VMware ESXi and vSphere Cluster Management

IPv6 Unique Local Addresses (ULA): Structure, Uses, and Examples

Learn how IPv6 Unique Local Addresses work, including FC00::/7, FD00::/8, Global ID and subnet structure, routing, comparisons, and configuration examples.

IPv6 Unique Local Addresses (ULAs) are IPv6 addresses intended for private or internal use. They provide stable addressing inside an organization, site, lab, private cloud, or other controlled environment.

ULAs are similar in purpose to IPv4 private address space defined by RFC 1918. However, IPv6 addressing, address selection, and routing behavior differ from IPv4, so a ULA should not be treated as a direct one-for-one replacement for every IPv4 private-addressing design.

Purpose of IPv6 Unique Local Addresses

A ULA gives hosts and networks an internal IPv6 prefix that does not depend on an Internet service provider. Internal applications, management systems, and network devices can continue using the same ULA addresses even when the organization's provider-assigned global IPv6 prefix changes.

Common uses include:

  • Internal services such as DNS, monitoring, directory services, and application servers.
  • Management networks for routers, switches, firewalls, and appliances.
  • Labs, test environments, and isolated private networks.
  • Private WAN or VPN connections between sites.
  • Stable internal addressing alongside changing provider-assigned global unicast prefixes.

Internet Routability and Internal Routing

ULA prefixes are not intended to be advertised or routed on the public Internet. Internet edge devices should prevent ULA source and destination prefixes from crossing external routing boundaries.

This restriction does not mean that ULAs can be used only on one local network. A ULA can be routed across multiple internal subnets and organizational networks. For example, a router can forward traffic between a ULA used on a user LAN and another ULA used on a server LAN.

Organizations may also route ULAs between private sites over private WAN links or VPN tunnels when the sites are under suitable administrative control. The routes should remain within the intended private routing domain.

ULA Prefix Ranges

The complete IPv6 ULA block is FC00::/7. This block is divided into two /8 portions:

  • FC00::/8: Reserved for a centrally assigned model that has not been defined for general use.
  • FD00::/8: The locally assigned range used in practice for organization-generated ULA prefixes.

A locally assigned ULA therefore begins with the hexadecimal prefix FD. A prefix beginning with FC is not the normal choice for an organization creating its own ULA space.

ULA Address Format

An IPv6 address has 128 bits. A typical locally assigned ULA is organized into an 8-bit ULA prefix, a 40-bit Global ID, a 16-bit Subnet ID, and a 64-bit Interface ID.

| 8 bits |       40 bits       | 16 bits |          64 bits          |
|  FD    |     Global ID      | Subnet  |       Interface ID        |
| prefix |                    |   ID    |                           |

ULA Address Field Layout

Field          Bit length   Purpose                                      Example value
ULA prefix     8            Identifies locally assigned ULA space         FD
Global ID      40           Random value that reduces prefix collisions  12:3456:789A
Subnet ID      16           Identifies an internal /64 subnet             0001
Interface ID   64           Identifies an interface on that /64           ::10

ULA Prefix

The first 8 bits are the locally assigned ULA prefix, represented by FD00::/8. Every locally generated ULA /48 should begin with FD.

Global ID

The Global ID is a 40-bit value. It should be generated randomly rather than selected as an obvious company number or copied from an example. Random generation reduces the chance that two independently administered private networks will use the same prefix when they later merge or connect.

The word “Global” in Global ID describes the field's position in the ULA format; it does not make the resulting address globally routable.

Subnet ID

The Subnet ID is 16 bits long. It lets an organization create many internal /64 networks beneath one ULA /48 allocation. For example, subnet ID 1 and subnet ID 2 can identify two different LANs.

Interface ID

The Interface ID is the lower 64-bit host portion of a typical IPv6 unicast address. It can be formed using normal IPv6 interface-ID methods, such as manually assigned values, stable address methods, or privacy-oriented temporary addresses where appropriate.

Creating a ULA /48 Prefix

A /48 is commonly used as the organization-level ULA prefix because it provides a clear boundary between the organization prefix and the 16-bit subnet field. It also supports a large number of internal /64 subnets while preserving the conventional IPv6 subnet size.

Start with FD00::/8 and add a randomly generated 40-bit Global ID. For illustration, use the Global ID 12:3456:789A:

ULA prefix: FD00::/8
Global ID:  12:3456:789A
Result:     FD12:3456:789A::/48

The resulting organization prefix is FD12:3456:789A::/48. The value is an instructional example; an actual organization should generate its own Global ID.

Creating Internal /64 Networks

Change the 16-bit Subnet ID to create individual internal /64 prefixes:

Organization ULA /48: FD12:3456:789A::/48
User LAN:              FD12:3456:789A:1::/64
Server LAN:            FD12:3456:789A:2::/64
Management LAN:        FD12:3456:789A:3::/64

An interface address on the user LAN could be FD12:3456:789A:1::10. The router interface for that LAN might use FD12:3456:789A:1::1.

ULA Configuration and Internal Routing Example

The following Cisco IOS-style commands are illustrative. Use a randomly generated organization-specific Global ID rather than copying this example into production.

interface GigabitEthernet0/0
 ipv6 address FD12:3456:789A:1::1/64

ipv6 route FD12:3456:789A:2::/64 FD12:3456:789A:1::2

The static route demonstrates that a ULA prefix can be routed internally. It is not a public Internet route.

Basic verification commands include:

show ipv6 interface brief
show ipv6 route
ping ipv6 FD12:3456:789A:2::10

Use the output to confirm interface addresses, /64 prefixes, routes, and reachability between internal subnets.

Comparing IPv6 Address Types

Address type       Typical prefix   Scope                         Public Internet routability   Typical use
Unique local       FC00::/7         Organization and private WAN  Not intended                   Internal services and networks
Global unicast     Provider-assigned Global IPv6 routing domain   Routable when advertised      Internet-connected communication
Link-local         FE80::/10        One Layer 2 link               No                            Neighbor discovery and next-hop communication
Deprecated site-local FEC0::/10     Historical site boundary      Deprecated                     Do not use for new designs

ULA Versus Global Unicast

A global unicast address is designed for global Internet routing. When a valid prefix is assigned, advertised, and permitted by routing policy, it can support Internet communication.

A ULA is intended for private routing. An internal server may have both a ULA and a global unicast address: internal systems can use the stable ULA, while external or Internet-connected services use the global address.

ULA Versus Link-Local

A link-local address generally comes from FE80::/10 and is valid only on the local Layer 2 link. Routers do not forward link-local traffic between subnets.

ULAs can communicate across routed internal networks, so a ULA is appropriate when a host must reach another subnet. Link-local addresses remain important for IPv6 neighbor discovery and router communication, but they are not a substitute for routable internal addressing.

A host can use ULA, global unicast, and link-local addresses simultaneously. IPv6 address selection and application policy determine which address is used for a particular connection.

Deprecated IPv6 Site-Local Addresses

IPv6 historically defined site-local addresses in the range FEC0::/10. Site-local addressing was deprecated because the meaning of a “site” and the boundary of site-local routing were ambiguous. Different networks could make incompatible decisions about where those addresses were valid.

ULAs replaced site-local addressing for private IPv6 use. Their randomly generated Global ID makes independently administered networks less likely to collide, while their private routing intent is clearer.

Operational Design Considerations

  • Generate the 40-bit Global ID randomly.
  • Use a /48 ULA prefix for the organization or private routing domain in common designs.
  • Use /64 prefixes for LANs and other standard IPv6 subnets.
  • Document the ULA /48, subnet assignments, DNS records, and routing boundaries.
  • Route ULA prefixes across internal routers only when the connected networks are under appropriate administrative control.
  • Do not use ULA alone when public Internet connectivity or public reachability is required.
  • Filter ULA source and destination prefixes at Internet boundaries to prevent unintended external forwarding.
  • Consider using ULA alongside global unicast addressing so internal reachability survives a provider-prefix change.

Troubleshooting ULA Connectivity

A ULA Host Cannot Reach Another Internal Subnet

Likely causes include a missing IPv6 route, disabled IPv6 forwarding on an intermediate router, an ACL or firewall blocking IPv6 traffic, or an incorrect prefix length or next-hop address.

Check the following:

  1. Verify interface IPv6 addresses and /64 prefixes.
  2. Inspect the IPv6 routing table on each relevant router.
  3. Test the next-hop address before testing the remote host.
  4. Check firewall and ACL rules for IPv6 traffic.

A ULA Prefix Is Sent Toward an Internet Connection

This may result from route leaking from an internal routing domain or missing edge prefix filters.

  • Review default routes and advertised IPv6 routes.
  • Apply suitable inbound and outbound filtering at the Internet edge.
  • Confirm that ULA routes remain inside the intended private routing domains.

Two Connected Private Networks Have the Same ULA Prefix

This usually means that a Global ID was manually chosen, duplicated, or copied from an example. Compare the /48 prefixes on both networks. Renumber one side with a newly generated 40-bit Global ID, then update routing, DNS, security policies, and host configuration.

Exam-Relevant Notes

  • FC00::/7 is the complete ULA block.
  • FD00::/8 is the locally assigned range used in practice.
  • A ULA commonly consists of an 8-bit prefix, 40-bit Global ID, 16-bit Subnet ID, and 64-bit Interface ID.
  • ULAs are private and not intended for public Internet routing, but they can be routed across internal subnets.
  • FE80::/10 identifies link-local addressing, which is limited to one Layer 2 link.
  • FEC0::/10 is the deprecated site-local range.
  • A host may have ULA, global unicast, and link-local addresses at the same time.

Summary

IPv6 ULAs provide stable private addressing for internal networks. Locally assigned ULAs use the FD00::/8 range within the broader FC00::/7 block. A randomly generated 40-bit Global ID creates an organization-level /48, the 16-bit Subnet ID creates internal /64 networks, and the lower 64-bit Interface ID identifies interfaces.

Unlike link-local addresses, ULAs can cross routed internal networks. Unlike global unicast addresses, they are not intended for public Internet routing. A well-designed IPv6 network can use all three address types together, with edge filtering keeping private ULA traffic inside its intended routing domain.

For related study, see IPv6 Unique Local Address.