VMware ESXi and vSphere Cluster Management

IPv6 Global Unicast Addresses

Learn how IPv6 global unicast addresses work, including 2000::/3, /48 and /64 prefixes, subnet IDs, interface identifiers, SLAAC, DHCPv6, and routing.

What Is an IPv6 Global Unicast Address?

An IPv6 global unicast address is a globally unique IPv6 address assigned to one network interface. It is intended to be routable beyond the local network, including across the public Internet when routing policies and security controls permit.

Unicast means one sender communicates with one destination. When a packet is sent to a global unicast address, routers forward it toward one destination interface rather than delivering it to a group of receivers.

The general role is similar to an IPv4 public address: both identify an address that can be used beyond a private local network. However, IPv6 allocation, subnetting, address autoconfiguration, and routing practices differ from IPv4. IPv6 normally gives organizations much larger address blocks and commonly uses a /64 subnet for a LAN.

The IPv6 Global Unicast Range

The currently defined IPv6 global unicast space is 2000::/3. The /3 prefix means that the first three bits are 001. In hexadecimal notation, addresses in this range commonly begin with 2 or 3.

For example, 2001:db8:1234:10::25 has a leading value in the global unicast range. The 2001:db8::/32 block is reserved for documentation and instructional examples, so it should not be expected to work on the public Internet.

Not every value in the 128-bit IPv6 address space is global unicast. Other portions are reserved for link-local, unique local, multicast, loopback, unspecified, and other purposes.

How Global Addresses Are Allocated

IPv6 address allocation follows an Internet number registry hierarchy. Regional Internet Registries, or RIRs, manage Internet number resources for geographic service regions. They distribute large address blocks to eligible Internet service providers and organizations. Providers may then assign or delegate smaller prefixes to their customers.

An organization uses its assigned prefix to create internal network prefixes. Each resulting subnet remains globally unique because it comes from the organization's allocated address space.

A simplified allocation hierarchy looks like this:

1. An Internet registry allocates a large block to a provider or eligible organization.
2. A provider delegates an organizational prefix, such as a /48 or /56, to a customer.
3. The organization uses part of that prefix to create individual /64 subnets.
4. Hosts and router interfaces create addresses within those /64 subnets.

Typical 128-Bit Address Structure

An IPv6 address contains 128 bits, normally written as eight hexadecimal groups called hextets. A common LAN design divides those bits into a 64-bit network prefix and a 64-bit interface identifier.

The 64-bit network prefix is commonly divided into:

• Global routing prefix: The leading portion allocated through the registry and provider hierarchy. Its length depends on the allocation and addressing plan.
• Subnet ID: Bits used by the organization to identify a particular subnet within its assigned prefix.

The final 64 bits form the interface identifier. On a typical /64 subnet, this identifies an interface on that subnet.

The labels depend on the assigned prefix length. A /48 allocation may provide 16 subnet bits before /64 LAN prefixes, but a different allocation can use a different division. The global routing prefix is not always a fixed number of bits.

Prefix Lengths and IPv6 Subnetting

A prefix length is the number after the slash in notation such as /48, /56, or /64. It identifies how many leading bits belong to the network prefix.

Do not confuse an assigned organizational prefix with a complete routed subnet prefix. For example, an organization might receive 2001:db8:1234::/48. That /48 is the organization's assigned prefix. A LAN may use 2001:db8:1234:00a5::/64, which is the complete subnet prefix routed to that LAN.

Example: Creating /64 Subnets from a /48

With a /48 allocation, 16 bits remain before reaching a /64 LAN prefix:

64 - 48 = 16 subnet bits

The number of possible /64 subnets is:

2^16 = 65,536

For example, subnet ID 00a5 produces:

2001:db8:1234:00a5::/64

/64 is the standard size for typical IPv6 LANs because many IPv6 host mechanisms, especially Stateless Address Autoconfiguration or SLAAC, are designed around a 64-bit interface identifier. Although other prefix lengths exist for special designs, using shorter-than-/64 prefixes for ordinary host LANs can conflict with expected IPv6 behavior.

Example: Breaking Down a /48 Allocation

Use the documentation-only example allocation 2001:db8:1234::/48. Assigning subnet ID 00a5 creates the /64 subnet:

2001:db8:1234:00a5::/64

A host address on that subnet might be:

2001:db8:1234:00a5:0211:22ff:fe33:4455

• /48 organizational prefix: 2001:db8:1234
• Subnet ID: 00a5
• /64 network prefix: 2001:db8:1234:00a5::/64
• 64-bit interface identifier: 0211:22ff:fe33:4455

Interface Identifier Creation

An interface identifier can be configured manually, generated automatically, or selected using a host's stable or temporary privacy mechanism. A MAC-derived identifier is possible but not required.

Modified EUI-64

Modified EUI-64 derives a 64-bit identifier from a 48-bit MAC address. The process is:

1. Start with the MAC address, such as 00:11:22:33:44:55.
2. Insert ff:fe between the third and fourth bytes: 00:11:22:ff:fe:33:44:55.
3. Invert the universal/local bit in the first octet. The first octet 00 becomes 02.
4. Write the result as four IPv6 hextets: 0211:22ff:fe33:4455.

This produces the illustrative address:

2001:db8:1234:00a5:0211:22ff:fe33:4455

Modern operating systems often avoid exposing a MAC-derived identifier. They may use stable private identifiers, randomized identifiers, or temporary privacy extension addresses. Temporary addresses help reduce tracking by changing the interface identifier used for outbound connections.

Ways to Configure a Global Unicast Address

Manual Static Configuration

A network administrator can manually configure an address and prefix on a router, server, or other device. Static configuration is useful for infrastructure interfaces that need predictable addresses.

ipv6 unicast-routing
interface GigabitEthernet0/0
 ipv6 address 2001:db8:1234:10::1/64
 no shutdown

This Cisco IOS example uses documentation space. In production, substitute a legitimately assigned prefix.

SLAAC

SLAAC, or Stateless Address Autoconfiguration, allows a host to build an address automatically. An IPv6 router sends a Router Advertisement, or RA, containing a network prefix such as:

2001:db8:1234:10::/64

The host combines that advertised /64 prefix with an automatically generated 64-bit interface identifier. The host also learns information from the RA, including the router it can use as a default gateway. SLAAC therefore provides both address configuration and a way for the host to discover a default router.

DHCPv6

DHCPv6 can provide IPv6 addresses, additional configuration options, or both, depending on the deployment. Some networks use SLAAC for the address and DHCPv6 for options such as DNS information. Other networks use DHCPv6 to assign addresses while still relying on router advertisements for default-router information.

Router advertisements remain important because hosts use them to learn the default gateway. DHCPv6 does not replace the basic IPv6 router-discovery function.

Routing Behavior

Routers forward IPv6 packets by examining the destination address, selecting a matching route, and applying longest-prefix match. If multiple routes match, the route with the greatest number of matching leading bits is normally preferred.

Global unicast prefixes can be advertised and routed across the public Internet when the appropriate routing announcements, return paths, provider agreements, and policies are in place. A global unicast address therefore has a potentially broad routing scope, but it does not guarantee end-to-end reachability.

Connectivity can fail because:

• A local or remote firewall blocks IPv6 traffic.
• The organization does not advertise its prefix upstream.
• An upstream provider filters or rejects the route.
• The destination has no return route.
• A router lacks a default route or a more specific route.

Cisco IOS Verification

show ipv6 interface brief
show ipv6 interface GigabitEthernet0/0
show ipv6 route

These commands help confirm interface addresses, interface state, router advertisements and IPv6 routes. A static IPv6 default route can be configured as follows:

ipv6 route ::/0 2001:db8:1234:10::fe

The next-hop address and route must match the actual topology. When a link-local next hop is used, the outgoing interface may also be required by the platform.

Comparison with Other IPv6 Address Types

A link-local address is automatically used on an IPv6-enabled interface and works only on the local link. Routers commonly use link-local addresses for neighbor and routing-protocol communication.

A unique local address is intended for private internal use. It is not the same as a global unicast address and is generally not publicly routed.

Unicast identifies one interface. Multicast identifies a group of receiving interfaces. Anycast uses the same address on multiple interfaces, with routing delivering traffic to the topologically nearest or otherwise preferred instance.

Reading a Global Unicast Address

IPv6 hexadecimal notation uses eight groups of up to four hexadecimal digits. Leading zeros in a group can be omitted. One consecutive sequence of all-zero groups can be replaced by ::, but this compression can be expanded only once in an address.

Before identifying exact bit boundaries, expand the address. For example:

2001:db8:1234:a::25

expands to:

2001:0db8:1234:000a:0000:0000:0000:0025

For a /64 prefix, the first four hextets are the network prefix and the final four hextets are the interface identifier:

• Network prefix: 2001:0db8:1234:000a::/64
• Interface identifier: 0000:0000:0000:0025

For a /48 allocation, the first three hextets may represent the organizational prefix and the fourth hextet may represent the subnet ID. These labels depend on the assigned prefix length and local addressing plan. Do not assume that every IPv6 address uses the same administrative field boundaries.

Practical SLAAC Example

Suppose a router advertises 2001:db8:1234:10::/64 on a LAN. A host receives the RA, creates a 64-bit interface identifier using its selected address-generation method, and combines the two parts:

2001:db8:1234:10:xxxx:xxxx:xxxx:xxxx

The host also records the advertising router as a possible default gateway. If the host has only a fe80:: address and no global address, the prefix advertisement or host autoconfiguration process may be failing.

Troubleshooting Global Unicast Addressing

Only a Link-Local Address Is Present

• Verify that the router interface has IPv6 enabled and a valid /64 global prefix.
• Verify that router advertisements are being sent and are not suppressed.
• Verify that the host interface is enabled and accepts IPv6 autoconfiguration.
• Check VLAN membership, wireless isolation, switch-port configuration, and other conditions that could block router advertisements.

A Global Address Exists but Remote Networks Are Unreachable

• Confirm that the host has a default route learned from an RA or configured manually.
• Verify that the local router has an IPv6 default route or a route to the remote prefix.
• Verify upstream routing and return routes for the assigned prefix.
• Check IPv6 firewall and access-control policy.

Two Devices Appear to Share an Address

• Check for duplicate static configuration.
• Review Duplicate Address Detection results and interface logs.
• Verify that SLAAC, DHCPv6, and manual assignment are not creating overlapping addresses.

An Address Is Misclassified

• Check the leading prefix. Global unicast addresses are within 2000::/3.
• Recognize FE80::/10 as link-local.
• Recognize FC00::/7 as unique local.
• Do not infer public reachability merely from the address being 128 bits long or configured on an interface.

The Subnet Boundary Is Unclear

• Expand the compressed address by replacing :: with the required number of zero groups.
• Count the bits specified by the prefix length.
• For a /64, use the first four hextets as the network prefix and the final four as the interface identifier.

Exam-Ready Summary

• An IPv6 global unicast address is a globally unique unicast address intended to be routable beyond a local network.
• The currently defined global unicast range is 2000::/3, whose first three bits are binary 001.
• A common LAN design uses a /64: 64-bit network prefix plus 64-bit interface identifier.
• A /48 allocation leaves 16 bits for subnet IDs before creating /64 LANs, resulting in 2^16, or 65,536, possible /64 subnets.
• The interface identifier may be manually assigned, generated with modified EUI-64, or created with stable or temporary privacy mechanisms.
• SLAAC uses router advertisements to provide a prefix and help hosts select a default router. DHCPv6 can provide addresses and/or other configuration options.
• Global unicast routing does not guarantee Internet reachability; routes, return paths, filtering, and firewalls still matter.
• FE80::/10 is link-local, FC00::/7 is unique local, and FF00::/8 is multicast.
• Expand compressed notation before identifying exact bit boundaries.

Continue with IPv6 global unicast addressing as a reference while practicing prefix calculations and address classification.