How to Configure OSPFv3 for IPv6 on Cisco IOS

What does not carry over from OSPFv2

Most of OSPF is unchanged. Areas, the backbone, cost, SPF, LSA flooding, DR and BDR election on a broadcast segment, the 10-second hello and 40-second dead interval on Ethernet, the MTU check during database exchange, and every neighbor state from DOWN to FULL all behave exactly as they do on IPv4. What changed is how you turn it on, what it rides on, and what you read back.

The table below is the short version. If you only remember two rows, make them the first two: OSPFv3 does not come up until ipv6 unicast-routing is on, and nothing under the process selects interfaces.

Step 1 — Turn on IPv6 routing before anything else

IPv6 forwarding is off by default on IOS. ipv6 unicast-routing switches it on, and it is a global command you type once per router. Leave it out and the router still accepts IPv6 addresses on interfaces and still answers a ping on its own link, but OSPFv3 never comes up. On the images these labs run on it does not get as far as a config: ipv6 router ospf 1 is rejected with % IPv6 routing not enabled, and ipv6 ospf 1 area 0 on an interface is rejected with % OSPFv3: IPv6 routing not enabled. Because those lines are refused as you enter them, none of them reach the running config, and every line that depends on the process — router-id, passive-interface, auto-cost reference-bandwidth — fails behind it. Type this one command before you touch OSPFv3 and the rest of the build lands.

Address the links next. Each interface that will run OSPFv3 needs to be up and to have IPv6 enabled on it; a global unicast address does that implicitly, and ipv6 enable does it on a transit link you do not want to number. See IPv6 addressing on Cisco IOS for the addressing itself, including EUI-64 and manual link-locals.

R1(config)# ipv6 unicast-routing
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:db8:acad:12::1/64
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ipv6 address 2001:db8:acad:10::1/64
R1(config-if)# no shutdown

IPv6 forwarding first, then an address on the transit link and the LAN.

Step 2 — Start the process and set the router ID by hand

OSPFv3 identifies routers exactly as OSPFv2 does: a 32-bit value written as a dotted quad. That did not change with the protocol version, and it is not an IPv6 address. IOS derives one from the highest IPv4 address on a loopback, or failing that the highest IPv4 address on an active interface.

On an IPv6-only router there is nothing to derive it from. The process cannot allocate an ID, so it does not start, and IOS tells you it could not pick one. Nothing in the neighbor table is wrong — there is no process to have a neighbor table. Set router-id explicitly on every router whether or not IPv4 exists: it survives interface changes, it makes the LSDB readable, and it removes an entire class of failure from a build.

Use the process for the settings that are genuinely process-wide — the router ID, passive interfaces, the reference bandwidth, summarization on an ABR. Interface membership is not one of them.

R1(config)# ipv6 router ospf 1
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# passive-interface GigabitEthernet0/1
R1(config-rtr)# exit

The process, an explicit router ID, and the LAN interface kept quiet.

Step 3 — Enable OSPFv3 on each interface

This is the step OSPFv2 habits break. Nothing under the OSPFv3 process selects interfaces, so there is nothing to get a wildcard mask wrong in. You go to each interface and enable the protocol there, naming the process and the area in one command.

The area is a property of the interface, which makes an area border router exactly what the name says: a router with interfaces in two areas, one of them area 0. The process ID stays local to the router, as it is in OSPFv2, so R1 can run process 1 while R2 runs process 20 and they will still be neighbors.

An interface without that line is not in OSPF, no matter how neatly its prefix fits the addressing plan. On a transit link that means no adjacency; on a LAN it means the /64 is never advertised and the rest of the network has no route to it. Neighbors up but routes missing almost always ends here.

• Both ends of a transit link need it, in the same area, or no adjacency forms.
• LAN interfaces need it too — that is how their prefix gets into the database. Pair it with passive-interface so no hellos go out toward the hosts.
• A link with only a link-local address works: run ipv6 enable on it and OSPFv3 has everything it needs.
• The instance ID defaults to 0 and must match. ipv6 ospf 1 area 0 instance 1 on one end only means no neighbor, with nothing else in the config looking wrong.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 ospf 1 area 0
R1(config-if)# exit
R1(config)# interface GigabitEthernet0/1
R1(config-if)# ipv6 ospf 1 area 0
R1(config-if)# end

Per-interface activation — the replacement for every network statement you would have typed.

Step 4 — Verify, and expect FE80:: everywhere

Adjacency forms over link-local addresses. Both routers source their hellos from FE80::/10 addresses on the link, so the global prefixes play no part in bringing the neighbor up, and the next hop installed for every route learned across that link is the neighbor's link-local address. That looks wrong the first time and is entirely normal: a link-local address is unique only on its own link, which is all a next hop ever has to be, and it stays valid even when the link's global prefix is renumbered. Link-local versus global unicast covers the address types; RFC 5340 is the protocol specification.

show ipv6 ospf neighbor differs from its IPv4 counterpart in one column, and it trips people up. Where OSPFv2 prints the neighbor's address, OSPFv3 prints an Interface ID — the neighbor's own numeric identifier for its side of the link. To see the link-local address, add detail. The states are the same ones as v2, and FULL means the same thing.

Work outward from there. show ipv6 ospf interface brief lists which interfaces are actually in the process, with their area and cost, and is the fastest way to catch an interface you forgot to enable. show ipv6 route ospf proves prefixes are being learned. Then test from the hosts with ping and traceroute, because a routing table that looks right and a LAN that does not work is usually a gateway or a prefix-length problem on the host, not an OSPF problem.

R1# show ipv6 ospf neighbor
Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
2.2.2.2           1   FULL/BDR        00:00:33    4               GigabitEthernet0/0

R1# show ipv6 route ospf
O   2001:DB8:ACAD:20::/64 [110/2]
     via FE80::2, GigabitEthernet0/0

Illustrative, not a capture: the shape of a healthy OSPFv3 adjacency and a route learned across it.

Cost and path choice across multiple routers

Costing is identical to OSPFv2. Each interface gets a cost of reference bandwidth divided by interface bandwidth, with a minimum of 1, and the default reference bandwidth is 100 Mbps. That default is the usual trap on modern topologies: every gigabit and faster interface lands on cost 1, so a gigabit path and a ten-gigabit path score the same. Raise it with auto-cost reference-bandwidth under the process, and set the same value on every router in the domain — a mismatch means two routers score the same topology differently.

Override a single interface with ipv6 ospf cost <1-65535>, which ignores the bandwidth calculation entirely. Two rules decide whether your override actually does anything. First, cost is applied to traffic leaving an interface, so set it on the outbound interface of the router making the decision; setting it at the far end changes a path you are not looking at. Second, the total cost of every outbound interface along a route is what competes, so compare whole paths rather than single links.

A tie is not a steer. If your adjusted path totals the same as the path you meant to avoid, OSPF installs both as equal-cost multipath and traffic uses both, which reads as though the change did nothing. Make the intended path strictly cheaper. After a change, read the cost OSPF is actually using on the interface with show ipv6 ospf interface, then re-read the routing table once SPF has run.

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 ospf cost 30
R1(config-if)# exit
R1(config)# ipv6 router ospf 1
R1(config-rtr)# auto-cost reference-bandwidth 10000

An interface cost that overrides the bandwidth calculation, and the reference bandwidth that must match domain-wide.

Authentication: the OSPFv2 commands do not apply

ip ospf authentication message-digest and ip ospf message-digest-key are OSPFv2 commands and do not apply to OSPFv3. OSPFv3 originally delegated authentication to IPsec — AH or ESP configured per interface or per area — rather than carrying its own authentication field. Newer IOS-XE also supports the OSPFv3 authentication trailer from RFC 7166, configured with the ospfv3 authentication command.

The practical point for a lab or an exam: do not reuse the IPv4 message-digest syntax on an IPv6 interface and assume the adjacency is protected. A command the CLI takes is not necessarily one that is doing anything for OSPFv3. Check what your image supports before you design around it.

Common problems (and the fix)

Work down the list in order — each check is cheaper than the one after it. Read the running config first: the top fault is the one where the lines you typed are not in it, and every fault under it produces a config that reads correctly.

• None of your OSPFv3 lines are in the running config. ipv6 unicast-routing was missing when you typed them, so IOS rejected each one as it was entered. Add it globally, then re-enter the OSPFv3 configuration — turning on forwarding afterwards does not restore lines the router never accepted.
• The process will not start. No router ID, on a router with no IPv4 address to borrow one from. Set router-id under the process. If the process was already running when you changed it, clear it with clear ipv6 ospf process so the new ID takes effect.
• Neighbor is FULL, but a prefix is missing. The interface that owns the prefix was never enabled for OSPFv3, or it is shut. show ipv6 ospf interface brief lists what is really in the process; compare that against your addressing plan, not against your intentions.
• Stuck in EXSTART or EXCHANGE. The hellos match and the database exchange is failing, which on OSPFv3 means the same MTU check as OSPFv2. Compare the IPv6 MTU on both interfaces and make them equal. The wider symptom-by-state method in OSPF neighbor not forming applies unchanged.
• No neighbor on one interface while the rest of the router is fine. Area or instance ID mismatch. Both are set on the interface line in OSPFv3, so compare interface configs rather than process configs.
• Hosts get an address but reach nothing. The address itself proves router advertisements are arriving, so the gateway and the LAN link-local are fine — look past them. Either the LAN interface was never enabled for OSPFv3, so nothing outside has a route back, or an IPv6 ACL on it ends in an explicit deny. IOS permits neighbor discovery implicitly ahead of an IPv6 ACL's implicit deny, so a plain list does not break ND — but an explicit deny ipv6 any any at the end overrides those permits and stops address resolution on the segment, which looks like a routing fault and is not one.
• The path did not move after a cost change. The cost went on the wrong end, or the two paths now total the same and both are installed. Recompute the totals and make the winner strictly cheaper.

Build it once, then build it again under grading

OSPFv3 is short enough to configure from memory after two or three passes, which is exactly why it is worth doing under a grader that reads your running config rather than your intent. The OSPFv3 labs below run on real Cisco IOS in CML: one forms an adjacency over link-local between two routers, one adds a third router and makes you steer the IPv6 path with cost, and the capstone puts OSPFv3 into a dual-stack site alongside SLAAC, stateless DHCPv6 and an IPv6 ACL.

Configure them without a walkthrough, then upload the config and read which checks failed. Start that reading with the two faults this guide opened with: IPv6 routing left off, and an interface never enabled for OSPFv3.