IPv6 Global Unicast Addressing is a core topic for the CCNA 200-301 exam (Objective 1.9) because it represents the future of IP addressing. As IPv4 addresses run out, understanding how to allocate, configure, and verify IPv6 global unicast addresses is essential for any network engineer. This chapter will give you a deep understanding of the structure, allocation, and practical deployment of these addresses, preparing you for both the exam and real-world networks.
Jump to a section
Think of IPv6 global unicast addresses like the postal system for the internet. The IPv6 address is like a full mailing address: the first part (the global routing prefix) is like the country and city, the subnet ID is like the street name, and the interface ID is like the house number. The Internet Assigned Numbers Authority (IANA) is like the Universal Postal Union that allocates country codes. Regional Internet Registries (RIRs) are like national postal services that allocate city codes to local post offices. Internet Service Providers (ISPs) are like local post offices that assign street names to neighborhoods. Finally, you assign house numbers to individual buildings. Just as a postal address must be globally unique for mail to reach you, an IPv6 global unicast address must be globally unique for packets to be routed across the internet. The hierarchical structure allows routers to aggregate routes, much like a postal sorting office can forward all mail for a city to the same destination without knowing every street. The 64-bit interface ID is like the house number—it must be unique on the local subnet. Stateless Address Autoconfiguration (SLAAC) is like a new resident looking at the street signs (router advertisements) to learn the street name and then choosing a unique house number (using EUI-64 or privacy extensions).
What is an IPv6 Global Unicast Address?
An IPv6 Global Unicast Address (GUA) is a globally unique, routable IPv6 address, similar to a public IPv4 address. It is used for communication across the internet. The address is 128 bits long, divided into two main parts: a 64-bit network prefix and a 64-bit interface identifier (IID). The network prefix is further subdivided into a global routing prefix (typically /48), a subnet ID (usually /16), and the interface ID (the remaining 64 bits). The global routing prefix is assigned by a Regional Internet Registry (RIR) to an ISP or large organization. The subnet ID allows the organization to create multiple subnets. The interface ID identifies a specific interface on a subnet.
Why does it exist?
IPv4 addresses are exhausted. IPv6 provides a vastly larger address space (2^128 addresses) to accommodate the growing number of internet-connected devices. Global unicast addresses are the primary type of IPv6 address used for end-to-end communication. They are designed to restore end-to-end connectivity without the need for NAT, simplifying network design and improving performance.
How it works step by step at the packet/frame level
Address Assignment: A host receives its IPv6 GUA through Stateless Address Autoconfiguration (SLAAC), DHCPv6, or manual configuration. In SLAAC, the host listens for Router Advertisement (RA) messages from a local router. The RA contains the network prefix (e.g., 2001:db8:abcd:1::/64). The host then generates its own interface ID using EUI-64 (based on its MAC address) or a random value (privacy extensions). The host performs Duplicate Address Detection (DAD) by sending a Neighbor Solicitation (NS) message with its tentative address as the target. If no Neighbor Advertisement (NA) is received, the address is considered unique.
Packet Forwarding: When a host sends a packet to a global unicast destination, it first checks if the destination is on the same subnet. If yes, it uses Neighbor Discovery (ND) to resolve the destination MAC address. If not, it sends the packet to its default gateway (the router that sent the RA). The router then forwards the packet based on the destination address, using the longest prefix match in its routing table.
Routing: Routers exchange IPv6 routes using routing protocols like OSPFv3 or EIGRP for IPv6. The global unicast prefix is aggregated at each level of the hierarchy, reducing the size of routing tables.
Key states, timers, and defaults
Prefix Lifetime: Router Advertisements include a Valid Lifetime and Preferred Lifetime. Defaults are typically 30 days (2592000 seconds) for valid lifetime and 7 days (604800 seconds) for preferred lifetime.
DAD: Duplicate Address Detection sends up to 3 NS messages (default 1 second apart). If no NA is received, the address is unique.
Router Advertisement Interval: Default is every 200 seconds (but can be configured).
EUI-64: The interface ID is derived from the MAC address by inserting FFFE in the middle and flipping the 7th bit (the universal/local bit). For example, MAC 00:1A:2B:3C:4D:5E becomes 021A:2BFF:FE3C:4D5E.
IOS CLI verification commands with real example output
To verify IPv6 global unicast addresses on a Cisco router:
Router# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::1
2001:DB8:ABCD:1::1
GigabitEthernet0/1 [up/up]
FE80::2
2001:DB8:ABCD:2::1To see detailed address information:
Router# show ipv6 interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::1
No Virtual link-local address(es):
Global unicast address(es):
2001:DB8:ABCD:1::1, subnet is 2001:DB8:ABCD:1::/64
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF00:1
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (default)
ND advertised reachable time is 0 (unspecified)
ND advertised retransmit interval is 0 (unspecified)
ND router advertisements are sent every 200 seconds
ND router advertisements live for 1800 seconds
Hosts use stateless autoconfiguration for addresses.How it interacts with related protocols
Neighbor Discovery Protocol (NDP): Replaces ARP. Used for address resolution, DAD, router discovery, and prefix advertisement.
DHCPv6: Can be used for stateful address assignment, but often used for additional parameters (DNS, domain name) in conjunction with SLAAC.
ICMPv6: Used for error reporting and diagnostic functions (ping, traceroute).
Routing Protocols: OSPFv3, EIGRP for IPv6, and BGP for IPv6 carry global unicast prefixes.
Understand Address Structure
An IPv6 global unicast address is 128 bits. The first 64 bits are the network prefix, and the last 64 bits are the interface ID. The network prefix is typically a /48 global routing prefix assigned by an RIR, followed by a 16-bit subnet ID, allowing 65536 subnets. The interface ID must be unique on the subnet. For example, 2001:db8:abcd:1::1/64 has prefix 2001:db8:abcd:1::/64 and interface ID ::1. The prefix is further divided: 2001:db8:abcd is the global routing prefix (48 bits), and :1 is the subnet ID (16 bits). The interface ID can be manually configured, derived from EUI-64, or randomly generated.
Assign Addresses with SLAAC
SLAAC allows hosts to automatically configure an IPv6 address without a DHCP server. The host listens for Router Advertisement (RA) messages on the local link. The RA includes the network prefix and other parameters. The host then generates its interface ID using EUI-64 or privacy extensions. The host performs Duplicate Address Detection (DAD) by sending a Neighbor Solicitation (NS) with its tentative address. If no Neighbor Advertisement (NA) is received, the address is unique and assigned to the interface. This process is stateless, meaning the router does not track which addresses are assigned.
Configure IPv6 on a Cisco Router
To configure a global unicast address on a Cisco router interface, use the `ipv6 address` command. For example: ``` Router> enable Router# configure terminal Router(config)# interface gigabitethernet 0/0 Router(config-if)# ipv6 address 2001:db8:abcd:1::1/64 Router(config-if)# no shutdown Router(config-if)# end ``` The router will automatically assign a link-local address (FE80::) based on EUI-64. To enable IPv6 routing globally, use `ipv6 unicast-routing`. This command enables the router to forward IPv6 packets and send Router Advertisements.
Verify Address Assignment
Use `show ipv6 interface brief` to see a summary of all IPv6-enabled interfaces and their addresses. Use `show ipv6 interface [interface]` for detailed information, including the subnet, link-local address, and DAD status. For example: ``` Router# show ipv6 interface brief GigabitEthernet0/0 [up/up] FE80::1 2001:DB8:ABCD:1::1 ``` The output confirms the global unicast address and link-local address. To verify that the router is sending RAs, use `debug ipv6 nd` or check the interface configuration.
Test Connectivity
Use `ping ipv6` to test reachability to a global unicast address. For example: ``` Router# ping ipv6 2001:db8:abcd:2::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8:ABCD:2::1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms ``` If ping fails, check routing with `show ipv6 route` and verify that both routers have routes to each other's prefixes. Use `traceroute ipv6` to see the path.
Troubleshoot Common Issues
Common issues include duplicate addresses, missing routes, or incorrect prefix lengths. Use `show ipv6 neighbors` to see the neighbor cache. If a host cannot get an address, check that the router is sending RAs with `show ipv6 interface` and look for 'Router advertisements are sent every 200 seconds'. If DAD fails, the address will show as 'tentative' or 'duplicate'. Use `debug ipv6 nd` to see RA and NS messages. Ensure that the `ipv6 unicast-routing` command is enabled globally on the router.
In a large enterprise network, IPv6 global unicast addresses are used to provide end-to-end connectivity for all devices. For example, a company with multiple sites might receive a /48 prefix from its ISP. The network engineer assigns a /64 subnet to each VLAN across all sites. This allows for simple addressing and eliminates the need for NAT. The engineer configures routers to send RAs so that hosts can autoconfigure addresses. For servers and network devices, static addresses are used for stability. Performance is excellent because there is no NAT overhead. However, misconfiguration can cause problems. For instance, if two routers on the same link advertise different prefixes, hosts may get confused. Or if DAD fails due to a loop, duplicate addresses can cause connectivity issues. In a service provider network, global unicast addresses are assigned to customers. The provider aggregates routes at the /48 level to keep the routing table small. If a customer misconfigures their prefix, traffic may be blackholed. Another scenario is migrating from IPv4 to IPv6. Engineers often run dual-stack, where both IPv4 and IPv6 are enabled. They must ensure that DNS resolves to the correct address family. Misconfiguring the prefix length (e.g., using /64 instead of /48 for a site) can waste addresses or cause routing issues. Overall, IPv6 global unicast addressing is straightforward but requires careful planning.
For CCNA 200-301 Objective 1.9, the exam tests your ability to identify, configure, and verify IPv6 global unicast addresses. Key areas include:
Address Structure: You must know the 64-bit network prefix and 64-bit interface ID. The global routing prefix is typically /48, subnet ID is /16, and interface ID is /64. Common wrong answer: thinking the subnet ID is part of the interface ID.
SLAAC vs DHCPv6: The exam often asks which method is used for address assignment. SLAAC uses RAs and does not require a DHCP server. DHCPv6 can be stateful or stateless. A common trap: thinking SLAAC always uses EUI-64; it can also use privacy extensions.
EUI-64 Calculation: You may be asked to derive the interface ID from a MAC address. Remember to insert FFFE and flip the 7th bit (the universal/local bit). For example, MAC 00:1A:2B:3C:4D:5E becomes 021A:2BFF:FE3C:4D5E. Common wrong answer: forgetting to flip the bit.
DAD: Duplicate Address Detection is performed before using an address. The host sends NS messages to the solicited-node multicast address. If no NA is received, the address is unique. A common wrong answer: thinking DAD uses broadcast.
Verification Commands: Know show ipv6 interface brief, show ipv6 interface, show ipv6 route, and ping ipv6. The exam may show output and ask you to identify the global unicast address or subnet.
Router Advertisement Flags: The 'M' and 'O' flags in RAs determine whether hosts use DHCPv6. M=1 means managed (stateful DHCPv6), O=1 means other configuration (stateless DHCPv6). Common wrong answer: confusing M and O.
Decision rule for scenario questions: If the question asks how a host gets an address, check if there is a DHCPv6 server. If not, SLAAC is used. If the question asks about address uniqueness, think DAD. If the question asks about route aggregation, think /48 prefix.
IPv6 global unicast address: 128 bits, network prefix (64 bits) + interface ID (64 bits).
Global routing prefix typically /48, subnet ID /16, interface ID /64.
SLAAC uses Router Advertisements for prefix and DAD for uniqueness.
EUI-64: insert FFFE after 24 bits of MAC, flip 7th bit (U/L bit).
DAD sends Neighbor Solicitation to solicited-node multicast address.
Verification: show ipv6 interface brief, show ipv6 interface, ping ipv6.
Router Advertisement flags: M=1 for stateful DHCPv6, O=1 for stateless DHCPv6.
These come up on the exam all the time. Here's how to tell them apart.
IPv4 Public Address
32 bits
Network + host (variable subnet mask)
Uses NAT for conservation
Address resolution via ARP (broadcast)
Exhausted
IPv6 Global Unicast Address
128 bits
64-bit network prefix + 64-bit interface ID
No NAT needed, end-to-end connectivity
Address resolution via NDP (multicast)
Vast address space
Mistake
IPv6 global unicast addresses always use EUI-64 for the interface ID.
Correct
EUI-64 is one method, but privacy extensions (RFC 4941) generate random interface IDs for temporary addresses.
Candidates often memorize EUI-64 and forget that SLAAC can use random IIDs.
Mistake
The subnet ID is part of the interface ID.
Correct
The subnet ID is part of the network prefix (bits 48-63), not the interface ID (bits 64-127).
Candidates confuse the /64 boundary and think the subnet is in the host portion.
Mistake
Duplicate Address Detection uses ARP-like broadcast.
Correct
DAD uses Neighbor Solicitation messages sent to the solicited-node multicast address (FF02::1:FFxx:xxxx).
Candidates are used to IPv4 ARP broadcasts and assume DAD uses broadcast.
Mistake
A /64 prefix means the network portion is 64 bits and the host portion is 64 bits, so you can have 2^64 hosts.
Correct
While the address space is 2^64, the actual number of usable addresses is limited by subnet broadcast considerations (though IPv6 has no broadcast, the address space is still huge). Also, the interface ID must be unique.
Candidates overestimate the practical number of hosts due to the large address space.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A global unicast address (GUA) is routable on the internet and globally unique. It starts with 2000::/3 (2000:: to 3FFF:FFFF:...). A link-local address (LLA) is only valid on the local link, starts with FE80::/10, and is automatically assigned. LLAs are used for neighbor discovery and routing protocol adjacencies. On the exam, remember that LLAs are not routable and cannot be used as source or destination for traffic beyond the local subnet.
Use the 'ipv6 address <prefix>/<prefix-length>' command in interface configuration mode. For example: 'interface gigabitethernet 0/0' then 'ipv6 address 2001:db8:abcd:1::1/64'. You can also specify the EUI-64 option: 'ipv6 address 2001:db8:abcd:1::/64 eui-64'. The router will generate the interface ID from its MAC address. Remember to enable 'ipv6 unicast-routing' globally.
The valid lifetime indicates how long an address is valid (default 30 days). The preferred lifetime indicates how long an address is preferred for new connections (default 7 days). After the preferred lifetime expires, the address becomes deprecated and should not be used for new connections, but existing connections continue. After the valid lifetime expires, the address is invalid. These timers are configurable via the 'ipv6 nd ra-lifetime' and 'ipv6 nd ra-interval' commands.
Yes, but it is wasteful because a /64 subnet contains 2^64 addresses, but only two are needed. However, many features (SLAAC, ND) require a /64. For point-to-point links, some engineers use /126 or /127 to conserve address space, but this breaks SLAAC and ND. Cisco recommends using /64 for all subnets to ensure compatibility. On the exam, know that /64 is the standard subnet size for IPv6.
Before using a unicast address, the host sends a Neighbor Solicitation (NS) message to the solicited-node multicast address corresponding to the tentative address. The solicited-node multicast address is FF02::1:FFxx:xxxx, where the last 24 bits are the last 24 bits of the unicast address. If another host responds with a Neighbor Advertisement (NA), the address is duplicate and cannot be used. The host sends up to 3 NS messages (default 1 second apart). If no NA is received, the address is unique.
Stateful DHCPv6 (M=1) assigns both IPv6 addresses and other parameters (DNS, domain) from a DHCPv6 server. Stateless DHCPv6 (O=1, M=0) does not assign addresses; hosts use SLAAC for addresses and DHCPv6 only for additional parameters. The flags are in Router Advertisements: M (Managed) and O (Other Configuration). On the exam, remember that SLAAC alone provides only the prefix and default gateway; DNS must be obtained via stateless DHCPv6 or manually configured.
It displays the IPv6 routing table, including directly connected networks, static routes, and routes learned via dynamic routing protocols. Look for the prefix and next-hop address. For global unicast routes, the next-hop is often a link-local address. For example: 'S 2001:DB8:ABCD:2::/64 [1/0] via FE80::1, GigabitEthernet0/0'. This shows a static route to the prefix via the link-local address of the next-hop router.
You've just covered IPv6 Global Unicast Addressing — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?