence after a failover and unnecessary multicast chatter on busy segments — 60 to 200 seconds is a reasonable range for most enterprise LANs, tightened only where sub-minute failover truly matters. Neighbor discovery cache size and DAD timers rarely need adjustment outside of very large Layer 2 domains, but on segments with thousands of hosts, consider ipv6 nd cache expire tuning and monitoring show ipv6 neighbors table size against platform maximums documented for your specific hardware.

Summary

Setting up IPv6 on a Cisco router starts with ipv6 unicast-routing, followed by deliberate choices about address type (GUA, ULA, link-local), how hosts will obtain addressing (SLAAC, stateless DHCPv6, or stateful DHCPv6), and how the router advertises its presence via RAs. Getting these fundamentals right up front avoids the majority of “IPv6 is configured but doesn’t work” issues seen in real deployments, and sets a solid foundation for the routing, security, and NAT64 topics that build on top of basic addressing.

References

Exit mobile version