IPv6 Global Unicast Addresses

Learn how IPv6 global unicast addresses are structured, subnetted, assigned, configured, verified, and routed in a CCNA-level network.

Learning objectives

After this lesson, you should be able to identify IPv6 global unicast addresses, interpret their notation and prefix structure, plan /64 subnets, explain SLAAC and DHCPv6, configure Cisco IOS interfaces, and troubleshoot IPv6 routing.

This lesson assumes familiarity with hexadecimal numbers, IPv4 subnetting, Cisco IOS interface configuration, and connected and static routes. For background, review the OSI reference model and basic computer networking concepts.

What is an IPv6 global unicast address?

A global unicast address is an IPv6 address intended to identify one interface. It is globally unique within the IPv6 address space and can be routed between networks when routing, upstream connectivity, filtering, and provider allocation are correctly configured.

“Globally routable” describes the address scope and intended use; it does not guarantee that every network on the Internet can reach the address. A provider must advertise the prefix, routers must have usable routes, and firewalls and security policies must permit the traffic.

Address type	Typical prefix or range	Scope	Primary use	Routable on the public Internet
Global unicast	2000::/3	Global	One interface that may communicate across routed networks	Yes, when allocated and routed
Link-local unicast	fe80::/10	Local link	Neighbor Discovery, router communication, and next hops	No
Unique local unicast	fc00::/7, commonly fd00::/8	Private organization	Internal addressing without public Internet routing	No
Multicast	ff00::/8	Defined by multicast scope	One-to-many delivery, including Neighbor Discovery	Not as unicast traffic
Loopback	::1/128	Local host	Testing the local IPv6 stack	No
Unspecified	::/128	No assigned address	表示 no address is assigned, such as before initial configuration	No

IPv6 does not use broadcast. Multicast and Neighbor Discovery provide functions that IPv4 networks commonly associated with broadcast.

The global unicast range: 2000::/3

The currently assigned IPv6 global unicast block is 2000::/3. The prefix length /3 means that the first three bits are fixed as binary 001. In hexadecimal notation, addresses in this range commonly begin with 2 or 3, because the first hexadecimal digit represents the first four bits.

2000::/3 is a broad address range, not the prefix automatically assigned to one organization. An ISP or registry delegates a smaller prefix, such as 2001:db8:1200::/48 in documentation examples. A customer must use the prefix assigned by its provider or authority rather than inventing a public range.

IPv6 address notation

Every IPv6 address contains 128 bits. It is written as eight groups called hextets. Each hextet contains 16 bits and is represented by up to four hexadecimal digits.

For example, this address contains eight hextets:

2001:0db8:0001:0020:0000:0000:0000:0005

Leading-zero suppression

Leading zeros may be removed from each individual hextet. A hextet containing only zeros becomes 0.

2001:0db8:0001:0020:0000:0000:0000:0005
2001:db8:1:20:0:0:0:5

Double-colon compression

One consecutive sequence of zero hextets may be replaced with ::. The double colon may appear only once, because using it twice would make the number of omitted hextets ambiguous.

2001:db8:1:20:0:0:0:5
2001:db8:1:20::5

To expand 2001:db8:1:20::5, count the visible hextets: five are present. Three zero hextets must be inserted:

2001:db8:1:20:0:0:0:5

Always expand an address before determining its prefix, subnet ID, or interface ID. This prevents errors when a compressed zero sequence crosses a visual boundary.

Global unicast address structure

A typical global unicast address is described using three logical components:

Global routing prefix: the provider- or registry-assigned portion used for Internet-scale routing.
Subnet ID: the organizational portion used to distinguish internal IPv6 networks.
Interface ID: the host- or interface-specific portion, normally the final 64 bits of a /64 subnet.

The exact division between the global routing prefix and subnet ID before the /64 boundary depends on the allocation. Providers, registries, and organizations may receive different prefix lengths. For a normal end-user LAN, however, the subnet itself is generally /64.

Component	Typical role	Example within an address	Who controls it
Global routing prefix	Identifies the customer or site for upstream routing	`2001:db8:1200`	Provider or registry, then the organization within its allocation
Subnet ID	Separates internal networks such as VLANs	`:10:` in `2001:db8:1200:10::/64`	Organization
Interface ID	Identifies an interface on one subnet	`::1` or another final-64-bit value	Host, administrator, or address-assignment method

Why /64 is important

A /64 has 64 network-prefix bits and 64 interface-ID bits. SLAAC is designed around this boundary, so normal LANs and wireless networks should use /64 prefixes even when the organization has far more address space than it needs for the number of hosts.

Global routing prefixes and prefix delegation

A global routing prefix is the portion of an address that upstream routers use to reach an organization or site. An ISP may use prefix delegation to assign a block to a customer edge router. For example, an ISP might delegate a /48 to an enterprise or a /56 to a smaller site.

The customer then divides the delegated prefix into /64 networks. The ISP must route the delegated aggregate toward the customer, while the customer routes individual internal /64 prefixes within its own network.

Organizations should use assigned prefixes because invented public-looking addresses may collide with legitimate addresses, fail return routing, and create difficult renumbering and security problems.

Subnet ID and IPv6 subnet planning

The subnet ID lets an organization create many internal networks without changing the provider-assigned routing prefix. Consider the documentation allocation 2001:db8:1200::/48. Its fourth hextet can be used to number /64 subnets:

Users VLAN:     2001:db8:1200:10::/64
Servers VLAN:   2001:db8:1200:20::/64
Wireless:       2001:db8:1200:30::/64
Infrastructure: 2001:db8:1200:40::/64

A router interface on the users VLAN could use:

2001:db8:1200:10::1/64

A /48 contains 16 bits available for selecting /64 subnets, allowing 65,536 distinct /64 prefixes. A /56 leaves 8 bits for subnet selection, allowing 256 /64 prefixes.

Use a consistent numbering plan. For example, reserve ranges for sites, VLANs, user networks, server networks, wireless networks, management, and point-to-point links. Consistent numbering makes route summaries, documentation, troubleshooting, and future growth easier.

Interface IDs

The interface ID is the interface-specific portion of an IPv6 address. On a typical /64 LAN, it is the last 64 bits. It can be assigned manually or generated automatically.

Static interface IDs

A static interface ID is manually selected, such as ::1 for a router, ::10 for a server, or another documented value. Static addresses are useful for infrastructure that must be predictable, but duplicate assignments must be avoided.

Modified EUI-64

Modified EUI-64 derives a 64-bit interface ID from a 48-bit MAC address. The process inserts ff:fe in the middle of the MAC-derived value and flips the Universal/Local bit in the first byte. This bit modification changes whether the identifier is treated as universally or locally administered.

EUI-64 is useful for CCNA laboratory practice, but modern hosts often use randomized or stable privacy-based interface IDs instead. EUI-64 can expose a relationship to a device MAC address and should not be assumed to be the preferred production method.

Privacy and stable addressing

Privacy extensions can create temporary randomized interface IDs. A host may therefore have more than one global address on the same interface: a stable address for ongoing connections and a temporary address for new outbound connections. Address selection and application behavior determine which address is used.

Address assignment methods

Method	Address source	Router advertisement role	DHCPv6 role	Typical use case
Static addressing	Administrator	May still advertise the prefix and default router	Not required	Routers, servers, and managed infrastructure
SLAAC	Host combines an advertised /64 prefix with a generated interface ID	Provides prefix, default-router information, and flags	Not required for the address	Automatic host addressing
Stateless DHCPv6	Host creates its own address through SLAAC	Advertises the prefix and indicates supplementary configuration is available	Provides information such as DNS configuration, not normally the address	SLAAC addressing with centralized options
Stateful DHCPv6	DHCPv6 server assigns the address	Indicates that DHCPv6 should be used and still supplies default-router information	Maintains address leases and other options	Centralized address management

SLAAC and router advertisements

SLAAC, or Stateless Address Autoconfiguration, allows a host to form an address from information in an ICMPv6 Router Advertisement (RA). The RA advertises one or more prefixes, identifies whether a prefix may be used for autonomous address configuration, communicates the default router, and carries configuration flags.

A common arrangement is for a host to use SLAAC to create its global address and use DHCPv6 to obtain supplementary information such as DNS settings. DHCPv6 does not replace the IPv6 default-router function: hosts normally learn the default router from RAs.

Relationship to link-local addressing

IPv6-enabled interfaces normally have a link-local address in addition to any global unicast address. Link-local addresses come from fe80::/10 and are valid only on the local Layer 2 link.

Routers use link-local addresses in many IPv6 routing operations. A host's default gateway is usually learned through an RA and is represented by the router's link-local address, not necessarily by the router's global address. This allows local control-plane communication to remain valid even if a provider changes the site's global prefix.

Routing global unicast prefixes

Routers advertise and forward network prefixes, not individual host addresses. A route such as 2001:db8:1200:10::/64 represents every address in that subnet.

Connected routes are created when an IPv6 prefix is configured on an active routed interface.
Static routes are manually configured paths to remote prefixes.
Default routes match destinations for which no more specific route exists.
Dynamic IPv6 routing, such as OSPFv3, exchanges reachable prefixes automatically. See the OSPF configuration lesson for related routing concepts.

IPv6 forwarding uses longest-prefix match: if several routes match a destination, the route with the greatest number of matching leading bits is selected. For example, a /64 route is preferred over a /48 route, and a /48 is preferred over a /0 default route.

On Cisco routers, IPv6 packet forwarding must be enabled globally before the router can route between IPv6 networks.

Cisco IOS configuration

Enable IPv6 routing

Router(config)# ipv6 unicast-routing

Assign a static global address

Router(config)# interface GigabitEthernet0/0
Router(config-if)# ipv6 address 2001:DB8:1200:10::1/64
Router(config-if)# no shutdown

The interface also normally receives a link-local address automatically. The configured global address identifies the interface on the users VLAN, while the /64 identifies the connected subnet.

Demonstrate EUI-64 in a lab

Router(config)# interface GigabitEthernet0/1
Router(config-if)# ipv6 address 2001:DB8:1200:20::/64 eui-64
Router(config-if)# no shutdown

The router derives the final 64 bits from the interface MAC address. Because the resulting value depends on the interface hardware, do not use this command when a predictable static interface ID is required.

Configure a static route

Router(config)# ipv6 route 2001:DB8:1300::/48 2001:DB8:1200:FF::2

In operational designs, a link-local next hop may be used with an outbound interface specified. The next hop must be reachable through that interface.

Verification commands

show ipv6 interface brief
show ipv6 interface GigabitEthernet0/0
show ipv6 route
show ipv6 neighbors
ping ipv6 2001:DB8:1200:20::10
traceroute ipv6 2001:DB8:1200:20::10

show ipv6 interface brief summarizes interface state and configured IPv6 addresses.
show ipv6 interface displays global and link-local addresses, prefix information, Neighbor Discovery details, and RA-related behavior.
show ipv6 route displays connected, local, static, default, and dynamically learned routes. Route codes and output vary by IOS release.
show ipv6 neighbors displays Neighbor Discovery entries, including IPv6 addresses, link-layer addresses, interfaces, and states.
ping ipv6 tests reachability using ICMPv6.
traceroute ipv6 helps identify the hop where forwarding stops.

Example: routing between two IPv6 LANs

Use one router interface in each /64 network:

GigabitEthernet0/0: 2001:DB8:1200:10::1/64
GigabitEthernet0/1: 2001:DB8:1200:20::1/64

After enabling ipv6 unicast-routing, the router installs connected routes for both prefixes. A host in 2001:db8:1200:10::/64 sends traffic for the servers subnet to the router's link-local default gateway. The router performs a longest-prefix lookup, selects the connected 2001:db8:1200:20::/64 route, resolves the destination neighbor with Neighbor Discovery, and forwards the packet.

Troubleshooting IPv6 global addressing

Only a link-local address appears

Verify the intended ipv6 address command and prefix length.
Confirm the interface is administratively enabled and its physical or line protocol state is up.
Compare show ipv6 interface brief with show running-config interface.

Same-LAN communication works, but another subnet is unreachable

Confirm ipv6 unicast-routing is enabled.
Confirm hosts have the correct /64 prefix and an active default-router entry.
Check show ipv6 route for the destination prefix.
Confirm firewalls and security policies permit IPv6 forwarding and ICMPv6.

SLAAC does not create a global address

Confirm the router interface has a valid global /64 address and is sending RAs.
Confirm the advertised prefix permits autonomous address configuration.
Verify the client accepts RAs and has IPv6 enabled.
Check VLAN, wireless isolation, and Layer 2 problems that may block ICMPv6 RAs.

An address is rejected or behaves unexpectedly

Check hexadecimal spelling, omitted hextets, double-colon placement, and prefix length.
Ensure the address is not link-local, unique local, multicast, loopback, unspecified, or documentation-only when a real public allocation is required.
Check Duplicate Address Detection results and ensure no duplicate static assignment exists.

A remote destination is unreachable

Verify a matching route or default route exists.
Verify the next hop is reachable through the correct outbound interface.
Use traceroute ipv6 to locate the forwarding failure.
Confirm upstream provider routing, prefix delegation, return routing, and firewall policy.

Operational considerations

Privacy and multiple addresses

Privacy extensions and stable address algorithms can cause a host to maintain several global addresses. An address may be preferred for new connections while another remains valid for existing sessions. Monitoring tools should therefore not assume one global address per interface.

Renumbering and prefix changes

If an ISP changes a delegated prefix, internal subnets and host addresses may need to change. Use SLAAC lifetimes, DNS updates, provider-independent planning where appropriate, and documented interface naming to reduce disruption. Avoid hard-coding provider-specific assumptions into applications and access-control rules.

Filtering and security

A global unicast address is potentially reachable beyond the local network. Apply explicit IPv6 firewall policies, permit required ICMPv6 and Neighbor Discovery traffic, restrict management access, and filter unwanted inbound traffic. Do not treat IPv6 as secure merely because address space is large.

Exam-relevant notes

2000::/3 identifies the currently assigned global unicast range; its first bits are binary 001.
A normal LAN uses a /64, leaving 64 bits for the interface ID.
fe80::/10 is link-local, not global unicast.
fd00::/8 is commonly used for unique local addressing, not public Internet routing.
An IPv6 host normally learns its default router through an RA, using the router's link-local address.
SLAAC creates an address from RA information; DHCPv6 may provide addresses, supplementary options, or both depending on the mode.
IPv6 routers need ipv6 unicast-routing enabled to forward packets between IPv6 interfaces.
Forwarding selects the most specific matching route using longest-prefix match.
Never use :: compression more than once in one IPv6 address.