IPv6 Deployment for Enterprise Networks

Introduction

IPv6 is no longer optional — with IPv4 exhaustion, many internet paths now prefer IPv6, and cloud providers assign IPv6 by default. Enterprise networks lagging on IPv6 face connectivity issues, security blind spots (IPv6 traffic bypassing IPv4-only security controls), and increased complexity. This guide teaches you to deploy IPv6 alongside IPv4 (dual-stack) in enterprise environments.

Understanding IPv6 Address Types

TEXT

IPv6 addresses are 128-bit, written as 8 groups of 4 hex digits:
2001:0db8:85a3:0000:0000:8a2e:0370:7334

Shortened forms:
- Leading zeros omitted: 2001:db8:85a3:0:0:8a2e:370:7334
- :: replaces ONE consecutive group of zeros: 2001:db8:85a3::8a2e:370:7334

Address types:
- Global Unicast (GUA): 2000::/3 — Public internet addresses (like IPv4 public)
- Link-Local:     fe80::/10 — Auto-configured, non-routable, per interface
- Unique Local:   fc00::/7  — Private addresses (like 192.168.x.x in IPv4)
- Multicast:      ff00::/8  — Group addresses (replaces broadcast)

/64 is the standard subnet size for most LANs (allows SLAAC)
/48 is typically assigned to a site by ISP
/32 is typically assigned to a large organization

Planning IPv6 Addressing

TEXT

Example enterprise IPv6 plan with /48 from ISP: 2001:db8:1234::/48

Subnets (/64 each from the /48):
2001:db8:1234:0001::/64  → Main office VLAN 10 (management)
2001:db8:1234:0002::/64  → Main office VLAN 20 (servers)
2001:db8:1234:0003::/64  → Main office VLAN 30 (users)
2001:db8:1234:0010::/64  → Branch office 1
2001:db8:1234:0020::/64  → Branch office 2
2001:db8:1234:ffff::/64  → DMZ

Each /64 has 18 quintillion addresses — never worry about exhaustion

Configuring IPv6 on Linux

BASH

# Check current IPv6 addresses
ip -6 addr show

# Add static IPv6 address
ip -6 addr add 2001:db8:1234:2::10/64 dev eth0
ip -6 route add default via 2001:db8:1234:2::1 dev eth0

# Permanent configuration (Ubuntu/Debian netplan)
# /etc/netplan/00-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      addresses:
        - 192.168.1.10/24
        - 2001:db8:1234:2::10/64
      gateway4: 192.168.1.1
      gateway6: 2001:db8:1234:2::1
      nameservers:
        addresses: [192.168.1.10, 2001:db8:1234:2::10]

# Apply
netplan apply

# Test IPv6 connectivity
ping6 2001:db8:1234:2::1
ping6 google.com  # Tests full IPv6 internet
traceroute6 google.com

Configuring IPv6 on Windows Server

POWERSHELL

# View IPv6 interfaces
Get-NetIPAddress -AddressFamily IPv6

# Add static IPv6 address
New-NetIPAddress `
  -InterfaceAlias "Ethernet" `
  -IPAddress "2001:db8:1234:2::11" `
  -PrefixLength 64 `
  -DefaultGateway "2001:db8:1234:2::1"

# Add IPv6 DNS servers
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" `
  -ServerAddresses ("2001:db8:1234:2::10", "2001:db8:1234:2::11")

# Test
Test-NetConnection -ComputerName "ipv6.google.com" -Port 80

Cisco Router/Switch IPv6 Configuration

TEXT

! Enable IPv6 routing
ipv6 unicast-routing

! Configure interface
interface GigabitEthernet0/0
 ipv6 address 2001:db8:1234:2::1/64
 ipv6 enable
 no shutdown

! Enable Router Advertisement (required for SLAAC)
! RA messages tell hosts the prefix for auto-configuration
interface GigabitEthernet0/0
 ipv6 nd prefix 2001:db8:1234:2::/64 14400 3600

! Static IPv6 route
ipv6 route 2001:db8:1234:3::/64 2001:db8:1234:2::2

! OSPFv3 for IPv6 dynamic routing
ipv6 router ospf 1
 router-id 1.1.1.1

interface GigabitEthernet0/0
 ipv6 ospf 1 area 0

DHCPv6 for Enterprise Addressing

SLAAC (Stateless Address Autoconfiguration) handles addressing automatically, but for DNS and other options use DHCPv6:

TEXT

# Windows Server DHCPv6 scope
Add-DhcpServerv6Scope `
  -Name "Users VLAN" `
  -Prefix "2001:db8:1234:3::" `
  -State Active `
  -PreferredLifetime (New-TimeSpan -Days 8) `
  -ValidLifetime (New-TimeSpan -Days 30)

Set-DhcpServerv6OptionValue `
  -Prefix "2001:db8:1234:3::" `
  -DnsServer "2001:db8:1234:2::10", "2001:db8:1234:2::11" `
  -DomainSearchList "company.local"

IPv6 Security Considerations

BASH

# IPv6 firewall rules (ip6tables on Linux)
# Default policy: drop
ip6tables -P INPUT DROP
ip6tables -P FORWARD DROP
ip6tables -P OUTPUT ACCEPT

# Allow established/related
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow ICMPv6 (required for IPv6 to function!)
ip6tables -A INPUT -p icmpv6 -j ACCEPT

# Allow SSH
ip6tables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow from internal network
ip6tables -A INPUT -s 2001:db8:1234::/48 -j ACCEPT

# Critical: Block router advertisement flooding (RA Guard)
# Configure on switches to prevent rogue RA messages
# Cisco IOS:
# ipv6 nd raguard policy HOST
#   device-role host
# interface range GigabitEthernet0/1-24
#  ipv6 nd raguard attach-policy HOST

Testing IPv6 Connectivity

BASH

# Test from Linux
ping6 -c 4 2001:db8:1234:2::1
traceroute6 2001:4860:4860::8888  # Google DNS IPv6

# From Windows
ping -6 2001:db8:1234:2::1
tracert -6 ipv6.google.com

# Test dual-stack website
curl -6 https://ipv6.google.com
curl -4 https://google.com  # Force IPv4

# Check which address is preferred (dual-stack)
curl https://ip.me   # Should return your IPv6 address

# Online tools
# test-ipv6.com - comprehensive IPv6 connectivity test

IPv6 deployment follows a simple rule: deploy dual-stack (IPv4 and IPv6 simultaneously), never IPv6-only until everything supports it. Start with servers and network equipment, then roll out to end-user devices. Enable IPv6 filtering from day one — don't let IPv6 traffic bypass your security controls.