IPv6 Basic Configuration — Global Unicast, Link-Local & EUI-64

IPv4 address exhaustion is no longer a future concern — it is the present reality. Internet Assigned Numbers Authority (IANA) allocated the last IPv4 /8 blocks to regional registries in 2011, and most regional registries have been in exhaustion mode since 2012–2015. IPv6 was designed to solve this permanently: a 128-bit address space providing 340 undecillion (3.4 × 10³⁸) unique addresses — enough to assign billions of addresses to every grain of sand on Earth. Every network engineer working today needs to understand IPv6 addressing, because every device you configure from now on will eventually be part of a dual-stack or pure-IPv6 network.

The good news is that IPv6 configuration on Cisco IOS follows familiar patterns. You enable IPv6 routing globally, assign addresses to interfaces, and verify with show and ping commands — the same three-step approach as IPv4. What changes is the address format, the additional address types (link-local addresses are mandatory and automatic, not optional), and EUI-64, which automatically derives a 64-bit interface identifier from the interface MAC address so you never have to manually track which host-portion address goes on which device.

This lab covers every IPv6 address type you will encounter in a CCNA exam or real network, step-by-step configuration for routers and switches, EUI-64 calculation by hand and in IOS, and a complete verification workflow. For IPv6 routing protocols built on top of this foundation see OSPFv3 / OSPF Configuration and EIGRP Configuration. For IPv6 address planning see IPv6 Overview & Subnetting. For prerequisites see Basic Interface Configuration and Static Routing Configuration.

1. IPv6 Addressing — Core Concepts

Address Format and Notation Rules

An IPv6 address is 128 bits written as eight groups of four hexadecimal digits separated by colons. Two compression rules reduce the length of long addresses:

  Full form (128 bits, 32 hex digits):
    2001:0DB8:0000:0001:0000:0000:0000:0001

  Rule 1 — Drop leading zeros within each group:
    2001:DB8:0:1:0:0:0:1

  Rule 2 — Replace ONE consecutive sequence of all-zero groups
            with :: (double colon). Can only be used ONCE per address:
    2001:DB8:0:1::1

  Examples of both rules applied:
    FE80:0000:0000:0000:0C1A:2B3C:4D5E:6F70  →  FE80::C1A:2B3C:4D5E:6F70
    2001:0DB8:ACAD:0001:0000:0000:0000:0100  →  2001:DB8:ACAD:1::100
    0000:0000:0000:0000:0000:0000:0000:0001  →  ::1  (loopback)
    0000:0000:0000:0000:0000:0000:0000:0000  →  ::   (unspecified)

  PREFIX NOTATION — same as IPv4 CIDR:
    2001:DB8:ACAD:1::1/64
                         ^^  prefix length in bits
    The /64 means the first 64 bits are the network prefix,
    the remaining 64 bits are the interface (host) identifier.
    /64 is by far the most common prefix length for LANs.
    /48 is the typical allocation to a site/organisation.
    /128 is a host route (single address — like /32 in IPv4).

IPv6 Address Types — Complete Reference

Type	Prefix / Range	Scope	Purpose	IOS Behaviour
Global Unicast (GUA)	`2000::/3` (addresses starting 2 or 3)	Global — routable on the public internet	Equivalent to public IPv4 addresses — the primary address type for inter-site communication	Manually assigned or from DHCPv6/SLAAC. Must be configured explicitly on Cisco IOS interfaces
Link-Local (LLA)	`FE80::/10`	Link-only — never routed beyond the local segment	Mandatory on every IPv6-enabled interface. Used for neighbour discovery, router advertisements, and next-hop in routing tables	Auto-generated when IPv6 is enabled on an interface. Can also be manually set with `ipv6 address fe80::x link-local`
Unique Local (ULA)	`FC00::/7` (FC00 or FD00)	Organisation — routable within a site, not on internet	Equivalent to private IPv4 (RFC 1918). Used for internal communication when GUA is not available or needed	Configured like GUA — `ipv6 address FD00::/48`
Multicast	`FF00::/8`	Variable (link, site, global)	Replaces IPv4 broadcast entirely. Specific well-known multicast groups replace broadcast for ARP, router discovery, etc.	Joined automatically — `FF02::1` (all nodes), `FF02::2` (all routers), `FF02::5` (OSPF)
Loopback	`::1/128`	Host only	Equivalent to IPv4 127.0.0.1. Used for local testing	Automatically present on every IPv6-capable host — not configured in IOS
Unspecified	`::/128`	Host only	Source address used before an IPv6 address is assigned (e.g., during SLAAC DAD process)	Never configured manually. Used internally by the IPv6 stack
Solicited-Node Multicast	`FF02::1:FF00:0/104`	Link-local	Used for Neighbour Discovery Protocol (NDP) — replaces ARP. Auto-generated from the last 24 bits of a unicast address	Automatically joined when a unicast address is assigned to an interface

Key IPv6 Well-Known Multicast Addresses

Address	Name	Equivalent IPv4	Used By
`FF02::1`	All-nodes multicast	255.255.255.255 (limited broadcast)	Router advertisements sent to all hosts on the link
`FF02::2`	All-routers multicast	224.0.0.2	Router solicitations sent by hosts to discover routers
`FF02::5`	All-OSPF-routers	224.0.0.5	OSPFv3 Hello packets
`FF02::6`	OSPF-DR-routers	224.0.0.6	OSPFv3 DR/BDR updates
`FF02::9`	All-RIP-routers	224.0.0.9	RIPng updates
`FF02::A`	All-EIGRP-routers	224.0.0.10	EIGRP for IPv6 Hellos

No Broadcast in IPv6: IPv6 completely eliminates broadcast. Every function that used IPv4 broadcast now uses a targeted multicast group instead — all-nodes (FF02::1) for router advertisements, solicited-node multicast for neighbour discovery (replacing ARP), all-routers (FF02::2) for router solicitation. This is why IPv6 networks are more efficient on large segments — routers and hosts only process multicast packets addressed to groups they have joined.

2. EUI-64 — Automatic Interface Identifier Generation

EUI-64 (Extended Unique Identifier — 64-bit) is the process by which an interface's 64-bit host portion of an IPv6 address is automatically derived from its 48-bit MAC address. When you configure an interface with the eui-64 keyword, you provide only the 64-bit network prefix — IOS calculates the 64-bit interface identifier automatically. For MAC address fundamentals see MAC Address:

EUI-64 Calculation — Step by Step

  Example: MAC address of Gi0/0 = 0C:1A:2B:3C:4D:5E

  Step 1 — Split the MAC into two halves (OUI and NIC):
    OUI (first 3 bytes):   0C:1A:2B
    NIC (last 3 bytes):    3C:4D:5E

  Step 2 — Insert FF:FE in the middle:
    0C:1A:2B : FF:FE : 3C:4D:5E
    ↓
    0C1A:2BFF:FE3C:4D5E

  Step 3 — Flip the 7th bit (Universal/Local bit) of the first byte:
    First byte: 0C  =  0000 1100  (binary)
                          ↑
                    bit 7 (counting from right, 0-indexed)
                    is currently 0 (universally administered)
                    flip it to 1 → 0000 1110 = 0E

    Modified first byte: 0E

  Step 4 — Final EUI-64 interface identifier:
    0E1A:2BFF:FE3C:4D5E

  Step 5 — Combine with the /64 prefix (e.g., 2001:DB8:ACAD:1::/64):
    Full IPv6 address:  2001:DB8:ACAD:1:0E1A:2BFF:FE3C:4D5E

  VERIFICATION — IOS will show this address when you configure:
    interface GigabitEthernet0/0
     ipv6 address 2001:DB8:ACAD:1::/64 eui-64

  QUICK REFERENCE — Common bit-flip outcomes:
    First byte 00 → 02   (00→02: bit 7 flipped 0→1)
    First byte 0C → 0E   (example above)
    First byte AA → A8   (bit 7 flipped 1→0 for locally admin'd)
    First byte 02 → 00   (locally administered → universal)

  NOTE: If bit 7 is already 1 (locally administered address),
        flipping it to 0 produces a valid EUI-64 IID — the flip
        always occurs regardless of the starting value.

Why Flip Bit 7?

In IEEE 802 MAC addressing, bit 7 of the first byte (the Universal/Local bit) indicates whether the address is globally administered by IEEE (bit = 0) or locally administered by the network operator (bit = 1). When MAC addresses are embedded into IPv6 addresses via EUI-64, this bit is flipped to align with IPv6's convention where bit 7 = 1 means globally unique. Most enterprise hardware has manufacturer-assigned (globally administered, bit = 0) MAC addresses, so the flip makes the bit = 1 in the IPv6 EUI-64 IID — correctly indicating the address is globally unique.

3. Lab Topology

                  2001:DB8:ACAD:12::/64
  NetsTuts_R1 ─────────────────────────── NetsTuts_R2
  Gi0/0                                   Gi0/0
  Manual GUA:  2001:DB8:ACAD:12::1/64    Manual GUA: 2001:DB8:ACAD:12::2/64
  Manual LLA:  FE80::1                   EUI-64 LLA: auto
  MAC Gi0/0:   0C:1A:2B:00:00:01         MAC Gi0/0:  0C:1A:2B:00:00:02

  Gi0/1 (LAN stub)                        Gi0/1 (LAN stub)
  2001:DB8:ACAD:1::/64 eui-64            2001:DB8:ACAD:2::/64 eui-64
  LLA: FE80::1 (manual)                  LLA: auto (EUI-64 derived)

       │                                       │
  [PC-A]                                  [PC-B]
  2001:DB8:ACAD:1::10/64                 2001:DB8:ACAD:2::10/64
  Gateway: FE80::1                       Gateway: FE80::2 (R2 LLA)

  Configuration Objectives:
    R1 Gi0/0 → Manual GUA + manual link-local FE80::1
    R1 Gi0/1 → EUI-64 GUA + manual link-local FE80::1
    R2 Gi0/0 → Manual GUA + EUI-64 (auto) link-local
    R2 Gi0/1 → EUI-64 GUA + EUI-64 (auto) link-local
    Both routers → IPv6 unicast routing enabled
    Verification → show ipv6 interface brief + ping ipv6

4. Step 1 — Enable IPv6 Unicast Routing

By default, Cisco IOS does not forward IPv6 packets between interfaces — even if IPv6 addresses are configured. The global command ipv6 unicast-routing must be entered before the router will route IPv6 traffic. This is the IPv6 equivalent of ip routing on a Layer 3 switch.

! ── Enable IPv6 routing on both routers ──────────────────────────
NetsTuts_R1(config)#ipv6 unicast-routing

NetsTuts_R2(config)#ipv6 unicast-routing

! ── Verify IPv6 routing is enabled ──────────────────────────────
NetsTuts_R1#show ipv6 route
IPv6 Routing Table - default - 1 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP,
       I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea,
       IS - ISIS summary, D - EIGRP, EX - EIGRP external,
       ND - ND Default, NDp - ND Prefix, DCE - Destination,
       NDr - Redirect, RL - RPL, O - OSPF Intra,
       OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2,
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, a - Application
LC    ::1/128 [0/0]
     via Loopback0, receive
! ── Only loopback shown — no interfaces configured yet ───────────

Without ipv6 unicast-routing, the router acts as an IPv6 host — it can send and receive IPv6 packets on its own interfaces but will not forward packets between interfaces. The router will also not send Router Advertisement (RA) messages, which hosts depend on for SLAAC address configuration. Always verify with show ipv6 route after enabling — the loopback entry (::1/128) confirms the IPv6 routing table is active. After completing configuration save with write memory.

5. Step 2 — Assign Global Unicast Addresses (Manual)

Configure R1's Gi0/0 interface with a manually specified global unicast address. Manual assignment gives you full control over the interface identifier portion — ideal for router interfaces where you want predictable, human-readable addresses.

R1 — Manual GUA on Gi0/0 (WAN Link)

NetsTuts_R1(config)#interface GigabitEthernet0/0
NetsTuts_R1(config-if)#ipv6 address 2001:DB8:ACAD:12::1/64
NetsTuts_R1(config-if)#no shutdown
NetsTuts_R1(config-if)#exit

! ── Verify: show ipv6 interface brief ───────────────────────────
NetsTuts_R1#show ipv6 interface brief
GigabitEthernet0/0         [up/up]
    FE80::E1A:2BFF:FE00:1       ← Link-local auto-generated from MAC
    2001:DB8:ACAD:12::1         ← Global unicast manually assigned

Two addresses appear immediately after assigning the GUA — the manual global unicast address you configured, and an automatically generated link-local address (FE80::...) derived from the interface MAC address using EUI-64. IOS generates the link-local address automatically whenever IPv6 is activated on an interface — you do not need to configure it separately. This auto-generated LLA is functional but the long EUI-64 derived address is harder to use as a gateway IP and in routing protocol configurations. We will replace it with a shorter manual LLA in the next step.

R2 — Manual GUA on Gi0/0

NetsTuts_R2(config)#interface GigabitEthernet0/0
NetsTuts_R2(config-if)#ipv6 address 2001:DB8:ACAD:12::2/64
NetsTuts_R2(config-if)#no shutdown
NetsTuts_R2(config-if)#exit

NetsTuts_R2#show ipv6 interface brief
GigabitEthernet0/0         [up/up]
    FE80::E1A:2BFF:FE00:2       ← Auto-generated LLA from MAC
    2001:DB8:ACAD:12::2         ← Manual GUA

6. Step 3 — Configure Manual Link-Local Addresses

While IOS auto-generates link-local addresses, manually configuring short, memorable LLAs (like FE80::1 and FE80::2) makes routing protocol configuration and troubleshooting significantly easier. When a routing protocol uses the LLA as the next-hop address, a short manual LLA is far easier to read in routing tables than a long EUI-64 derived address.

R1 — Manual Link-Local on Both Interfaces

! ── Set manual LLA on Gi0/0 (WAN) ───────────────────────────────
NetsTuts_R1(config)#interface GigabitEthernet0/0
NetsTuts_R1(config-if)#ipv6 address FE80::1 link-local
NetsTuts_R1(config-if)#exit

! ── Set manual LLA on Gi0/1 (LAN stub) ──────────────────────────
NetsTuts_R1(config)#interface GigabitEthernet0/1
NetsTuts_R1(config-if)#ipv6 address FE80::1 link-local
NetsTuts_R1(config-if)#no shutdown
NetsTuts_R1(config-if)#exit

! ── Verify: both interfaces now show FE80::1 ────────────────────
NetsTuts_R1#show ipv6 interface brief
GigabitEthernet0/0         [up/up]
    FE80::1                     ← Manual LLA (replaced auto-generated)
    2001:DB8:ACAD:12::1         ← Manual GUA

GigabitEthernet0/1         [up/up]
    FE80::1                     ← Same LLA — valid on different links

The same link-local address (FE80::1) can be configured on multiple interfaces of the same router — this is explicitly permitted in IPv6. Link-local addresses are only significant within a single link (subnet). When a host on the Gi0/1 LAN segment uses FE80::1 as its gateway, it is reaching R1's Gi0/1 interface. A host on the Gi0/0 segment using FE80::1 reaches R1's Gi0/0. The link context disambiguates the address. This is why when routing tables show link-local next-hop addresses, IOS always includes the outgoing interface: via FE80::1, GigabitEthernet0/1 — both pieces are required to uniquely identify the next hop.

Why Link-Local Addresses Cannot Be Routed

  Link-local addresses (FE80::/10) have a scope of "link-only" —
  they are only valid within a single network segment (link).

  A router that receives a packet destined for a link-local address
  MUST NOT forward it beyond the link on which it arrived.

  This is different from IPv4's private addresses (RFC 1918) which
  CAN be routed within an organisation (just not on the public
  internet). IPv6 link-local addresses truly cannot leave the link.

  Practical consequence: you CANNOT ping FE80::2 (R2's LLA) from R1
  using the GUA as a source. You MUST specify the source interface:

    NetsTuts_R1#ping FE80::2           ← FAILS — ambiguous (which link?)
    % Specify source interface
    
    NetsTuts_R1#ping FE80::2 source GigabitEthernet0/0  ← WORKS
    !!!!!

  The source interface tells IOS which link to use, disambiguating
  the link-local destination address.

7. Step 4 — Configure EUI-64 Address Assignment

EUI-64 is ideal for LAN interfaces where the exact host-portion address does not need to be human-memorable — IOS derives it automatically from the MAC address. You provide only the /64 network prefix and append eui-64; IOS handles the rest.

R1 Gi0/1 — EUI-64 GUA on LAN Interface

! ── Configure EUI-64 on R1's LAN interface ──────────────────────
NetsTuts_R1(config)#interface GigabitEthernet0/1
NetsTuts_R1(config-if)#ipv6 address 2001:DB8:ACAD:1::/64 eui-64
NetsTuts_R1(config-if)#exit

! ── Verify — IOS calculated the full address from the MAC ────────
NetsTuts_R1#show ipv6 interface GigabitEthernet0/1
GigabitEthernet0/1 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::1
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:ACAD:1:E1A:2BFF:FE00:101, subnet is 2001:DB8:ACAD:1::/64 [EUI]
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:1      ← Solicited-node multicast for LLA FE80::1
    FF02::1:FF00:101    ← Solicited-node multicast for GUA ..:E1A:2BFF:FE00:101

! ── Confirm with show ipv6 interface brief ───────────────────────
NetsTuts_R1#show ipv6 interface brief
GigabitEthernet0/0         [up/up]
    FE80::1
    2001:DB8:ACAD:12::1

GigabitEthernet0/1         [up/up]
    FE80::1
    2001:DB8:ACAD:1:E1A:2BFF:FE00:101   ← EUI-64 derived GUA

The [EUI] tag in the full

show ipv6
    interface

output confirms the address was EUI-64 derived. IOS also shows all multicast groups the interface has joined — notice the two solicited-node multicast addresses, one for the LLA and one for the GUA. Each unicast address the interface holds causes it to join a corresponding solicited-node multicast group (FF02::1:FF[last 24 bits of unicast]). These groups are used by Neighbour Discovery Protocol (NDP) — the IPv6 replacement for ARP — to resolve IPv6 addresses to MAC addresses.

R2 — EUI-64 on Both Interfaces (Including WAN)

! ── R2 Gi0/1: EUI-64 GUA for LAN segment ────────────────────────
NetsTuts_R2(config)#interface GigabitEthernet0/1
NetsTuts_R2(config-if)#ipv6 address 2001:DB8:ACAD:2::/64 eui-64
NetsTuts_R2(config-if)#no shutdown
NetsTuts_R2(config-if)#exit

! ── Check R2's MAC on Gi0/1 to verify EUI-64 calculation ────────
NetsTuts_R2#show interfaces GigabitEthernet0/1 | include address
  Hardware is ISR4321-2x1GE, address is 0c1a.2b00.0021 (bia 0c1a.2b00.0021)

! ── EUI-64 from MAC 0C:1A:2B:00:00:21:
!    Split → 0C:1A:2B | 00:00:21
!    Insert FF:FE → 0C:1A:2B:FF:FE:00:00:21
!    Flip bit 7 of 0C (0000 1100) → 0E (0000 1110)
!    IID = 0E1A:2BFF:FE00:0021
!    Full address = 2001:DB8:ACAD:2:E1A:2BFF:FE00:21 ──────────────

NetsTuts_R2#show ipv6 interface brief
GigabitEthernet0/0         [up/up]
    FE80::E1A:2BFF:FE00:2       ← Auto LLA (EUI-64 from MAC of Gi0/0)
    2001:DB8:ACAD:12::2         ← Manual GUA

GigabitEthernet0/1         [up/up]
    FE80::E1A:2BFF:FE00:21      ← Auto LLA (EUI-64 from MAC of Gi0/1)
    2001:DB8:ACAD:2:E1A:2BFF:FE00:21  ← EUI-64 derived GUA

R2 demonstrates using EUI-64 on a LAN interface while keeping a manual GUA on the WAN interface — a common production approach. WAN point-to-point links use simple manual addresses (::1 and ::2) for readability in routing tables and troubleshooting. LAN interfaces use EUI-64 so the router address can be auto-derived without tracking which specific IID to assign to each device. Note that R2's LLA on Gi0/0 is still the EUI-64 auto-generated one — we did not override it with a manual LLA on R2 (unlike R1), so the full EUI-64 LLA will appear as the next-hop in routing tables for R2.

8. Step 5 — Full Verification

show ipv6 interface brief — Complete Output Guide

NetsTuts_R1#show ipv6 interface brief
                           [status/protocol]
GigabitEthernet0/0         [up/up]         ← [1] Interface state (same as show ip interface brief)
    FE80::1                                ← [2] Link-local address (always first)
    2001:DB8:ACAD:12::1                    ← [3] Global unicast address(es)

GigabitEthernet0/1         [up/up]
    FE80::1
    2001:DB8:ACAD:1:E1A:2BFF:FE00:101

Loopback0                  [up/up]
    FE80::E1A:2BFF:FE00:1                 ← Loopback also gets auto-LLA if IPv6 enabled
    2001:DB8:ACAD:100::1

! ── Field meanings ──────────────────────────────────────────────
! [1] Interface state: up/up = physically up and protocol up
!     down/down = physical link failure
!     up/down   = connected but no keepalives (wrong encapsulation)
! [2] LLA always shown first — every IPv6-enabled interface has one
! [3] All GUAs listed below LLA — interface can have multiple GUAs

show ipv6 interface [name] — Detailed Output

NetsTuts_R1#show ipv6 interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up         ← [A] Interface status
  IPv6 is enabled, link-local address is FE80::1       ← [B] LLA
  No Virtual link-local address(es):
  Global unicast address(es):
    2001:DB8:ACAD:12::1, subnet is 2001:DB8:ACAD:12::/64 ← [C] GUA with subnet
  Joined group address(es):                            ← [D] Multicast memberships
    FF02::1         ← All-nodes: receives RA from routers
    FF02::2         ← All-routers: sends RA to hosts (because ipv6 unicast-routing)
    FF02::1:FF00:1  ← Solicited-node for FE80::1
    FF02::1:FF12::1 ← Solicited-node for 2001:DB8:ACAD:12::1
  MTU is 1500 bytes                                    ← [E] IPv6 MTU
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ICMP unreachables are sent
  ND DAD is enabled, number of DAD attempts: 1         ← [F] Duplicate Address Detection
  ND reachable time is 30000 milliseconds (using 44046)
  ND advertised reachable time is 0 (unspecified)
  ND advertised retransmit interval is 0 (unspecified)
  ND router advertisements are sent every 200 seconds  ← [G] RA interval
  ND router advertisements live for 1800 seconds
  ND advertised default router preference is Medium
  Hosts use stateless autoconfig for addresses.        ← [H] SLAAC enabled

The detailed show ipv6 interface output reveals the full IPv6 operational state: [D] shows multicast group membership (the interface joins FF02::2 all-routers only because ipv6 unicast-routing is enabled — hosts without routing enabled only join FF02::1). [F] shows Duplicate Address Detection (DAD) — the process by which a device verifies that its chosen IPv6 address is not already in use on the link by sending a Neighbour Solicitation for its own address before using it. [G] shows Router Advertisement interval — R1 sends unsolicited RAs every 200 seconds, advertising the 2001:DB8:ACAD:12::/64 prefix so hosts can use SLAAC.

ping ipv6 — Testing Connectivity

! ── Ping R2's GUA from R1 ────────────────────────────────────────
NetsTuts_R1#ping 2001:DB8:ACAD:12::2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2001:DB8:ACAD:12::2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

! ── Ping R2's link-local — MUST specify source interface ─────────
NetsTuts_R1#ping FE80::E1A:2BFF:FE00:2 source GigabitEthernet0/0
!!!!!

! ── Extended IPv6 ping (specify source address) ──────────────────
NetsTuts_R1#ping 2001:DB8:ACAD:12::2 source GigabitEthernet0/0
!!!!!

! ── Ping across the network to R2's LAN prefix ───────────────────
NetsTuts_R1#ping 2001:DB8:ACAD:2:E1A:2BFF:FE00:21
.....
! ── Fails — no route to 2001:DB8:ACAD:2::/64 yet (need IPv6 routing protocol)

! ── Verify IPv6 routing table ────────────────────────────────────
NetsTuts_R1#show ipv6 route
IPv6 Routing Table - default - 5 entries
C   2001:DB8:ACAD:12::/64 [0/0]
     via GigabitEthernet0/0, directly connected
L   2001:DB8:ACAD:12::1/128 [0/0]
     via GigabitEthernet0/0, receive
C   2001:DB8:ACAD:1::/64 [0/0]
     via GigabitEthernet0/1, directly connected
L   2001:DB8:ACAD:1:E1A:2BFF:FE00:101/128 [0/0]
     via GigabitEthernet0/1, receive
LC  ::1/128 [0/0]
     via Loopback0, receive
! ── C = connected, L = local (host route for own address) ────────
! ── No route to 2001:DB8:ACAD:2::/64 — need static or OSPFv3 ────

Adding a Static IPv6 Route for Verification

! ── Add static route on R1 to reach R2's LAN via R2's GUA ───────
NetsTuts_R1(config)#ipv6 route 2001:DB8:ACAD:2::/64 2001:DB8:ACAD:12::2

! ── Or use R2's link-local as next-hop (must specify interface) ──
NetsTuts_R1(config)#ipv6 route 2001:DB8:ACAD:2::/64 GigabitEthernet0/0 FE80::E1A:2BFF:FE00:2

! ── Verify route is in the table ────────────────────────────────
NetsTuts_R1#show ipv6 route static
S   2001:DB8:ACAD:2::/64 [1/0]
     via FE80::E1A:2BFF:FE00:2, GigabitEthernet0/0

! ── Ping now succeeds ────────────────────────────────────────────
NetsTuts_R1#ping 2001:DB8:ACAD:2:E1A:2BFF:FE00:21 source GigabitEthernet0/1
!!!!!

! ── Traceroute ───────────────────────────────────────────────────
NetsTuts_R1#traceroute 2001:DB8:ACAD:2:E1A:2BFF:FE00:21 source Gi0/1
  1  2001:DB8:ACAD:12::2  1 msec
  2  2001:DB8:ACAD:2:E1A:2BFF:FE00:21  2 msec

IPv6 static routes are configured exactly like IPv4 static routes but with the ipv6 route command and IPv6 addresses. When using a link-local address as the next-hop, the outgoing interface must also be specified — IOS needs to know which link to send the packet on because link-local addresses are not globally unique. The format is: ipv6 route [dest-prefix] [exit-interface] [LLA-next-hop]. Without a routing protocol (OSPFv3, EIGRP for IPv6, RIPng), static routes are required for any prefix beyond directly connected networks. See show ip route and show ip interface brief for IPv4 equivalents of the verification commands used here.

show ipv6 neighbors — IPv6 Neighbour Cache (Replaces ARP)

! ── IPv6 replaces ARP with Neighbour Discovery Protocol (NDP) ────
! ── show ipv6 neighbors is the equivalent of show arp ─────────────
NetsTuts_R1#show ipv6 neighbors
IPv6 Address                              Age Link-layer Addr State Interface
FE80::E1A:2BFF:FE00:2                      0 0c1a.2b00.0002  REACH Gi0/0
2001:DB8:ACAD:12::2                        0 0c1a.2b00.0002  REACH Gi0/0

! ── NDP entry states: ─────────────────────────────────────────────
! REACH  — Recently verified reachable (within reachable time ~30s)
! STALE  — Reachable time expired — still in cache but unverified
! DELAY  — In STALE, traffic sent — waiting before probing
! PROBE  — Sending Neighbour Solicitations to verify reachability
! INCOMPLETE — NS sent, waiting for Neighbour Advertisement reply

9. Complete Configuration & Command Reference

Final Running Configurations

! ════════════ NetsTuts_R1 — Complete IPv6 Configuration ══════════
NetsTuts_R1#show running-config | section ipv6
ipv6 unicast-routing
!
interface GigabitEthernet0/0
 ipv6 address FE80::1 link-local
 ipv6 address 2001:DB8:ACAD:12::1/64
!
interface GigabitEthernet0/1
 ipv6 address FE80::1 link-local
 ipv6 address 2001:DB8:ACAD:1::/64 eui-64
!
ipv6 route 2001:DB8:ACAD:2::/64 GigabitEthernet0/0 FE80::E1A:2BFF:FE00:2

! ════════════ NetsTuts_R2 — Complete IPv6 Configuration ══════════
NetsTuts_R2#show running-config | section ipv6
ipv6 unicast-routing
!
interface GigabitEthernet0/0
 ipv6 address 2001:DB8:ACAD:12::2/64
!
interface GigabitEthernet0/1
 ipv6 address 2001:DB8:ACAD:2::/64 eui-64
!
ipv6 route 2001:DB8:ACAD:1::/64 GigabitEthernet0/0 FE80::1

IPv6 Configuration Command Reference

Command	Mode	Purpose
`ipv6 unicast-routing`	Global config	Enables IPv6 routing between interfaces. Required before the router will forward IPv6 packets
`ipv6 address [addr]/[prefix]`	Interface config	Assigns a global unicast (or unique local) address manually. Also activates IPv6 on the interface
`ipv6 address [prefix]/64 eui-64`	Interface config	Assigns a /64 prefix; IOS auto-derives the 64-bit interface identifier from the MAC address using EUI-64
`ipv6 address [fe80::x] link-local`	Interface config	Overrides the auto-generated link-local address with a manually specified one. The `link-local` keyword is required
`ipv6 enable`	Interface config	Activates IPv6 on an interface and auto-generates a link-local address without assigning a GUA. Useful for interfaces that only need NDP/routing protocol participation
`ipv6 route [prefix]/[len] [next-hop\|interface]`	Global config	Configures a static IPv6 route. When using a link-local next-hop, the outgoing interface must also be specified
`show ipv6 interface brief`	Privileged exec	Shows all IPv6-enabled interfaces with their LLA and GUA(s) — the primary IPv6 verification command
`show ipv6 interface [name]`	Privileged exec	Detailed IPv6 interface information including multicast groups, DAD status, RA intervals, and NDP parameters
`show ipv6 route`	Privileged exec	Displays the IPv6 routing table. C=connected, L=local, S=static, O=OSPFv3, D=EIGRP, R=RIPng
`show ipv6 neighbors`	Privileged exec	Shows the IPv6 neighbour cache — equivalent to `show arp` in IPv4. Lists IPv6→MAC mappings learned via NDP
`ping ipv6 [address]` or `ping [ipv6-addr]`	Privileged exec	Sends ICMPv6 Echo Request to an IPv6 address. For link-local targets, add `source [interface]`
`traceroute ipv6 [address]`	Privileged exec	IPv6 path trace — equivalent to `traceroute` in IPv4

IPv4 vs IPv6 — Key Differences Summary

Feature	IPv4	IPv6
Address length	32 bits — 4.3 billion addresses	128 bits — 340 undecillion addresses
Address notation	Dotted decimal: 192.168.1.1	Colon hex: 2001:DB8:ACAD:1::1
Routing enable command	`ip routing` (L3 switch) / on by default on routers	`ipv6 unicast-routing` — required on ALL devices
Broadcast	Yes — 255.255.255.255 and directed broadcasts	No — replaced entirely by multicast
Address resolution	ARP — broadcast based	NDP (Neighbour Discovery Protocol) — multicast based
Link-local address	169.254.0.0/16 (APIPA — failure state only)	FE80::/10 — mandatory on every IPv6 interface, always active
Auto-configuration	DHCP only	SLAAC (stateless), DHCPv6 (stateful), or both
Header size	Variable (20–60 bytes)	Fixed 40 bytes — simpler for routers to process
NAT required?	Yes — IPv4 exhaustion forces NAT in most networks	No — enough addresses for every device globally
Fragmentation	Routers can fragment packets in transit	Only the source host fragments — routers never fragment (use Path MTU Discovery)

Next Steps: With IPv6 basic addressing confirmed, the next progression is enabling a dynamic IPv6 routing protocol so routes are exchanged automatically without static configuration. See OSPF Configuration for OSPF running over IPv6 (OSPFv3), and EIGRP Configuration for the Cisco proprietary option. For static IPv6 routing see Static Routing Configuration. For IPv6 address planning and subnetting see IPv6 Overview & Subnetting. For DNS in an IPv6 environment see How DNS Works.

TEST WHAT YOU LEARNED

1. A router interface has MAC address `00:1A:2B:3C:4D:5E`. What is the EUI-64 derived interface identifier, and what would the full IPv6 address be if the interface is configured with `ipv6 address 2001:DB8::/64 eui-64`?

A. IID = 001A:2BFF:FE3C:4D5E — Full address: 2001:DB8::1A:2BFF:FE3C:4D5E B. IID = 021A:2BFF:FE3C:4D5E — Full address: 2001:DB8::21A:2BFF:FE3C:4D5E. Calculation: split MAC (00:1A:2B | 3C:4D:5E), insert FF:FE (00:1A:2B:FF:FE:3C:4D:5E), flip bit 7 of first byte 00 (0000 0000 → 0000 0010 = 02). IID = 021A:2BFF:FE3C:4D5E C. IID = 001A:2BFF:FE3C:4D5E — Full address: 2001:DB8::1A:2BFF:FE3C:4D5E (bit 7 flip is optional) D. IID = 021A:2B3C:4D5E:FF:FE — the FF:FE is appended at the end, not the middle

Correct answer is B. The EUI-64 process has three mandatory steps: (1) Split the 48-bit MAC into two 24-bit halves — OUI (00:1A:2B) and device identifier (3C:4D:5E); (2) Insert FF:FE between the two halves — producing 00:1A:2B:FF:FE:3C:4D:5E, which expressed as four 16-bit groups is 001A:2BFF:FE3C:4D5E; (3) Flip bit 7 (the Universal/Local bit) of the first byte. The first byte is 00 in binary = 0000 0000. Bit 7 (counting from the right, 0-indexed, which is the second-most-significant bit) is 0 — flipping it gives 0000 0010 = 0x02. The IID becomes 021A:2BFF:FE3C:4D5E. Combined with the /64 prefix 2001:DB8::/64, the full address is 2001:DB8:0:0:21A:2BFF:FE3C:4D5E, which compresses to 2001:DB8::21A:2BFF:FE3C:4D5E. The bit flip is never optional — it always occurs. Option A skips the bit flip entirely. Option D incorrectly places FF:FE at the end.

2. An engineer configures `FE80::1` as the link-local address on both Gi0/0 and Gi0/1 of the same router. A network administrator challenges this — "you can't have the same address on two interfaces." Who is correct, and why?

A. The administrator is correct — all IPv6 addresses including link-local must be globally unique. Using FE80::1 on two interfaces causes a DAD failure B. The administrator is correct for GUAs, but link-local addresses are only recommended to be unique per-interface — using the same LLA on two interfaces may work but is not supported C. The engineer is correct only if the two interfaces are in different VRFs — within the same VRF, duplicate LLAs are not permitted D. The engineer is correct. Link-local addresses have link scope — they are only significant within a single link (subnet). The same LLA can be configured on multiple interfaces of the same router because each interface is a different link. Hosts on each segment see FE80::1 as the gateway for their specific segment. Routing tables always include the outgoing interface with any link-local next-hop (e.g., "via FE80::1, GigabitEthernet0/1") to disambiguate which link's FE80::1 is meant

Correct answer is D. Link-local addresses are scoped to a single link — they are never forwarded beyond that link by any router. This scope makes it perfectly valid (and common practice) to configure the same short link-local address on multiple router interfaces. RFC 4291 explicitly states that link-local addresses are not required to be unique outside their link. The standard approach in Cisco IOS deployments is to give each router a memorable LLA per device (FE80::1 on all of R1's interfaces, FE80::2 on all of R2's interfaces), making routing table next-hop entries, routing protocol configuration, and troubleshooting significantly easier. DAD (Duplicate Address Detection) operates per-link — when FE80::1 is configured on Gi0/0, DAD checks for duplicates only on the Gi0/0 link. It does not check Gi0/1. So configuring FE80::1 on both Gi0/0 and Gi0/1 involves no DAD conflict — they are separate link-scoped DAD processes.

3. What happens when you enter `ipv6 enable` on an interface, and how does it differ from `ipv6 address 2001:DB8:1::1/64`?

A. ipv6 enable activates IPv6 on the interface and auto-generates a link-local address (using EUI-64 from the MAC) but does NOT assign any global unicast address. The interface can participate in NDP and IPv6 routing protocols using only its LLA, but cannot be a destination for global IPv6 traffic. ipv6 address 2001:DB8:1::1/64 assigns a GUA AND implicitly enables IPv6 on the interface (auto-generating the LLA as well) — so both a GUA and LLA are present after that command B. ipv6 enable is identical to configuring a GUA — both result in the same interface state C. ipv6 enable enables IPv6 routing on the interface and is equivalent to ipv6 unicast-routing at the interface level D. ipv6 enable assigns the interface a temporary IPv6 address from the FE80::/10 range that changes with every reboot

Correct answer is A. ipv6 enable is specifically designed for interfaces that need to participate in IPv6 operations (NDP, routing protocol Hellos, router advertisements) without being assigned a routable global unicast address. A common use case is a router's WAN interface that faces an ISP — you might want OSPFv3 or EIGRP for IPv6 to run over that interface without assigning a GUA (the ISP provides the routing context). When ipv6 enable is entered, IOS creates an EUI-64 derived link-local address and makes the interface IPv6-capable. In show ipv6 interface brief, the interface shows only the LLA with no GUA listed. When ipv6 address 2001:DB8:1::1/64 is entered, it implicitly enables IPv6 (equivalent to ipv6 enable) AND assigns the GUA — both addresses appear in the interface output. You can also explicitly configure ipv6 enable and then separately configure ipv6 address [fe80::x] link-local to control which LLA is used, without ever assigning a GUA.

4. An engineer tries to ping R2's link-local address from R1 with `ping FE80::E1A:2BFF:FE00:2` and gets the message `% Specify source interface`. Why does this error occur, and what is the correct command?

A. The ping fails because link-local addresses cannot be pinged — they are reserved for internal NDP use only B. The ping fails because R1 does not have a route to FE80::/10 — add a static route for the link-local prefix C. Link-local addresses are not globally unique — FE80::E1A:2BFF:FE00:2 could theoretically exist on any of R1's interfaces (since every link can have its own FE80:: addresses). IOS requires you to specify which outgoing interface the ping should use so it knows which link to send the ICMPv6 Echo Request on. The correct command is: ping FE80::E1A:2BFF:FE00:2 source GigabitEthernet0/0 — this sends the ping out Gi0/0 where R2's LLA is reachable D. The ping fails because FE80::E1A:2BFF:FE00:2 is not in R1's neighbour cache — run ipv6 nd cache resolve first

Correct answer is C. This error is one of the first IPv6 gotchas that trips up engineers transitioning from IPv4. In IPv4, all addresses are globally unique (or at least unique within a routing domain), so a ping to any address unambiguously determines which interface to use via the routing table. In IPv6, link-local addresses (FE80::/10) are only locally scoped — they exist on every link and are not in the routing table. When you type ping FE80::2, IOS does not know which of its interfaces to use: should it send out Gi0/0 or Gi0/1? Both could potentially have a neighbor with FE80::2. The mandatory solution is to specify the source interface, which identifies the link: ping FE80::E1A:2BFF:FE00:2 source GigabitEthernet0/0. This tells IOS: "send this ping out Gi0/0, and the source will be R1's Gi0/0 LLA." The same requirement applies to static routes with link-local next-hops — you must specify both the LLA and the exit interface: ipv6 route ::/0 GigabitEthernet0/0 FE80::2.

5. What is the purpose of the solicited-node multicast address `FF02::1:FF00:1`, and how is it derived from the unicast address `FE80::1`?

A. It is the all-nodes multicast address — every IPv6 host automatically joins FF02::1:FF00:1 regardless of its unicast address B. It is derived by prepending FF02::1:FF to the full 128-bit unicast address — not just the last 24 bits C. It is the all-routers multicast address for OSPF — all OSPF routers join this group automatically D. The solicited-node multicast address replaces IPv4 ARP broadcasts. It is formed by taking the fixed prefix FF02::1:FF00:0/104 and appending the last 24 bits (6 hex digits) of the corresponding unicast address. For FE80::1 (which ends in ...::0000:0000:0001), the last 24 bits are 00:00:01, giving FF02::1:FF00:1. When a device wants to resolve an IPv6 address to a MAC address, it sends a Neighbour Solicitation to the target's solicited-node multicast address — only the device(s) with that unicast address are listening on that multicast group, making the resolution targeted rather than broadcast

Correct answer is D. The solicited-node multicast address is the mechanism by which IPv6 achieves efficient address-to-MAC resolution without broadcasting. In IPv4, ARP sends a broadcast (255.255.255.255) to all hosts on the segment — every device must process the ARP packet even if it is not the target. In IPv6, Neighbour Solicitation (NS) is sent to a multicast group that only the target device listens on — specifically, FF02::1:FF followed by the last 24 bits of the target's IPv6 address. For FE80::1, the last 24 bits are 00:00:01, giving the solicited-node multicast FF02::1:FF00:1. For a GUA like 2001:DB8::ACAD:1:E1A:2BFF:FE00:101, the last 24 bits are 00:01:01, giving FF02::1:FF00:101. The interface joins all solicited-node multicast groups corresponding to its unicast addresses (both LLA and GUA). This is visible in show ipv6 interface under "Joined group address(es)" — you'll see one FF02::1:FFxx:xxxx entry per unicast address. The efficiency gain is significant on large networks — a host with IP ending in ::1234 will only receive NS packets intended for addresses ending in the same 24 bits, rather than every ARP broadcast.

6. A router has `ipv6 unicast-routing` disabled. IPv6 addresses are configured on its interfaces. What are the two effects of this missing command?

A. The interfaces will not get link-local addresses, and global unicast addresses cannot be configured without ipv6 unicast-routing B. The router will not forward IPv6 packets between its interfaces (acting as a host, not a router), and it will not send Router Advertisement (RA) messages to hosts on connected segments. Hosts depending on SLAAC for address configuration will not receive prefix advertisements and cannot auto-configure their addresses. IPv6 addresses are still visible on the interfaces, and the router can send/receive IPv6 traffic to/from its own interface addresses — it just won't route between them C. All IPv6 addresses are removed from interfaces when ipv6 unicast-routing is disabled D. OSPFv3 and EIGRP for IPv6 still work without ipv6 unicast-routing — only static routing is affected

Correct answer is B. Without ipv6 unicast-routing, a Cisco router behaves as an IPv6 host rather than a router. Two critical capabilities are lost: (1) Packet forwarding between interfaces — if a packet arrives on Gi0/0 destined for a prefix reachable via Gi0/1, the router discards it rather than forwarding it. The router can still respond to pings addressed to its own interface addresses, but cannot route transit traffic. (2) Router Advertisement (RA) transmission — RAs are sent by routers to advertise their presence and the IPv6 prefix(es) of each connected link. Hosts use these RAs for SLAAC (Stateless Address Autoconfiguration) to automatically configure their own IPv6 addresses. Without RAs, hosts using SLAAC cannot learn the network prefix and will only have their link-local addresses. This is a very common misconfiguration — an engineer configures IPv6 addresses on all interfaces and wonders why routing doesn't work, forgetting that unlike IPv4 (where IP routing is enabled by default on routers), IPv6 routing must be explicitly enabled. Routing protocols (OSPFv3, EIGRP for IPv6) also require ipv6 unicast-routing to function — they rely on the router's ability to forward packets.

7. How does IPv6 Neighbour Discovery Protocol (NDP) differ from IPv4 ARP, and what IOS command shows the equivalent of the IPv4 ARP table for IPv6?

A. NDP is identical to ARP but uses IPv6 addresses. The show command is show ipv6 arp B. NDP uses TCP instead of UDP for reliable delivery of address resolution requests. The show command is show ipv6 cache C. NDP replaces ARP and uses ICMPv6 Neighbour Solicitation (NS) and Neighbour Advertisement (NA) messages sent to solicited-node multicast addresses rather than broadcasts. This makes NDP more efficient — only the target device processes the NS, not every host on the segment. NDP also handles router discovery (RS/RA messages) and duplicate address detection (DAD), functions that required separate protocols (ICMP Router Discovery, Gratuitous ARP) in IPv4. The IOS command to view the IPv6 neighbour cache is show ipv6 neighbors D. NDP is only used for duplicate address detection — address resolution in IPv6 is still handled by ARP. The show command is show arp ipv6

Correct answer is C. NDP (defined in RFC 4861) is a comprehensive replacement for several IPv4 protocols, not just ARP. It uses ICMPv6 (not ARP which is a separate Layer 2 protocol) and specifically uses five ICMPv6 message types: Neighbour Solicitation (NS, type 135), Neighbour Advertisement (NA, type 136), Router Solicitation (RS, type 133), Router Advertisement (RA, type 134), and Redirect (type 137). The key efficiency improvement over ARP is the use of solicited-node multicast for NS messages — rather than broadcasting to all devices on the segment, the NS is sent to FF02::1:FF[last 24 bits of target], which only the target device(s) monitor. NDP also handles: router discovery (hosts send RS to FF02::2 all-routers; routers respond with RA advertising prefixes); prefix information for SLAAC; duplicate address detection (DAD — a device sends NS for its own tentative address before using it, listening for a conflicting NA); and redirect messages (equivalent to IPv4 ICMP redirects). The show ipv6 neighbors command displays the NDP neighbour cache with the IPv6 address, age, MAC address, state (REACH/STALE/DELAY/PROBE/INCOMPLETE), and interface — directly equivalent to show arp in IPv4.

8. Which IPv6 address type is described by each of the following: (1) `FD00:ACAD:1234::/48`, (2) `FF02::5`, (3) `2001:DB8::/32`, (4) `::1`?

A. (1) Unique Local Address (ULA) — FD prefix indicates locally assigned ULA, not internet routable; (2) Link-local scope multicast — FF02::5 is OSPFv3 all-OSPF-routers multicast; (3) Documentation/example prefix (2001:DB8::/32 is reserved by RFC 3849 for use in documentation and examples — it is routable in structure but never allocated); (4) IPv6 loopback address — equivalent to 127.0.0.1 in IPv4 B. (1) Global unicast — all FD addresses are internet-routable; (2) All-nodes multicast; (3) Private/ULA address; (4) Unspecified address C. (1) Link-local address; (2) All-routers multicast; (3) Global unicast assigned to a real organisation; (4) Loopback D. (1) Unique local; (2) All-nodes multicast FF02::1; (3) Global unicast; (4) Unspecified address used during SLAAC

Correct answer is A. Breaking down each address: (1) FD00:ACAD:1234::/48 — the FD prefix (binary 1111 1101) falls within the FC00::/7 unique local address range (FC00 or FD00 prefix). The FC variant is reserved; FD is used for locally generated ULAs. These are the IPv6 equivalent of RFC 1918 private addresses — not routable on the public internet but usable within an organisation. The /48 is the standard ULA site prefix. (2) FF02::5 — the FF prefix identifies multicast. The 02 in the second position indicates link-local scope (scope = 2). FF02::5 is specifically the all-OSPF-routers multicast address used by OSPFv3 (equivalent to IPv4's 224.0.0.5). (3) 2001:DB8::/32 — this specific block is reserved by IANA/RFC 3849 exclusively for use in documentation, examples, and educational materials like this guide. You will see it in all Cisco lab guides (including this one), RFCs, and textbooks. It is structured as a GUA and is routable in format, but real internet service providers filter it and will not route it. (4) ::1/128 — the IPv6 loopback address (binary all-zeros except the last bit = 1). Every IPv6 stack automatically has this address and uses it exactly as IPv4 uses 127.0.0.1 — for local testing and applications binding to the local host.

9. After configuring IPv6 on all interfaces and running `show ipv6 route`, an engineer notices the routing table contains entries with code `L` in addition to `C` for each connected interface. What does `L` mean and why does every connected network produce both a `C` and an `L` entry?

A. L stands for Link-local — these are the FE80:: routes automatically added for each interface's link-local address B. L stands for Learned — these are routes learned from neighbouring routers via NDP Router Advertisements C. L routes are the same as C routes but shown separately for IPv6-only interfaces that have not yet formed NDP neighbours D. L stands for Local — it is a /128 host route for the router's own interface address. When an interface has 2001:DB8:ACAD:1::1/64 configured, IOS adds two routes: C 2001:DB8:ACAD:1::/64 (the connected network, reachable via the interface) and L 2001:DB8:ACAD:1::1/128 (the exact address of the router's own interface, used to receive packets addressed to this router). The /128 local route ensures that traffic addressed specifically to this router's interface (not just to the subnet) is received and processed locally rather than forwarded. This same C+L pair pattern exists in IPv4 but is only visible in IPv6's routing table by default

Correct answer is D. The L (Local) route type is unique to IPv6 routing tables (though the underlying concept exists in IPv4). For every IPv6 address configured on an interface, IOS automatically creates two routing table entries: (1) The C (Connected) entry — the /64 network prefix, showing that the entire subnet is reachable via this interface; (2) The L (Local) entry — a /128 host route for the router's own specific address on that interface. The /128 local route tells the router: "if a packet is addressed to exactly 2001:DB8:ACAD:1::1, that's me — receive it locally." Without this host route, a packet addressed to the router's own interface IP would match the broader /64 connected route and might be treated as a transit packet rather than one destined for the router itself. You'll also see LC entries (Local Connected) for special addresses like ::1/128 (the loopback). The /128 local routes appear in the routing table as "via [interface], receive" — the "receive" action means IOS hands the packet to the upper-layer process rather than forwarding it. In show ipv6 route, a healthy interface with a /64 GUA assigned should always show both the /64 C entry and the /128 L entry for that address.

10. A host in the 2001:DB8:ACAD:1::/64 network needs to send a packet to a host in 2001:DB8:ACAD:2::/64 through R1. R1 has a static IPv6 route configured as: `ipv6 route 2001:DB8:ACAD:2::/64 GigabitEthernet0/0 FE80::2`. What would happen if the static route were configured without the outgoing interface (`ipv6 route 2001:DB8:ACAD:2::/64 FE80::2`) and why?

A. The route would work identically — the interface specification is optional when a link-local next-hop is used B. The route would be rejected with a configuration error — IOS does not accept link-local addresses as next-hops in static routes C. IOS would reject the route or it would not function correctly. Link-local addresses are not in the global IPv6 routing table — they are only valid within a specific link. Without specifying the outgoing interface, IOS cannot determine which of its interfaces to use to reach FE80::2. The router cannot look up FE80::2 in its routing table to determine the exit interface because link-local addresses are explicitly excluded from the IPv6 routing table. The interface specification makes the route unambiguous: "to reach 2001:DB8:ACAD:2::/64, send out Gi0/0 toward the neighbour whose link-local address on that link is FE80::2" D. The route would be installed but IOS would flood the packet out all interfaces since it cannot determine the correct exit

Correct answer is C. This is a fundamental IPv6 routing concept that the CCNA exam tests regularly. In IPv4, a static route with a next-hop IP address works because the next-hop IP is in the global routing table — the router looks up the next-hop IP to find which interface to use. In IPv6, global unicast next-hops work the same way. But link-local addresses (FE80::/10) are never installed in the global IPv6 routing table — they are link-scoped and only meaningful within a specific link. If you configure ipv6 route 2001:DB8:ACAD:2::/64 FE80::2, IOS needs to resolve FE80::2 to a MAC address to send the packet, but it doesn't know which interface's NDP neighbour table to check. In some IOS versions this command is rejected at entry time; in others it may be accepted but fail to route correctly. The solution is always to specify both the exit interface and the link-local next-hop: ipv6 route 2001:DB8:ACAD:2::/64 GigabitEthernet0/0 FE80::2. This completely defines the forwarding action: exit via Gi0/0, and the Layer 2 destination is the device whose IPv6 LLA on that link is FE80::2. The same requirement applies to any IOS command that uses a link-local address as a reference — it must always be accompanied by an interface identifier.

Back to Home