EUI-64 Address Generation
Imagine you're building an IPv6 network and need to assign link-local or global unicast addresses to hundreds of devices. Manually configuring each interface is error-prone and time-consuming. That's where EUI-64 address generation comes in—it automatically derives a 64-bit interface identifier from a device's MAC address, enabling stateless address autoconfiguration (SLAAC). For the CCNA 200-301 exam (Objective 1.9), you must understand how EUI-64 works, its role in IPv6, and how to verify it on Cisco IOS.
Jump to a section
The License Plate Factory
Think of EUI-64 as a license plate factory for cars. Each car (network device) arrives with a unique Vehicle Identification Number (VIN) – its MAC address. The factory (EUI-64 process) takes that VIN and transforms it into a standardized license plate (interface ID) that can be attached to any state-issued plate (IPv6 prefix). First, the factory splits the VIN into two halves: the first 24 bits (manufacturer code) and the last 24 bits (serial number). Then it inserts a special two-character separator (FFFE) between them. Finally, it flips a specific digit (the 7th bit) to indicate whether the plate is for a globally unique car or a locally assigned one. The result is a 64-bit license plate that is unique and fits any state's plate format. This factory doesn't care about the state—it just produces the license plate. Similarly, EUI-64 doesn't care about the IPv6 prefix; it just creates the interface identifier. The network engineer can then combine this identifier with any /64 prefix (link-local fe80::/10 or global unicast) to form a complete IPv6 address. The beauty is that the license plate is guaranteed unique (as long as the VIN is unique), and the process is fully automatic—no manual plate assignment needed.
How It Actually Works
What is EUI-64 and Why Does It Exist?
EUI-64 (Extended Unique Identifier-64) is a method for generating a 64-bit interface identifier (the host portion of an IPv6 address) from a 48-bit MAC address. It is defined in RFC 4291 and is a core component of IPv6 stateless address autoconfiguration (SLAAC). The primary purpose is to provide a unique, globally scoped identifier for an interface without requiring manual configuration or a central server (like DHCP). On the CCNA 200-301 exam, you need to know how EUI-64 works, how to calculate an interface ID from a MAC address, and how to verify the resulting IPv6 address on Cisco routers.
How EUI-64 Works Step by Step
The process is straightforward:
Take the 48-bit MAC address of the interface. Example: 00:1A:2B:3C:4D:5E.
Split it into two 24-bit halves: The first half (OUI) is 00:1A:2B, the second half (NIC-specific) is 3C:4D:5E.
Insert the 16-bit value `FF:FE` in the middle: This creates a 64-bit string: 00:1A:2B:FF:FE:3C:4D:5E.
Flip the 7th bit (the Universal/Local bit) of the first byte: The first byte is 00 in binary 00000000. The 7th bit (counting from left, 0-indexed as bit 6) is the second-least significant bit. Flipping it makes it 00000010 which is 02 in hex. So the final interface ID becomes 02:1A:2B:FF:FE:3C:4D:5E.
This flipping indicates whether the address is globally unique (U/L bit = 1) or locally administered (U/L bit = 0). Since MAC addresses are globally unique, the original U/L bit is 0, and flipping it to 1 indicates a globally unique IPv6 interface ID.
Key States, Timers, and Defaults
No timers: EUI-64 is a one-time calculation, not a protocol with states.
Default behavior: On Cisco IOS, EUI-64 is used by default when you configure an IPv6 address with the eui-64 keyword, e.g., ipv6 address 2001:db8::/64 eui-64.
Interface ID length: Always 64 bits.
Prefix length: Must be /64 or shorter (for global unicast); link-local addresses are automatically generated using EUI-64 on all IPv6-enabled interfaces.
IOS CLI Verification Commands
To verify EUI-64 generated addresses, use the following commands:
Router# show ipv6 interface brief
FastEthernet0/0 [up/up]
FE80::21A:2BFF:FE3C:4D5E
2001:DB8::21A:2BFF:FE3C:4D5ERouter# show interfaces fa0/0
FastEthernet0/0 is up, line protocol is up
Hardware is AmdFE, address is 001a.2b3c.4d5e (bia 001a.2b3c.4d5e)
...Notice how the interface ID 21A:2BFF:FE3C:4D5E matches the MAC address after EUI-64 transformation: MAC 001a.2b3c.4d5e → split → 001a.2b and 3c.4d.5e → insert FFFE → 001a.2bff.fe3c.4d5e → flip 7th bit of first byte: 00 → 02 → 021a.2bff.fe3c.4d5e. The IOS output shows 21A:2BFF:FE3C:4D5E because leading zeros are omitted in the hex notation (021a becomes 21a).
How EUI-64 Interacts with Related Protocols
SLAAC: EUI-64 provides the interface ID for SLAAC-generated addresses. A host receives a Router Advertisement with a /64 prefix and combines it with its EUI-64 interface ID.
DHCPv6: DHCPv6 can also assign addresses, but EUI-64 is used for stateless autoconfiguration.
Privacy Extensions (RFC 4941): Because EUI-64 addresses are predictable (tied to MAC), they can be a privacy concern. Privacy extensions generate temporary random interface IDs for outbound connections, while EUI-64 addresses are still used for incoming connections.
Link-local addresses: Every IPv6-enabled interface automatically gets a link-local address (fe80::/10) using EUI-64. This is used for neighbor discovery and routing protocols.
Walk-Through
Obtain MAC address
The first step is to know the MAC address of the interface. On a Cisco router, use `show interfaces` or `show ipv6 interface brief` to see the MAC address. For example, `show interfaces GigabitEthernet0/0` will display the hardware address. The MAC is a 48-bit hexadecimal number, typically written as `001a.2b3c.4d5e` in Cisco format (three groups of four hex digits separated by dots).
Split MAC into two halves
Divide the 48-bit MAC into two 24-bit halves: the first 24 bits (OUI, or Organizationally Unique Identifier) and the last 24 bits (NIC-specific). For MAC `001a.2b3c.4d5e`, the first half is `001a.2b` (24 bits) and the second half is `3c.4d.5e` (24 bits). In hex, this is `00:1A:2B` and `3C:4D:5E`.
Insert FFFE in the middle
Insert the 16-bit value `FF:FE` between the two halves. This yields a 64-bit string: `001a.2bff.fe3c.4d5e` (in Cisco format) or `00:1A:2B:FF:FE:3C:4D:5E` (in colon-hex). This step ensures the interface ID is exactly 64 bits.
Flip the 7th bit (U/L bit)
Take the first byte of the result (the first octet of the OUI) and flip the 7th bit (the second-least significant bit, also called the Universal/Local bit). For `00` (binary `00000000`), flipping the 7th bit gives `00000010` which is `02` hex. So the first byte becomes `02`. The rest of the bytes remain unchanged. The final interface ID is `02:1A:2B:FF:FE:3C:4D:5E`.
Combine with IPv6 prefix
The resulting 64-bit interface ID is appended to a /64 IPv6 prefix to form a complete IPv6 address. For example, with prefix `2001:db8::/64`, the full address becomes `2001:db8::21a:2bff:fe3c:4d5e` (note that leading zeros are omitted in the interface ID representation). On Cisco IOS, this is configured with the command `ipv6 address 2001:db8::/64 eui-64`.
Verify the generated address
Use `show ipv6 interface brief` or `show ipv6 interface GigabitEthernet0/0` to see the generated IPv6 address. The output will display both the link-local address (also EUI-64 based) and any global unicast addresses with EUI-64. You can cross-check the interface ID against the MAC address to ensure the transformation is correct.
What This Looks Like on the Job
In enterprise networks, EUI-64 is most commonly encountered in two scenarios: stateless autoconfiguration for end-user devices and automatic link-local address generation for routers.
Scenario 1: Stateless Autoconfiguration for Client Devices
A large university deploys IPv6 across its campus. Instead of running DHCPv6 servers for every subnet, they use SLAAC with EUI-64. Each student's laptop or phone receives a Router Advertisement from the access layer switch containing the /64 prefix for that VLAN. The device then generates its own IPv6 address using EUI-64. This eliminates the need for DHCP infrastructure and simplifies address management. However, the network team must be aware that EUI-64 addresses are predictable—an attacker who knows the MAC address can guess the IPv6 address. For this reason, many organizations enable privacy extensions (temporary addresses) on client devices for outbound connections, while keeping EUI-64 addresses for inbound services (like servers).
Scenario 2: Link-Local Addresses on Routers
Every Cisco router interface automatically gets a link-local address (fe80::/10) using EUI-64. This address is used for neighbor discovery (NDP) and routing protocol adjacencies (e.g., OSPFv3, EIGRP for IPv6). Network engineers rarely need to manually configure link-local addresses because EUI-64 provides a unique address per interface. However, in some designs, engineers prefer to use a consistent, easy-to-remember link-local address (like fe80::1) for management purposes. In that case, they must manually configure it, overriding the EUI-64 default.
Performance and Scale
EUI-64 generation is a trivial computation, so there is no performance impact. The main consideration is address uniqueness: since MAC addresses are globally unique (for Ethernet interfaces), EUI-64 guarantees a unique interface ID. However, on virtual interfaces (like VLAN interfaces on a switch) that may share the same MAC, duplicate addresses can occur. In such cases, Cisco IOS automatically detects duplicates using Duplicate Address Detection (DAD) and may assign a temporary address or log an error.
Misconfiguration Consequences
If an engineer mistakenly uses a prefix longer than /64 (e.g., /48) with EUI-64, the router will reject it because EUI-64 requires a 64-bit interface ID. Also, if a MAC address changes (e.g., due to hardware replacement), the IPv6 address changes, which can disrupt connectivity for devices that rely on static DNS entries.
How CCNA 200-301 Actually Tests This
The CCNA 200-301 exam tests EUI-64 under Objective 1.9: "Configure and verify IPv6 addressing and prefix." You should expect to see questions that require you to calculate the EUI-64 interface ID from a given MAC address, or to identify the correct IPv6 address after EUI-64 transformation.
Common Wrong Answers and Why
Forgetting to flip the 7th bit: Many candidates correctly insert FFFE but forget to flip the U/L bit. For example, they might generate 001a.2bff.fe3c.4d5e instead of 021a.2bff.fe3c.4d5e. The exam will include the correct answer and a distractor with the unflipped version.
Flipping the wrong bit: Some candidates flip the first bit (most significant) instead of the 7th bit, resulting in 801a... instead of 021a.... Remember: it's the second-least significant bit (bit 6 in 0-indexed, or bit 7 in 1-indexed).
Inserting FFFE in the wrong position: A common mistake is to insert FFFE at the end or before the OUI. The correct position is between the two 24-bit halves.
Confusing EUI-64 with MAC address format: The exam may show a MAC address in different formats (e.g., 001a.2b3c.4d5e vs 00:1a:2b:3c:4d:5e). Be comfortable converting between them.
Specific Values and Command Outputs
The U/L bit flip changes 00 to 02, 01 to 03, 02 to 00, etc. Practice flipping the first hex digit: if the first hex digit is even, add 2; if odd, subtract 2 (with carry if needed). For example, 00 → 02, 01 → 03, 02 → 00, 03 → 01, A0 → A2, F0 → F2.
The show ipv6 interface brief command output will show the EUI-64 address with the interface ID in compressed format (e.g., 21A:2BFF:FE3C:4D5E).
Calculation Trap
When the MAC address has a first byte like 02, flipping the 7th bit results in 00. Candidates often panic and think they made a mistake, but it's correct. For example, MAC 0200.1234.5678 → first byte 02 → flip → 00 → interface ID 00:00:FF:FE:12:34:56:78. The leading zeros are omitted, so it appears as 0:0:FF:FE:1234:5678.
Decision Rule for Scenario Questions
If a question asks for the IPv6 address generated via EUI-64 from a given MAC, follow these steps: (1) Split MAC into two 24-bit halves. (2) Insert FFFE. (3) Flip the 7th bit of the first byte. (4) Combine with the given prefix (must be /64). (5) Compress the address using standard IPv6 rules.
Key Takeaways
EUI-64 generates a 64-bit interface ID from a 48-bit MAC address by inserting FFFE and flipping the 7th (U/L) bit.
The 7th bit flip changes the first byte: if the first hex digit is even, add 2; if odd, subtract 2.
EUI-64 is used by default for link-local addresses and can be configured for global unicast with the eui-64 keyword.
The prefix length must be /64 or shorter; EUI-64 requires a 64-bit interface ID.
Use 'show ipv6 interface brief' to verify EUI-64 generated addresses.
Privacy extensions (RFC 4941) can override EUI-64 for outbound connections to prevent address tracking.
EUI-64 is not used on virtual interfaces that share a MAC address; DAD detects duplicates.
Easy to Mix Up
These come up on the exam all the time. Here's how to tell them apart.
EUI-64
Derives interface ID from MAC address (predictable)
Always generates the same address for a given MAC
Used for link-local and global unicast addresses
Simplifies address management (stateless)
No additional configuration needed
Privacy Extensions (RFC 4941)
Generates random temporary interface IDs
Address changes over time (privacy)
Used for outbound connections; EUI-64 still used for inbound
Requires host OS support and configuration
Reduces risk of address-based tracking
Watch Out for These
Mistake
EUI-64 simply takes the MAC address and adds FFFE without any bit flipping.
Correct
EUI-64 inserts FFFE between the two 24-bit halves of the MAC, then flips the 7th (U/L) bit of the first byte to indicate global uniqueness.
Candidates often skip the bit flip because they focus on the insertion step.
Mistake
The U/L bit is the most significant bit (first bit) of the first byte.
Correct
The U/L bit is the 7th bit (second-least significant) of the first byte. For byte 00 (binary 00000000), flipping bit 7 gives 00000010 (02).
The term '7th bit' is ambiguous; candidates sometimes count from the left instead of the right.
Mistake
EUI-64 can be used with any prefix length, such as /48 or /56.
Correct
EUI-64 produces a 64-bit interface ID, so the prefix must be /64 or shorter (e.g., /48 is allowed, but the address will have 16 bits of subnet and 64 bits of interface ID).
Candidates think the interface ID can be truncated, but it is always 64 bits.
Mistake
The EUI-64 address is the same as the modified EUI-64 address used in IPv4.
Correct
EUI-64 is specific to IPv6; IPv4 does not use EUI-64. The process is defined in RFC 4291 for IPv6.
Some candidates confuse it with similar concepts like MAC address formatting.
Do You Actually Know This?
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Frequently Asked Questions
What is the difference between EUI-64 and modified EUI-64?
EUI-64 and modified EUI-64 are often used interchangeably in IPv6, but technically, EUI-64 refers to the 64-bit identifier format, while modified EUI-64 is the specific process of inserting FFFE and flipping the U/L bit. In CCNA context, they mean the same thing. The term 'modified' emphasizes the bit flip. For the exam, just know the standard process.
Does EUI-64 work with any MAC address?
Yes, EUI-64 works with any 48-bit MAC address, including burned-in addresses (BIA) and locally administered addresses. However, if the MAC address changes (e.g., due to interface replacement), the IPv6 address will change. For stability, some administrators manually configure the interface ID or use DHCPv6.
Can I use EUI-64 on a prefix longer than /64?
No. EUI-64 always generates a 64-bit interface ID. If you try to configure an address with a prefix longer than /64 (e.g., /124), the router will reject it because there is not enough room for the 64-bit interface ID. The prefix must be /64 or shorter (e.g., /48, /56).
Why does my EUI-64 address look different from the MAC address?
The EUI-64 process modifies the MAC address in two ways: inserting FFFE and flipping the 7th bit. So the resulting interface ID will always have 'FF:FE' in the middle and the first byte will be different (e.g., 00 becomes 02). This is normal and expected.
How do I disable EUI-64 on a Cisco router?
You cannot disable EUI-64 for link-local addresses; they are always generated automatically. For global unicast addresses, simply do not use the 'eui-64' keyword. Instead, configure the full address manually, e.g., 'ipv6 address 2001:db8::1/64'.
What is the purpose of the U/L bit in EUI-64?
The U/L (Universal/Local) bit indicates whether the interface ID is globally unique (1) or locally administered (0). Since MAC addresses are globally unique, flipping the U/L bit from 0 to 1 signals that the IPv6 interface ID is globally unique. This helps in address assignment and troubleshooting.
Can I use EUI-64 on a switch virtual interface (SVI)?
Yes, SVIs have MAC addresses (usually the base MAC of the switch or a pool). EUI-64 works the same way. However, if multiple SVIs share the same MAC (common on some switches), duplicate address detection (DAD) may flag conflicts. In such cases, manually configure the interface ID to avoid duplicates.
Terms Worth Knowing
Ready to put this to the test?
You've just covered EUI-64 Address Generation — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?