The address that scares people because it's long and hexadecimal — but IPv6 is genuinely simpler than IPv4 once the vocabulary clicks. Address types, link-local, how hosts get addresses without DHCP, enabling routing, OSPFv3, and the big mindset shift: no NAT, so the firewall does the hiding.
IPv6 looks intimidating — 128 bits, hex, colons — but it removes more complexity than it adds. There's no subnet-mask arithmetic (every LAN is a /64, full stop), no address scarcity, no broadcast storms (broadcast is gone, replaced by targeted multicast), and — the big one — no NAT. Every device can have a globally routable address, which means end-to-end connectivity is back and the network is simpler, but the security model shifts: NAT was never a firewall, and in IPv6 you can't pretend it was.
This post is the "get comfortable" tour for someone fluent in IPv4 Cisco. We'll decode the address types (global, link-local, ULA), give an interface addresses, let hosts self-configure with SLAAC or take a DHCPv6 assignment, turn on routing, and stand up OSPFv3 — every piece mapped to the IPv4 command you already know. And we'll be honest about where IPv6 actually matters for an SMB versus where dual-stack is the pragmatic answer. Notice the addressing here uses 2001:db8::/32 — the documentation range, like 192.0.2.0/24 for v4.
:: collapses consecutive zero groups)01
An IPv6 interface has several addresses at once, each with a job. Learn the four prefixes and you can read any address at a glance.
| Type | Range | Role |
|---|---|---|
| Global Unicast (GUA) | 2000::/3 | Internet-routable — the public IP. Like a v4 public address, but every device gets one. |
| Link-Local | fe80::/10 | Auto-created on every v6 interface, valid on that link only. Routing protocols and NDP live here. |
| Unique Local (ULA) | fd00::/8 | Private, not internet-routed — the v6 equivalent of RFC1918 (10.x/192.168.x). |
| Multicast | ff00::/8 | Replaces broadcast. e.g. ff02::1 = all nodes, ff02::2 = all routers on the link. |
The moment IPv6 is enabled on an interface, it auto-generates a link-local address (fe80::…) — you don't configure it, and it never leaves the link. This isn't a curiosity: OSPFv3 neighbors form over link-local, NDP (the ARP replacement) uses it, and static routes to a directly-connected next hop are often written to the neighbor's link-local address plus the exit interface. Getting comfortable that "every v6 interface has both a global and a link-local address, and they do different jobs" is 80% of the mental adjustment from IPv4.
02
IPv6 routing is off by default — one global command turns it on. Then addressing an interface is just like IPv4, with a couple of v6-only conveniences.
# THE command — without it, the router won't route v6 at all R1(config)# ipv6 unicast-routing R1(config)# interface GigabitEthernet0/1 # Manual global address (host part = ::1) R1(config-if)# ipv6 address 2001:db8:acad:10::1/64 # Or let the router pick the host part from its MAC (EUI-64): R1(config-if)# ipv6 address 2001:db8:acad:10::/64 eui-64 # Link-local is auto-made, but you can pin a friendly one: R1(config-if)# ipv6 address fe80::1 link-local R1(config-if)# no shutdown R1(config-if)# end R1# show ipv6 interface brief GigabitEthernet0/1 [up/up] FE80::1 ← link-local 2001:DB8:ACAD:10::1 ← global
ipv6 unicast-routing
You can address every interface perfectly, watch link-local come up, ping directly-connected neighbors — and still find the router won't forward v6 between subnets or run a routing protocol, because ipv6 unicast-routing is off. It's the exact analog of needing ip routing on a switch (from the VLAN post), and it's the number-one "my IPv6 lab doesn't route" cause. Turn it on first, globally, before anything else.
03
IPv6 hosts can address themselves with zero DHCP — the router just advertises the prefix and they build their own address. Or you use DHCPv6 for more control. Most networks use a mix.
# With a global address on the interface and unicast-routing on, the router # already sends Router Advertisements (RAs) — hosts hear the /64 prefix and # build their own address automatically. That's SLAAC; nothing more needed. # Stateless DHCPv6: SLAAC for the address, DHCPv6 for DNS/domain only R1(config)# ipv6 dhcp pool STATELESS R1(config-dhcpv6)# dns-server 2001:4860:4860::8888 R1(config-dhcpv6)# domain-name noctis.lan R1(config-dhcpv6)# exit R1(config)# interface GigabitEthernet0/1 R1(config-if)# ipv6 nd other-config-flag # "get extras from DHCPv6" R1(config-if)# ipv6 dhcp server STATELESS R1(config-if)# end
| Method | Address from | DNS/extras from |
|---|---|---|
| SLAAC (pure) | Host self-builds from RA prefix | RDNSS in the RA (modern) or none |
| Stateless DHCPv6 | SLAAC (host self-builds) | DHCPv6 (other-config-flag) |
| Stateful DHCPv6 | DHCPv6 assigns it (managed-config-flag) | DHCPv6 |
04
There's no ARP in IPv6. The Neighbor Discovery Protocol does the same job — mapping addresses to MACs — plus router discovery and address autoconfiguration, all over multicast.
R1# show ipv6 neighbors IPv6 Address Age Link-layer Addr State Interface 2001:DB8:ACAD:10::10 0 0012.7f3a.1b2c REACH Gi0/1 FE80::212:7FFF:FE3A:1B2C 3 0012.7f3a.1b2c STALE Gi0/1 # Ping the "all-nodes" multicast to discover who's on the link: R1# ping ff02::1 # every IPv6 node answers R1# ping ff02::2 # every router answers R1# show ipv6 interface GigabitEthernet0/1 | include joined|link-local # Shows the multicast groups the interface joined — NDP in action.
05
Same concepts as IPv4, prefixed with ipv6. A default route to the ISP, and OSPFv3 for dynamic routing — enabled per interface rather than with network statements.
# Default route toward the ISP (note: often via a LINK-LOCAL next hop # plus the exit interface, since that's what NDP resolves) R1(config)# ipv6 route ::/0 GigabitEthernet0/0 FE80::1 # OSPFv3 — enabled ON THE INTERFACE, no "network" statements R1(config)# ipv6 router ospf 1 R1(config-rtr)# router-id 1.1.1.1 # still a 32-bit v4-style ID R1(config-rtr)# exit R1(config)# interface GigabitEthernet0/1 R1(config-if)# ipv6 ospf 1 area 0 R1(config-if)# end R1# show ipv6 route ospf R1# show ipv6 ospf neighbor # neighbors identified by their link-local
OSPFv3 keeps the OSPF you learned in the routing post — areas, router-ids (still written as 32-bit dotted quads, oddly), DR/BDR, the same troubleshooting checklist — but enables per-interface with ipv6 ospf 1 area 0 instead of network statements, and neighbors are identified by link-local address. That per-interface model is actually cleaner: you enable OSPF exactly where you want it, no wildcard-mask matching to get wrong. Most of your IPv4 routing instincts transfer directly.
06
The most important operational difference. In IPv4, NAT accidentally hid your hosts behind one address. In IPv6 every host is globally addressable — so the firewall, not NAT, must do the protecting. Explicitly.
NAT was never a security control — it just happened to drop unsolicited inbound because there was no translation to match. Take NAT away and, without an explicit firewall, every internal host with a global address is reachable from the internet. That's not an IPv6 flaw; it's IPv6 removing a crutch. The fix is a stateful firewall that does what NAT accidentally did, on purpose: permit established/return traffic, deny unsolicited inbound. On IOS that's a v6 ACL (ipv6 access-list) with reflexive/established handling, or better, the Zone-Based Firewall which inspects v6 too. Enable IPv6 and you must build the inbound firewall in the same breath — it is not optional.
R1(config)# ipv6 access-list WAN-IN # Permit NDP (v6 breaks entirely without ICMPv6 — do NOT block it all) R1(config-ipv6-acl)# permit icmp any any nd-na R1(config-ipv6-acl)# permit icmp any any nd-ns # Permit replies to sessions we started R1(config-ipv6-acl)# permit tcp any any established # Deny the rest inbound R1(config-ipv6-acl)# deny ipv6 any any log R1(config-ipv6-acl)# exit R1(config)# interface GigabitEthernet0/0 R1(config-if)# ipv6 traffic-filter WAN-IN in R1(config-if)# end
In IPv4 many admins reflexively drop ICMP at the edge. Do that to ICMPv6 and IPv6 stops working — NDP (neighbor discovery), RA (address config), and Path MTU Discovery all ride ICMPv6. A blanket deny icmp breaks address resolution and connectivity in ways that look like a routing bug. Permit the essential ICMPv6 types (neighbor solicit/advertise, router advert, packet-too-big) and filter selectively. This single reflex causes more "IPv6 is flaky" tickets than anything else.
07
An honest answer, since we get asked. IPv6 is inevitable, but for most small sites dual-stack is the pragmatic path, not a v6-only leap.
For a Cretan hotel or shop, the internal network runs fine on IPv4 + NAT today, and there's rarely a burning reason to renumber. But two things make IPv6 worth knowing now: some ISPs deliver it by default (and mobile/Starlink paths increasingly are v6-native), so you'll meet it whether you planned to or not; and guest devices already speak it — if your network offers IPv6 you haven't secured, that's an unmonitored path in and out. The pragmatic move for most SMBs is dual-stack: keep IPv4 internally, enable IPv6 where the ISP provides it, and — critically — apply the same firewalling and monitoring to both. The failure mode we see isn't "no IPv6," it's "IPv6 quietly enabled and completely unfiltered." Know it so you can secure it, even if you don't lead with it.
Takeaways
ipv6 unicast-routing first. Everything can look configured and still not route without it — the v6 twin of ip routing.ipv6 prefixes; OSPFv3 enables per-interface and neighbors by link-local.NOCTIS audits and configures dual-stack properly — v6 addressing where your ISP provides it, and the same firewalling and monitoring on IPv6 as IPv4, so it's an asset, not an unwatched back door. For hotels and SMBs getting v6 whether they asked or not.
Book a Discovery Call →