CCNA online course

IPv6 Link-Local Addresses

Learn how IPv6 link-local addresses work, how Cisco IOS creates and configures them, and how to verify, route, and troubleshoot FE80::/10 addresses.

IPv6 link-local addresses are unicast addresses used for communication on one directly connected Layer 2 network segment. They are essential to IPv6 operation because hosts and routers use them for Neighbor Discovery, router discovery, next-hop resolution, and many routing-protocol adjacencies.

This lesson covers the FE80::/10 range, automatic and manual assignment, Cisco IOS configuration, routing behavior, address scope, verification, and troubleshooting.

What Is an IPv6 Link-Local Address?

A link-local address is an IPv6 unicast address usable only on the local network link where the interface is connected. A local link commonly means one Ethernet segment or Layer 2 broadcast domain.

A link-local address is not a general-purpose address for communication across routed networks. Routers do not forward packets with a link-local destination beyond the local link, and link-local prefixes are not advertised as ordinary routable prefixes.

Do not confuse a local link with an entire routed IPv6 subnet. A router can connect two different links that use the same link-local value, such as FE80::1. The value is valid separately on each interface because its scope is the individual link, not the entire routed network.

IPv6 Link-Local Range: FE80::/10

The reserved link-local unicast range is FE80::/10. The first 10 bits identify the range. In hexadecimal notation, the first hextet can range from FE80 through FEBF. Because many examples use the beginning of the range, link-local addresses are commonly shown as starting with FE80.

A conventional address layout is:

FE80:0000:0000:0000:interface-identifier

In a typical IPv6 /64 design, the lower 64 bits are the interface identifier. The identifier may be derived from the interface MAC address using modified EUI-64, or generated by an operating system using stable-private or temporary privacy mechanisms. The exact generation method depends on the device and configuration.

Compressed notation

IPv6 addresses contain eight groups, or hextets, of four hexadecimal digits. Leading zeroes in a hextet can be removed, and one consecutive sequence of all-zero hextets can be replaced by ::.

FE80:0000:0000:0000:021A:2BFF:FE3C:4D5E
FE80::21A:2BFF:FE3C:4D5E

The double colon can be used only once in an address because it represents an inferred number of zero hextets.

How Link-Local Addresses Are Created

Automatic assignment

When IPv6 is enabled on an interface, the device normally creates a link-local address automatically. This can occur even when no global unicast address has been configured.

The interface identifier may be produced from modified EUI-64 information based on the MAC address. Modern operating systems and network devices may instead use a stable generated identifier or a privacy-oriented random identifier. These mechanisms reduce dependence on a visible hardware address and can make tracking more difficult.

Duplicate Address Detection

Before an automatically generated or manually configured address becomes usable, IPv6 commonly performs Duplicate Address Detection (DAD). DAD uses Neighbor Discovery messages to determine whether another device on the same link already uses the address.

If a duplicate is detected, the device should not use that address normally. Duplicate addresses can prevent Neighbor Discovery from identifying the correct device and can cause intermittent or complete communication failures.

Configuring Link-Local Addresses on Cisco IOS

Enable IPv6 routing

On a Cisco router, enable IPv6 unicast routing globally when the router must forward IPv6 packets:

configure terminal
ipv6 unicast-routing

Observe automatic creation

Configure a global unicast address on an interface and enable the interface:

interface GigabitEthernet0/0
 ipv6 address 2001:db8:1:1::1/64
 no shutdown
show ipv6 interface GigabitEthernet0/0

The interface output should show the configured global unicast address and an automatically generated link-local address. The exact automatically generated value depends on the IOS release and interface-identification method.

Manually configure a predictable address

An administrator may assign a stable link-local address when predictable router identification is useful. For example:

interface GigabitEthernet0/0
 ipv6 address FE80::1 link-local
 no shutdown
show ipv6 interface GigabitEthernet0/0

The link-local keyword tells IOS that the address is a link-local address rather than a normal prefix address. The address must be unique among all interfaces sharing that Layer 2 segment.

On different links, the same value can be reused:

interface GigabitEthernet0/0
 ipv6 address FE80::1 link-local

interface GigabitEthernet0/1
 ipv6 address FE80::1 link-local

This is valid only if the two interfaces connect to different local links. Reusing FE80::1 on two interfaces attached to the same segment creates a duplicate-address problem.

Operational Uses

Automatic interface addressing: IPv6-enabled interfaces normally create a link-local address for local control-plane communication.

Duplicate Address Detection: DAD checks whether the proposed address is already in use on the link.

Neighbor Discovery: Neighbor Solicitation and Neighbor Advertisement messages use link-local communication to resolve neighbors and verify reachability.

Router discovery: Hosts send Router Solicitation messages and receive Router Advertisement messages, commonly using link-local addresses.

Default gateway and next hop: A host commonly installs the router's link-local address as its default gateway.

IPv6 routing adjacencies: Routing protocols commonly use the neighbor's link-local address to identify an adjacent router.

Static routes: A link-local next hop can be used for a remote destination, but the outgoing interface must also be specified.

Neighbor Discovery Protocol

Neighbor Discovery Protocol (NDP) is the ICMPv6-based set of functions used for neighbor discovery, address resolution, router discovery, and related operations.

  • Router Solicitation (RS): A host requests router information instead of waiting for a periodic advertisement.
  • Router Advertisement (RA): A router announces prefix information, default-router information, and other IPv6 configuration details.
  • Neighbor Solicitation (NS): A device resolves a neighbor's link-layer address or checks whether an address is in use.
  • Neighbor Advertisement (NA): A device replies with neighbor information or announces its own reachability.

A host can receive a global prefix in an RA and still use the router's link-local address as its default gateway. The global address is used for broader reachability; the link-local address identifies the directly connected router interface.

Routing-protocol adjacencies

IPv6 routing protocols such as OSPFv3 commonly form adjacencies using link-local addresses. This keeps neighbor identification tied to the directly connected interface. If an interface loses its link-local address, the routing adjacency may fail even when a global unicast address remains configured.

Link-Local Addresses and Routing

A router can forward traffic toward a remote destination through a neighbor's link-local address. The packet's final destination may be a global unicast address on another network, while the immediate next hop is link-local.

A link-local next hop requires an outgoing interface because the same link-local value may exist on several router interfaces. The router must know which local link contains the neighbor.

Global next hop versus link-local next hop

A global unicast next hop is normally unique within the routing domain, so a route can often specify only the next-hop address:

ipv6 route 2001:db8:2::/64 2001:db8:1:1::2

For a link-local next hop, include both the exit interface and the link-local address:

ipv6 route 2001:db8:2::/64 GigabitEthernet0/0 FE80::2

The first value is the remote destination prefix. The interface identifies the local link, and FE80::2 identifies the neighboring router on that link.

Address Types Compared

Link-local unicast | FE80::/10 | One local link | No | NDP, router discovery, next hops, and local control traffic | FE80::1

Global unicast | Commonly 2000::/3 | Broad routed scope | Yes | End-to-end IPv6 communication | 2001:db8:1:1::10

Unique local | FC00::/7, commonly FD00::/8 in use | Organization or private internetwork | Not on the public Internet | Internal addressing | fd12:3456:789a::10

Multicast | FF00::/8 | Depends on multicast scope field | Multicast forwarding rules apply | One-to-many delivery | FF02::1

Loopback | ::1/128 | One device | No | A device tests its own IPv6 stack | ::1

Unspecified | ::/128 | No usable interface scope | No | Indicates no address, such as before a host selects a source address | ::

Link-local unicast is different from multicast even though both are used extensively by IPv6 control protocols. A link-local address identifies one interface; a multicast address identifies a group of receivers.

Interface Scope and Zone Identifiers

Because a link-local address is meaningful only on one link, a host with multiple IPv6-enabled interfaces may need an interface reference when sending to that address. This reference is called a scope ID, zone index, or interface identifier.

Platform-neutral examples include:

FE80::2%eth0
FE80::2%3

Here, eth0 is an interface name and 3 is an interface index. The syntax varies by operating system and application. On Cisco IOS, the equivalent operation is commonly performed by specifying the source or outgoing interface in the command.

The same link-local value can therefore refer to different neighbors on different interfaces. Without scope information, a host may not know which local link should receive the packet.

Practical Cisco IOS Example

Consider a router connected to a LAN through GigabitEthernet0/0. The router has a global address for end-to-end traffic and a documented link-local address for local neighbor operations:

configure terminal
ipv6 unicast-routing
interface GigabitEthernet0/0
 ipv6 address FE80::1 link-local
 ipv6 address 2001:db8:1:1::1/64
 no shutdown
end

A host on the LAN may learn 2001:db8:1:1::/64 from Router Advertisements and install FE80::1 as its default gateway. The host does not need the router's global address as the gateway identity.

Verification Commands

show ipv6 interface brief: Summarizes IPv6 addresses and interface status. Inspect the link-local address and whether the interface is up.

show ipv6 interface GigabitEthernet0/0: Displays detailed IPv6 state, addresses, NDP information, and related interface behavior.

show ipv6 neighbors: Displays discovered neighbors, their IPv6 addresses, link-layer addresses, states, and interfaces.

show ipv6 route: Displays connected, local, static, and learned IPv6 routes.

ping ipv6: Tests IPv6 reachability. For a link-local destination, specify the appropriate source interface when needed.

show running-config interface GigabitEthernet0/0: Confirms whether IPv6 addresses, routing settings, and no shutdown are configured.

Verify a directly connected neighbor

ping ipv6 FE80::2
ping ipv6 FE80::2 source GigabitEthernet0/0

The second form removes ambiguity by identifying the local interface. A link-local ping should target a directly connected neighbor. It is not a test of reachability across a routed network.

Troubleshooting Link-Local Problems

Ping fails or uses the wrong interface

  • Confirm that the destination is directly connected to the selected interface.
  • Check the local link-local addresses with show ipv6 interface brief.
  • Specify the source interface or host scope ID.
  • Check show ipv6 neighbors for a resolved neighbor entry.

A static route using FE80::2 does not work

  • Ensure the route includes both the outgoing interface and FE80::2.
  • Confirm that FE80::2 belongs to a router on that same link.
  • Check that the interface is up and that Neighbor Discovery has resolved the neighbor.
ipv6 route 2001:db8:2::/64 GigabitEthernet0/0 FE80::2
show ipv6 route 2001:db8:2::/64
show ipv6 neighbors

No expected link-local address appears

  • Check whether the interface is administratively down.
  • Use show ipv6 interface and show running-config interface.
  • Enable the interface with no shutdown.
  • Confirm that IPv6 addressing is enabled as required by the IOS platform and configuration.
  • Configure an explicit link-local address if a stable address is required.

Duplicate address detected

  • Compare link-local addresses on every interface sharing the segment.
  • Inspect interface messages and neighbor information.
  • Replace a duplicated manually assigned address with a unique value.
  • Remember that reuse across separate links is valid, but reuse on one shared Layer 2 segment is not.

Host has IPv6 addressing but no off-link connectivity

  • Check whether the host received Router Advertisements.
  • Inspect the host's IPv6 default route and gateway.
  • Verify that the router interface is up and has the expected link-local and global addresses.
  • Confirm that the router is advertising the LAN prefix and that IPv6 forwarding is enabled.

Security and Design Considerations

Link-local scope limits direct reachability from remote routed networks, but it does not make the local link automatically safe. A compromised host on the same segment can send malicious Neighbor Discovery messages, impersonate a router, or attempt local-link denial-of-service attacks.

Use appropriate IPv6 first-hop security controls where supported, such as protections against rogue Router Advertisements and Neighbor Discovery attacks. Apply switch and network-access controls appropriate to the environment.

When manually assigning router link-local addresses, document the address used on each segment. Predictable values such as FE80::1 can simplify default-gateway documentation, static routes, routing-protocol troubleshooting, and operational support.

Exam-Relevant Summary

  • FE80::/10 is the IPv6 link-local range; the first hextet spans FE80 through FEBF.
  • A link-local address is valid only on its directly connected local Layer 2 link.
  • Routers do not forward link-local destinations beyond that link.
  • IPv6 interfaces normally generate link-local addresses automatically.
  • DAD checks for duplicate use before an address becomes usable.
  • NDP uses link-local communication for RS, RA, NS, and NA operations.
  • Hosts commonly use a router's link-local address as the default gateway.
  • A link-local static-route next hop requires an outgoing interface.
  • The same link-local value may be reused on different links, but not on the same segment.
  • Pinging a link-local address often requires a source interface or scope ID.

For related fundamentals, review the OSI Reference Model, computer networking fundamentals, and OSPF configuration concepts.