🌍 IPv6

Plan, Deploy & Operate Dual-Stack the Right Way (Addressing, DNS, Security & Evidence)

IPv6 removes address scarcity and simplifies routing—but only if you deploy it intentionally.
SolveForce delivers IPv6 as a program: address plan → dual-stack rollout → DNS/DHCPv6/SLAAC → security controls → app readiness → telemetry & audits. You get a network that is future-proof, operable, and measurably successful.

Where IPv6 touches the stack:
🔀 Routing → BGP Management • 🌐 WAN → SD-WAN • ☁️ Cloud on-ramps → Direct Connect
🛡️ Security → Cybersecurity • 🌐 Edge → WAF / Bot Management • 🔒 Access → ZTNA / SASE
🖧 Fabric → Networks & Data Centers • 🌐 Catalog → Connectivity

---

🎯 Outcomes (Why SolveForce IPv6)

• Clean address plan— /48 per site (typical), /64 per VLAN (always), P2P links on /127 (or /64 w/ guardrails).
• Dual-stack without the drama— phased rollout (core → DC → WAN → campus → users).
• Apps & DNS ready— AAAA, reverse ip6.arpa, load balancers, logs.
• Security-aware— ND/RA protection, ICMPv6 policy (don’t break PMTUD), no “accidental NAT66”.
• Evidence-driven— success SLOs, dashboards, and change artifacts in SIEM.

---

🧭 Scope (What We Deliver)

• Address architecture— provider-independent (RIR) or provider-assigned; aggregation & summarization strategy.
• Numbering— site /48, infra /56, user/server VLANs /64, p2p /127; reserved blocks for growth.
• Host config— SLAAC (RAs), DHCPv6 (options & stateful), or hybrid; DNS & NTP options.
• DNS— AAAA, ip6.arpa reverse, split-horizon, health checks; load balancer listeners.
• Routing— IGP (OSPFv3/IS-IS) + BGP design (peering, policy, communities). → BGP Management
• Security controls— RA Guard, ND Inspection, DHCPv6 Guard, uRPF/BCP-38, firewall rules, DDoS stance. → Cybersecurity
• Cloud & WAN— IPv6 for VPC/VNet/VPCe, LB/ALB/FW, Direct Connect/ExpressRoute/Interconnect parity. → Direct Connect
• Observability— logs, flows, and ND stats to SIEM; SLO dashboards; carrier/NOC integration. → SIEM / SOAR • NOC Services

---

🧱 Building Blocks (Spelled Out)

• Address plan truths
• Don’t subnet smaller than /64 for LANs (SLAAC, DAD, ND depend on it).
• /127 for routed p2p (or /64 with strict ND/RA guard).
• Keep aggregation: per-region/site blocks that summarize in the core/WAN.
• Host configuration
• RAs (Router Advertisements) for default gateway & on-link; DHCPv6 for DNS/NTP or full state.
• Wi-Fi/endpoint policy: disable “privacy extensions” only where auditing requires stable EUI-64 or DHCPv6 IAID/DUID.
• Routing & peering
• OSPFv3/IS-IS for IGP; eBGP for Internet/partners; policy symmetry vs hot-potato per app.
• Anycast services publish AAAA with IPv6-capable health checks.
• DNS & load balancing
• Add AAAA alongside A; ensure LB/WAF supports IPv6 at the edge and to origins (or v6→v4 NAT64 where needed). → WAF / Bot Management
• Security
• Don’t block ICMPv6 generically—allow ND, RA (guarded), and Packet MTU Discovery (PTB type-2).
• RA Guard / DHCPv6 Guard / ND inspection on switches; strict first-hop security on Wi-Fi.
• Firewalls: explicit IPv6 policy; mirror IPv4 controls; drop extension-header abuse; log summary, not every ND.
• Migration/transition
• Dual-stack first → remove CGNAT pressure and test apps.
• NAT64/DNS64 for v6-only segments calling v4-only services; 464XLAT for mobile/edge where needed.
• Avoid NAT66/NPTv6 except for rare multi-homing policies.

---

🛠️ Design Patterns (Choose Your Fit)

---

📐 SLO Guardrails (Success Metrics You Can Prove)

KPI / SLO	Target (Recommended)
Address plan coverage	100% sites with /48 (or policy)
Dual-stack edge readiness	100% edges publish AAAA + A
Internal dual-stack reachability	≥ 99.99% service reachability
ICMPv6 PMTUD pass rate	≥ 99.5% (no black-hole MTU)
IPv6 traffic ratio	Track ↑ month-over-month (goal by app)
Security controls deployed	RA/DHCPv6 Guard on 100% access ports
Evidence completeness	100% (plans, changes, tests, logs)

SLO breaches open tickets and trigger SOAR actions (policy fix, route tweak, MTU clamp, ACL update). → SIEM / SOAR

---

🔒 Security Checklist (Zero-Trust for IPv6)

---

📊 Observability & Evidence

• NetFlow/IPFIX (v9/IPFIX v6 fields), ND counters, RA/DHCPv6 events, AAAA hit ratio, PMTUD failures.
• Dashboardsper site/app; SLO widgets (reachability, MTU, dual-stack ratio).
• Change artifacts— address plan, router/firewall diffs, DNS zone commits → SIEM. → SIEM / SOAR

---

🛠️ Implementation Blueprint (No-Surprise Rollout)

1) Address & policy — choose PI/PA, carve /48 per site, /64 per VLAN, /127 p2p; reserve growth blocks.
2) Core & edge — enable IPv6 IGP + BGP; firewalls/load balancers; MTU strategy; ICMPv6 policy.
3) DNS & DHCPv6/SLAAC — AAAA + ip6.arpa; RA config; DHCPv6 options; test privacy extensions impact.
4) Security — RA/DHCPv6 Guard, ND Inspection, ACLs, uRPF; WAF/DDoS IPv6 parity.
5) Cloud & WAN — VPC/VNet IPv6, on-ramps, SD-WAN SLOs; peering policy by app.
6) Apps & clients — test top apps; fix hard-coded v4 literals; update allowlists; MDM/UEM posture.
7) Pilot & rings — core/DC → WAN → campus → remote; measure SLOs; auto-rollback if needed.
8) Operate — dashboards, monthly reports; raise IPv6 ratio goals by domain; publish wins & RCAs.

---

✅ Pre-Engagement Checklist

---

🔄 Where IPv6 Fits (Recursive View)

1) Grammar — addresses & routes in Connectivity and Networks & Data Centers.
2) Syntax — delivery patterns across Cloud, WAN, and campus.
3) Semantics — Cybersecurity ensures truthful routing & safe ND/RA.
4) Pragmatics — SolveForce AI predicts routing/MTU pitfalls and suggests policy fixes.
5) Foundation — consistent terms via Primacy of Language.
6) Map — indexed in the SolveForce Codex & Knowledge Hub.

---

📞 Plan & Deploy IPv6 with Confidence

Related pages:
BGP Management • SD-WAN • Direct Connect • WAF / Bot Management • Cybersecurity • Cloud • Networks & Data Centers • Connectivity • Knowledge Hub

---

Key terms in plain language

Open a term for a concise explanation of language used on this page.

⏱️Latency

The time it takes data to travel between two points. Lower latency improves voice, video meetings, cloud applications, gaming, and other real-time services.

🔀SD-WAN

Software-defined wide area networking. It manages multiple connections and chooses paths based on application needs, performance, and policy to improve resilience and control.

🛡️Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

🚫Zero Trust

A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.

🧭SASE

Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.

⚡Content Delivery Network (CDN)

A distributed system that serves website or application content from locations closer to users, improving speed, resilience, and capacity.

🔗API

An application programming interface is a defined way for software systems to exchange data or request functions from one another.

🤖Artificial Intelligence (AI)

Software designed to perform tasks involving prediction, classification, generation, reasoning, or decision support. Business use still requires clear data, governance, security, and human accountability.