IPv6 SLAAC & DHCPv6

Mental model

IPv4 hosts get addresses from DHCP almost universally. IPv6 has the same option (DHCPv6), but it also has a built-in alternative: hosts can derive their own address from information broadcast by the local router.

That alternative is SLAAC — Stateless Address Autoconfiguration. The router doesn’t need to track who has which address. It just advertises “the prefix on this link is 2001:db8:1::/64” and hosts handle the rest:

1. Host generates a 64-bit interface ID (either EUI-64 from its MAC, or random for privacy).
2. Host combines 2001:db8:1:: + interface ID = its full IPv6 address.
3. Host runs DAD (Duplicate Address Detection) to check no one else has the same address.
4. If unique, host starts using it. If duplicate, regenerate.

That’s the entire SLAAC flow. No state on the router, no DHCP server required.

The four message types — Router Advertisement & Solicitation

SLAAC uses ICMPv6 (not a separate protocol):

Routers send RAs unsolicited at regular intervals (default every 200 seconds on Cisco). Hosts that boot in between can multicast an RS to get one immediately.

The M and O flags

The Router Advertisement carries two key flags that tell hosts how to behave:

For CCNA: know these flag combinations. M=0 O=1 is the most common “real network” setup — addresses via SLAAC, DNS info via DHCPv6.

EUI-64 — the deprecated way to generate interface IDs

The original SLAAC method derives the interface ID from the host’s MAC address:

MAC:        00:11:22:33:44:55
Split:      00:11:22       :       33:44:55
Insert FFFE: 00:11:22:FF:FE:33:44:55
Flip U/L bit: 02:11:22:FF:FE:33:44:55
Final addr:  ::0211:22FF:FE33:4455 (combined with /64 prefix)

The first byte’s 7th bit gets flipped. Why? Don’t worry about it for the exam — just know:

• EUI-64 IDs are derived from the MAC
• They’re stable (same MAC → same interface ID forever)
• That means trackable across networks, which is a privacy concern
• Modern OSes (Windows 10+, macOS, Linux with NetworkManager) generate random interface IDs by default instead — privacy addresses (RFC 4941)

Privacy addresses

Because EUI-64 makes you trackable, modern hosts generate a random interface ID:

Prefix:        2001:db8:1::/64
Random suffix: ::abcd:1234:5678:9abc
Full address:  2001:db8:1:0:abcd:1234:5678:9abc

Rotates daily by default. The original EUI-64 address still exists for incoming connections; the random one is used for outbound. Hosts may have multiple IPv6 addresses simultaneously — totally normal.

Stateful DHCPv6 — when you need IPv4-like behavior

If you need to track which device got which address (for audit logs, IP-pinning, etc.), SLAAC isn’t enough. DHCPv6 in stateful mode handles this — and is the only option for some Windows scenarios that don’t fully support SLAAC.

Trigger it by setting the M flag = 1 in the router advertisement:

R1(config-if)# ipv6 nd managed-config-flag       ! set M flag
R1(config-if)# ipv6 nd other-config-flag         ! set O flag (optional)

Then point hosts at a DHCPv6 server, configured similarly to IPv4 DHCP but with ipv6 keywords.

Commands — typical SLAAC setup

! Enable IPv6 routing globally
R1(config)# ipv6 unicast-routing

! Assign a global address to the LAN interface
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# no shutdown

! Configure RA settings (optional — defaults work for pure SLAAC)
R1(config-if)# ipv6 nd ra interval 200            ! RA every 200s (default)
R1(config-if)# ipv6 nd prefix 2001:db8:acad:1::/64 valid-lifetime 86400 preferred-lifetime 43200

That’s it. Hosts on the link will pick up 2001:db8:acad:1::xxxx automatically.

Stateless DHCPv6 — SLAAC + DNS info

R1(config)# ipv6 unicast-routing

! Enable DHCPv6 server with DNS info only
R1(config)# ipv6 dhcp pool DHCP-STATELESS
R1(config-dhcpv6)# dns-server 2001:4860:4860::8888
R1(config-dhcpv6)# domain-name corp.local

R1(config)# interface GigabitEthernet0/0
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# ipv6 dhcp server DHCP-STATELESS
R1(config-if)# ipv6 nd other-config-flag         ! O flag = "use DHCPv6 for DNS"

Verification

R1# show ipv6 interface GigabitEthernet0/0
R1# show ipv6 neighbors
R1# show ipv6 dhcp pool
R1# debug ipv6 nd                                ! while troubleshooting RAs

On a host: ipconfig /all (Windows) or ip -6 addr (Linux) shows the addresses received.

Common mistakes

1. Forgetting ipv6 unicast-routing. Without it, the router accepts an IPv6 address on an interface but won’t route between subnets or send RAs.

2. Configuring a non-/64 prefix. SLAAC requires /64. A /48 or /56 prefix doesn’t work for SLAAC. The exception: /127 for point-to-point links (RFC 6164) — but SLAAC isn’t used there anyway.

3. M and O flag confusion. M=1 means “address via DHCPv6” (turn off SLAAC). O=1 alongside M=0 means “address via SLAAC, but ask DHCPv6 for DNS.” Mix them up and hosts behave unexpectedly.

4. Expecting the router to learn hosts’ addresses automatically. It doesn’t track stateless SLAAC addresses. To know who’s on the network, you need DHCPv6 logs (stateful only) or scan via NDP.

5. Filtering RAs at the wrong place. A rogue RA from a misconfigured host can poison all SLAAC clients. RA Guard is the switch-level defense — like DHCP Snooping but for RAs.

6. Forgetting hosts can have multiple IPv6 addresses. It’s normal. A laptop on a /64 has: link-local (fe80::…), SLAAC EUI-64, SLAAC privacy address, possibly a DHCPv6 address too. Don’t be alarmed.

Lab to try tonight

1. Two routers, one PC. Both routers on a shared LAN with a /64.
2. Enable ipv6 unicast-routing on both. Configure ipv6 address 2001:db8:1::1/64 on R1 and ::2/64 on R2.
3. Connect a Windows / Linux PC to the LAN. Set IPv6 to “Automatic.”
4. On the PC: ipconfig /all (or ip -6 addr). Observe the global address picked up via SLAAC.
5. Ping R1’s address from the PC. Verify reachability.
6. Run Wireshark on the PC. Reload it. Watch the RS → RA → DAD exchange.
7. Enable ipv6 nd managed-config-flag on R1’s interface. Configure a DHCPv6 pool. Restart the PC. Verify it now gets its address from DHCPv6.

Cheat strip