# EUI-64 Address Generation

> Chapter 7 of the Courseiva CCNA curriculum — https://courseiva.com/learn/ccna/eui64

**Official objective:** 1.9 — CCNA 200-301 v2.0 Objective 1.4

## Introduction

Imagine you're building an IPv6 network and need to assign link-local or global unicast addresses to hundreds of devices. Manually configuring each interface is error-prone and time-consuming. That's where EUI-64 address generation comes in—it automatically derives a 64-bit interface identifier from a device's MAC address, enabling stateless address autoconfiguration (SLAAC). For the CCNA 200-301 exam (Objective 1.9), you must understand how EUI-64 works, its role in IPv6, and how to verify it on Cisco IOS.

## The License Plate Factory

What happens when a car's VIN enters a license plate factory? Each car (network device) arrives with a unique Vehicle Identification Number (VIN) – its MAC address. The factory (EUI-64 process) takes that VIN and transforms it into a standardized license plate (interface ID) that can be attached to any state-issued plate (IPv6 prefix). First, the factory splits the VIN into two halves: the first 24 bits (manufacturer code) and the last 24 bits (serial number). Then it inserts a special two-character separator (FFFE) between them. Finally, it flips a specific digit (the 7th bit) to indicate whether the plate is for a globally unique car or a locally assigned one. The result is a 64-bit license plate that is unique and fits any state's plate format. This factory doesn't care about the state—it just produces the license plate. Similarly, EUI-64 doesn't care about the IPv6 prefix; it just creates the interface identifier. The network engineer can then combine this identifier with any /64 prefix (link-local fe80::/10 or global unicast) to form a complete IPv6 address. The beauty is that the license plate is guaranteed unique (as long as the VIN is unique), and the process is fully automatic—no manual plate assignment needed.

## Core explanation

### What is EUI-64 and Why Does It Exist?

EUI-64 (Extended Unique Identifier-64) is a method for generating a 64-bit interface identifier (the host portion of an IPv6 address) from a 48-bit MAC address. It is defined in RFC 4291 and is a core component of IPv6 stateless address autoconfiguration (SLAAC). The primary purpose is to provide a unique, globally scoped identifier for an interface without requiring manual configuration or a central server (like DHCP). On the CCNA 200-301 exam, you need to know how EUI-64 works, how to calculate an interface ID from a MAC address, and how to verify the resulting IPv6 address on Cisco routers.

### How EUI-64 Works Step by Step

The process is straightforward:

1. **Take the 48-bit MAC address** of the interface. Example: `00:1A:2B:3C:4D:5E`.
2. **Split it into two 24-bit halves**: The first half (OUI) is `00:1A:2B`, the second half (NIC-specific) is `3C:4D:5E`.
3. **Insert the 16-bit value `FF:FE` in the middle**: This creates a 64-bit string: `00:1A:2B:FF:FE:3C:4D:5E`.
4. **Flip the 7th bit (the Universal/Local bit) of the first byte**: The first byte is `00` in binary `00000000`. The 7th bit (counting from left, 0-indexed as bit 6) is the second-least significant bit. Flipping it makes it `00000010` which is `02` in hex. So the final interface ID becomes `02:1A:2B:FF:FE:3C:4D:5E`.

This flipping indicates whether the address is globally unique (U/L bit = 1) or locally administered (U/L bit = 0). Since MAC addresses are globally unique, the original U/L bit is 0, and flipping it to 1 indicates a globally unique IPv6 interface ID.

### Key States, Timers, and Defaults

- **No timers**: EUI-64 is a one-time calculation, not a protocol with states.
- **Default behavior**: On Cisco IOS, EUI-64 is used by default when you configure an IPv6 address with the `eui-64` keyword, e.g., `ipv6 address 2001:db8::/64 eui-64`.
- **Interface ID length**: Always 64 bits.
- **Prefix length**: Must be /64 or shorter (for global unicast); link-local addresses are automatically generated using EUI-64 on all IPv6-enabled interfaces.

### IOS CLI Verification Commands

To verify EUI-64 generated addresses, use the following commands:

```
Router# show ipv6 interface brief
FastEthernet0/0    [up/up]
    FE80::21A:2BFF:FE3C:4D5E
    2001:DB8::21A:2BFF:FE3C:4D5E
```

```
Router# show interfaces fa0/0
FastEthernet0/0 is up, line protocol is up
  Hardware is AmdFE, address is 001a.2b3c.4d5e (bia 001a.2b3c.4d5e)
  ...
```

Notice how the interface ID `21A:2BFF:FE3C:4D5E` matches the MAC address after EUI-64 transformation: MAC `001a.2b3c.4d5e` → split → `001a.2b` and `3c.4d.5e` → insert FFFE → `001a.2bff.fe3c.4d5e` → flip 7th bit of first byte: `00` → `02` → `021a.2bff.fe3c.4d5e`. The IOS output shows `21A:2BFF:FE3C:4D5E` because leading zeros are omitted in the hex notation (021a becomes 21a).

### How EUI-64 Interacts with Related Protocols

- **SLAAC**: EUI-64 provides the interface ID for SLAAC-generated addresses. A host receives a Router Advertisement with a /64 prefix and combines it with its EUI-64 interface ID.
- **DHCPv6**: DHCPv6 can also assign addresses, but EUI-64 is used for stateless autoconfiguration.
- **Privacy Extensions (RFC 4941)**: Because EUI-64 addresses are predictable (tied to MAC), they can be a privacy concern. Privacy extensions generate temporary random interface IDs for outbound connections, while EUI-64 addresses are still used for incoming connections.
- **Link-local addresses**: Every IPv6-enabled interface automatically gets a link-local address (fe80::/10) using EUI-64. This is used for neighbor discovery and routing protocols.

## Real-world context

In enterprise networks, EUI-64 is most commonly encountered in two scenarios: stateless autoconfiguration for end-user devices and automatic link-local address generation for routers.

**Scenario 1: Stateless Autoconfiguration for Client Devices**

A large university deploys IPv6 across its campus. Instead of running DHCPv6 servers for every subnet, they use SLAAC with EUI-64. Each student's laptop or phone receives a Router Advertisement from the access layer switch containing the /64 prefix for that VLAN. The device then generates its own IPv6 address using EUI-64. This eliminates the need for DHCP infrastructure and simplifies address management. However, the network team must be aware that EUI-64 addresses are predictable—an attacker who knows the MAC address can guess the IPv6 address. For this reason, many organizations enable privacy extensions (temporary addresses) on client devices for outbound connections, while keeping EUI-64 addresses for inbound services (like servers).

**Scenario 2: Link-Local Addresses on Routers**

Every Cisco router interface automatically gets a link-local address (fe80::/10) using EUI-64. This address is used for neighbor discovery (NDP) and routing protocol adjacencies (e.g., OSPFv3, EIGRP for IPv6). Network engineers rarely need to manually configure link-local addresses because EUI-64 provides a unique address per interface. However, in some designs, engineers prefer to use a consistent, easy-to-remember link-local address (like fe80::1) for management purposes. In that case, they must manually configure it, overriding the EUI-64 default.

**Performance and Scale**

EUI-64 generation is a trivial computation, so there is no performance impact. The main consideration is address uniqueness: since MAC addresses are globally unique (for Ethernet interfaces), EUI-64 guarantees a unique interface ID. However, on virtual interfaces (like VLAN interfaces on a switch) that may share the same MAC, duplicate addresses can occur. In such cases, Cisco IOS automatically detects duplicates using Duplicate Address Detection (DAD) and may assign a temporary address or log an error.

**Misconfiguration Consequences**

If an engineer mistakenly uses a prefix longer than /64 (e.g., /48) with EUI-64, the router will reject it because EUI-64 requires a 64-bit interface ID. Also, if a MAC address changes (e.g., due to hardware replacement), the IPv6 address changes, which can disrupt connectivity for devices that rely on static DNS entries.

## Exam focus

The CCNA 200-301 exam tests EUI-64 under Objective 1.9: "Configure and verify IPv6 addressing and prefix." You should expect to see questions that require you to calculate the EUI-64 interface ID from a given MAC address, or to identify the correct IPv6 address after EUI-64 transformation.

**Common Wrong Answers and Why**

1. **Forgetting to flip the 7th bit**: Many candidates correctly insert FFFE but forget to flip the U/L bit. For example, they might generate `001a.2bff.fe3c.4d5e` instead of `021a.2bff.fe3c.4d5e`. The exam will include the correct answer and a distractor with the unflipped version.

2. **Flipping the wrong bit**: Some candidates flip the first bit (most significant) instead of the 7th bit, resulting in `801a...` instead of `021a...`. Remember: it's the second-least significant bit (bit 6 in 0-indexed, or bit 7 in 1-indexed).

3. **Inserting FFFE in the wrong position**: A common mistake is to insert FFFE at the end or before the OUI. The correct position is between the two 24-bit halves.

4. **Confusing EUI-64 with MAC address format**: The exam may show a MAC address in different formats (e.g., `001a.2b3c.4d5e` vs `00:1a:2b:3c:4d:5e`). Be comfortable converting between them.

**Specific Values and Command Outputs**

- The U/L bit flip changes `00` to `02`, `01` to `03`, `02` to `00`, etc. Practice flipping the first hex digit: if the first hex digit is even, add 2; if odd, subtract 2 (with carry if needed). For example, `00` → `02`, `01` → `03`, `02` → `00`, `03` → `01`, `A0` → `A2`, `F0` → `F2`.
- The `show ipv6 interface brief` command output will show the EUI-64 address with the interface ID in compressed format (e.g., `21A:2BFF:FE3C:4D5E`).

**Calculation Trap**

When the MAC address has a first byte like `02`, flipping the 7th bit results in `00`. Candidates often panic and think they made a mistake, but it's correct. For example, MAC `0200.1234.5678` → first byte `02` → flip → `00` → interface ID `00:00:FF:FE:12:34:56:78`. The leading zeros are omitted, so it appears as `0:0:FF:FE:1234:5678`.

**Decision Rule for Scenario Questions**

If a question asks for the IPv6 address generated via EUI-64 from a given MAC, follow these steps: (1) Split MAC into two 24-bit halves. (2) Insert FFFE. (3) Flip the 7th bit of the first byte. (4) Combine with the given prefix (must be /64). (5) Compress the address using standard IPv6 rules.

## Step by step

1. **Obtain MAC address** — The first step is to know the MAC address of the interface. On a Cisco router, use `show interfaces` or `show ipv6 interface brief` to see the MAC address. For example, `show interfaces GigabitEthernet0/0` will display the hardware address. The MAC is a 48-bit hexadecimal number, typically written as `001a.2b3c.4d5e` in Cisco format (three groups of four hex digits separated by dots).
2. **Split MAC into two halves** — Divide the 48-bit MAC into two 24-bit halves: the first 24 bits (OUI, or Organizationally Unique Identifier) and the last 24 bits (NIC-specific). For MAC `001a.2b3c.4d5e`, the first half is `001a.2b` (24 bits) and the second half is `3c.4d.5e` (24 bits). In hex, this is `00:1A:2B` and `3C:4D:5E`.
3. **Insert FFFE in the middle** — Insert the 16-bit value `FF:FE` between the two halves. This yields a 64-bit string: `001a.2bff.fe3c.4d5e` (in Cisco format) or `00:1A:2B:FF:FE:3C:4D:5E` (in colon-hex). This step ensures the interface ID is exactly 64 bits.
4. **Flip the 7th bit (U/L bit)** — Take the first byte of the result (the first octet of the OUI) and flip the 7th bit (the second-least significant bit, also called the Universal/Local bit). For `00` (binary `00000000`), flipping the 7th bit gives `00000010` which is `02` hex. So the first byte becomes `02`. The rest of the bytes remain unchanged. The final interface ID is `02:1A:2B:FF:FE:3C:4D:5E`.
5. **Combine with IPv6 prefix** — The resulting 64-bit interface ID is appended to a /64 IPv6 prefix to form a complete IPv6 address. For example, with prefix `2001:db8::/64`, the full address becomes `2001:db8::21a:2bff:fe3c:4d5e` (note that leading zeros are omitted in the interface ID representation). On Cisco IOS, this is configured with the command `ipv6 address 2001:db8::/64 eui-64`.
6. **Verify the generated address** — Use `show ipv6 interface brief` or `show ipv6 interface GigabitEthernet0/0` to see the generated IPv6 address. The output will display both the link-local address (also EUI-64 based) and any global unicast addresses with EUI-64. You can cross-check the interface ID against the MAC address to ensure the transformation is correct.

## Comparisons

### EUI-64 vs Privacy Extensions (RFC 4941)

**EUI-64:**
- Derives interface ID from MAC address (predictable)
- Always generates the same address for a given MAC
- Used for link-local and global unicast addresses
- Simplifies address management (stateless)
- No additional configuration needed

**Privacy Extensions (RFC 4941):**
- Generates random temporary interface IDs
- Address changes over time (privacy)
- Used for outbound connections; EUI-64 still used for inbound
- Requires host OS support and configuration
- Reduces risk of address-based tracking

## Common misconceptions

- **Misconception:** EUI-64 simply takes the MAC address and adds FFFE without any bit flipping. **Reality:** EUI-64 inserts FFFE between the two 24-bit halves of the MAC, then flips the 7th (U/L) bit of the first byte to indicate global uniqueness. (Candidates often skip the bit flip because they focus on the insertion step.)
- **Misconception:** The U/L bit is the most significant bit (first bit) of the first byte. **Reality:** The U/L bit is the 7th bit (second-least significant) of the first byte. For byte 00 (binary 00000000), flipping bit 7 gives 00000010 (02). (The term '7th bit' is ambiguous; candidates sometimes count from the left instead of the right.)
- **Misconception:** EUI-64 can be used with any prefix length, such as /48 or /56. **Reality:** EUI-64 produces a 64-bit interface ID, so the prefix must be /64 or shorter (e.g., /48 is allowed, but the address will have 16 bits of subnet and 64 bits of interface ID). (Candidates think the interface ID can be truncated, but it is always 64 bits.)
- **Misconception:** The EUI-64 address is the same as the modified EUI-64 address used in IPv4. **Reality:** EUI-64 is specific to IPv6; IPv4 does not use EUI-64. The process is defined in RFC 4291 for IPv6. (Some candidates confuse it with similar concepts like MAC address formatting.)

## Key takeaways

- EUI-64 generates a 64-bit interface ID from a 48-bit MAC address by inserting FFFE and flipping the 7th (U/L) bit.
- The 7th bit flip changes the first byte: if the first hex digit is even, add 2; if odd, subtract 2.
- EUI-64 is used by default for link-local addresses and can be configured for global unicast with the eui-64 keyword.
- The prefix length must be /64 or shorter; EUI-64 requires a 64-bit interface ID.
- Use 'show ipv6 interface brief' to verify EUI-64 generated addresses.
- Privacy extensions (RFC 4941) can override EUI-64 for outbound connections to prevent address tracking.
- EUI-64 is not used on virtual interfaces that share a MAC address; DAD detects duplicates.

## FAQ

**What is the difference between EUI-64 and modified EUI-64?**

EUI-64 and modified EUI-64 are often used interchangeably in IPv6, but technically, EUI-64 refers to the 64-bit identifier format, while modified EUI-64 is the specific process of inserting FFFE and flipping the U/L bit. In CCNA context, they mean the same thing. The term 'modified' emphasizes the bit flip. For the exam, just know the standard process.

**Does EUI-64 work with any MAC address?**

Yes, EUI-64 works with any 48-bit MAC address, including burned-in addresses (BIA) and locally administered addresses. However, if the MAC address changes (e.g., due to interface replacement), the IPv6 address will change. For stability, some administrators manually configure the interface ID or use DHCPv6.

**Can I use EUI-64 on a prefix longer than /64?**

No. EUI-64 always generates a 64-bit interface ID. If you try to configure an address with a prefix longer than /64 (e.g., /124), the router will reject it because there is not enough room for the 64-bit interface ID. The prefix must be /64 or shorter (e.g., /48, /56).

**Why does my EUI-64 address look different from the MAC address?**

The EUI-64 process modifies the MAC address in two ways: inserting FFFE and flipping the 7th bit. So the resulting interface ID will always have 'FF:FE' in the middle and the first byte will be different (e.g., 00 becomes 02). This is normal and expected.

**How do I disable EUI-64 on a Cisco router?**

You cannot disable EUI-64 for link-local addresses; they are always generated automatically. For global unicast addresses, simply do not use the 'eui-64' keyword. Instead, configure the full address manually, e.g., 'ipv6 address 2001:db8::1/64'.

**What is the purpose of the U/L bit in EUI-64?**

The U/L (Universal/Local) bit indicates whether the interface ID is globally unique (1) or locally administered (0). Since MAC addresses are globally unique, flipping the U/L bit from 0 to 1 signals that the IPv6 interface ID is globally unique. This helps in address assignment and troubleshooting.

**Can I use EUI-64 on a switch virtual interface (SVI)?**

Yes, SVIs have MAC addresses (usually the base MAC of the switch or a pool). EUI-64 works the same way. However, if multiple SVIs share the same MAC (common on some switches), duplicate address detection (DAD) may flag conflicts. In such cases, manually configure the interface ID to avoid duplicates.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ccna/eui64