IPv6 is no longer optional on the CCNA 200-301 exam, and it's increasingly common in real networks. However, IPv6 configuration and troubleshooting are riddled with subtle traps that trip up even experienced engineers. This chapter covers the most common IPv6 errors seen on the exam and in production—from link-local addressing mistakes to EUI-64 formatting pitfalls. Mastering these traps is essential for passing the exam and for building reliable dual-stack networks.
Jump to a section
Imagine a large apartment building with 200 units. Each unit has a unique apartment number, like 301 or 205. The building also has a central mailroom with a set of mailboxes. Each mailbox has a label that includes the building's street address and the apartment number, e.g., "123 Main St, Apt 301." Now suppose a new mail carrier arrives and is told to deliver mail to "Apt 301" without the street address. That's ambiguous—there are thousands of buildings. The carrier needs the full address. In IPv6, a host's full address includes both the network prefix (like the street address) and the interface ID (like the apartment number). A common trap is to configure only the interface ID or only the prefix, leaving the address incomplete. Another trap: the mailroom assigns mailboxes using a standard format: the apartment number is exactly three digits, and if it's only two digits, a leading zero is added (e.g., "Apt 050"). If a resident writes their apartment number as "50" instead of "050," the mailbox label doesn't match. In IPv6, the EUI-64 format requires inserting "FFFE" in the middle of the MAC address and flipping the seventh bit. If you forget to flip that bit, the interface ID is wrong, and communication fails. Finally, imagine two apartments accidentally share the same mailbox label because of a typo. That's a duplicate address—exactly like a duplicate IPv6 address on a network, which causes Neighbor Discovery to fail. The analogy helps you remember: always check the full address, follow the format rules, and ensure uniqueness.
What Are IPv6 Common Errors?
IPv6 common errors are configuration mistakes, addressing misunderstandings, and operational pitfalls that frequently appear on the CCNA 200-301 exam and in real-world deployments. These errors often stem from differences between IPv4 and IPv6, such as the use of hexadecimal notation, longer addresses, and new protocols like Neighbor Discovery (ND) and Stateless Address Autoconfiguration (SLAAC). The exam objective 1.9 specifically tests your ability to identify and correct these errors.
Link-Local Address Misconfiguration
Every IPv6-enabled interface automatically generates a link-local address (fe80::/10). A common error is manually assigning a global unicast address but forgetting that the link-local address is still needed for neighbor discovery and routing protocol adjacencies. For example, OSPFv3 uses link-local addresses as the next-hop for routes. If you accidentally change the link-local address to a global unicast address (e.g., ipv6 address 2001:db8::1 link-local), OSPFv3 adjacency may fail because routers expect a fe80:: address. The correct command to set a custom link-local address is:
ipv6 address fe80::1 link-localAnother trap: assuming all link-local addresses are the same. They are only unique on a given link, but two interfaces on the same router can have the same link-local address (though not recommended). On the exam, if a question shows a router with two interfaces both using fe80::1, that is allowed—but if they are on the same link, it's a problem.
EUI-64 Format Errors
EUI-64 is a method to derive an interface ID from a MAC address. The process: take the 48-bit MAC (e.g., 0012.3456.789a), split it in half, insert FFFE in the middle (0012.34FF.FE56.789a), and flip the seventh bit of the first byte (the universal/local bit). The seventh bit of 0x00 is 0, so flipping it gives 0x02, resulting in 0212.34FF.FE56.789a. A common error is forgetting to flip that bit. For example, a candidate might write 0012.34FF.FE56.789a, which is incorrect. The exam expects you to know that the resulting interface ID must have the second hexadecimal digit (the first nibble after the colon) as 2, 6, A, or E for a globally unique MAC (if the original MAC's seventh bit was 0). Another trap: applying EUI-64 to a MAC address that is already modified (e.g., from a virtual interface). Always use the burned-in MAC address.
IPv6 Address Shortening Errors
IPv6 addresses can be shortened by omitting leading zeros and replacing one contiguous block of zeros with ::. Common errors: using :: twice (e.g., 2001:db8::1::2), which is illegal because the router can't determine how many zeros each :: represents. Another error: forgetting to shorten leading zeros but keeping trailing zeros. For example, 2001:0db8:0000:0000:0000:0000:0000:0001 should be shortened to 2001:db8::1, not 2001:db8:0:0:0:0:0:1. The exam often asks for the fully expanded or fully shortened form. Know that :: can only appear once.
Subnet Prefix Length Mistakes
IPv6 subnetting uses prefixes like /64, /56, /48. The most common subnet size for LANs is /64, because SLAAC requires a /64 prefix. A common error is using a /48 or /56 on a LAN segment. While technically possible, SLAAC will not work because the interface ID is 64 bits. Another trap: confusing the prefix length with the number of subnets. For example, a /48 prefix provides 65536 /64 subnets (2^(64-48) = 2^16 = 65536). On the exam, you may be asked to calculate the number of subnets from a given prefix. Don't forget that the interface ID must be 64 bits for SLAAC.
Duplicate Address Detection (DAD) Failures
DAD is performed by Neighbor Discovery to ensure no other node uses the same IPv6 address. A common error is configuring a static IPv6 address that is already in use. The router will log a DAD failure message like:
%IPV6-4-DAD_DUPLICATE: Duplicate address 2001:db8::1 on GigabitEthernet0/0On the exam, if you see this message, the address is not usable. The interface will remain in "tentative" state until the conflict is resolved. Another trap: assuming DAD works like ARP in IPv4. In IPv6, DAD uses Neighbor Solicitation messages sent to the solicited-node multicast address. If no Neighbor Advertisement is received, the address is unique.
OSPFv3 Network Type Mismatch
OSPFv3 (for IPv6) uses link-local addresses for neighbor adjacency. A common error is configuring an OSPFv3 interface with a network type that doesn't match the neighbor. For example, one side is broadcast and the other is point-to-point. This causes adjacency to fail. The verification command is:
show ipv6 ospf interface gigabitethernet 0/0Look for "Network Type BROADCAST" or "Network Type POINT_TO_POINT." Ensure both sides match.
Misconfigured IPv6 ACLs
IPv6 ACLs are similar to IPv4 extended ACLs but use different syntax. A common error is forgetting the ipv6 keyword or using the wrong protocol number. For example, to permit OSPF (protocol 89), the command is:
ipv6 access-list PERMIT-OSPF
permit 89 any anyAnother trap: not applying the ACL to the correct interface or direction. Always verify with show ipv6 access-list.
Verify Link-Local Address
Use `show ipv6 interface brief` to list all IPv6 interfaces and their link-local addresses. A common error is seeing a global unicast address in the link-local field. The link-local address must start with fe80::. If it doesn't, the interface may have been misconfigured with a global address as link-local. Check with `show ipv6 interface <interface>` and look for "link-local address:". If wrong, remove the incorrect address with `no ipv6 address <address> link-local` and add the correct one. Example output: ``` GigabitEthernet0/0 [up/up] FE80::1 2001:DB8::1 ``` If the link-local was 2001:DB8::1, that's an error.
Check EUI-64 Format
When using EUI-64, verify the interface ID with `show ipv6 interface <interface>`. The interface ID should have the seventh bit flipped. For example, MAC 0012.3456.789a should produce 0212.34ff.fe56.789a. If you see 0012.34ff.fe56.789a, the bit was not flipped. Use `show interfaces <interface>` to get the MAC address, then manually compute the EUI-64 interface ID. On the exam, you may be asked to identify the correct EUI-64 address from multiple choices. Remember: the second hex digit of the first byte must be 2, 6, A, or E for a globally unique MAC.
Validate Address Shortening
Given a full IPv6 address, shorten it correctly. For example, 2001:0db8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. Common errors: using :: twice (e.g., 2001:db8::1::2) or not eliminating leading zeros (e.g., 2001:0db8:0:0:0:0:0:1). Use the rule: replace the longest contiguous block of zeros with ::, but only once. If there are multiple blocks of zeros, replace the longest one. If equal length, replace the first one. Practice with `show ipv6 interface` output to see how IOS shortens addresses.
Confirm Subnet Prefix Length
For LAN segments, ensure the prefix length is /64. Use `show ipv6 interface <interface> | include subnet` to see the prefix. If it's not /64, SLAAC will not work. For point-to-point links, /64 is still common but /126 or /127 can be used. On the exam, if a question says "SLAAC is not working," check the prefix length. Also, when calculating subnets, remember that a /48 provides 2^(64-48)=65536 /64 subnets. A common trap is thinking a /48 gives 2^48 subnets, which is wrong.
Test Duplicate Address Detection
After configuring a static IPv6 address, check for DAD failures. Use `show ipv6 interface <interface>` and look for "tentative" or "duplicate." If the address is in "duplicate" state, it cannot be used. You can also check logs with `show logging | include DAD`. To resolve, either change the address or remove the conflicting address on the other device. On the exam, you might see a syslog message: "%IPV6-4-DAD_DUPLICATE: Duplicate address..." The correct action is to reconfigure the address.
Verify OSPFv3 Adjacency
Use `show ipv6 ospf neighbor` to see OSPFv3 neighbors. If none are listed, check interface configuration with `show ipv6 ospf interface`. Ensure the network type matches on both sides. Also verify that the link-local addresses are reachable (ping the link-local address). A common error is using a global unicast address in the `router-id` or `area` commands incorrectly. OSPFv3 uses the router-id as a 32-bit number (like an IPv4 address), not an IPv6 address. Another trap: forgetting to enable OSPFv3 on the interface with `ipv6 ospf <process-id> area <area-id>`.
Enterprise Scenario: Dual-Stack Migration
A large enterprise is migrating from IPv4 to dual-stack. The network team configures IPv6 on all access switches using SLAAC with EUI-64. After deployment, some workstations cannot reach the IPv6 internet. Troubleshooting reveals that the switch interfaces were configured with a /56 prefix instead of /64. SLAAC requires a /64, so the hosts did not autoconfigure a global address. The fix: change the prefix length to /64. This scenario highlights the importance of using /64 on LAN segments. In production, always verify the prefix length with show ipv6 interface.
Service Provider: Duplicate Address Detection Failure
A service provider assigns static /64 prefixes to customer routers. One customer mistakenly configures the same IPv6 address as another customer on the same link. DAD detects the duplicate, and the router logs an error. The customer cannot communicate until the address is changed. In a large network, DAD failures can be hard to find. Network engineers use show ipv6 interface | include duplicate to locate problematic interfaces. The lesson: always check for DAD messages during initial configuration.
Data Center: OSPFv3 Adjacency Issues
A data center uses OSPFv3 for IPv6 routing. After upgrading IOS, OSPFv3 adjacencies fail between core routers. The engineer checks show ipv6 ospf neighbor and sees nothing. Using show ipv6 ospf interface, they notice one side is configured as point-to-point while the other is broadcast. The mismatch prevents adjacency. The fix: configure both sides with the same network type. In production, always verify network type consistency when troubleshooting OSPFv3.
Exam Objective 1.9: Identify and Correct IPv6 Common Errors
This objective is tested via multiple-choice questions, simulation labs, and troubleshooting scenarios. You must be able to spot configuration mistakes and understand the underlying protocol behavior.
Top Wrong Answers and Why
Wrong: EUI-64 interface ID is derived by inserting FFFE without flipping the seventh bit. Many candidates forget the bit flip. They see 0012.34FF.FE56.789a and think it's correct. The right answer must have the second hex digit as 2, 6, A, or E.
Wrong: Using :: twice in an IPv6 address is allowed. Candidates think they can shorten multiple zero blocks. The rule: only one :: per address.
Wrong: Link-local addresses are globally routable. They are not. They are only valid on the local link. A common trap question asks: "Can you ping a link-local address from a different subnet?" The answer is no, unless you specify the outgoing interface.
Wrong: OSPFv3 uses global unicast addresses for neighbor adjacency. It uses link-local addresses. If you configure OSPFv3 with a global address, adjacency fails.
Specific Values and Commands
EUI-64: The seventh bit of the first byte is flipped. For MAC 0012.3456.789a, the interface ID is 0212:34FF:FE56:789A.
DAD: Uses Neighbor Solicitation to solicited-node multicast address FF02::1:FFxx:xxxx.
Prefix length for SLAAC: /64.
Verification commands: show ipv6 interface brief, show ipv6 interface, show ipv6 ospf neighbor, show ipv6 route.
Decision Rule for Scenario Questions
If a question describes an IPv6 connectivity problem, follow this order: 1. Check if the interface has a valid IPv6 address (global or unique local). 2. Verify the prefix length is /64 for SLAAC. 3. Check for DAD errors. 4. For routing issues, verify OSPFv3 adjacency and network type. 5. Ensure ACLs are not blocking traffic.
EUI-64 requires inserting FFFE and flipping the seventh bit of the first byte of the MAC address.
Link-local addresses always start with fe80:: and are only valid on the local link.
Only one :: is allowed in an IPv6 address shortening.
SLAAC requires a /64 prefix length.
DAD uses Neighbor Solicitation to the solicited-node multicast address FF02::1:FFxx:xxxx.
OSPFv3 uses link-local addresses for neighbor adjacency and a 32-bit router-id.
Common verification commands: show ipv6 interface brief, show ipv6 interface, show ipv6 ospf neighbor.
These come up on the exam all the time. Here's how to tell them apart.
IPv4 Addressing
32-bit address, dotted decimal (e.g., 192.168.1.1)
Uses ARP for address resolution
Subnet mask expressed as /n or 255.255.255.0
Private addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
Broadcast address used for all-hosts communication
IPv6 Addressing
128-bit address, hexadecimal colon notation (e.g., 2001:db8::1)
Uses Neighbor Discovery (ND) for address resolution
Prefix length always /n (e.g., /64), no dotted decimal mask
Unique local addresses: fc00::/7 (similar to private)
No broadcast; uses multicast (e.g., FF02::1 for all-nodes)
Mistake
EUI-64 only inserts FFFE in the middle of the MAC address.
Correct
EUI-64 also flips the seventh (U/L) bit of the first byte. For a MAC starting with 00, the first byte becomes 02.
Candidates often focus only on the FFFE insertion and forget the bit flip, which is a critical step.
Mistake
You can use :: multiple times in an IPv6 address to shorten different zero blocks.
Correct
Only one :: is allowed because it represents a variable number of zero blocks. Using it twice is ambiguous.
This rule is frequently tested, and candidates mistakenly think they can shorten multiple blocks with multiple ::.
Mistake
Link-local addresses can be used to communicate with devices on different subnets.
Correct
Link-local addresses are only valid on the same link. Routers do not forward packets with link-local source or destination addresses.
Because link-local addresses begin with fe80, some assume they are globally unique and routable, but they are not.
Mistake
OSPFv3 uses the same network types as OSPFv2, but they don't need to match.
Correct
Network types must match between OSPFv3 neighbors (e.g., both broadcast or both point-to-point) for adjacency to form.
Candidates sometimes forget that mismatched network types prevent adjacency in OSPFv3 just as in OSPFv2.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Use the command 'ipv6 address fe80::1 link-local' under the interface. Do not use a global unicast address with the 'link-local' keyword. The link-local address must start with fe80::. On the exam, if you see a link-local address like 2001:db8::1, it is an error. Always verify with 'show ipv6 interface'.
Take the 48-bit MAC, split it in half (first 24 bits, last 24 bits), insert FFFE in the middle, then flip the seventh bit of the first byte. For example, MAC 0012.3456.789a: split into 0012.34 and 56.789a, insert FFFE to get 0012.34FF.FE56.789a, then flip the seventh bit of 0x00 (binary 00000000) to 0x02 (00000010), resulting in 0212.34FF.FE56.789a. The interface ID is 0212:34FF:FE56:789A.
No. The :: notation can only appear once in an IPv6 address because it represents a variable number of zero blocks. Using it twice would be ambiguous. For example, 2001:db8::1::2 is invalid. The correct form would be 2001:db8:0:0:0:0:1:2 or 2001:db8::1:0:0:2 depending on where the zeros are.
OSPFv3 adjacency requires matching network types and reachable link-local addresses. Use 'show ipv6 ospf interface' to check the network type and ensure both sides match. Also, verify that you can ping the neighbor's link-local address. If the link-local address is misconfigured (e.g., using a global address), adjacency will fail.
The message '%IPV6-4-DAD_DUPLICATE: Duplicate address 2001:db8::1 on GigabitEthernet0/0' means that another device on the same link is already using that IPv6 address. The interface will not use that address. You must either change the address on one of the devices or remove the duplicate. DAD uses Neighbor Solicitation messages to detect duplicates.
Use 'show ipv6 interface <interface>' and look for the line that says 'IPv6 is enabled, link-local address is ...' and then 'Global unicast address(es):' followed by the address and prefix. For example, '2001:db8::1/64'. The prefix length is the number after the slash. If it is not /64 for a LAN, SLAAC may not work.
It is used by Neighbor Discovery for address resolution and DAD. The solicited-node multicast address is FF02::1:FFxx:xxxx, where the last 24 bits are the last 24 bits of the IPv6 address (or interface ID). For example, for address 2001:db8::1:2:3:4, the solicited-node multicast address is FF02::1:FF03:4. This allows efficient multicast-based neighbor discovery.
You've just covered Exam Trap: IPv6 Common Errors — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?