Configuring an IPv6 global unicast address
Use one of the following methods to configure an IPv6 global unicast address for an interface:
EUI-64 IPv6 address—The IPv6 address prefix of the interface is manually configured, and the interface ID is generated automatically by the interface.
Manual configuration—The IPv6 global unicast address is manually configured.
Stateless address autoconfiguration—The IPv6 global unicast address is generated automatically based on the address prefix information contained in the RA message.
Prefix-specific address autoconfiguration—The IPv6 global unicast address is generated automatically based on the prefix specified by its ID. The prefix can be manually configured or obtained through DHCPv6.
You can configure multiple IPv6 global unicast addresses on an interface.
Manually configured global unicast addresses (including EUI-64 IPv6 addresses) take precedence over automatically generated ones. If you manually configure a global unicast address with the same address prefix as an existing global unicast address on an interface, the manually configured one takes effect. However, it does not overwrite the automatically generated address. If you delete the manually configured global unicast address, the device uses the automatically generated one.
EUI-64 IPv6 address
To configure an interface to generate an EUI-64 IPv6 address:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Enter interface view. | interface interface-type interface-number | N/A |
3. Configure the interface to generate an EUI-64 IPv6 address. | ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } eui-64 | By default, no EUI-64 IPv6 address is configured on an interface. |
Manual configuration
To configure an IPv6 global unicast address for an interface:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Enter interface view. | interface interface-type interface-number | N/A |
3. Configure an IPv6 global unicast address for the interface. | ipv6 address { ipv6-address prefix-length | ipv6-address/prefix-length } | By default, no IPv6 global unicast address is configured on an interface. |
Stateless address autoconfiguration
To configure an interface to generate an IPv6 address through stateless address autoconfiguration:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Enter interface view. | interface interface-type interface-number | N/A |
3. Enable stateless address autoconfiguration on an interface, so that the interface can automatically generate a global unicast address. | ipv6 address auto | By default, the stateless address autoconfiguration feature is disabled on an interface. Using the undo ipv6 address auto command on an interface deletes all IPv6 global unicast addresses and link-local addresses that are automatically generated on the interface. |
After this configuration is completed, the interface automatically generates an IPv6 global unicast address by using the address prefix in the received RA message and the interface ID. On an IEEE 802 interface (such as an Ethernet interface or a VLAN interface), the interface ID is generated based on the interface's MAC address and is globally unique. An attacker can exploit this rule to identify the sending device easily.
To fix the vulnerability, you can configure the temporary address feature. With this feature, an IEEE 802 interface generates the following addresses:
Public IPv6 address—Includes the address prefix in the RA message and a fixed interface ID generated based on the MAC address of the interface.
Temporary IPv6 address—Includes the address prefix in the RA message and a random interface ID generated through MD5.
You can also configure the interface to preferentially use the temporary IPv6 address as the source address of sent packets. When the valid lifetime of the temporary IPv6 address expires, the interface deletes the address and generates a new one. This feature enables the system to send packets with different source addresses through the same interface. If the temporary IPv6 address cannot be used because of a DAD conflict, the public IPv6 address is used.
The preferred lifetime and valid lifetime for a temporary IPv6 address are determined as follows:
The preferred lifetime of a temporary IPv6 address takes the smaller of the following values:
The preferred lifetime of the address prefix in the RA message.
The preferred lifetime configured for temporary IPv6 addresses minus DESYNC_FACTOR (a random number in the range of 0 to 600 seconds).
The valid lifetime of a temporary IPv6 address takes the smaller of the following values:
The valid lifetime of the address prefix.
The valid lifetime configured for temporary IPv6 addresses.
To configure the temporary address feature:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Enable the temporary IPv6 address feature. | ipv6 temporary-address [ valid-lifetime preferred-lifetime ] | By default, the temporary IPv6 address feature is disabled. |
3. Enable the system to preferentially use the temporary IPv6 address as the source address of the packet. | ipv6 prefer temporary-address | By default, the system does not preferentially use the temporary IPv6 address as the source address of the packet. |
To generate a temporary address, an interface must be enabled with stateless address autoconfiguration. Temporary IPv6 addresses do not overwrite public IPv6 addresses, so an interface can have multiple IPv6 addresses with the same address prefix but different interface IDs.
If an interface fails to generate a public IPv6 address because of a prefix conflict or other reasons, it does not generate any temporary IPv6 address.
Prefix-specific address autoconfiguration
This task allows you to specify an IPv6 prefix for an interface to automatically generate an IPv6 global unicast address and advertise the prefix. You must specify the IPv6 prefix by its ID.
To specify an IPv6 prefix for an interface to generate an IPv6 address and advertise the prefix:
Step | Command | Remarks |
|---|---|---|
1. Enter system view. | system-view | N/A |
2. Configure an IPv6 prefix. |
| By default, no static or dynamic IPv6 prefixes exist. |
3. Enter interface view. | interface interface-type interface-number | N/A |
4. Specify an IPv6 prefix for an interface to automatically generate an IPv6 global unicast address and advertise the prefix. | ipv6 address prefix-number sub-prefix/prefix-length | By default, no IPv6 prefix is specified for the interface to automatically generate an IPv6 global unicast address. |