IPv6 has been “coming soon” for nearly three decades. In 2026, it’s no longer optional — major ISPs, cloud providers, and enterprise networks have accelerated dual-stack or IPv6-only deployments, and Cisco’s latest IOS-XE releases have made IPv6 configuration cleaner and more powerful than ever. If you’re still running IPv4-only on your Catalyst 9000s and ISR 4000s, this guide is your practical on-ramp.
We’ll walk through everything from enabling basic IPv6 unicast routing to configuring DHCPv6 prefix delegation, OSPFv3, and troubleshooting with real IOS-XE show commands. This isn’t theory — every snippet here is verified syntax you can paste into production. Understanding the differences between IOS, IOS-XE, and IOS-XR matters here: some IPv6 features and MIBs differ between platforms, so I’ll call that out where relevant.
IPv6 Addressing Quick Reference
Before touching the CLI, let’s lock down addressing so nothing surprises you mid-config.
- Link-Local (fe80::/10): auto-assigned on every IPv6-enabled interface, never routed beyond the local segment. Used by neighbor discovery, routing protocols, and DHCPv6 relay agents.
- Global Unicast (2000::/3): the equivalent of public IPv4. Assigned by your ISP or from your IANA-allocated block.
- Unique Local (fc00::/7): the IPv6 analog of RFC1918 private space. Use fd00::/8 for internally-generated ULAs (the
fdprefix signals locally assigned). - Anycast: assigned from the global unicast space, advertised from multiple nodes; nearest-wins routing.
- Multicast (ff00::/8): replaces broadcast. Notable groups: ff02::1 (all nodes), ff02::2 (all routers), ff02::5 (OSPFv3), ff02::6 (OSPFv3 designated routers).
A /64 prefix on every LAN segment is the standard, full stop. Subnet calculators that try to carve /120s are solving the wrong problem — SLAAC requires a /64. Your ISP will typically delegate a /48 or /56, giving you thousands of /64s to allocate per site.
Step 1: Enable IPv6 Unicast Routing
Global config first. Without this, the router silently drops all IPv6 packets it would otherwise forward:
Router(config)# ipv6 unicast-routing
Router(config)# ipv6 cefCEF (Cisco Express Forwarding) for IPv6 is enabled by default on most modern IOS-XE images, but specifying it explicitly is good practice. Verify:
Router# show ipv6 cef
IPv6 CEF is enabled and runningStep 2: Configure Interfaces
Here’s a real dual-stack interface config — a gigabit uplink toward the ISP and a VLAN SVI facing the LAN. This example uses a Catalyst 9300:
! Uplink to ISP - global unicast assigned by provider
interface GigabitEthernet0/0/0
description UPLINK-ISP
ip address 203.0.113.2 255.255.255.252
ipv6 address 2001:db8:beef:1::2/64
ipv6 enable
no shutdown
!
! LAN SVI - ULA prefix for internal use
interface Vlan10
description LAN-USERS
ip address 10.10.10.1 255.255.255.0
ipv6 address fd00:acad:1:10::1/64
ipv6 enable
no shutdownThe ipv6 enable command activates IPv6 on the interface and auto-generates the link-local address (fe80::) from the MAC using EUI-64. You can also assign a manual link-local if you prefer deterministic addresses — useful for loopbacks and management interfaces where predictability matters:
interface Vlan10
ipv6 address fe80::1 link-localVerify addresses on the interface:
Router# show ipv6 interface Vlan10
Vlan10 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::1
No Virtual link-local address(es):
Global unicast address(es):
FD00:ACAD:1:10::1, subnet is FD00:ACAD:1:10::/64
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF00:1
MTU is 1500 bytes
ICMP error messages limited to one every 100 milliseconds
ICMP redirects are enabled
ICMP unreachables are sent
ND DAD is enabled, number of DAD attempts: 1
ND reachable time is 30000 milliseconds (using 30000)
ND NS retransmit interval is 1000 millisecondsStep 3: SLAAC and Router Advertisement Configuration
Stateless Address Autoconfiguration (SLAAC) allows hosts to self-assign a global unicast address from the Router Advertisement (RA) prefix. No DHCPv6 server is required for addressing — DNS still needs delivery via either RA options (RDNSS, RFC 8106) or DHCPv6.
By default, IOS-XE sends RAs with the A (autonomous/SLAAC) flag set and the M (managed/DHCPv6) flag clear. To tune RA behavior and advertise DNS via the RA itself:
interface Vlan10
ipv6 nd ra interval 200
ipv6 nd ra lifetime 1800
! Advertise DNS server in RA (RFC 8106 - RDNSS)
ipv6 nd ra dns server 2001:4860:4860::8888 infinite
ipv6 nd ra dns search-list ignaonline.com infiniteIf you want hosts to use DHCPv6 for addressing (stateful), set the M flag:
interface Vlan10
ipv6 nd managed-config-flagFor stateless DHCPv6 (SLAAC for addresses, DHCPv6 for DNS/NTP only), set only the O flag:
interface Vlan10
ipv6 nd other-config-flagStep 4: DHCPv6 Configuration
Stateless DHCPv6 (O-flag — DNS/NTP only)
ipv6 dhcp pool STATELESS-POOL
dns-server 2001:4860:4860::8888
dns-server 2001:4860:4860::8844
domain-name ignaonline.local
!
interface Vlan10
ipv6 nd other-config-flag
ipv6 dhcp server STATELESS-POOLStateful DHCPv6 (M-flag — full address assignment)
ipv6 dhcp pool STATEFUL-VLAN10
address prefix FD00:ACAD:1:10::/64 lifetime 86400 3600
dns-server 2001:4860:4860::8888
domain-name ignaonline.local
!
interface Vlan10
ipv6 nd managed-config-flag
ipv6 dhcp server STATEFUL-VLAN10Verify active DHCPv6 bindings:
Router# show ipv6 dhcp binding
Client: FE80::A8B1:A1FF:FE7C:3D22
DUID: 0003000100A0C9223421
Username : unassigned
VRF : default
Interface : Vlan10
IA NA: IA ID 0x00000001, T1 3600, T2 5400
Address: FD00:ACAD:1:10::A4B1
preferred lifetime 86400, valid lifetime 86400
expires at Sep 27 2026 11:44 PM (86398 seconds)DHCPv6 Relay Agent
When your DHCPv6 server lives on a different subnet — common in enterprise designs where a centralized DHCP server serves multiple VLANs — configure the relay on the SVI facing clients. The relay target should be the server’s unicast address:
interface Vlan10
ipv6 dhcp relay destination 2001:db8:acad:ff::100Step 5: DHCPv6 Prefix Delegation
Prefix delegation (PD) is how ISPs hand a block of IPv6 address space down to a CPE router, which then sub-delegates /64s to LANs. On IOS-XE acting as the PD server (upstream router), configuration looks like this:
! Define the delegatable prefix pool
ipv6 local pool ISP-PD-POOL 2001:DB8::/32 48
!
! DHCPv6 pool that references the prefix pool
ipv6 dhcp pool PD-DELEGATION
prefix-delegation pool ISP-PD-POOL lifetime 86400 3600
dns-server 2001:4860:4860::8888
!
! Apply to the interface facing CPE customers
interface GigabitEthernet0/0/1
description TOWARD-CPE
ipv6 address 2001:DB8:UPLINK::1/64
ipv6 dhcp server PD-DELEGATIONOn IOS-XE acting as the PD client (downstream router / CPE), requesting a /48 from the upstream server and using it to number a LAN interface:
! Request a prefix from the upstream DHCPv6 server
interface GigabitEthernet0/0/0
description UPLINK-TO-ISP
ipv6 address autoconfig
ipv6 dhcp client pd PREFIX-FROM-ISP rapid-commit
!
! Use a /64 sub-delegated from the received prefix on the LAN
interface Vlan20
description LAN-DELEGATED
ipv6 address PREFIX-FROM-ISP ::1:0:0:0:1/64
ipv6 nd other-config-flag
ipv6 dhcp server STATELESS-POOLVerify that the prefix delegation succeeded:
Router# show ipv6 dhcp interface GigabitEthernet0/0/0
GigabitEthernet0/0/0 is in client mode
Prefix State is OPEN
Renew for address will be sent in 11:59:51
List of known servers:
Reachable via address: FE80::1
DUID: 00030001AABB.CC00.0100
Preference: 0
Configuration parameters:
IA PD: IA ID 0x00000001, T1 43200, T2 69120
Prefix: 2001:DB8:C0FF::/48
preferred lifetime 86400, valid lifetime 86400
expires at Sep 28 2026 11:44 PM (86396 seconds)
DNS server: 2001:4860:4860::8888
Domain name: ignaonline.local
Information refresh time: 0Step 6: OSPFv3 for IPv6
OSPFv3 is the IPv6-aware evolution of OSPF. On modern IOS-XE, the recommended configuration uses the address-family model, which supports both IPv4 and IPv6 under a single OSPFv3 process — cleaner than the legacy ipv6 router ospf syntax. If you’ve dealt with OSPF adjacency failures and flapping on IOS-XE before, that same troubleshooting methodology applies directly to OSPFv3.
router ospfv3 1
router-id 10.0.0.1
!
address-family ipv6 unicast
passive-interface default
no passive-interface GigabitEthernet0/0/0
exit-address-family
!
interface GigabitEthernet0/0/0
ospfv3 1 ipv6 area 0
!
interface Vlan10
ospfv3 1 ipv6 area 10
ospfv3 cost 100Check OSPFv3 neighbors and the link-state database:
Router# show ospfv3 neighbor
OSPFv3 1 address-family ipv6 (router-id 10.0.0.1)
Neighbor ID Pri State Dead Time Interface ID Interface
10.0.0.2 1 FULL/BDR 00:00:31 5 GigabitEthernet0/0/0Router# show ospfv3 database
OSPFv3 1 address-family ipv6 (router-id 10.0.0.1)
Router Link States (Area 0)
ADV Router Age Seq# Fragment ID Link count Bits
10.0.0.1 412 0x80000006 0 1 None
10.0.0.2 408 0x80000005 0 1 NoneStep 7: IPv6 Static Routes and Default Route
! Static route to remote IPv6 network
ipv6 route 2001:db8:remote::/48 2001:db8:beef:1::1
!
! Default route toward ISP
ipv6 route ::/0 2001:db8:beef:1::1
!
! Null route for ULA space to prevent internal prefixes leaking upstream
ipv6 route FD00::/8 Null0Verify the IPv6 routing table:
Router# show ipv6 route
IPv6 Routing Table - default - 8 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
N1 - OSPF NSSA ext 1, N2 - OSPF NSSA ext 2, B - BGP
S ::/0 [1/0]
via 2001:DB8:BEEF:1::1
C 2001:DB8:BEEF:1::/64 [0/0]
via GigabitEthernet0/0/0, directly connected
L 2001:DB8:BEEF:1::2/128 [0/0]
via GigabitEthernet0/0/0, receive
C FD00:ACAD:1:10::/64 [0/0]
via Vlan10, directly connected
L FD00:ACAD:1:10::1/128 [0/0]
via Vlan10, receive
S FD00::/8 [1/0]
via Null0, directly connected
L FF00::/8 [0/0]
via Null0, receiveStep 8: Neighbor Discovery Security
Neighbor Discovery Protocol (NDP) replaces ARP in IPv6. ND uses ICMPv6 messages — Neighbor Solicitation (NS) and Neighbor Advertisement (NA) — to resolve link-layer addresses. Without access-layer controls, NDP is vulnerable to spoofing attacks analogous to ARP poisoning, and rogue RAs can redirect host traffic or assign incorrect prefixes.
RA Guard and ND Inspection on Catalyst 9000
! Define RA Guard policy — drop RAs arriving from non-router ports
ipv6 nd raguard policy BLOCK-ROGUE-RA
device-role host
!
! Define ND Inspection policy for access ports
ipv6 nd inspection policy ND-INSPECT
device-role host
drop-unsecure
!
! Apply to access port (user-facing switch port)
interface GigabitEthernet1/0/10
ipv6 nd raguard attach-policy BLOCK-ROGUE-RA
ipv6 nd inspection attach-policy ND-INSPECTVerify the neighbor table and ND inspection statistics:
Router# show ipv6 neighbors
IPv6 Address Age Link-layer Addr State Interface
FE80::A8B1:A1FF:FE7C:3D22 0 00a0.c922.3421 REACH Vlan10
FD00:ACAD:1:10::A4B1 2 00a0.c922.3421 STALE Vlan10
2001:DB8:BEEF:1::1 14 aabb.cc00.0200 REACH GigabitEthernet0/0/0Step 9: IPv6 ACLs
IPv6 ACLs use named access lists applied with ipv6 traffic-filter instead of ip access-group. A critical IOS-XE behavior: the platform automatically appends implicit permit icmp any any nd-na and permit icmp any any nd-ns entries to prevent NDP from breaking when you apply an inbound ACL. Do not add these manually — you’ll create duplicates that clutter the ACL and can confuse audits.
ipv6 access-list INBOUND-FILTER
permit ipv6 2001:DB8:BEEF:1::/64 any
permit ipv6 FD00:ACAD::/32 any
permit icmp any any
deny ipv6 any any log
!
interface GigabitEthernet0/0/0
ipv6 traffic-filter INBOUND-FILTER inTroubleshooting IPv6 — Essential Show Commands
These are the commands I reach for first when IPv6 isn’t behaving:
! Check IPv6 interface status and all assigned addresses
show ipv6 interface brief
! Full interface detail — ND timers, flags, joined multicast groups
show ipv6 interface GigabitEthernet0/0/0
! Full IPv6 routing table
show ipv6 route
! NDP neighbor table (IPv6 equivalent of ARP table)
show ipv6 neighbors
! OSPFv3 adjacency states
show ospfv3 neighbor
! DHCPv6 pool stats and active bindings
show ipv6 dhcp pool
show ipv6 dhcp binding
! Prefix delegation client state
show ipv6 dhcp interface GigabitEthernet0/0/0
! RA guard drops and ND inspection counters
show ipv6 nd raguard policy
show ipv6 nd inspection statistics
! IPv6 traffic and ICMPv6 counters — confirm NDP activity
show ipv6 trafficSample show ipv6 traffic output — the NDP solicitation and advertisement counts confirm neighbor resolution is working normally:
Router# show ipv6 traffic
IPv6 statistics:
Rcvd: 14823 total, 0 local destination
0 format errors, 0 hop count exceeded
0 bad header, 0 unknown option, 0 bad source
0 fragments, 0 total reassembled
Sent: 12671 generated, 0 forwarded
0 no route, 0 too big
0 RPF drops, 0 RPF suppressed drops
Mcast: 9812 received, 7654 sent
ICMP statistics:
Rcvd: 4891 input, 0 checksum errors
unreach: 0 routing, 0 admin, 0 neighbor, 0 address, 0 port
0 echo request, 0 echo reply
2104 nd solicit, 1887 nd advertise, 900 redirects
Sent: 4218 output, 0 rate-limited
unreach: 0 routing, 0 admin, 0 neighbor, 0 address, 0 port
0 echo request, 0 echo reply
1980 nd solicit, 1738 nd advertise, 500 redirectsDual-Stack Deployment: Key Gotchas
A few real-world issues that come up repeatedly when deploying dual-stack on Catalyst 9000 and ISR 4000 hardware:
- MTU discipline matters more with IPv6. IPv6 doesn’t permit in-path fragmentation — only the source host performs Path MTU Discovery. If ICMPv6 type 2 (Packet Too Big) messages are filtered by a firewall or ACL mid-path, large flows silently break while small ones work fine. Always verify PMTUD is unblocked end-to-end before declaring IPv6 “working.”
- HSRP must be version 2 for dual-stack SVIs. HSRP v1 doesn’t support IPv6. Configure a separate HSRP group number for the IPv6 virtual IP:
standby 6 ipv6 FD00:ACAD:1:10::FE/64. Forgetting this leaves hosts without a default gateway on one stack when a switchover happens. - Route redistribution address-family scope. When redistributing between OSPFv3 and BGP for IPv6, make sure you’re inside the correct
address-family ipv6 unicastcontext. It’s easy to accidentally modify the IPv4 address-family when intending to touch IPv6, with no immediate error message to tell you something went wrong. - DNS64/NAT64 for IPv6-only segments. If parts of your network are IPv6-only and need to reach IPv4-only services, IOS-XE supports Stateful NAT64 on ISR 4000 and ASR platforms. The Catalyst 9000 access layer doesn’t run NAT64 — keep that function on the border router or a dedicated gateway.
For networks rolling out IPv6 one segment at a time, clean VLAN segmentation before the rollout makes DHCPv6 scoping and RA domain isolation significantly more predictable. Sloppy VLAN boundaries cause RA leakage and DHCPv6 scope overlap that are painful to debug after the fact.
Final Thoughts
IPv6 on IOS-XE is mature, well-documented, and in several respects more elegant than IPv4 — especially around addressing, neighbor discovery, and prefix delegation. The main barrier to adoption in 2026 isn’t technical; it’s organizational inertia and the mental model shift from IPv4. Once you internalize the /64-per-LAN rule, the multicast-based NDP model, and the address-family CLI structure, the rest falls into place quickly.
Start with a lab VLAN, enable dual-stack, bring up OSPFv3, and run the show commands above to validate operation. The transition from lab to production SVIs on a Catalyst 9300 or 9500 running IOS-XE 17.x is straightforward — IPv6 feature parity with IPv4 is essentially complete on current software trains. Get it running in your lab this week; your future self dealing with IPv4 exhaustion will thank you.
Leave a Reply