If you're studying for the CCNA 200-301 exam, you must understand IPv6 link-local addresses—they are fundamental to almost every IPv6-enabled network. While global unicast addresses are often what we think of as 'the' IPv6 address, link-local addresses are the unsung heroes that make neighbor discovery, routing protocol adjacencies, and even basic ping work on a local link. Exam objective 1.9 requires you to know how these addresses are formed, when they are used, and how to verify them—a topic that appears in both configuration and troubleshooting scenarios.
Jump to a section
Imagine a large apartment building. Each apartment has a unique mailing address (global unicast) that includes the building number, street, city, etc.—this allows mail to be delivered from anywhere in the world. However, inside the building, residents need a way to communicate locally: the mailroom doesn't use the full global address to deliver a package to apartment 3B; it uses the apartment number alone, which is only meaningful within that building. The apartment number is like a link-local address—it's unique only on that link (the building) and is automatically assigned to every apartment when the building is constructed. In IPv6, every interface automatically gets a link-local address (fe80::/10) as soon as IPv6 is enabled, and it never leaves the local network segment. Just as the mailroom uses the apartment number to deliver packages without consulting a global directory, routers use link-local addresses for neighbor discovery and routing protocol hellos without needing to route these packets beyond the local link. If a resident moves to another building, they get a new apartment number (link-local address) but keep their global address. Similarly, if you move a device to a different subnet, its link-local address changes, but its global address might stay the same if you manually configure it. The mailroom also has a special 'super' mailbox for the building manager—that's the all-nodes multicast address (ff02::1) used for certain broadcasts. Understanding this analogy helps you grasp why link-local addresses are critical for local communication but are never forwarded by routers.
What is an IPv6 Link-Local Address?
An IPv6 link-local address is a unicast address that is automatically configured on every IPv6-enabled interface. It is used for communication within a single network segment (link) and is never routed beyond that link. The address prefix is fe80::/10 (first 10 bits are 1111 1110 10), although the standard practice is to use the first 64 bits as fe80:: (the remaining 54 bits are zero). The interface ID (last 64 bits) is typically derived from the interface's MAC address using the EUI-64 format or is randomly generated for privacy (RFC 4941, privacy extensions).
Why Do We Need Link-Local Addresses?
Link-local addresses are essential for the operation of IPv6. They are used for:
Neighbor Discovery Protocol (NDP) – the IPv6 equivalent of ARP and ICMP Router Discovery.
Stateless Address Autoconfiguration (SLAAC) – devices use link-local addresses to communicate with routers and obtain global prefixes.
Routing protocol adjacencies – OSPFv3, EIGRP for IPv6, and RIPng all use link-local addresses as the source address for hello packets and as the next-hop address in routing updates.
Default gateway – the router's link-local address is often used as the next-hop for default routes, not the global unicast address.
How Link-Local Addresses Are Generated
When IPv6 is enabled on an interface, the router automatically generates a link-local address. By default, Cisco IOS uses the EUI-64 method, which takes the MAC address of the interface, inserts FFFE in the middle, and flips the U/L bit (bit 7 of the first byte). For example, if the MAC address is 0011.2233.4455, the EUI-64 interface ID becomes 0211.22FF.FE33.4455 (note the first byte becomes 02, flipping the U/L bit from 0 to 1). The complete link-local address would be fe80::0211:22FF:FE33:4455.
You can also manually configure a link-local address using the ipv6 address command with the link-local keyword. This is common for routers to have a well-known link-local address for easy identification.
Verification Commands
To see the link-local address on a Cisco interface, use:
R1# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::21A:2BFF:FE3C:4D5D
2001:DB8:1:1::1For detailed information:
R1# show ipv6 interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::21A:2BFF:FE3C:4D5D
No Virtual link-local address(es):
Global unicast address(es):
2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF3C:4D5D
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND NS retransmit interval is 1000 millisecondsNotice that the link-local address is automatically present, and the interface joins the all-nodes multicast group (FF02::1) and the solicited-node multicast group (FF02::1:FF3C:4D5D) for neighbor discovery.
How Link-Local Addresses Interact with Other Protocols
Neighbor Discovery (ND): When a device wants to resolve the link-layer address of another device on the same link, it sends a Neighbor Solicitation (NS) message with the source address being its own link-local address and the destination being the solicited-node multicast address of the target. The target responds with a Neighbor Advertisement (NA) using its link-local address as source. This is the IPv6 replacement for ARP.
Router Discovery: Routers send Router Advertisement (RA) messages with their link-local address as the source. Hosts use the router's link-local address as the default gateway, not the global address. This is why you often see a default route pointing to a link-local address like fe80::1.
OSPFv3: OSPF for IPv6 uses link-local addresses for all neighbor communications. The router ID remains a 32-bit number, but hello packets are sourced from the link-local address and sent to the multicast address FF02::5 (all OSPF routers). The next-hop in OSPFv3 routes is always a link-local address.
EIGRP for IPv6: Similarly, EIGRP uses link-local addresses for neighbor relationships and as the next-hop in its topology table.
Key Characteristics
Scope: Link-local addresses are only valid on the local link. Routers must not forward packets with a link-local source or destination address beyond the link.
Uniqueness: They only need to be unique on the link, not globally. However, on a single link, each interface must have a unique link-local address. Duplicate Address Detection (DAD) is performed to ensure uniqueness.
Automatic Configuration: Every IPv6-enabled interface automatically gets a link-local address, even if no global unicast address is configured. This ensures that IPv6 can always communicate on the local link.
Prefix: fe80::/10, but practically fe80::/64 is used because the interface ID is 64 bits. The remaining 54 bits of the prefix are typically zero, but they can be non-zero; routers ignore them.
Exam Traps
Source address for NDP: The source address of Neighbor Solicitations and Router Solicitations is the interface's link-local address, not the global unicast address. Many candidates mistakenly think the global address is used.
Next-hop in routing table: When you see a next-hop of fe80::something, it's a link-local address. This is common for directly connected routes learned via routing protocols. Some candidates think this is an error, but it's correct.
Link-local vs. global: A packet with a link-local destination address will never be forwarded by a router. If you need to reach a device on another subnet, you must use its global unicast address.
Multiple link-local addresses: An interface can have multiple link-local addresses (e.g., one EUI-64, one manually configured), but typically only one is used as the primary. The show ipv6 interface output shows the one that is used as the source for outgoing packets.
Enable IPv6 on an Interface
On a Cisco router, IPv6 is not enabled by default. You must first enable IPv6 globally with 'ipv6 unicast-routing' (this also enables routing protocols). Then, on each interface where you want IPv6, use 'ipv6 enable'. This command automatically generates a link-local address using EUI-64 from the MAC address. For example: ``` R1(config)# ipv6 unicast-routing R1(config)# interface GigabitEthernet0/0 R1(config-if)# ipv6 enable ``` After this, the interface will have a link-local address. You can verify with 'show ipv6 interface brief'. Note: If you configure a global unicast address on the interface, IPv6 is automatically enabled, so 'ipv6 enable' is not strictly required, but it's good practice to ensure link-local is created.
Configure a Manual Link-Local Address
Sometimes you want a predictable link-local address, especially on routers, to make troubleshooting easier. Use the 'ipv6 address' command with the 'link-local' keyword. For example: ``` R1(config)# interface GigabitEthernet0/0 R1(config-if)# ipv6 address fe80::1 link-local ``` This replaces the automatically generated link-local address with the manually configured one. You can only have one link-local address per interface (unless you use a virtual link-local address, which is beyond CCNA). The command overwrites any existing link-local address. Verify with 'show ipv6 interface GigabitEthernet0/0' and look for 'link-local address is FE80::1'.
Verify Link-Local Address with show Commands
Use 'show ipv6 interface brief' to see a quick list of interfaces and their IPv6 addresses, including link-local. The link-local address is shown in the format FE80::... For detailed information, use 'show ipv6 interface [interface]'. This output includes the link-local address, global addresses, joined multicast groups, and ND parameters. Example output: ``` R1# show ipv6 interface GigabitEthernet0/0 GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::1 Global unicast address(es): 2001:DB8:1:1::1, subnet is 2001:DB8:1:1::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:1 ... ``` Notice that the interface joins the all-nodes (FF02::1) and all-routers (FF02::2) multicast groups, as well as the solicited-node multicast group for each unicast address.
Test Link-Local Reachability with Ping
You can ping a link-local address from a Cisco router, but you must specify the exit interface because the router needs to know which link to use (link-local addresses are not unique across links). The syntax is: ``` R1# ping fe80::2%GigabitEthernet0/0 ``` Or using the 'ping' command with the source interface: ``` R1# ping ipv6 fe80::2 gigabitethernet0/0 ``` If you omit the interface, the ping will fail because the router doesn't know which interface to send the packet out. This is a common exam trap: candidates forget the interface specification.
Observe Link-Local in Neighbor Discovery
When a device needs to resolve the MAC address of another device on the same link, it sends a Neighbor Solicitation (NS) with source = its link-local address, destination = solicited-node multicast address of the target. The target responds with a Neighbor Advertisement (NA) with source = its link-local address. To see the neighbor cache, use: ``` R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface FE80::2 0 aabb.cc00.0200 REACH Gi0/0 2001:DB8:1:1::2 0 aabb.cc00.0200 REACH Gi0/0 ``` Notice that both the link-local and global addresses of the neighbor are listed, but they share the same MAC address. The link-local address is used for on-link communication.
Understand Link-Local in Routing Protocol Adjacencies
For OSPFv3 or EIGRP for IPv6, the source address of hello packets is the link-local address. The next-hop in routing tables for routes learned via these protocols is also a link-local address. For example, in OSPFv3: ``` R1# show ipv6 route ospf IPv6 Routing Table - default - 3 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP O - OSPF Intra, OI - OSPF Inter, OE - OSPF Ext, ON1 - OSPF NSSA Ext Type 1, ON2 - OSPF NSSA Ext Type 2 O 2001:DB8:2:2::/64 [110/2] via FE80::2, GigabitEthernet0/0 ``` Here, the next-hop is FE80::2 (the link-local address of the neighbor router). This is normal and expected. Some candidates think this is an error, but it's correct because link-local addresses are used for next-hop on directly connected links.
In enterprise networks, link-local addresses are ubiquitous but often overlooked. Consider a scenario where a company has multiple branch offices connected via MPLS. Each branch router runs OSPFv3 for IPv6 routing. The OSPFv3 adjacencies are formed using link-local addresses. If a network engineer needs to troubleshoot a routing issue, they might ping the neighbor's link-local address to test Layer 3 connectivity without needing to know the global address. For example, from the head-end router, they would ping fe80::2%GigabitEthernet0/0 to verify the link is up and OSPF hello packets are being exchanged. This is faster than pinging the global address because it isolates the local link.
Another common use case is stateless address autoconfiguration (SLAAC) in a guest Wi-Fi network. When a guest device connects, it uses its link-local address to send a Router Solicitation. The router responds with a Router Advertisement containing the prefix and other configuration parameters. The device then generates its global address using the prefix and its own interface ID. The link-local address remains the key for local communication, such as DNS queries to a local resolver. If the router's link-local address changes (e.g., due to interface replacement), all hosts must perform Duplicate Address Detection again and update their default gateway. This is why many administrators manually configure link-local addresses on routers (e.g., fe80::1) to ensure stability.
A critical performance consideration: because link-local addresses are used for NDP, every IPv6 device continuously listens for Neighbor Solicitations. On a large broadcast domain with thousands of devices, the solicited-node multicast groups can cause high CPU usage on switches. Best practice is to segment the network into smaller VLANs to limit the scope of link-local communication. Misconfiguration can lead to issues: for example, if a router has two interfaces with the same manually configured link-local address (e.g., both fe80::1), Duplicate Address Detection will fail, and the router will not use that address. This can break routing protocol adjacencies and cause routing loops. Always ensure link-local addresses are unique per link.
The CCNA 200-301 exam objective 1.9 covers 'Configure, verify, and troubleshoot IPv6 addressing,' which includes link-local addresses. Expect at least one question that requires you to identify the correct link-local address format or to know when it is used. The most common wrong answers on this topic are:
Thinking the link-local address is fe80::/64: While the prefix is fe80::/10, the standard practice is to use /64 because the interface ID is 64 bits. However, the exam may test that the prefix length is /10, not /64. Candidates often confuse the two.
Believing that link-local addresses can be used as source addresses for packets that must be routed: This is false. Link-local addresses are never forwarded by routers. A packet with a link-local destination will be dropped. Candidates may think it's okay to use them for inter-subnet communication.
Forgetting to specify the exit interface when pinging a link-local address: The exam will test this in a simulation or multiple-choice. If you see a ping to fe80::1 without an interface, it will fail. The correct syntax is ping fe80::1%interface or ping ipv6 fe80::1 interface.
Assuming the default gateway is always a global unicast address: In IPv6, the default gateway is typically the router's link-local address. The exam may show a routing table with a default route pointing to fe80::1, and candidates might think it's incorrect.
For troubleshooting questions, remember that the 'show ipv6 interface' command displays the link-local address. If an interface has no link-local address, IPv6 is not enabled (or the interface is down). The 'show ipv6 neighbors' command will show both link-local and global addresses. If you see a neighbor entry with a link-local address but no global address, it's normal—the neighbor might not have a global address configured.
Calculation traps: There are no calculations for link-local addresses, but you may be asked to identify the EUI-64 format. Remember that the 7th bit of the first byte is flipped (the U/L bit). For example, MAC 0011.2233.4455 becomes 0211.22FF.FE33.4455. The first byte 0x00 becomes 0x02. This is a common exam point.
Decision rule for scenario questions: If a question asks about communication between two devices on the same link, think link-local addresses and NDP. If it asks about communication between different subnets, think global unicast addresses and routing.
Link-local addresses have prefix fe80::/10 (practically fe80::/64) and are automatically generated on every IPv6-enabled interface.
They are used for Neighbor Discovery, SLAAC, and routing protocol adjacencies (OSPFv3, EIGRP for IPv6).
Link-local addresses are never routed; packets with link-local source or destination are confined to the local link.
Cisco routers automatically generate link-local addresses using EUI-64 from the MAC address, unless manually configured.
To ping a link-local address, you must specify the exit interface (e.g., ping fe80::2%GigabitEthernet0/0).
The default gateway in IPv6 is typically the router's link-local address, not a global unicast address.
The 'show ipv6 interface' command displays the link-local address; 'show ipv6 neighbors' shows both link-local and global neighbor addresses.
These come up on the exam all the time. Here's how to tell them apart.
IPv6 Link-Local Address
Prefix fe80::/10, automatically generated on every IPv6 interface.
Used for essential IPv6 functions like NDP and SLAAC.
Never routed; always present even with global addresses.
Generated using EUI-64 or privacy extensions.
Required for IPv6 operation; cannot be disabled.
IPv4 APIPA (169.254.0.0/16)
Prefix 169.254.0.0/16, used when DHCP fails.
Only used for basic local communication; no equivalent to NDP.
Never routed; only used as a fallback.
Randomly generated by the host.
Optional; only appears when no DHCP address is obtained.
Mistake
Link-local addresses are fe80::/64.
Correct
The prefix is fe80::/10, but the standard subnet prefix length is /64 because the interface ID is 64 bits. The /10 is the prefix length in the address format, not the subnet mask.
Candidates see the common representation fe80::/64 in configurations and assume that is the prefix length, but the RFC defines the prefix as /10.
Mistake
You can use a link-local address as a source for packets that need to be routed across subnets.
Correct
Link-local addresses are only valid on the local link. Routers must not forward packets with a link-local source or destination. For inter-subnet communication, use global unicast or unique local addresses.
Candidates may think that because link-local addresses are unicast, they can be routed like any other unicast address, but their scope is link-local.
Mistake
The default gateway in IPv6 is always a global unicast address.
Correct
In IPv6, the default gateway is typically the router's link-local address. This is because Router Advertisements include the router's link-local address, and hosts use that as the next-hop for off-link traffic.
In IPv4, the default gateway is an IPv4 address in the same subnet. Candidates carry over that expectation to IPv6 without realizing the different mechanism.
Mistake
You can ping a link-local address without specifying an interface.
Correct
Because link-local addresses are not unique across links, the router needs to know which interface to use. You must specify the exit interface, e.g., ping fe80::1%GigabitEthernet0/0.
Candidates are used to pinging IPv4 addresses without an interface, so they assume the same applies to IPv6 link-local addresses.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The prefix is fe80::/10. However, in practice, the subnet prefix length is /64 because the interface ID is 64 bits. The /10 is the prefix length defined by the address format, not a subnet mask. On Cisco devices, you can configure a link-local address with 'ipv6 address fe80::1 link-local', and the prefix length is implied as /10, but the address is always a /64 in terms of the interface ID.
Because link-local addresses are only unique on a local link, multiple interfaces could have the same link-local address (e.g., fe80::1 on two different routers). The router needs to know which interface to send the packet out. You specify the interface using the %interface notation (e.g., fe80::1%GigabitEthernet0/0) or by using the 'ping ipv6' command with the interface keyword.
Yes, in IPv6, the default gateway is typically the router's link-local address. When a router sends a Router Advertisement, it includes its link-local address. Hosts then use that address as the next-hop for off-link traffic. You will often see default routes pointing to fe80::1 in routing tables.
By default, Cisco routers use EUI-64 to generate the interface ID from the MAC address. For example, if the MAC is 0011.2233.4455, the EUI-64 ID becomes 0211.22FF.FE33.4455. The link-local address then becomes fe80::0211:22FF:FE33:4455. You can also manually configure a link-local address with the 'ipv6 address fe80::1 link-local' command.
A link-local address is only valid on the local link and is never routed. It is automatically generated and used for local communication like Neighbor Discovery. A global unicast address is routable on the internet and is typically assigned by a DHCP server or configured manually. Both can coexist on the same interface.
Duplicate Address Detection (DAD) will detect the conflict. When a device configures a link-local address, it sends a Neighbor Solicitation for that address. If it receives a Neighbor Advertisement in response, it knows the address is duplicate and will not use it. The device will then generate a new link-local address (e.g., using privacy extensions) or the interface will not have a link-local address until the conflict is resolved.
No, OSPFv3 automatically uses the link-local address of the interface for neighbor discovery and as the source of hello packets. However, you must ensure that IPv6 is enabled on the interface (via 'ipv6 enable' or by configuring a global address). The link-local address is automatically generated and used by OSPFv3.
You've just covered IPv6 Link-Local Addresses — now see how well it sticks with free CCNA 200-301 practice questions. Full explanations included, no account needed.
Done with this chapter?