Ping Labz

IPv6 Configuration on Cisco IOS XE

IPv6 configuration on Cisco IOS XE: enabling IPv6, static and SLAAC addresses, RA options, OSPFv3, BGP for IPv6, EIGRP for IPv6, VRRPv3, dual-stack, and first-hop security.

Configuring IPv6 on Cisco IOS XE is mostly about turning things on. The protocol is built into modern Cisco code; you enable IPv6 routing globally, assign addresses to interfaces, and Neighbor Discovery + SLAAC handle most of the host-side work automatically. The configurations look familiar to anyone who has done IPv4 on Cisco - the syntax is parallel, just with ipv6 instead of ip.

This article walks through the configuration patterns: enabling IPv6, assigning static and SLAAC addresses, Router Advertisement options, IPv6 routing protocols, and the verification commands. If you are configuring IPv6 for the first time or auditing an existing deployment, this is the operator's walkthrough.

Enabling IPv6 Globally

By default, Cisco IOS XE has IPv6 disabled at the routing layer. Enable it:

Router(config)# ipv6 unicast-routing

That single command turns the router into an IPv6 router - it will forward IPv6 traffic between interfaces. Without it, the router can have IPv6 addresses on its interfaces but won't route between them.

For multicast forwarding (used by some applications):

Router(config)# ipv6 multicast-routing

Per-Interface Configuration

Static Address

interface GigabitEthernet0/0/0
 ipv6 address 2001:db8:1::1/64
 ipv6 enable                       ! Enable link-local even without global config (often automatic)

The static form is the most explicit. ipv6 enable is sometimes redundant when you have a global address (the link-local is created automatically when the interface comes up with any IPv6 config) but is good practice for clarity.

EUI-64 Auto-derived Interface ID

interface GigabitEthernet0/0/0
 ipv6 address 2001:db8:1::/64 eui-64

This makes the router derive its interface ID from its MAC address using Modified EUI-64. The result is something like 2001:db8:1:0:21a:2bff:fe3c:4d5e. Useful for routers in dynamic environments; less common than static addresses for production.

SLAAC (host-style autoconfiguration)

interface GigabitEthernet0/0/0
 ipv6 address autoconfig

Less common on routers (which usually have static addresses) but useful for simulating a host. The router waits for a Router Advertisement from another router on the segment and configures its address based on the received prefix.

interface GigabitEthernet0/0/1
 ipv6 enable

The interface gets a link-local FE80:: address (auto-derived) but no global address. Useful for point-to-point links where the IGP runs over link-locals only - the global address space is preserved.

Router Advertisement Options

By default, IPv6-enabled router interfaces send Router Advertisements (RAs) every 200 seconds (with random jitter). Hosts on the segment use these RAs to learn the prefix, default gateway, and DNS info.

Tune RA timers:

interface GigabitEthernet0/0/0
 ipv6 nd ra interval 200 60        ! Max 200s, min 60s between RAs
 ipv6 nd ra lifetime 1800           ! Default router lifetime in RA

Suppress RAs (for interfaces where they should not be sent, e.g. point-to-point links between routers):

interface GigabitEthernet0/0/0
 ipv6 nd ra suppress all

Tell hosts to use DHCPv6 for addresses (M flag) or other config like DNS (O flag):

ipv6 nd managed-config-flag         ! M flag: hosts should use DHCPv6 for address
ipv6 nd other-config-flag           ! O flag: hosts should use DHCPv6 for other info (DNS, etc.)

Send DNS server info in RAs (RDNSS option, RFC 6106):

interface GigabitEthernet0/0/0
 ipv6 nd ra dns server 2001:4860:4860::8888 1800

This eliminates the need for DHCPv6 just for DNS - the RA carries it. Modern hosts (Windows 10+, Linux, macOS) all support RDNSS.

Static Routes

! Default route via next-hop
ipv6 route ::/0 2001:db8:1::1

! Specific prefix
ipv6 route 2001:db8:2::/48 2001:db8:1::2

! Floating static (higher AD = backup)
ipv6 route ::/0 2001:db8:1::3 200

The syntax mirrors IPv4 static routes (ip route becomes ipv6 route) but uses IPv6 addresses and prefix lengths.

OSPFv3 for IPv6

OSPFv3 is the IPv6-capable version of OSPF. Modern code supports an "address-family" mode that runs both IPv4 and IPv6 in one process; older code uses separate processes per AF.

Modern OSPFv3 (address-family):

router ospfv3 1
 router-id 1.1.1.1
 address-family ipv6 unicast
  passive-interface default
  no passive-interface GigabitEthernet0/0/0
 exit-address-family

interface GigabitEthernet0/0/0
 ipv6 address 2001:db8:1::1/64
 ospfv3 1 ipv6 area 0

Three things to notice. First, router ospfv3 (not router ospf) - separate command. Second, OSPFv3 router-id is still 32 bits (configured as a dotted-decimal IPv4-style number); it does not have to match an actual IPv4 address. Third, the ospfv3 1 ipv6 area 0 on the interface activates OSPFv3 for the IPv6 address-family.

Verify with show ipv6 ospf neighbor.

BGP for IPv6

router bgp 65001
 bgp router-id 1.1.1.1
 no bgp default ipv4-unicast
 neighbor 2001:db8:12::2 remote-as 65002

 address-family ipv6 unicast
  neighbor 2001:db8:12::2 activate
  network 2001:db8:1::/48
 exit-address-family

BGP for IPv6 uses the same router bgp process as IPv4. The address-family ipv6 unicast block configures IPv6-specific behavior. Update sources and route maps work the same way as IPv4.

For full BGP coverage including MP-BGP, see the BGP cluster pillar and MP-BGP article.

EIGRP for IPv6

Named-mode EIGRP supports IPv6 cleanly:

router eigrp PROD
 address-family ipv6 unicast autonomous-system 100
  af-interface default
   passive-interface
  af-interface GigabitEthernet0/0/0
   no passive-interface
  topology base
   eigrp router-id 1.1.1.1
  exit-af-topology
 exit-address-family

EIGRP for IPv6 uses link-local addresses for adjacency formation (like OSPFv3). The router-id is still 32 bits. Otherwise it works exactly like IPv4 EIGRP. See the EIGRP cluster pillar.

VRRPv3 for IPv6

fhrp version vrrp v3

interface GigabitEthernet0/0/1
 ipv6 address 2001:db8:1::2/64
 vrrp 1 address-family ipv6
  address FE80::1 primary       ! Link-local virtual address
  address 2001:db8:1::1
  priority 110
  preempt

VRRPv3 for IPv6 uses a link-local address as the virtual gateway (hosts learn it via Router Advertisement). The configuration mirrors IPv4 VRRPv3 with an additional ipv6 address-family block. See the VRRP article.

Dual-Stack Configuration

Most production deployments run IPv4 and IPv6 simultaneously on the same interfaces:

interface GigabitEthernet0/0/0
 description WAN
 ip address 192.168.1.1 255.255.255.0
 ipv6 address 2001:db8:1::1/64

router ospf 1
 network 192.168.1.0 0.0.0.255 area 0

router ospfv3 1
 address-family ipv6 unicast
 exit-address-family

interface GigabitEthernet0/0/0
 ip ospf 1 area 0
 ospfv3 1 ipv6 area 0

Both protocols run independently on the same interface. Each has its own routing table; show ip route and show ipv6 route are separate.

Security Configurations

IPv6 ACLs:

ipv6 access-list ALLOW-MGMT
 permit tcp 2001:db8:0:1::/64 any eq 22
 permit ipv6 any any log

interface GigabitEthernet0/0/0
 ipv6 traffic-filter ALLOW-MGMT in

IPv6 first-hop security (DHCPv6 Guard, RA Guard, ND Inspection):

! Drop rogue RAs from non-router interfaces
interface GigabitEthernet1/0/3
 ipv6 nd raguard

! Inspect ND messages
ipv6 nd inspection

! DHCPv6 Guard
ipv6 dhcp guard policy CLIENT
 device-role client
interface GigabitEthernet1/0/3
 ipv6 dhcp guard attach-policy CLIENT

These are the IPv6 equivalents of DHCP snooping, Dynamic ARP Inspection, and IP Source Guard for IPv4.

Verification

! IPv6 routing table
Router# show ipv6 route

! IPv6 interface details
Router# show ipv6 interface
Router# show ipv6 interface brief

! Neighbor table (ARP equivalent)
Router# show ipv6 neighbors

! Routing protocol state
Router# show ipv6 ospf neighbor
Router# show bgp ipv6 unicast summary
Router# show eigrp address-family ipv6 neighbors

! Connectivity
Router# ping ipv6 2001:db8:1::1
Router# traceroute ipv6 2001:db8:1::1

Anti-Patterns

  • Forgetting ipv6 unicast-routing. The router has IPv6 addresses but does not forward; baffled operators see traffic die at the router.
  • Not suppressing RAs on point-to-point router-to-router links. RAs leak between routers and create confusing output.
  • Disabling IPv6 on host stacks. Microsoft and Apple specifically advise against this; modern apps depend on IPv6.
  • Using documentation prefix 2001:db8::/32 in production. Routable but reserved for examples; will never reach the actual internet correctly.
  • Forgetting first-hop security. Rogue RAs and DHCPv6 servers are real threats; deploy RA Guard and DHCPv6 Guard.

Summary

Cisco IOS XE IPv6 configuration is parallel to IPv4 with a few specific commands. Enable IPv6 globally (ipv6 unicast-routing), assign addresses on interfaces, configure Router Advertisements with the appropriate options, and run routing protocols in their IPv6 forms (OSPFv3, BGP for IPv6, EIGRP for IPv6, VRRPv3). Dual-stack is the dominant deployment model.

The configuration is straightforward; the operational habits are different and need practice. Bookmark this article alongside the IPv6 cluster pillar, the address format article, and the address types article.

Share Share Share Share Share Email

Read next

© 2025 Ping Labz. All rights reserved.