Cisco 200-301: IPv6 Addressing and IPv6 Routing — Study Guide

By Laurynas Brazys · 14 August 2026 · #cisco #200-301 #certification #exam-prep #study-guide

Part of the Cisco CCNA 200-301 — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

IPv6 replaces exhaustion-prone IPv4 addressing with a vastly larger, structured space and control-plane protocols designed to operate without broadcast. This section explains IPv6 addressing and routing concepts, with configuration touchpoints and the operational reasoning behind design choices. Emphasis is placed on failure modes, security at the first hop, and a practical troubleshooting workflow.

IPv6 Addressing Fundamentals

Notation, compression, and expansion:

• IPv6 addresses are 128-bit values written in eight 16-bit hextets in hexadecimal, separated by colons (for example, 2001:0db8:0000:0000:0500:000a:400f:583b).
• Leading zeros within a hextet may be suppressed. One run of contiguous all-zero hextets may be compressed once using ::. Example compression: 2001:db8::500:a:400f:583b.
• Expansion reverses the process by restoring omitted zeros and hextets.

Address types:

• Global unicast (GUA): 2000::/3. Publicly routable; analogous to IPv4 public addresses. Used for interdomain communication.
• Unique local (ULA): fc00::/7 (commonly fd00::/8 for locally assigned). Reachable within a site or across VPN-connected sites but not intended for public Internet routing. Useful for internal stability and lab/test spaces.
• Link-local: fe80::/10. Required on every IPv6 interface; used for on-link communications such as NDP and as next hops for routing. Never routed off-link.
• Multicast: ff00::/8. Replaces broadcast. Scopes define reach (for example, ff02::/16 is link-local scope).
• Anycast: One unicast address configured on multiple interfaces; routing delivers to the topologically closest. Often used for services like DNS or default gateway in leaf-spine designs. Anycast has no special bit pattern; it is an operational practice.

Prefixes, interface identifiers, and subnet planning:

• The most common LAN prefix length is /64. A /64 is required for SLAAC. Interface identifiers (IIDs) are 64 bits.
• IID formation:
  • EUI-64 derives the IID from the interface MAC by inserting fffe in the middle and inverting the universal/local bit (bit 7). Example on Cisco IOS: ipv6 address 2001:DB8:5:112::/64 eui-64.
  • Privacy IIDs (temporary addresses) randomize the IID to mitigate host tracking; RFC 7217 defines stable-but-random IIDs per-prefix.
• Planning guidance:
  • Use hierarchical aggregation (for example, a /48 per site, /56 per building, /64 per VLAN).
  • Point-to-point links can use /127 to eliminate subnet-router anycast and prevent certain scanning/ND exhaustion attacks; if using SLAAC on such links, retain /64.
  • Reserve GUAs for Internet-reachable networks; consider ULAs for purely internal segments to decouple internal addressing from ISP allocations. Avoid NAT66; if translation is needed for policy or provider-independence, prefer NPTv6 prefix translation with careful symmetry.

IPv6 Autoconfiguration, Neighbor Discovery, and Multicast

Router Advertisements (RAs) and address assignment:

• RAs convey on-link prefixes, default gateway lifetime, and flags governing host behavior:
  • SLAAC: Hosts create IIDs (EUI-64 or privacy) using RA Prefix Information Options (PIOs).
  • Stateless DHCPv6: RA “Other Configuration” flag set; hosts use DHCPv6 for DNS and other parameters, but not for addresses.
  • Stateful DHCPv6: RA “Managed” flag set; hosts obtain addresses and parameters from DHCPv6. The RA may still provide a default gateway.
• Cisco note: RAs are sent by L3 interfaces when ipv6 unicast-routing is enabled and a link prefix is present. Tuning via ipv6 nd commands controls intervals and flags.
• Example to signal stateless DHCPv6 on an SVI:
  • interface Vlan10 ipv6 address 2001:db8:10:10::1/64 ipv6 nd other-config-flag

Neighbor Discovery Protocol (NDP) and ICMPv6:

• ICMPv6 underpins IPv6 control: Router Solicitation (RS), Router Advertisement (RA), Neighbor Solicitation (NS), Neighbor Advertisement (NA), and Redirect.
• Duplicate Address Detection (DAD) uses NS to the solicited-node multicast of the tentative address; if a response (NA) is received, the address is not assigned.
• Default router selection is derived from RAs; neighbors and default routers are cached in the Neighbor Cache (similar to ARP table). Operational issues often stem from stale or incomplete neighbor cache entries.

Multicast behavior and solicited-node multicast:

• IPv6 has no broadcast. Multicast groups target specific functions:
  • ff02::1 all-nodes (every interface joins when IPv6 is enabled).
  • ff02::2 all-routers (router interfaces join; hosts do not).
  • ff02::1:ffXX:XXXX solicited-node multicast; each assigned unicast/anycast address maps to one solicited-node group using the low-order 24 bits of the address. Used by NDP to resolve L2 addresses efficiently.
• Layer 2 mapping for IPv6 multicast uses MAC 33:33:xx:xx:xx:xx. Ethernet multicast filtering and MLD snooping on switches prevent excessive flooding.

Common failure modes and trade-offs:

• Missing or filtered RAs lead hosts to self-configure only link-local addresses; connectivity appears local-only.
• Mis-set RA flags cause unintended reliance on DHCPv6 or lack of DNS settings.
• EUI-64 exposes OUI-derived identifiers; privacy IIDs mitigate tracking at the expense of operational stability for ACLs.
• DAD failures arise with anycast-like duplicate addresses on the same link; coordinate gateway redundancy design accordingly.

IPv6 Routing and Migration

Static routes and default routes:

• Default route: ::/0. Example:
  • ipv6 route ::/0 GigabitEthernet0/0 fe80::1
  • When using a link-local next hop, include the exit interface to disambiguate scope.
• Network route examples:
  • ipv6 route 2001:db8:20::/48 2001:db8:10:1::2
  • ipv6 route 2001:db8:30::/48 GigabitEthernet0/1 fe80::2
• Operational notes:
  • Recursive next-hop resolution requires a neighbor entry; ND failures appear as unresolved adjacencies in CEF.
  • Administrative distance and metric determine route preference among candidates; forwarding uses longest prefix match.

Routing-table lookup:

• Longest prefix match selects the most specific route; if equal, route selection considers protocol preference and metric. Connected and local routes are most preferred and provide directly attached next hops.

Dual-stack, tunneling, and migration:

• Dual-stack: Run IPv4 and IPv6 in parallel. Easiest to troubleshoot and offers native performance; doubles control-plane and security policy work.
• Tunneling (IPv6-in-IPv4): Manual or dynamic tunnels, GRE, and 6RD carry IPv6 over IPv4 cores. Useful when provider lacks native IPv6; MTU and PMTUD considerations are critical. Tunnels add encapsulation overhead and operational complexity.
• Translation: NAT64/DNS64 enables IPv6-only clients to reach IPv4-only servers. Introduces state, protocol edge cases (embedded IPs, literals), and debugging complexity. NPTv6 provides stateless prefix translation for provider independence with symmetric paths.
• Design trade-offs:
  • Prefer native dual-stack at the edges first, then in the core.
  • Use tunnels as transitional scaffolding with explicit retirement plans.
  • For IPv6-only segments, plan application readiness and NAT64 placement.

IPv6 first-hop security concepts:

• RA Guard: Blocks unauthorized RAs on untrusted access ports; prevents rogue gateways.
• DHCPv6 Guard: Blocks unauthorized DHCPv6 server messages.
• IPv6 Snooping and Binding Table: Learns bindings of IPv6-to-MAC-to-port to feed enforcement features.
• IPv6 Source Guard and ND Inspection: Enforces source address validity and validates NDP messages against the binding table to stop spoofing.
• SeND (Secure NDP) exists but is rarely deployed due to PKI complexity.
• MLD Snooping: Constrains multicast to interested receivers; reduces flooding.

Verification and Troubleshooting Workflow

Baseline checks:

• Ensure global IPv6 is enabled: show running-config | include ipv6 unicast-routing.
• Interface state and addressing: show ipv6 interface brief; show ipv6 interface to confirm link-local, RA settings, and ND parameters.
• Verify RAs and default routers learned by hosts: show ipv6 routers, and on hosts, inspect default route and SLAAC/DHCPv6 state.

Neighbor discovery and path resolution:

• Check neighbor cache: show ipv6 neighbors; clear ipv6 neighbors if entries are stale.
• Use ping and traceroute with IPv6; test both link-local (scoped with outgoing interface) and global addresses to isolate on-link vs off-link issues.

Routing:

• Inspect routing table: show ipv6 route; confirm longest match for the destination.
• Validate static routes and next-hop reachability; for link-local next hops, confirm the specified egress interface has the neighbor in REACH or STALE state.
• CEF and adjacency: show ipv6 cef exact-route to see resolved adjacency; unresolved indicates ND or ARP-like failure.

Control-plane health:

• ICMPv6 counters: show ipv6 traffic to observe NS/NA/RA/RS volumes and drops.
• On switches, verify first-hop security policies and MLD snooping status to ensure legitimate control traffic is not being blocked.

Common pitfalls:

• Forgetting ipv6 unicast-routing on routers prevents RAs and routing.
• Misconfigured prefix lengths lead hosts to treat destinations as on-link or off-link incorrectly; symptoms include NDP queries for off-link prefixes or missing default routes.
• MTU/fragmentation across tunnels breaks PMTUD; observe oversized ICMPv6 “Packet Too Big” handling.

Practical Problem Scenario

Northwind Textiles is rolling out IPv6 to its headquarters campus while its MPLS WAN remains IPv4-only for six months. The challenge: provide dual-stack service to user VLANs, native IPv6 Internet access, and secure first-hop behavior, while using the IPv4 MPLS core to carry IPv6 between buildings.

Approach:

1. Enable IPv6 and establish addressing plan

• Configure ipv6 unicast-routing on campus routers and SVIs. Assign a /48 GUA from the ISP as 2001:db8:1200::/48, carving /64s per user VLAN and /127s on routed point-to-point links. Rationale: /64s support SLAAC; /127s on P2P reduce attack surface and eliminate subnet-router anycast.

2. Deploy SLAAC with stateless DHCPv6 for DNS

• On SVIs, configure ipv6 address ::1/64 and ipv6 nd other-config-flag. Stand up DHCPv6 for RDNSS option or use stateless DHCPv6 to provide DNS servers. Rationale: SLAAC minimizes client configuration overhead; stateless DHCPv6 supplies critical non-address parameters without adding address state.

3. Build IPv6-in-IPv4 GRE tunnels across the MPLS core

• Create point-to-point GRE tunnels between building routers with keepalives; run an IPv6 IGP or place static IPv6 routes across tunnels. Rationale: GRE encapsulates IPv6 over the IPv4-only provider with predictable paths; keepalives detect path failure. MTU is adjusted to avoid fragmentation (tunnel path-mtu-discovery or interface mtu tuning).

4. Advertise the default route from the Internet edge

• On the Internet edge, install ipv6 route ::/0 toward the ISP and advertise the default into the campus IGP. Rationale: Centralized egress ensures symmetric flows and consistent policy control; distributing a default simplifies campus routing.

5. Secure the first hop on access switches

• Enable RA Guard and DHCPv6 Guard on user-facing ports; enable IPv6 Snooping to populate the binding table and enforce IPv6 Source Guard. Rationale: Prevents rogue RAs and unauthorized DHCPv6 servers; source validation stops spoofing and neighbor cache poisoning.

6. Standardize IIDs and privacy

• For infrastructure interfaces, use stable IIDs (manual ::1, ::2) or EUI-64 where appropriate; for users, allow privacy extensions. Rationale: Predictable infra addresses simplify operations; privacy IIDs protect users from tracking without impacting gateway operations.

7. Verification and monitoring

• Validate RAs with show ipv6 interface and show ipv6 routers; confirm neighbor tables and tunnel adjacencies with show ipv6 neighbors and show interfaces tunnel. Establish baseline with show ipv6 traffic and netflow/IPFIX where available. Rationale: Early baselines identify deviations quickly; ND and tunnel health directly affect forwarding.

8. Contingency for IPv6-only services

• If a pilot IPv6-only segment is required, place NAT64/DNS64 at the campus edge for access to IPv4-only sites. Rationale: NAT64 enables incremental IPv6 adoption while avoiding dual-stack on targeted, modern endpoints; scoped use confines translation complexity.

This plan brings IPv6 online with minimal disruption, contains first-hop risks, and bridges the temporary provider gap with controlled tunneling until native IPv6 is available end to end.

← IPv4 Addressing · All domains · Dynamic Routing and IP Connectivity →

Practice these questions → · Timed practice on ExamRoll.io →