How to Configure IPv6 Addressing on Cisco (Step by Step)
Configuring IPv6 on a Cisco router is only a handful of interface commands, but the mental model behind them is what separates a working design from one that silently refuses to route. Unlike IPv4, an IPv6-enabled interface carries at least two addresses at once — an automatic link-local address for on-link operations and one or more global unicast addresses for end-to-end reachability — and forwarding between networks hinges on a single global command that is easy to leave out. This guide walks through enabling IPv6 forwarding, assigning global addresses both statically and with EUI-64, understanding and overriding the link-local address, and verifying the result, then closes with the mistakes that cost CCNA and CCNP candidates the most points.
Part of the Subnetting & IP Addressing learning hub
Step 1 — Enable IPv6 routing globally
By default, a Cisco router will accept IPv6 addresses on its interfaces but will not forward IPv6 packets between them. It behaves like an IPv6 host, not a router. The global command `ipv6 unicast-routing` flips that behavior: it enables forwarding of IPv6 unicast traffic and lets the router send Router Advertisements on its interfaces.
Do this once, in global configuration mode, before you worry about interfaces. Leaving it out is the single most common reason a fully addressed lab still fails to route — every interface pings its own subnet, but traffic never crosses the router. A useful side effect you can verify later: with routing enabled, each IPv6 interface joins the all-routers multicast group FF02::2.
Step 2 — Assign a static global unicast address (GUA)
A global unicast address is the routable, internet-scope address of the interface — the IPv6 equivalent of a public/private IPv4 address on a link. You configure it in interface mode with the address and prefix length together on one line. Use a /64 prefix on LAN segments; /64 is the standard subnet size and is required for EUI-64 and SLAAC to work.
The examples here use the 2001:db8::/32 range, which RFC 3849 reserves specifically for documentation, so it is safe to publish and will never collide with a real allocation. Substitute your own assigned prefix in production. Remember that router interfaces are administratively down by default, so finish with `no shutdown` or the address is configured but inactive.
R1# configure terminal
R1(config)# ipv6 unicast-routing
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:db8:acad:10::1/64
R1(config-if)# no shutdown
R1(config-if)# endStep 3 — Let IOS build the host bits with EUI-64
Instead of typing the full address, you can give IOS just the /64 prefix and the `eui-64` keyword, and it derives the 64-bit interface ID from the interface's MAC address. This guarantees a unique host portion per interface without manual bookkeeping.
The derivation follows three steps. Take the 48-bit MAC, split it into two 24-bit halves, and insert the fixed value FFFE in the middle to pad it to 64 bits. Then flip the seventh bit of the first octet — the Universal/Local (U/L) bit. For a MAC of 0090.2B12.3456, inserting FFFE gives 0090:2BFF:FE12:3456, and flipping the U/L bit changes the first octet 00 (0000 0000) to 02 (0000 0010). The resulting interface ID is 0290:2BFF:FE12:3456, so with the prefix above the interface takes 2001:db8:acad:20:290:2bff:fe12:3456. You do not compute this by hand in practice — you let IOS do it and read the result back with a show command (Step 5). Note that the automatically generated link-local address uses this same EUI-64 interface ID, which is why the two addresses share a tail.
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ipv6 address 2001:db8:acad:20::/64 eui-64
R1(config-if)# no shutdown
R1(config-if)# endStep 4 — Understand (and optionally set) the link-local address
The moment IPv6 is enabled on an interface — which happens automatically as soon as you assign any IPv6 address — IOS generates a link-local address in the FE80::/10 range, derived by EUI-64 from the interface MAC. This is not optional and not a bug; every IPv6 interface has exactly one. Link-local addresses are used for on-link communication only (they are never routed off the link) and are what routing protocols such as OSPFv3 and EIGRP for IPv6 use as the next-hop.
Because the auto-generated link-local is long and MAC-derived, many engineers override it with a short, memorable value using the `link-local` keyword. A manual link-local must stay in the FE80::/10 range and only needs to be unique on that link. If you want a link-local address but no global address at all — common on point-to-point transit links — use `ipv6 enable`, which turns on IPv6 processing and generates the link-local without any global unicast address.
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# exit
!
! Link-local only, no global address:
R1(config)# interface GigabitEthernet0/2
R1(config-if)# ipv6 enable
R1(config-if)# no shutdown
R1(config-if)# endStep 5 — Verify your addressing
Two commands confirm the result. `show ipv6 interface brief` gives a fast per-interface summary: line state plus every IPv6 address on the interface — note that each up interface lists a link-local (FE80::…) and any global addresses beneath it.
For detail, `show ipv6 interface <interface>` reports the link-local address, each global unicast address with its subnet, and the multicast groups the interface has joined. Confirm the interface joined FF02::1 (all-nodes), FF02::2 (all-routers — this appears only when `ipv6 unicast-routing` is enabled, so it doubles as a check on Step 1), and the solicited-node groups FF02::1:FFxx:xxxx used by Duplicate Address Detection (DAD). If an address ever shows as DUPLICATE in this output, DAD found another node using it and the address will not be used until the conflict is resolved.
R1# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::1
2001:DB8:ACAD:10::1
GigabitEthernet0/1 [up/up]
FE80::290:2BFF:FE12:3457
2001:DB8:ACAD:20:290:2BFF:FE12:3457
R1# show ipv6 interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
IPv6 is enabled, link-local address is FE80::1
Global unicast address(es):
2001:DB8:ACAD:10::1, subnet is 2001:DB8:ACAD:10::/64
Joined group address(es):
FF02::1
FF02::2
FF02::1:FF00:1
MTU is 1500 bytesCommon problems (and the fix)
1) The router won't route between subnets. Interface addressing is correct and each connected host is reachable, but traffic never crosses the router. Cause: you forgot `ipv6 unicast-routing` in global config. Fix: add it. A quick tell is that `show ipv6 interface` does not list FF02::2 (all-routers) — the router is still acting as a host.
2) "Where did this FE80 address come from?" You never configured a link-local, yet one appears. This is expected: link-local addresses are automatic and mandatory on every IPv6-enabled interface. Do not try to remove it — it is required for neighbor discovery and as the routing next-hop. Only override it (Step 4) if you want a friendlier value.
3) The EUI-64 host bits look wrong. The classic error is forgetting to flip the seventh (U/L) bit, or flipping the wrong bit. A universal MAC has that bit as 0, and EUI-64 inverts it to 1 — so a first octet of 00 becomes 02, 52 becomes 50, and FC becomes FE. Fix: don't hand-compute in the router; configure with the `eui-64` keyword and confirm the derived address with `show ipv6 interface`.
4) EUI-64 or SLAAC behaves oddly on a non-/64 subnet. EUI-64 produces a 64-bit interface ID and assumes a 64-bit prefix; using a longer or shorter prefix on a host LAN breaks address autoconfiguration. Fix: use /64 for any segment where EUI-64 or SLAAC is expected.
5) Address configured, but the interface is down. Router interfaces default to shutdown, so the address is present in the config but inactive and unreachable. Fix: issue `no shutdown` on the interface and re-check `show ipv6 interface brief` for an up/up state.
Frequently asked questions
Why can I ping the link-local address but not the global IPv6 address?
A link-local address (FE80::/10) is generated the moment IPv6 is enabled on an interface and works for same-segment traffic without any routing, so it succeeds even when forwarding is broken. Reaching a global address on another subnet requires ipv6 unicast-routing to be enabled plus a valid route or default gateway on both ends. If link-local pings work but global ones fail, suspect missing unicast-routing or a missing return route rather than the address itself.
What is the difference between SLAAC and DHCPv6 for assigning IPv6 addresses?
With SLAAC the router advertises a /64 prefix in Router Advertisements and each host builds its own address (via EUI-64 or a randomized identifier), so no server tracks leases. Stateful DHCPv6 instead hands out full addresses from a server pool and records them, much like IPv4 DHCP. Stateless DHCPv6 is a hybrid where SLAAC forms the address while DHCPv6 supplies only options such as DNS server addresses.
Does IPv6 use ARP, and how do I view the neighbor table?
No, IPv6 replaces ARP with the Neighbor Discovery Protocol, which uses ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages sent to a solicited-node multicast address. You view learned mappings with 'show ipv6 neighbors' rather than 'show arp'. Duplicate Address Detection is also part of NDP, which is why a newly configured address may briefly appear as tentative.
Why does EUI-64 flip a bit in the MAC address?
EUI-64 splits the 48-bit MAC, inserts FFFE in the middle, and inverts the 7th bit of the first byte, which is the Universal/Local bit, so a burned-in MAC starting 00 becomes 02. That flipped bit signals the interface identifier was derived from a globally unique MAC. It is a common exam trap, so always toggle that bit when hand-calculating an EUI-64 address.
Do I need global addresses to form an OSPFv3 or EIGRP for IPv6 adjacency?
No, IPv6 routing protocols use the interface link-local addresses as the source and next-hop for neighbor relationships, so adjacencies form even with only link-local addresses configured. You still need global unicast addresses to actually advertise and reach user prefixes. This is why 'show ipv6 route' lists FE80:: next-hops even for networks that are globally routed.
Practice this on graded Cisco labs
Reading is step one — build Subnetting & IP Addressing on real Cisco IOS and grade your own config, or try a free sample lab first.