IP version 6

IP version 6 (IPv6) is a suite of standard protocols that is the next generation of network layer protocols for the Internet.

  • Before you begin using IPv6 with this computer, see Checklist: Installing and configuring IPv6.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Installing and configuring IPv6

Step | Reference
Review IPv6 concepts, such as core protocols, addressing, and routing. | Understanding IPv6
Review IPv6 name resolution concepts for resolving DNS names to IP addresses. | Name resolution
Verify that network adapter hardware is installed, or install hardware if needed. | Installing devices overview
Install IPv6 on this computer. | To install IPv6
(Manual configuration only) Configure IPv6 address and prefix settings. | To configure IPv6 with manual addresses
Use the ping command to verify that you have IPv6 installed and running. | To test an IPv6 configuration by using the ping command
Use the ping command to verify that you can communicate with another IPv6 node. | To test IPv6 connectivity by using the ping command


How to...

This section provides instructions for installing and configuring the IPv6 protocol.

  • Install and configure IPv6
  • Manage routes
  • Diagnose connections


Install and configure IPv6

  • Install IPv6
  • Remove IPv6
  • Configure IPv6


Install IPv6

Microsoft Windows graphic

To install IPv6

  1. Open Network Connections.
  2. Right-click any local area connection, and then click Properties.
  3. Click Install.
  4. In the Select Network Component Type dialog box, click Protocol, and then click Add.
  5. In the Select Network Protocol dialog box, click Microsoft TCP/IP version 6, and then click OK.
  6. Click Close to save changes to your network connection.

Note

  • XOX

Related Topics


Remove IPv6

Microsoft Windows graphic

To remove IPv6

  1. Open Network Connections.
  2. Right-click any local area connection, and then click Properties.
  3. Click Microsoft TCP/IP version 6 in the list of installed components, and then click Uninstall.
  4. In the Uninstall Microsoft TCP/IP version 6 dialog box, click Yes.
  5. Click Close to save changes to your network connection.

Note

  • XOX

Related Topics


Configure IPv6

  • Configure IPv6 with manual addresses
  • Configure interface attributes


Configure IPv6 with manual addresses

Microsoft Windows graphic

To configure IPv6 with manual addresses

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type add address [interface=]String [address=]IPv6Address

    5. Where:

    [interface=]String
    Specifies the name for the interface.
    [address=]IPv6Address
    Specifies the IPv6 address.

Notes

  • XOX
  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


Configure interface attributes

Microsoft Windows graphic

To configure interface attributes

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER
    3. .
  3. Type interface ipv6, and then press ENTER
    4. .
  4. Type set interface [interface=]String [[forwarding=]{enabled | disabled}]
             [[advertise=]{enabled | disabled}] [[mtu=]Integer]
             [[siteid=]Integer] [[metric=]Integer]
             [[firewall=]{enabled | disabled}]
             [[siteprefixlength=]Integer]
             [[store=]{active | persistent}]

    5. Where:

    [interface=]String
    Specifies the interface name.
    [[forwarding=]{enabled | disabled}]
    Specifies whether packets arriving on this interface can be forwarded to other interfaces. The default is disabled.
    [[advertise=]{enabled | disabled}]
    Specifies whether Router Advertisements are sent on this interface. The default is disabled.
    [[mtu=]Integer]
    Specifies the maximum transmission unit (MTU) of this interface. If mtu is not specified, the default MTU of the link is used.
    [[siteid=]Integer]
    Specifies the site scope zone identifier. The site identifier is used to distinguish among interfaces belonging to different administrative regions that use site-local addressing.
    [[metric=]Integer]
    Specifies the interface metric, which is added to route metrics for all routes over the interface.
    [[firewall=]{enabled | disabled}]
    Specifies whether to operate in firewall mode.
    [[siteprefixlength=]Integer]
    Specifies the default length of the global prefix for the entire site.
    [[store=]{active | persistent}]
    If active is specified, the change only lasts until the computer is restarted. If persistent is specified, the change is permanent. The default is Persistent.

Note

  • XOX

Related Topics


Manage routes

  • View the IPv6 routing table
  • Add an IPv6 route
  • Remove an IPv6 route
  • Enable IPv6 forwarding


View the IPv6 routing table

Microsoft Windows graphic

To view the IPv6 routing table

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type show routes, and then press ENTER

Notes

  • XOX
  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


Add an IPv6 route

Microsoft Windows graphic

To add an IPv6 route

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type add route [prefix=]IPv6Address/Integer [[interface=]String]
             [[nexthop=]IPv6Address] [[siteprefixlength=]Integer]
             [[metric=]Integer] [[publish=]{no | yes | immortal}]
             [[validlifetime=]{Integer | infinite}]
             [[preferredlifetime=]{Integer | infinite}]
             [[store=]{active | persistent}]

    5. Where:

    [prefix=]IPv6Address/Integer
    Required. Specifies the prefix for which to add a route. Integer specifies the prefix length.
    [[interface=]String]
    Specifies an interface name or index.
    [[nexthop=]IPv6Address]
    Specifies the gateway address, if the prefix is not on-link.
    [[siteprefixlength=]Integer]
    Specifies the prefix length for the entire site, if the prefix is not on-link.
    [[metric=]Integer]
    Specifies the route metric.
    [[publish=]{no | yes | immortal}]
    Specifies whether routes are advertised (yes), advertised with an infinite lifetime (immortal), or not advertised (no) in Route Advertisements. The default selection is no.
    [[validlifetime=]{Integer | infinite}]
    Specifies the lifetime over which the route is valid. The default value is infinite.
    [[preferredlifetime=]{Integer | infinite}]
    Specifies the lifetime over which the route is preferred. The default value is infinite.
    [[store=]{active | persistent}]
    Specifies whether the change lasts only until the next boot (active) or is persistent (persistent). The default selection is persistent.

Note

  • XOX

Related Topics


Remove an IPv6 route

Microsoft Windows graphic

To remove an IPv6 route

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type show routes

    5. to obtain the route prefix and the interface index of the interface over which the addresses for the route prefix are reachable.

  5. To delete a route, type delete route [prefix=]IPv6Address/Integer [interface=]String

    6. Where:

    [prefix=]IPv6Address/Integer
    Specifies the prefix for which to delete a route. IPv6Address is an IPv6 address and Integer is the prefix length of the route to delete.
    [interface=]String
    Specifies the interface name or index.

Notes

  • XOX
  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


Enable IPv6 forwarding

Microsoft Windows graphic

To enable IPv6 forwarding

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type set interface [interface=]String [forwarding=]enabled

    5. Where:

    [interface=]String
    Specifies the interface name or index.
    [forwarding=]enabled
    Specifies whether packets arriving on this interface can be forwarded to other interfaces. The default is disabled.

Notes

  • XOX
  • You can also send Router Advertisement messages by adding the advertise parameter to the command, as follows:

    set interface [interface=]String [forwarding=]enabled [advertise=]enabled

  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


Diagnose connections

  • Test an IPv6 configuration by using the ping command
  • Test IPv6 connectivity by using the ping command
  • Trace a path by using the tracert command
  • View the interface configuration
  • View the neighbor cache
  • View the destination cache


Test an IPv6 configuration by using the ping command

Microsoft Windows graphic

To test an IPv6 configuration by using the ping command

  1. To obtain the IPv6 configuration for a computer, open Command Prompt, and then type netsh interface ipv6 show interface. If IPv6 is not installed, see Related Topics.
  2. At the command prompt, ping the loopback address by typing ping ::1.

    3. If the ping command fails, verify that the ::1 address is assigned to the interface named Loopback Pseudo-Interface.

  3. Use the following command to ping a link-local IPv6 address of the computer:

    4. ping Address%ZoneID

    where Address is the link-local address and ZoneID is the interface index for the interface to which the link-local address is assigned. A link-local address begins with FE80.

    If the ping command fails, verify the address and interface index.

  4. Use the following command to ping the link-local address of another host on your link (also known as a subnet):

    5. ping Address%ZoneID

    where Address is the link-local address of the other host and ZoneID is the interface index for the interface from which you want to send the ping packets.

    If the ping command fails, verify the link-local address of the other host and the zone ID.

Note

  • XOX

Related Topics


Test IPv6 connectivity by using the ping command

Microsoft Windows graphic

To test IPv6 connectivity by using the ping command

  1. To obtain the IPv6 configuration for a computer, open Command Prompt, and then type netsh interface ipv6 show interface InterfaceName, where InterfaceName is the name of an interface on your computer. For example, if you have an interface named Local Area Connection, type:

    netsh interface ipv6 show interface "Local Area Connection"

    If IPv6 is not installed, see Related Topics.
  2. Use one of the following commands to ping another IPv6 node:
    • To ping the link-local address of another node on your link (also known as a subnet):

      • ping Address%ZoneID

      where Address is the link-local address of the other node and ZoneID is typically the interface index for the interface from which you want to send ping packets. You can obtain the interface index from the display of the netsh interface ipv6 show interface command.

      If the ping command fails, verify the link-local address of the other node and the zone ID.

    • To ping the site-local address of another node:

      • ping Address%ZoneID

      where Address is the site-local address of the other node and ZoneID is the site identifier (Zone ID for Site) from the display of the netsh interface ipv6 show interface level=verbose command. If you are not using site identifiers or have only a single site, the %ZoneID portion of the command is not required.

      If the ping command fails, verify the site-local address of the other node and the zone ID.

    • To ping the global address of another node:

      • ping Address

      where Address is the global address of the other node.

      If the ping command fails, verify the global address of the other node.

    • To ping another node by name:

      • ping -6 Name

      where Name is a name that can be resolved to an IPv6 address through entries in the local hosts file, or through AAAA resource records that are present in your Domain Name System (DNS) infrastructure. When you identify the target host by name rather than IPv6 address, it is necessary to include the -6 parameter to ensure that IPv6 addresses are used.

      If the ping command fails, verify that the name can be resolved to an IPv6 address.

Note

  • XOX

Related Topics


Trace a path by using the tracert command

Microsoft Windows graphic

To trace a path by using the tracert command

  • Open Command Prompt, and type the following:

    tracert -d -6 HostName

    Or, type tracert IPv6Address%ZoneID

    • where:

    • HostName is the host name of the remote computer.
    • IPv6Address is the IPv6 address of the remote computer.
    • ZoneID is the zone identifier (ID) for the destination address. The zone ID for link-local destination addresses is typically the interface index of the interface from which you want to send tracert packets. You can obtain the interface index from the display of the netsh interface ipv6 show interface command. The zone ID for site-local destination addresses is the Zone ID for Site from the display of the netsh interface ipv6 show interface level=verbose command. If you are not using site identifiers or have only a single site, the %ZoneID portion of the command for site-local addresses is not required. The %ZoneID portion of the command is not required for global destination addresses.

Notes

  • XOX
  • For IPv6, the tracert command traces the path taken by IPv6 packets from this computer to another remote computer. The tracert command uses ICMPv6 Echo Request messages (similar to the ping command) to produce command-line report information about each router that is crossed and the roundtrip time for each hop.
  • If tracert is unsuccessful, you can use the command-line report information to determine at which intermediate router forwarding either failed or was slowed.

Related Topics


View the interface configuration

Microsoft Windows graphic

To view the interface configuration

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type show interface [interface=]String

    5. Where:

    [interface=]String
    Specifies the interface name or index.

Notes

  • XOX
  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


View the neighbor cache

Microsoft Windows graphic

To view the neighbor cache

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type show neighbors, and then press ENTER.

Notes

  • XOX
  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


View the destination cache

Microsoft Windows graphic

To view the destination cache

  1. Open Command Prompt.
  2. At the command prompt, type netsh, and then press ENTER.
  3. Type interface ipv6, and then press ENTER.
  4. Type show destinationcache, and then press ENTER.

Notes

  • XOX
  • Additional parameters are available for this command. For more information, see Related Topics.

Related Topics


Concepts

This section provides general background information about IPv6:

  • IPv6 overview
  • Understanding IPv6
  • Administering IPv6
  • Resources


IPv6 overview

This section covers:

  • Security information for IPv6
  • Introduction to IPv6
  • IPv6 features
  • IPv6 protocol features
  • Security features for IPv6


Security information for IPv6

The use of IPv6 is currently supported only when IPv4 is also installed. TCP/IP internetworks are susceptible to a variety of possible attacks, from passive attacks (such as eavesdropping) to active attacks (such as denial-of-service attacks). For more information, see Security issues with IP.

It is important to follow best practices for security when using IPv6 on your network. For more information, see Best practices for security.

Following is known security information for IPv6:

  • The installation of an unauthorized router can cause reconfiguration of clients and rerouting of IPv6 traffic

    Configuration of IPv6 addresses is based on the receipt of Router Advertisement messages from IPv6 routers. In addition, to communicate with IPv6 nodes on other network segments, IPv6 must use a default router. A default router is automatically assigned based on the receipt of a router advertisement.

    Malicious users with physical access to the IPv6-enabled network can cause a denial of service attack on IPv6 hosts by installing an unauthorized IPv6 router on the network segment. The unauthorized IPv6 router can reconfigure IPv6 clients, set itself as the default router, reroute link traffic, and disrupt other network services.

    Recommendations:

    • Ensure that unauthorized persons do not have physical or wireless access to your network.
  • Internet Connection Firewall (ICF) and Basic Firewall cannot filter or block IPv6 traffic

    ICF, available on the 32-bit editions of XOX and XOX, is used to restrict the traffic that is allowed to enter your network from the Internet. Because ICF can only filter IPv4 traffic, IPv6 traffic might circumvent the firewall and enter your network.

    Basic Firewall is a component of Routing and Remote Access that you can enable for any public interface on a computer running both Routing and Remote Access and a member of the Windows Server 2003 family. Because Basic Firewall can only filter IPv4 traffic, IPv6 traffic circumvent the firewall and enter your network.

    Recommendations:

    • Use firewall software that can filter and block IPv6 traffic if you are running IPv6 on your network.
  • On-link computers can take control of another IPv6 address, causing on-link devices to create an incorrect entry in their neighbor cache

    Nodes on an IPv6 link use address resolution to resolve a neighboring node's IPv6 address to its link-layer address (equivalent to ARP in IPv4). The resolved link-layer address becomes an entry in a node's neighbor cache (equivalent to the ARP cache in IPv4). If an IPv6 node uses another node's address, it can cause other computers on the link to add a false entry to their neighbor cache. All traffic intended for the original computer instead goes to the attacker's computer, and the attacker can appear to send traffic from the original computer.

    Recommendations:

    • Ensure that unauthorized persons do not have physical or wireless access to your network.
  • When native IPv6 connectivity is not present, spoofing off-link IPv6 source addresses is easier

    The common defense against IP source address spoofing is source ingress and egress filtering on packets by routers. Because traffic between hosts on the same link does not cross a router, this protective filtering is not used.

    While this threat applies to native connectivity (in both IPv4 and IPv6) where on-link hosts can spoof off-link addresses in communication with other hosts on the link, the threat is greater when native connectivity does not exist. When native IPv6 connectivity is not present, encapsulation technologies such as ISATAP and 6to4 are used.

    Because the virtual link used for packet encapsulation spans a large logical area of the network (for example, in the case of 6to4, the entire IPv4 Internet), an attacker can be anywhere on the IPv4 Internet and still spoof off-link addresses.

    Recommendations:

    • Ensure that native IPv6 connectivity is present.

Note

  • When the computer running IPv6 is started, IPv6 logs event ID 3100 in the system event log. For more information about viewing the event log, see Event Viewer overview.

Additional information

  • This implementation of IPSec for IPv6 is not recommended for use in a production environment because it relies on static keying and has no provisions for updating keys upon sequence number reuse.
  • When you manually configure Security Parameters Indexes (SPIs) for IPSec for IPv6, always use random numbers. Do not use sequential numbers for SPIs, or you will compromise the security of your IPSec for IPv6 policies.
  • The IPv6 protocol for the Windows Server 2003 family does not support the use of IPSec Encapsulating Security Payload (ESP) encryption. However, the use of ESP with NULL encryption is supported. Although NULL encryption uses the ESP header, only data origin authentication and data integrity services are provided.

For additional information about IPv6 security, see Security features for IPv6 and Using IPSec between two local link hosts.


Introduction to IPv6

The current version of the Internet Protocol (known as IP version 4 or IPv4) has not been substantially changed since RFC 791 was published in 1981. IPv4 has proven to be robust, easily implemented and interoperable, and has stood the test of scaling an internetwork to a global utility the size of today's Internet. This is a tribute to its initial design.

However, the initial design did not anticipate:

  • The recent exponential growth of the Internet and the impending exhaustion of the IPv4 address space.

    • IPv4 addresses have become relatively scarce, forcing some organizations to use a network address translator (NAT) to map multiple private addresses to a single public IP address. While NATs promote reuse of the private address space, they do not support standards-based network layer security or the correct mapping of all higher layer protocols and can create problems when connecting two organizations that use the private address space.

    Additionally, the rising prominence of Internet-connected devices and appliances assures that the public IPv4 address space will eventually be depleted.

  • The growth of the Internet and the ability of Internet backbone routers to maintain large routing tables.

    • Because of the way in which IPv4 network IDs have been and are currently allocated, there are routinely over 70,000 routes in the routing tables of Internet backbone routers. The current IPv4 Internet routing infrastructure is a combination of both flat and hierarchical routing.

  • The need for simpler configuration.

    • Most current IPv4 implementations must be configured either manually or through a stateful address configuration protocol such as Dynamic Host Configuration Protocol (DHCP). With more computers and devices using IP, there is a need for a simpler and more automatic configuration of addresses and other configuration settings that do not rely on the administration of a DHCP infrastructure.

  • The requirement for security at the IP level.

    • Private communication over a public medium like the Internet requires encryption services that protect the data sent from being viewed or modified in transit. Although a standard now exists for providing security for IPv4 packets (known as Internet Protocol security or IPSec), this standard is optional and proprietary solutions are prevalent.

  • The need for better support for real-time delivery of data (also known as quality of service).

    • While standards for quality of service (QoS) exist for IPv4, real-time traffic support relies on the IPv4 Type of Service (TOS) field and the identification of the payload, typically using a UDP or TCP port. Unfortunately, the IPv4 TOS field has limited functionality and has different interpretations. In addition, payload identification using a TCP and UDP port is not possible when the IPv4 packet payload is encrypted.

To address these concerns, the Internet Engineering Task Force (IETF) has developed a suite of protocols and standards known as IP version 6 (IPv6). This new version, previously named IP-The Next Generation (IPng), incorporates the concepts of many proposed methods for updating the IPv4 protocol. IPv6 is intentionally designed for minimal impact on upper and lower layer protocols by avoiding the arbitrary addition of new features.


IPv6 features

The following are the features of the IPv6 protocol:

  • New header format
  • Large address space
  • Efficient and hierarchical addressing and routing infrastructure
  • Stateless and stateful address configuration
  • Built-in security
  • Better support for quality of service (QoS)
  • New protocol for neighboring node interaction
  • Extensibility

The following sections discuss each of these new features in detail.

New header format

The IPv6 header has a new format that is designed to minimize header overhead. This is achieved by moving both nonessential fields and option fields to extension headers that are placed after the IPv6 header. The streamlined IPv6 header provides more efficient processing at intermediate routers.

IPv4 headers and IPv6 headers are not interoperable and the IPv6 protocol is not backward compatible with the IPv4 protocol. A host or router must use an implementation of both IPv4 and IPv6 in order to recognize and process both header formats. The new IPv6 header is only twice as large as the IPv4 header, even though IPv6 addresses are four times as large as IPv4 addresses.

For more information, see Internet Protocol version 6 (IPv6).

Large address space

IPv6 has 128-bit (16-byte) source and destination addresses. Although 128 bits can provide over 3.4×1038 possible combinations, the large address space of IPv6 has been designed to allow for multiple levels of subnetting and address allocation from the Internet backbone to the individual subnets within an organization.

Although only a small percentage of possible addresses are currently allocated for use by hosts, there are plenty of addresses available for future use. With a much larger number of available addresses, address-conservation techniques, such as the deployment of NATs, are no longer necessary.

For more information, see IPv6 addressing.

Efficient and hierarchical addressing and routing infrastructure

IPv6 global addresses used on the IPv6 portion of the Internet are designed to create an efficient, hierarchical, and summarizable routing infrastructure that addresses the common occurrence of multiple levels of Internet service providers. On the IPv6 Internet, backbone routers have much smaller routing tables.

For more information, see Unicast IPv6 addresses.

Stateless and stateful address configuration

To simplify host configuration, IPv6 supports both stateful address configuration, such as address configuration in the presence of a DHCP server, and stateless address configuration (address configuration in the absence of a DHCP server). With stateless address configuration, hosts on a link automatically configure themselves with IPv6 addresses for the link (link-local addresses) and with addresses that are derived from prefixes advertised by local routers. Even in the absence of a router, hosts on the same link can automatically configure themselves with link-local addresses and communicate without manual configuration.

For more information, see IPv6 address autoconfiguration.

Built-in security

Support for IPSec is an IPv6 protocol suite requirement. This requirement provides a standards-based solution for network security needs and promotes interoperability between different IPv6 implementations.

For more information, see Security features for IPv6.

Better support for quality of service (QoS)

New fields in the IPv6 header define how traffic is handled and identified. Traffic identification, by using a Flow Label field in the IPv6 header, allows routers to identify and provide special handling for packets that belong to a flow. A flow is a series of packets between a source and destination. Because the traffic is identified in the IPv6 header, support for QoS can be easily achieved even when the packet payload is encrypted with IPSec.

New protocol for neighboring node interaction

The Neighbor Discovery protocol for IPv6 is a series of Internet Control Message Protocol for IPv6 (ICMPv6) messages that manage the interaction of neighboring nodes (that is, nodes on the same link). Neighbor Discovery replaces Address Resolution Protocol (ARP), ICMPv4 Router Discovery, and ICMPv4 Redirect messages with efficient multicast and unicast messages and provides additional functionality.

For more information, see Neighbor Discovery (ND).

Extensibility

IPv6 can be extended for new features by adding extension headers after the IPv6 header. Unlike the IPv4 header, which can only support 40 bytes of options, the size of IPv6 extension headers is only constrained by the size of the IPv6 packet.


IPv6 protocol features

The IPv6 protocol for the Microsoft® Windows® Server 2003 family includes the following features:

6to4 tunneling

6to4 is a tunneling technique that is described in RFC 3056. 6to4 hosts do not require any manual configuration and create 6to4 addresses by using standard autoconfiguration. 6to4 uses the global address prefix of 2002:WWXX:YYZZ::/48, where WWXX:YYZZ is the colon-hexadecimal representation of a public IPv4 address (w.x.y.z) that is assigned to a site or host. WWXX:YYZZ is the Next Level Aggregator (NLA) portion of a 6to4 address.

6to4 allows IPv6-enabled sites and hosts to communicate by using unicast IPv6 the Internet. IPv6 sites and hosts can use their 6to4 address prefix and the Internet to communicate without obtaining an IPv6 global address prefix from an Internet service provider and connecting to the IPv6 Internet.

For more information, see IPv6 traffic between nodes in different sites across the Internet (6to4).

Intrasite Automatic Tunnel Addressing Protocol

Intrasite Automatic Tunnel Addressing Protocol (ISATAP) is an address assignment and tunneling mechanism for communication between IPv6/IPv4 nodes within an IPv4 site. It is described in the Internet draft titled "Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)" (draft-ietf-ngtrans-isatap-0x.txt). For more information, see IPv6 traffic between nodes on different subnets of an IPv4 internetwork.

Temporary addresses

To provide a level of anonymity when accessing Internet resources, the 64-bit interface identifier of a global IPv6 address is derived by using random numbers to create a temporary global address.

For more information, see IPv6 interface identifiers.

Site prefixes in router advertisements

Published on-link prefixes can be configured with a site prefix length, as described in the Internet draft titled "Site prefixes in Neighbor Discovery" (draft-ietf-ipngwg-site-prefixes-0x.txt). You can use the netsh interface ipv6 add route command to include a site prefix length with the address prefix. For more information, see Netsh commands for Interface IPv6.

When a prefix information option that specifies a site prefix is received, an entry is created in the site prefix table. You can view this table by using the netsh interface ipv6 show siteprefixes command. The site prefix table is used to remove inappropriate site-local addresses from those that are returned by the getaddrinfo() Windows sockets function.

DNS support

Processing for Domain Name System (DNS) IPv6 host records (known as AAAA or quad-A resource records), as defined in RFC 1886, "DNS Extensions to support IP version 6," is supported by the DNS resolver (client) in XOX and the Windows Server 2003 family, and DNS Server service in the Windows Server 2003 family and Windows 2000. All DNS traffic is sent over IPv4 or IPv6.

For more information, see Name resolution.

IPSec support

Processing for the Authentication Header (AH) using the Message Digest 5 (MD5) hash, and the Encapsulating Security Payload (ESP) using the NULL ESP header and the MD5 hash, is supported. There is no support for ESP data encryption.

Caution

  • This implementation of IPSec for IPv6 is not recommended for use in a production environment because it relies on static keying and has no provisions for updating keys upon sequence number reuse.

For an example configuration, see Using IPSec between two local link hosts.

Application support

Applications and components that are provided with the Windows Server 2003 family and support the use of IPv6 include:

  • Distributed Component Object Model (DCOM)
  • Distributed File System (DFS)
  • Domain Name System (DNS) server and client
  • File and print sharing
  • File Transfer Protocol (FTP) client
  • Internet Explorer
  • Microsoft .NET Framework
  • Network Monitor
  • Telnet Server and Telnet Client
  • Windows Media Services
  • Windows Sockets

For more information, see IPv6 applications.

RPC support

Remote Procedure Call (RPC) functions, which are used to forward application function calls to a remote system across the network, can be used over IPv6. A typical use for RPC is remote administration.

Static router support

A computer running a member of the Windows Server 2003 family can act as a static IPv6 router that forwards IPv6 packets between interfaces based on the contents of the IPv6 routing table. You can configure static routes with the netsh interface ipv6 add route command. There is currently no support for IPv6 routing protocols.

A computer running a member of the Windows Server 2003 family can send router advertisements. The contents of router advertisements are automatically derived from the published routes in the routing table. Nonpublished routes are used for routing but are not sent in router advertisements. Router advertisements always contain a source link-layer address option and an MTU option. The value for the MTU option is taken from the sending interface's current link MTU. You can change this value with the following Netsh command:

netsh interface ipv6 set interface [interface=]String [[mtu=]Integer]

A computer running a member of the Windows Server 2003 family will only advertise itself as a default router (by using a router advertisement with a router lifetime other than zero) if there is a default route that is configured to be published.

For more information and examples, see Netsh commands for Interface IPv6, IPv6 traffic between nodes on different subnets of an IPv6 internetwork, and IPv6 test lab tasks.

Command-line tool support

The following command-line tools are provided with the Windows Server 2003 family and support the use and configuration of IPv6:

  • Netsh commands for Interface IPv6
  • Netsh commands for Interface Portproxy
  • Ipconfig
  • Pathping
  • Ping
  • Route
  • Tracert
  • Netstat

The Netstat command-line tool provided with the Windows Server 2003 family and XOX includes support for IPv6-related statistics. There are four categories of statistics:

  1. IPv6 statistics
  2. ICMPv6 statistics
  3. TCP connections over IPv6 statistics
  4. UDP traffic over IPv6 statistics

6over4 tunneling

6over4, also known as IPv4 multicast tunneling, is a tunneling technique that is described in RFC 2529. 6over4 allows IPv6 and IPv4 nodes to communicate by using IPv6 over an IPv4 infrastructure. 6over4 uses the IPv4 infrastructure as a multicast-capable link. In order for 6over4 to work correctly, the IPv4 infrastructure must be IPv4 multicast-enabled.

For more information about configuring a 6over4 interface, see the command add 6over4tunnel in Netsh commands for Interface IPv6.


Security features for IPv6

The IPv6 protocol for Microsoft® Windows® Server 2003 family incorporates Internet Protocol security (IPSec), which provides protection of IPv6 data as it is sent over the network. IPSec is a set of Internet standards that uses cryptographic security services to provide the following:

  • Confidentiality

    • IPSec traffic is encrypted. Captured IPSec traffic cannot be deciphered without the encryption key.

  • Authentication

    • IPSec traffic is digitally signed with the shared encryption key so that the receiver can verify that it was sent by the IPSec peer.

  • Data integrity

    • IPSec traffic contains a cryptographic checksum that incorporates the encryption key. The receiver can verify that the packet was not modified in transit.

For an example of configuring IPSec for IPv6, see Using IPSec between two local link hosts.

The IPv6 protocol for Windows Server 2003 family also provides support for temporary addresses. Temporary addresses provide a level of anonymity when accessing Internet resources. For more information about temporary addresses, see Temporary address interface identifiers.

Caution

  • This implementation of IPSec for IPv6 is not recommended for use in a production environment because it relies on static keying and has no provisions for updating keys upon sequence number reuse.

Notes

  • IPSec in IPv6 is separate from and not interoperable with IPSec for the TCP/IP protocol. IPSec policies that are configured with the IP Security Policies or Group Policy snap-ins have no effect on IPv6 traffic. For more information about IPSec for the TCP/IP protocol, see Internet Protocol security (IPSec).
  • IPSec in the IPv6 protocol for Windows Server 2003 family does not support the use of data encryption for data confidentiality.
  • IPSec in the IPv6 protocol for Windows Server 2003 family does not support the use of Internet Key Exchange (IKE) to negotiate security associations (SAs). IPSec policies, SAs, and keys must be manually configured.


Understanding IPv6

This section covers:

  • Name resolution
  • Core protocols of IPv6
  • IPv6 addressing and routing
  • IPv6 and network applications


Name resolution

While IPv6 is designed to work with the 128-bit IPv6 addresses of the source and the destination hosts, computer users are likely to experience difficulty in using and remembering the IPv6 addresses of the computers with which they want to communicate. Unique names, which are easier to remember, can be used instead.

If a name is used as an alias for an IPv6 address, you need to ensure that the name is unique and that it resolves to the correct IPv6 address. The IPv6 protocol for the Windows Server 2003 family can use host names to resolve a name to an IPv6 address. Host names are used by programs that use Windows Sockets.

Host name resolution is successfully mapping a host name to an IPv6 address. A host name is an alias that is assigned to an IPv6 node, identifying it as an IPv6 host. The host name can be up to 255 characters long and can contain alphabetic and numeric characters, hyphens, and periods. You can assign multiple host names to the same host.

Windows Sockets (Winsock) programs can use one of two values for the destination to which you want to connect: the IPv6 address or a host name. When the IPv6 address is specified, name resolution is not required. When a host name is specified, the host name must be resolved to an IPv6 address before IPv6-based communication with a resource can begin.

Host names can take various forms. The two most common forms are a nickname and a domain name. A nickname is an alias for an IPv6 address that individuals can assign and use. A domain name is a structured name in a hierarchical namespace named Domain Name System (DNS). An example of a domain name is www.microsoft.com.

Nicknames or domain names are resolved through entries in the Hosts file, which is stored in the systemroot\System32\Drivers\Etc folder. For IPv6 name-to-address entries, the IPv6 address is written by using standard colon-hexadecimal format. For more information, see Expressing IPv6 addresses and TCP/IP database files.

Domain names are resolved by sending DNS name queries to a configured DNS server, which is a computer that either stores domain name-to-IPv6 address mapping records or has records of other DNS servers. The DNS server resolves the queried domain name to an IPv6 address and returns the results. The DNS client in XOX and the Windows Server 2003 family supports the processing of AAAA (quad-A) resource records. All DNS queries and responses are sent by using IPv6 and IPv4. DNS name devolution for fully qualified domain names is also supported. For more information, see DNS defined.


Core protocols of IPv6

This section covers:

  • Internet Protocol version 6 (IPv6)
  • Internet Control Message Protocol for IPv6 (ICMPv6)
  • Multicast Listener Discovery (MLD)
  • Neighbor Discovery (ND)


Internet Protocol version 6 (IPv6)

IPv6 is defined in RFC 2460, "Internet Protocol, Version 6 (IPv6) Specification." IPv6 is a connectionless, unreliable datagram protocol used primarily for addressing and routing packets between hosts.

Connectionless means that a session is not established before exchanging data. Unreliable means that delivery is not guaranteed. IPv6 always makes a best-effort attempt to deliver a packet. An IPv6 packet might be lost, delivered out of sequence, duplicated, or delayed. IPv6 does not attempt to recover from these types of errors. The acknowledgment of packets delivered and the recovery of lost packets are done by a higher-layer protocol, such as TCP.

An IPv6 packet, also known as an IPv6 datagram, consists of an IPv6 header and an IPv6 payload, as shown in the following illustration.

An IPv6 packet

The IPv6 header contains the following fields for addressing and routing.

IPv6 header field | Function
Source Address | The IPv6 address of the original source of the IPv6 packet.
Destination Address | The IPv6 address of the intermediate or final destination of the IPv6 packet.
Hop Limit | The number of network segments on which the packet is allowed to travel before being discarded by a router. The Hop Limit is set by the sending host and is used to prevent packets from endlessly circulating on an IPv6 internetwork. When forwarding an IPv6 packet, IPv6 routers are required to decrease the Hop Limit by 1 and to discard the IPv6 packet when the Hop Limit is 0.

Note

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.


Internet Control Message Protocol for IPv6 (ICMPv6)

Internet Control Message Protocol for IPv6 (ICMPv6) is a required IPv6 standard defined in RFC 2463, "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification." With ICMPv6, hosts and routers that use IPv6 communication can report errors and send simple echo messages.

The ICMPv6 protocol also provides a framework for the following:

  • Multicast Listener Discovery (MLD)

    • MLD is a series of three ICMPv6 messages that replace version 2 of the Internet Group Management Protocol (IGMP) for IPv4 to manage subnet multicast membership. For more information, see Multicast Listener Discovery (MLD).

  • Neighbor Discovery (ND)

    • Neighbor Discovery is a series of five ICMPv6 messages that manage node-to-node communication on a link. Neighbor Discovery replaces Address Resolution Protocol (ARP), ICMPv4 Router Discovery, and the ICMPv4 Redirect message and provides additional functions. For more information, see Neighbor Discovery (ND).

ICMPv6 messages are usually sent automatically when an IPv6 packet cannot reach its destination.

ICMPv6 messages are encapsulated and sent as the payload of IPv6 packets, as shown in the following illustration.

ICMPv6 encapsulation in an IPv6 packet

Different types of ICMPv6 messages are identified in the ICMPv6 header. Because ICMPv6 messages are carried in IPv6 packets, they are unreliable.

ICMPv6 messages that are not related to MLD or ND are listed and described in the following table.

ICMPv6 message | Description
Destination Unreachable | An error message that informs the sending host that a packet cannot be delivered.
Packet Too Big | An error message that informs the sending host that the packet is too large to forward.
Time Exceeded | An error message that informs the sending host that the Hop Limit of an IPv6 packet has expired.
Parameter Problem | An error message that informs the sending host that an error was encountered in processing the IPv6 header or an IPv6 extension header.
Echo Request | An informational message that is used to determine whether an IPv6 node is available on the network.
Echo Reply | An informational message that is used to reply to the ICMPv6 Echo Request message.

You can use the ping command to send ICMPv6 Echo Request messages and record the receipt of ICMPv6 Echo Reply messages. With ping, you can detect network or host communication failures and troubleshoot common IPv6 connectivity problems. For more information, see To test IPv6 connectivity by using the ping command.

You can use the tracert command to send ICMPv6 Echo Request messages with incrementally increasing values in the Hop Limit field. Tracert will trace and display the path taken by IPv6 packets between a source and destination, allowing you to troubleshoot common IPv6 routing problems. For more information, see To trace a path by using the tracert command.

Note

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.


Multicast Listener Discovery (MLD)

The use of multicasting in IP networks is defined as a TCP/IP standard in RFC 1112, "Internet Group Management Protocol (IGMP)." This RFC defines address and host extensions for the way in which IP hosts support multicasting. The same concepts originally developed for the current version of IP, known as IP version 4 (IPv4), also apply to IPv6.

What is multicasting?

Multicast traffic is sent to a single address but is processed by multiple hosts. Multicasting is similar to a newsletter subscription. As only subscribers receive the newsletter when it is published, only host computers that belong to the multicast group receive and process traffic sent to the group's reserved address. The set of hosts listening on a specific multicast address is called a multicast group.

Other important aspects of multicasting include the following:

  • Group membership is dynamic, allowing hosts to join and leave the group at any time.
  • The joining of multicast groups is performed through the sending of group membership messages. In IPv6, Multicast Listener Discovery (MLD) messages are used to determine group membership on a network segment, also known as a link or subnet.
  • Groups are not limited by size and members can be spread out across multiple network segments (if connecting routers support the forwarding of multicast traffic and group membership information).
  • A host can send traffic to the group's address without belonging to the corresponding group.

IPv6 multicast addressing

IPv6 multicast addresses are reserved and assigned from the Format Prefix 1111 1111 (0xFF). The following table is a partial list of IPv6 multicast addresses that are reserved for IPv6 multicasting and registered with the Internet Assigned Numbers Authority (IANA).

IPv6 multicast address | Description
FF02::1 | The all-nodes address used to reach all nodes on the same link.
FF02::2 | The all-routers address used to reach all routers on the same link.
FF02::4 | The all-Distance Vector Multicast Routing Protocol (DVMRP) routers address used to reach all DVMRP multicast routers on the same link.
FF02::5 | The all-Open Shortest Path First (OSPF) routers address used to reach all OSPF routers on the same link.
FF02::6 | The all-OSPF designated routers address used to reach all OSPF designated routers on the same link.
FF02::1:FFXX:XXXX | The solicited-node address used in the address resolution process to resolve the IPv6 address of a link-local node to its link-layer address. The last 24 bits (XX:XXXX) of the solicited-node address are the last 24 bits of an IPv6 unicast address.

For a full and current listing of additional IPv6 addresses that are reserved for multicasting, see the Information Sciences Institute Web site document: Internet Protocol Version 6 Multicast Addresses.

A single IPv6 multicast address identifies each multicast group. Each group's reserved IPv6 address is shared by all host members of the group who listen and receive any IPv6 messages sent to the group's address.

IPv6 multicast addresses are mapped to a reserved set of media access control (MAC) multicast addresses. For information about the mapping of IPv6 multicast addresses to Ethernet MAC addresses, see RFC 2464, "Transmission of IPv6 Packets over Ethernet Networks."

Note

  • XOX

MLD messages

MLD is used to exchange membership status information between IPv6 routers that support multicasting and members of multicast groups on a network segment. Host membership in a multicast group is reported by individual member hosts, and membership status is periodically polled by multicast routers. MLD is defined in RFC 2710, "Multicast Listener Discovery (MLD) for IPv6."

MLD message types are described in the following table.

MLD message type | Description
Multicast Listener Query | Sent by a multicast router to poll a network segment for group members. Queries can be general (requesting group membership for all groups), or specific (requesting group membership for a specific group).
Multicast Listener Report | Sent by a host when it joins a multicast group, or in response to an MLD Multicast Listener Query sent by a router.
Multicast Listener Done | Sent by a host when it leaves a host group and might be the last member of that group on the network segment.

MLD messages are sent as ICMPv6 messages.

Note

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.


Neighbor Discovery (ND)

IPv6 Neighbor Discovery (ND) is a set of messages and processes that determine relationships between neighboring nodes. ND replaces Address Resolution Protocol (ARP), Internet Control Message Protocol (ICMP) Router Discovery, and ICMP Redirect, which are used in IPv4, and provides additional functionality. ND is described in RFC 2461, "Neighbor Discovery for IP Version 6 (IPv6)."

ND is used by hosts to:

  • Discover neighboring routers.
  • Discover addresses, address prefixes, and other configuration parameters.

ND is used by routers to:

  • Advertise their presence, host configuration parameters, and on-link prefixes.
  • Inform hosts of a better next-hop address to forward packets for a specific destination.

ND is used by nodes to:

  • Both resolve the link-layer address of a neighboring node to which an IPv6 packet is being forwarded and determine when the link-layer address of a neighboring node has changed.
  • Determine whether IPv6 packets can be sent to and received from a neighbor.

The following table lists and describes ND processes.

Process | Description
Router discovery | The process by which a host discovers the local routers on an attached link (equivalent to ICMPv4 Router Discovery) and automatically configures a default router (equivalent to a default gateway in IPv4).
Prefix discovery | The process by which a host discovers the network prefixes for local destinations.
Parameter discovery | The process by which a host discovers additional operating parameters, including the link maximum transmission unit (MTU) and the default hop limit for outbound packets.
Address autoconfiguration | The process for configuring IP addresses for interfaces in either the presence or absence of a stateful address configuration server such as Dynamic Host Configuration Protocol version 6 (DHCPv6). For more information, see IPv6 address autoconfiguration.
Address resolution | The process by which a node resolves a neighboring node's IPv6 address to its link-layer address (equivalent to ARP in IPv4). The resolved link-layer address becomes an entry in a node's neighbor cache (equivalent to the ARP cache in IPv4). You can use the netsh interface ipv6 show neighbors command to view the contents of the neighbor cache on a computer running the Windows Server 2003 family and XOX. The neighbor cache displays the interface identifier for the neighbor cache entry, the neighboring node's IPv6 address, the corresponding link-layer address, and the state of the neighbor cache entry. For more information, see To view the neighbor cache and Netsh commands for Interface IPv6.
Next-hop determination | The process by which a node determines the IPv6 address of the neighbor to which a packet is being forwarded based on the destination address. The forwarding or next-hop address is either the destination address of the packet being sent or the address of a neighboring router. The resolved next hop address for a destination becomes an entry in a node's destination cache (also known as a route cache). You can use the netsh interface ipv6 show destinationcache command to view the contents of the destination cache on a computer running the Windows Server 2003 family and XOX. The destination cache displays the destination address, the interface identifier and next-hop address, the interface identifier and address used as a source address when sending to the destination, and the path MTU for the destination. For more information, see To view the destination cache and Netsh commands for Interface IPv6.
Neighbor unreachability detection | The process by which a node determines that IPv6 packets cannot be sent to and received from a neighboring node. After the link-layer address for a neighbor has been determined, the state of the entry in the neighbor cache is tracked. If the neighbor is no longer receiving and sending back packets, the neighbor cache entry is eventually removed. Neighbor unreachability detection provides a mechanism for IPv6 to determine that neighboring hosts or routers are no longer available on the local network segment.
Duplicate address detection | The process by which a node determines that an address considered for use is not already in use by a neighboring node (equivalent to the use of gratuitous ARP frames in IPv4).
Redirect function | The process by which a router informs a host of a better first-hop IPv6 address to reach a destination (equivalent to the function of the IPv4 ICMP Redirect message).

Note

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.


IPv6 addressing and routing

This section covers:

  • IPv6 address autoconfiguration
  • IPv6 routing
  • The IPv6 routing table
  • IPv6 addressing


IPv6 address autoconfiguration

A highly useful aspect of IPv6 is its ability to automatically configure itself without the use of a stateful configuration protocol, such as Dynamic Host Configuration Protocol for IPv6 (DHCPv6). By default, an IPv6 host can configure a link-local address for each interface. By using router discovery, a host can also determine the addresses of routers, additional addresses, and other configuration parameters. Included in the Router Advertisement message is an indication of whether a stateful address configuration protocol should be used.

Address autoconfiguration can only be performed on multicast-capable interfaces. Address autoconfiguration is described in RFC 2462, "IPv6 Stateless Address Autoconfiguration."

Autoconfigured address states

Autoconfigured addresses are in one or more of the following states:

  • Tentative

    • The address is in the process of being verified as unique. Verification occurs through duplicate address detection.

  • Preferred

    • An address for which uniqueness has been verified. A node can send and receive unicast traffic to and from a preferred address. The period of time that an address can remain in the tentative and preferred states is included in the Router Advertisement message.

  • Deprecated

    • An address that is still valid, but its use is discouraged for new communication. Existing communication sessions can continue to use a deprecated address. A node can send and receive unicast traffic to and from a deprecated address.

  • Valid

    • An address from which unicast traffic can be sent and received. The valid state covers both the preferred and deprecated states. The amount of time that an address remains in the tentative and valid states is included in the Router Advertisement message. The valid lifetime must be greater than or equal to the preferred lifetime.

  • Invalid

    • An address for which a node can no longer send or receive unicast traffic. An address enters the invalid state after the valid lifetime expires.

The relationship between the states of an autoconfigured address and the preferred and valid lifetimes is shown in the following illustration.

The states and lifetimes for an autoconfigured address

Note

  • With the exception of link-local addresses, address autoconfiguration is only specified for hosts. Routers must obtain address and configuration parameters through another means (for example, manual configuration).

Types of autoconfiguration

There are three types of autoconfiguration:

  1. Stateless

    2. Configuration of addresses is based on the receipt of Router Advertisement messages. These messages include stateless address prefixes and require that hosts not use a stateful address configuration protocol.

  2. Stateful

    3. Configuration is based on the use of a stateful address configuration protocol, such as DHCPv6, to obtain addresses and other configuration options. A host uses stateful address configuration when it receives Router Advertisement messages that do not include address prefixes and require that the host use a stateful address configuration protocol. A host will also use a stateful address configuration protocol when there are no routers present on the local link.

  3. Both

    4. Configuration is based on receipt of Router Advertisement messages. These messages include stateless address prefixes and require that hosts use a stateful address configuration protocol.

For all autoconfiguration types, a link-local address is always configured.

Autoconfiguration process

The address autoconfiguration process for an IPv6 node occurs as follows:

  1. A tentative link-local address is derived, based on the link-local prefix of FE80::/64 and the 64-bit interface identifier.
  2. Duplicate address detection is performed to verify the uniqueness of the tentative link-local address.
  3. If duplicate address detection fails, manual configuration must be performed on the node.
  4. If duplicate address detection succeeds, the tentative link-local address is assumed to be unique and valid. The link-local address is initialized for the interface. The corresponding solicited-node multicast link-layer address is registered with the network adapter.

For an IPv6 host, address autoconfiguration continues as follows:

  1. The host sends a Router Solicitation message.
  2. If no Router Advertisement messages are received, then the host uses a stateful address configuration protocol to obtain addresses and other configuration parameters. The IPv6 protocol for the Windows Server 2003 family and XOX does not support the use of a stateful address configuration protocol.
  3. If a Router Advertisement message is received, the configuration information that is included in the message is set on the host.
  4. For each stateless autoconfiguration address prefix that is included:
    • The address prefix and the appropriate 64-bit interface identifier are used to derive a tentative address.
    • Duplicate address detection is used to verify the uniqueness of the tentative address.
      • If the tentative address is in use, the address is not initialized for the interface.
      • If the tentative address is not in use, the address is initialized. This includes setting the valid and preferred lifetimes based on information included in the Router Advertisement message.
  5. If it is specified in the Router Advertisement message, the host uses a stateful address configuration protocol to obtain additional addresses or configuration parameters.

Notes

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.
  • Standards for stateful address configuration for IPv6 are in development. The IPv6 protocol for the Windows Server 2003 family and XOX does not support stateful address configuration or the DHCPv6 protocol.


IPv6 routing

Routing is the process of forwarding packets between connected network segments. For IPv6-based networks, routing is the part of IPv6 that provides forwarding capabilities between hosts that are located on separate segments within a larger IPv6-based network.

IPv6 is the mailroom in which IPv6 data sorting and delivery occur. Each incoming or outgoing packet is called an IPv6 packet. An IPv6 packet contains both the source address of the sending host and the destination address of the receiving host. Unlike link-layer addresses, IPv6 addresses in the IPv6 header typically remain the same as the packet travels across an IPv6 network.

Routing is the primary function of IPv6. IPv6 packets are exchanged and processed on each host by using IPv6 at the Internet layer.

Above the IPv6 layer, transport services on the source host pass data in the form of TCP segments or UDP messages down to the IPv6 layer. The IPv6 layer creates IPv6 packets with source and destination address information that is used to route the data through the network. The IPv6 layer then passes packets down to the link layer, where IPv6 packets are converted into frames for transmission over network-specific media on a physical network. This process occurs in reverse order on the destination host.

IPv6 layer services on each sending host examine the destination address of each packet, compare this address to a locally maintained routing table, and then determine what additional forwarding is required. IPv6 routers are attached to two or more IPv6 network segments that are enabled to forward packets between them.

IPv6 routers

IPv6 network segments, also known as links or subnets, are connected by IPv6 routers, which are devices that pass IPv6 packets from one network segment to another. This process is known as IPv6 routing and is shown in the following illustration.

IPv6 routing

IPv6 routers provide the primary means for joining together two or more physically separated IPv6 network segments. All IPv6 routers have the following characteristics:

  • IPv6 routers are physically multihomed hosts.

    A physically multihomed host is a network host that uses two or more network connection interfaces to connect to each physically separated network segment.

  • IPv6 routers provide packet forwarding for other IPv6 hosts.

    IPv6 routers are distinct from other hosts that use multihoming. An IPv6 router must be able to forward IPv6-based communication between networks for other IPv6 network hosts.

You can implement IPv6 routers by using a variety of hardware and software products, including a computer running a member of the Windows Server 2003 family with the IPv6 protocol. Routers that are dedicated hardware devices running specialized software are common. Regardless of the type of IPv6 routers that you use, all IPv6 routing relies on a routing table to communicate between network segments.

Routing tables

IPv6 hosts use a routing table to maintain information about other IPv6 networks and IPv6 hosts. Network segments are identified by using an IPv6 network prefix and prefix length. In addition, routing tables provide important information for each local host regarding how to communicate with remote networks and hosts.

For each computer on an IPv6 network, you can maintain a routing table with an entry for every other computer or network that communicates with that local computer. In general, this is not practical, and a default router is used instead.

Before a computer sends an IPv6 packet, it inserts its source IPv6 address and the destination IPv6 address (for the recipient) into the IPv6 header. The computer then examines the destination IPv6 address, compares it to a locally maintained IPv6 routing table, and takes appropriate action. The computer does one of three things:

  • It passes the packet to a protocol layer above IPv6 on the local host.
  • It forwards the packet through one of its attached network interfaces.
  • It discards the packet.

IPv6 searches the routing table for the route that is the closest match to the destination IPv6 address. The most specific to the least specific route is determined in the following order:

  1. A route that matches the destination IPv6 address (a host route with a 128-bit prefix length).
  2. A route that matches the destination with the longest prefix length.
  3. The default route (the network prefix ::/0).

If a matching route is not found, the destination is determined to be an on-link destination.

For more information, see The IPv6 routing table.


The IPv6 routing table

Every computer that runs IPv6 determines how to forward packets based on the contents of the IPv6 routing table. To display the IPv6 routing table on a computer that is running a member of the Windows Server 2003 family or XOX, type netsh interface ipv6 show routes at the Command Prompt.

Entries in the IPv6 routing table consist of:

  • An address prefix
  • The interface over which packets matching the address prefix are sent
  • A forwarding or next-hop address
  • A preference value used to select between multiple routes with the same prefix
  • The lifetime of the route
  • The specification of whether the route is published (advertised in a Routing Advertisement)
  • The specification of how the route is aged
  • The route type

The IPv6 routing table is built automatically, based on the current IPv6 configuration of your computer. When forwarding IPv6 packets, the routing table is searched by your computer for an entry that is the most specific match to the destination IPv6 address. A route for the link-local prefix (FE80::/64) is not displayed.

The default route (a route with a prefix of ::/0) is typically used to forward an IPv6 packet to a default router on the local link. Because the router that corresponds to the default router contains information about the network prefixes of the other IPv6 subnets within the larger IPv6 internetwork, it forwards the packet to other routers until it is eventually delivered to the destination.

For information about managing IPv6 routes, see Manage routes.


IPv6 addressing

This section covers:

  • IPv6 address space
  • Expressing IPv6 addresses
  • Unicast IPv6 addresses
  • Multicast IPv6 addresses
  • Anycast IPv6 addresses
  • Addresses for hosts and routers
  • IPv6 interface identifiers


IPv6 address space

The most obvious distinguishing feature of IPv6 is its use of much larger addresses. The size of an address in IPv6 is 128 bits, which is four times larger than an address in IPv4. A 32-bit address space allows for 232 or 4,294,967,296 possible addresses. A 128-bit address space allows for 2128 or 340,282,366,920,938,463,463,374,607,431,768,211,456 (3.4 × 1038) possible addresses.

In the late 1970s when the IPv4 address space was designed, it was unimaginable that it could be exhausted. However, due to changes in technology and an allocation practice that did not anticipate the recent explosion of hosts on the Internet, the IPv4 address space was consumed to the point that by 1992, it was clear a replacement would be necessary.

With IPv6, it is even harder to conceive that the IPv6 address space will be consumed. To help put this number in perspective, a 128-bit address space provides 655,570,793,348,866,943,898,599 (6.5 × 1023) addresses for every square meter of the Earth's surface.

It is important to note that the decision to make the IPv6 address 128 bits in length was not so that every square meter of the Earth could have 6.5 x 1023 addresses. Rather, the relatively large size of the IPv6 address is designed to be subdivided into hierarchical routing domains that reflect the topology of the modern-day Internet. The use of 128 bits provides multiple levels of hierarchy and flexibility in designing hierarchical addressing and routing that is currently lacking on the IPv4-based Internet.

The architecture of IPv6 addressing is described in RFC 2373, "IP Version 6 Addressing Architecture."

Current allocation

Similar to the way in which the IPv4 address space is divided, the IPv6 address space is divided based on the value of high order bits in the address. The high order bits and their fixed values are known as a Format Prefix (FP).

The following table shows the allocation of the IPv6 address space by FPs.

Allocation | Format Prefix (FP) | Fraction of the address space
Reserved | 0000 0000 | 1/256
Reserved for NSAP allocation | 0000 001 | 1/128
Aggregatable global unicast addresses | 001 | 1/8
Link-local unicast addresses | 1111 1110 10 | 1/1024
Site-local unicast addresses | 1111 1110 11 | 1/1024
Multicast addresses | 1111 1111 | 1/256

The remainder of the IPv6 address space is unassigned.

The current set of unicast addresses that can be used with IPv6 nodes consists of aggregatable global unicast addresses, link-local unicast addresses, and site-local unicast addresses. These represent only 15 percent of the entire IPv6 address space. For more information, see Unicast IPv6 addresses.

Note

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.


Expressing IPv6 addresses

IPv4 addresses are represented in dotted-decimal format. This 32-bit address is divided along 8-bit boundaries. Each set of 8 bits is converted to its decimal equivalent and separated by periods. For IPv6, the 128-bit address is divided along 16-bit boundaries, and each 16-bit block is converted to a 4-digit hexadecimal number and separated by colons. The resulting representation is called colon-hexadecimal.

The following is an IPv6 address in binary form:

0010000111011010000000001101001100000000000000000010111100111011
0000001010101010000000001111111111111110001010001001110001011010

The 128-bit address is divided along 16-bit boundaries, as follows:

0010000111011010   0000000011010011   0000000000000000   0010111100111011
0000001010101010   0000000011111111   1111111000101000   1001110001011010

Each 16-bit block is converted to hexadecimal and delimited with colons. The result is:

21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A

IPv6 representation can be further simplified by removing the leading zeros within each 16-bit block. However, each block must have at least a single digit. With leading zero suppression, the address representation becomes:

21DA:D3:0:2F3B:2AA:FF:FE28:9C5A

Compressing zeros

Some types of addresses contain long sequences of zeros. To further simplify the representation of IPv6 addresses, a contiguous sequence of 16-bit blocks set to 0 in the colon-hexadecimal format can be compressed to :: (known as double-colon).

For example, the link-local address of FE80:0:0:0:2AA:FF:FE9A:4CA2 can be compressed to FE80::2AA:FF:FE9A:4CA2. The multicast address of FF02:0:0:0:0:0:0:2 can be compressed to FF02::2. Zero compression can only be used to compress a single contiguous series of 16-bit blocks expressed in colon-hexadecimal notation. You cannot use zero compression to include part of a 16-bit block. For example, you cannot express FF02:30:0:0:0:0:0:5 as FF02:3::5.

To determine how many 0 bits are represented by the ::, you can count the number of blocks in the compressed address, subtract this number from 8, and then multiply the result by 16. For example, in the address FF02::2, there are two blocks (the FF02 block and the 2 block). The number of bits expressed by the :: is 96 (96 = (8 - 2) × 16).

Zero compression can only be used once in a given address. Otherwise, you could not determine the number of 0 bits represented by each instance of a double-colon (::).

IPv6 prefixes

The prefix is the part of the address that indicates the bits that have fixed values or are the bits of the network identifier. Prefixes for IPv6 routes and subnet identifiers are expressed in the same way as Classless Inter-Domain Routing (CIDR) notation for IPv4. An IPv6 prefix is written in address/prefix-length notation. For example, 21DA:D3::/48 is a route prefix and 21DA:D3:0:2F3B::/64 is a subnet prefix.

Note

  • IPv4 implementations commonly use a dotted decimal representation of the network prefix known as the subnet mask. A subnet mask is not used in IPv6. Only prefix-length notation is supported.


Unicast IPv6 addresses

A unicast address identifies a single interface within the scope of the type of unicast address. With the appropriate unicast routing topology, packets addressed to a unicast address are delivered to a single interface. The following types of addresses are unicast IPv6 addresses:

  • Aggregatable global unicast addresses
  • Link-local addresses
  • Site-local addresses
  • Special addresses
  • Compatibility addresses
  • NSAP addresses

Aggregatable global unicast addresses

Aggregatable global unicast addresses, identified by the Format Prefix (FP) of 001, are equivalent to public IPv4 addresses. They are globally routable and reachable on the IPv6 Internet. Aggregatable global unicast addresses are also known as global addresses.

As the name implies, aggregatable global unicast addresses are designed to be aggregated or summarized to produce an efficient routing infrastructure. Unlike the current IPv4-based Internet, which has a mixture of both flat and hierarchical routing, the IPv6-based Internet has been designed from its foundation to support efficient, hierarchical addressing and routing. The scope, the region of the IPv6 internetwork over which the address is unique, of an aggregatable global unicast address is the entire IPv6 Internet.

The structure of an aggregatable global unicast address

The fields in the aggregatable global unicast address are described as follows:

  • TLA ID

    • The TLA ID field indicates the Top Level Aggregation Identifier (TLA ID) for the address. The size of this field is 13 bits. The TLA identifies the highest level in the routing hierarchy. TLAs are administered by IANA and allocated to local Internet registries that, in turn, allocate individual TLA IDs to large, global Internet service providers (ISPs). A 13-bit field allows up to 8,192 different TLA IDs. Routers in the highest level of the IPv6 Internet routing hierarchy (called default-free routers) do not have a default route—only routes with 16-bit prefixes that correspond to the allocated TLAs.

  • Res

    • The Res field is reserved for future use in expanding the size of either the TLA ID or the NLA ID. The size of this field is 8 bits.

  • NLA ID

    • The NLA ID field indicates the Next Level Aggregation Identifier (NLA ) for the address. The NLA ID is used to identify a specific customer site. The size of this field is 24 bits. The NLA ID allows an ISP to create multiple levels of addressing hierarchy to organize addressing and routing and to identify sites. The structure of the ISP's network is not visible to the default-free routers.

  • SLA ID

    • The SLA ID field indicates the Site Level Aggregation Identifier (SLA ID) for the address. The SLA ID is used by an individual organization to identify subnets within its site. The size of this field is 16 bits. The organization can use these 16 bits within its site to create 65,536 subnets or multiple levels of addressing hierarchy and an efficient routing infrastructure. With 16 bits of subnetting flexibility, an aggregatable global unicast prefix assigned to an organization is equivalent to that organization being allocated an IPv4 Class A network ID (assuming that the last octet is used for identifying nodes on subnets). The structure of the customer's network is not visible to the ISP.

  • Interface ID

    • The Interface ID field indicates the interface of a node on a specific subnet. The size of this field is 64 bits.

The following illustration shows how the fields within the aggregatable global unicast address create a three-level topological structure.

The three-level structure of the aggregatable global unicast address

The public topology is the collection of larger and smaller ISPs that provide access to the IPv6 Internet. The site topology is the collection of subnets within an organization's site. The interface identifier identifies a specific interface on a subnet within an organization's site. For more information about aggregatable global unicast addresses, see RFC 2374, "An IPv6 Aggregatable Global Unicast Address Format."

Local-use unicast addresses

There are two types of local-use unicast addresses:

  1. Link-local addresses, which are used between on-link neighbors and for Neighbor Discovery processes.
  2. Site-local addresses, which are used between nodes that communicate with other nodes in the same site.

Link-local addresses

Link-local addresses, identified by the FP of 1111 1110 10, are used by nodes when communicating with neighboring nodes on the same link. For example, on a single link IPv6 network with no router, link-local addresses are used to communicate between hosts on the link. Link-local addresses are equivalent to Automatic Private IP Addressing (APIPA) IPv4 addresses (using the 169.254.0.0/16 prefix). The scope of a link-local address is the local link. A link-local address is required for Neighbor Discovery processes and is always automatically configured, even in the absence of all other unicast addresses. For more information about the address autoconfiguration process for link-local addresses, see IPv6 address autoconfiguration.

Link-local addresses always begin with FE80. With the 64-bit interface identifier, the prefix for link-local addresses is always FE80::/64. An IPv6 router never forwards link-local traffic beyond the link.

For information about how to use link-local addresses, see Single subnet with link-local addresses.

Site-local addresses

Site-local addresses, identified by the FP of 1111 1110 11, are equivalent to the IPv4 private address space (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16). For example, private intranets that do not have a direct, routed connection to the IPv6 Internet can use site-local addresses without conflicting with aggregatable global unicast addresses. Site-local addresses are not reachable from other sites, and routers must not forward site-local traffic outside of the site. Site-local addresses can be used in addition to aggregatable global unicast addresses. The scope of a site-local address is the site (the organization internetwork).

Unlike link-local addresses, site-local addresses are not automatically configured and must be assigned either through stateless or stateful address configuration processes. For more information, see IPv6 address autoconfiguration.

The first 48-bits are always fixed for site-local addresses, beginning with FEC0::/48. After the 48 fixed bits is a 16-bit subnet identifier (Subnet ID field) that provides 16 bits with which you can create subnets within your organization. With 16 bits, you can have up to 65,536 subnets in a flat subnet structure, or you can subdivide the high-order bits of the Subnet ID field to create a hierarchical and aggregatable routing infrastructure. After the Subnet ID field is a 64-bit Interface ID field that identifies a specific interface on a subnet.

The aggregatable global unicast address and site-local address share the same structure beyond the first 48 bits of the address. In aggregatable global unicast addresses, the SLA ID identifies the subnet within an organization. For site-local addresses, the Subnet ID performs the same function. Because of this, you can assign a specific subnet number to identify a subnet that is used for both site-local and aggregatable global unicast addresses.

Special addresses

The following are special IPv6 addresses:

  • Unspecified address

    • The unspecified address (0:0:0:0:0:0:0:0 or ::) is used only to indicate the absence of an address. It is equivalent to the IPv4 unspecified address of 0.0.0.0. The unspecified address is typically used as a source address for packets that are attempting to verify the uniqueness of a tentative address. The unspecified address is never assigned to an interface or used as a destination address.

  • Loopback address

    • The loopback address (0:0:0:0:0:0:0:1 or ::1) is used to identify a loopback interface, enabling a node to send packets to itself. It is equivalent to the IPv4 loopback address of 127.0.0.1. Packets addressed to the loopback address are never sent on a link or forwarded by an IPv6 router.

Compatibility addresses

To aid in the migration from IPv4 to IPv6 and facilitate the coexistence of both types of hosts, the following addresses are defined:

  • IPv4-compatible address

    • The IPv4-compatible address, 0:0:0:0:0:0:w.x.y.z or ::w.x.y.z (where w.x.y.z is the dotted decimal representation of a public IPv4 address), is used by dual-stack nodes that are communicating with IPv6 over an IPv4 infrastructure. Dual-stack nodes are nodes with both IPv4 and IPv6 protocols. When the IPv4-compatible address is used as an IPv6 destination, IPv6 traffic is automatically encapsulated with an IPv4 header and sent to the destination by using the IPv4 infrastructure.

  • IPv4-mapped address

    • The IPv4-mapped address, 0:0:0:0:0:FFFF:w.x.y.z or ::FFFF:w.x.y.z, is used to represent an IPv4-only node to an IPv6 node. It is used only for internal representation. The IPv4-mapped address is never used as a source or destination address for an IPv6 packet. The IPv6 protocol does not support the use of IPv4-mapped addresses.

  • 6to4 address

    • The 6to4 address is used for communicating between two nodes running both IPv4 and IPv6 over the Internet. The 6to4 address is formed by combining the prefix 2002::/16 with the 32 bits of the public IPv4 address of the node, forming a 48-bit prefix. For example, for the IPv4 address of 131.107.0.1, the 6to4 address prefix is 2002:836B:1::/48. For more information about 6to4, see IPv6 traffic between nodes in different sites across the Internet (6to4).

NSAP addresses

To provide a means for mapping Network Service Access Point (NSAP) addresses to IPv6 addresses, NSAP addresses use the FP of 0000001 and map the last 121 bits of the IPv6 address to an NSAP address. For more information about the four types of NSAP address mappings, see RFC 1888, "OSI NSAPs and IPv6."

Note

  • IPv6 is a rapidly evolving standard. The RFCs referenced might have been made obsolete by newer RFCs.


Multicast IPv6 addresses

A multicast address identifies multiple interfaces. With the appropriate multicast routing topology, packets addressed to a multicast address are delivered to all interfaces that are identified by the address.

IPv6 multicast addresses have the Format Prefix (FP) of 1111 1111. An IPv6 address is simple to classify as multicast because it always begins with FF. Multicast addresses cannot be used as source addresses.

Beyond the FP, multicast addresses include additional structure to identify their flags, scope, and multicast group, as shown in the following illustration.

The structure of an IPv6 multicast address

The fields in the multicast address are as follows:

  • Flags

    • The Flags field indicates flags that are set on the multicast address. The size of this field is 4 bits. As of RFC 2373, the only flag defined is the Transient (T) flag. The T flag uses the low-order bit of the Flags field. When set to 0, the T flag indicates that the multicast address is a permanently-assigned (well-known) multicast address allocated by the Internet Assigned Numbers Authority (IANA). When set to 1, the T flag indicates that the multicast address is a transient (not permanently assigned) multicast address.

  • Scope

    • The Scope field indicates the scope of the IPv6 internetwork for which the multicast traffic is intended. The size of this field is 4 bits. In addition to information provided by multicast routing protocols, routers use the multicast scope to determine whether multicast traffic can be forwarded.

    The following scopes are defined in RFC 2373:

    Scope field value | Scope
1 | Node-local
2 | Link-local
5 | Site-local
8 | Organization-local
E | Global

    For example, traffic with the multicast address of FF02::2 has a link-local scope. An IPv6 router never forwards this traffic beyond the local link.

  • Group ID

    • The Group ID field identifies the multicast group and is unique within the scope. The size of this field is 112 bits. Permanently assigned group IDs are independent of the scope. Transient group IDs are only relevant to a specific scope. Multicast addresses from FF01:: through FF0F:: are reserved, well-known addresses.

To identify all nodes for the node-local and link-local scopes, the following multicast addresses are defined:

  • FF01::1 (node-local scope all-nodes address)
  • FF02::1 (link-local scope all-nodes address)

To identify all routers for the node-local, link-local, and site-local scopes, the following multicast addresses are defined:

  • FF01::2 (node-local scope all-routers address)
  • FF02::2 (link-local scope all-routers address)
  • FF05::2 (site-local scope all-routers address)

With 112 bits in the Group ID, it is possible to have 2112 group IDs. However, because of the way in which IPv6 multicast addresses are mapped to Ethernet multicast MAC addresses, RFC 2373 recommends assigning the Group ID from the low order 32 bits of the IPv6 multicast address and setting the remaining original group ID bits to 0. By using only the low-order 32 bits in the group ID, each group ID maps to a unique Ethernet multicast MAC address.

Solicited-node address

The solicited-node address facilitates efficient querying of network nodes during address resolution. In IPv4, the ARP Request frame is sent to the MAC-level broadcast, disturbing all nodes on the network segment, including those that are not running IPv4. IPv6 uses the Neighbor Solicitation message to perform address resolution. However, instead of using the local-link scope all-nodes address as the Neighbor Solicitation message destination, which would disturb all IPv6 nodes on the local link, the solicited-node multicast address is used. The solicited-node multicast address consists of the prefix FF02::1:FF00:0/104 and the last 24-bits of the IPv6 address that is being resolved.

For example, for the node with the link-local IPv6 address of FE80::2AA:FF:FE28:9C5A, the corresponding solicited-node address is FF02::1:FF28:9C5A. To resolve the FE80::2AA:FF:FE28:9C5A address to its link layer address, a node sends a Neighbor Solicitation message to the solicited-node address of FF02::1:FF28:9C5A. The node that is using the address of FE80::2AA:FF:FE28:9C5A is listening for multicast traffic at the solicited-node address and, for interfaces that correspond to a physical network adapter, has registered the corresponding multicast address with the network adapter.

The result of using the solicited-node multicast address is that address resolution, which commonly occurs on a link, is not required to use a mechanism that disturbs all network nodes. In fact, very few nodes are disturbed during address resolution. In practice, because of the relationship between the Ethernet MAC address, the IPv6 interface ID, and the solicited-node address, the solicited-node address acts as a pseudo-unicast address for very efficient address resolution.


Anycast IPv6 addresses

An anycast address identifies multiple interfaces. With the appropriate routing topology, packets addressed to an anycast address are delivered to a single interface (the nearest interface that is identified by the address). The nearest interface is defined as being closest in terms of routing distance. A multicast address is used for one-to-many communication, with delivery to multiple interfaces. An anycast address is used for one-to-one-of-many communication, with delivery to a single interface.

In order to facilitate delivery to the nearest anycast group member, the routing infrastructure must be aware of the interfaces that are assigned anycast addresses and their distances in terms of routing metrics. At present, anycast addresses are used only as destination addresses and are assigned only to routers. Anycast addresses are assigned from the unicast address space. The scope of an anycast address is the scope of the type of unicast address from which the anycast address is assigned.

Subnet-router anycast address

The subnet-router anycast address is both predefined and required. It is created from the subnet prefix for a given interface. To construct the subnet-router anycast address, the bits in the subnet prefix are fixed at their appropriate values and the remaining bits are set to 0. All router interfaces attached to a subnet are assigned the subnet-router anycast address for that subnet. The subnet-router anycast address is used for communication with one of multiple routers attached to a remote subnet.


Addresses for hosts and routers

An IPv4 host with a single network adapter typically has a single IPv4 address assigned to that adapter. An IPv6 host, however, usually has multiple IPv6 addresses, even with a single interface.

An IPv6 host is assigned the following unicast addresses:

  • A link-local address for each interface
  • Unicast addresses for each interface (which could be a site-local address and one or multiple global addresses)
  • The loopback address (::1) for the loopback interface

Typical IPv6 hosts are logically multihomed because they have at least two addresses with which they can receive packets. Each host has a link-local address for local link traffic and a routable site-local or global address.

Additionally, each host is listening for traffic on the following multicast addresses:

  • The node-local scope all-nodes address (FF01::1)
  • The link-local scope all-nodes address (FF02::1)
  • The solicited-node address for each unicast address on each interface
  • The multicast addresses of joined groups on each interface

An IPv6 router is assigned the following unicast addresses:

  • A link-local address for each interface
  • Unicast addresses for each interface (which might be a site-local address and one or multiple aggregatable global unicast addresses)
  • The loopback address (::1) for the loopback interface

An IPv6 router is assigned the following anycast addresses:

  • A subnet-router anycast address for each subnet
  • Additional anycast addresses (optional)

Additionally, each router is listening for traffic on the following multicast addresses:

  • The node-local scope all-nodes address (FF01::1)
  • The node-local scope all-routers address (FF01::2)
  • The link-local scope all-nodes address (FF02::1)
  • The link-local scope all-routers address (FF02::2)
  • The site-local scope all-routers address (FF05::2)
  • The solicited-node address for each unicast address on each interface
  • The addresses of joined groups on each interface


IPv6 interface identifiers

The last 64 bits of an IPv6 address are the interface identifier that is unique to the 64-bit prefix of the IPv6 address. The ways in which an interface identifier is determined are as follows:

  • RFC 2373 states that all unicast addresses that use the prefixes 001 through 111 must also use a 64-bit interface identifier that is derived from the Extended Unique Identifier (EUI)-64 address.
  • RFC 3041 describes a randomly-generated interface identifier that changes over time to provide a level of anonymity.
  • An interface identifier that is assigned during stateful address autoconfiguration (for example, through DHCPv6). DHCPv6 standards are currently being defined. The IPv6 protocol for the Windows Server 2003 family and XOX does not support stateful address configuration or DHCPv6.
  • An interface identifier that is manually configured.

EUI-64 address-based interface identifiers

The 64-bit EUI-64 address is defined by the Institute of Electrical and Electronic Engineers (IEEE). EUI-64 addresses are either assigned to a network adapter or derived from IEEE 802 addresses.

IEEE 802 addresses

Traditional interface identifiers for network adapters use a 48-bit address called an IEEE 802 address. This address consists of a 24-bit company ID (also called the manufacturer ID), and a 24-bit extension ID (also called the board ID). The combination of the company ID, which is uniquely assigned to each manufacturer of network adapters, and the board ID, which is uniquely assigned to each network adapter at the time of assembly, produces a globally unique 48-bit address. This 48-bit address is also called the physical, hardware, or media access control (MAC) address.

The structure of the 48-bit IEEE 802 address

Defined bits within the IEEE 802 address are the following:

  • Universal/Local (U/L)

    • The U/L bit is the seventh bit of the first byte and is used to determine whether the address is universally or locally administered. If the U/L bit is set to 0, the IEEE, through the designation of a unique company ID, has administered the address. If the U/L bit is set to 1, the address is locally administered. The network administrator has overridden the manufactured address and specified a different address.

  • Individual/Group (I/G)

    • The I/G bit is the low order bit of the first byte and is used to determine whether the address is an individual address (unicast) or a group address (multicast). When set to 0, the address is a unicast address. When set to 1, the address is a multicast address.

For a typical 802.x network adapter address, both the U/L and I/G bits are set to 0, corresponding to a universally administered, unicast MAC address.

IEEE EUI-64 addresses

The IEEE EUI-64 address represents a new standard for network interface addressing. The company ID is still 24-bits in length, but the extension ID is 40 bits, creating a much larger address space for a network adapter manufacturer. The EUI-64 address uses the U/L and I/G bits in the same way as the IEEE 802 address.

The structure of the EUI-64 address

Mapping IEEE 802 addresses to EUI-64 addresses

To create an EUI-64 address from an IEEE 802 address, the 16 bits of 11111111 11111110 (0xFFFE) are inserted into the IEEE 802 address between the company ID and the extension ID. The following illustration shows the conversion of an IEEE 802 address to an EUI-64 address.

The conversion of an IEEE 802 address to an EUI-64 address

Mapping EUI-64 addresses to IPv6 interface identifiers

To obtain the 64-bit interface identifier for IPv6 unicast addresses, the U/L bit in the EUI-64 address is complemented (if it is a 1, it is set to 0; and if it is a 0, it is set to 1). The following illustration shows the conversion for a universally administered, unicast EUI-64 address.

The conversion of a universally administered, unicast EUI-64 address to an IPv6 interface identifier

To obtain an IPv6 interface identifier from an IEEE 802 address, you must first map the IEEE 802 address to an EUI-64 address, and then complement the U/L bit. The following illustration shows the conversion process for a universally administered, unicast IEEE 802 address.

The conversion of a universally administered, unicast IEEE 802 address to an IPv6 interface identifier

IEEE 802 address conversion example

Host A has the Ethernet MAC address of 00-AA-00-3F-2A-1C. First, it is converted to EUI-64 format by inserting FF-FE between the third and fourth bytes, yielding 00-AA-00-FF-FE-3F-2A-1C. Next, the U/L bit, which is the seventh bit in the first byte, is complemented. The first byte in binary form is 00000000. When the seventh bit is complemented, it becomes 00000010 (0x02). The final result is 02-AA-00-FF-FE-3F-2A-1C which, when converted to colon-hexadecimal notation, becomes the interface identifier 2AA:FF:FE3F:2A1C. As the result, the link-local address that corresponds to the network adapter with the MAC address of 00-AA-00-3F-2A-1C is FE80::2AA:FF:FE3F:2A1C.

Note

  • When complementing the U/L bit, add 0x2 to the first byte if the EUI-64 address is universally administered, and subtract 0x2 from the first byte if the EUI-64 address is locally administered.

Temporary address interface identifiers

In today's IPv4-based Internet, a typical Internet user connects to an Internet service provider (ISP) and obtains an IPv4 address by using the Point-to-Point Protocol (PPP) and the Internet Protocol Control Protocol (IPCP). Each time the user connects, a different IPv4 address might be obtained. Because of this, it is difficult to track a user's traffic on the Internet on the basis of IP address.

For IPv6-based dial-up connections, the user is assigned a 64-bit prefix after the connection is made through router discovery and stateless address autoconfiguration. If the interface identifier is always based on the EUI-64 address (as derived from the static IEEE 802 address), it is possible to identify the traffic of a specific node regardless of the prefix, making it easy to track a specific user and their use of the Internet. To address this concern and provide a level of anonymity, an alternative IPv6 interface identifier that is randomly generated and changes over time is described in RFC 3041.

The initial interface identifier is generated by using random numbers. For IPv6 systems that cannot store any historical information for generating future interface identifier values, a new random interface identifier is generated each time the IPv6 protocol is initialized. For IPv6 systems that have storage capabilities, a history value is stored and, when the IPv6 protocol is initialized, a new interface identifier is created through the following process:

  1. Retrieve the history value from storage and append the interface identifier based on the EUI-64 address of the adapter.
  2. Compute the Message Digest-5 (MD5) one-way encryption hash over the quantity in step 1.
  3. Save the last 64 bits of the MD5 hash computed in step 2 as the history value for the next interface identifier computation.
  4. Take the first 64 bits of the MD5 hash computed in Step 2 and set the seventh bit to zero. The seventh bit corresponds to the U/L bit which, when set to 0, indicates a locally administered interface identifier. The result is the interface identifier.

The resulting IPv6 address, based on this random interface identifier, is known as a temporary address. Temporary addresses are generated for public address prefixes that use stateless address autoconfiguration. Temporary addresses are used for the lower of the following values of the valid and preferred lifetimes:

  • The lifetimes included in the Prefix Information option in the received Router Advertisement message.
  • Local default values of 1 week for valid lifetime and 1 day for preferred lifetime.

After the valid lifetime of a temporary address expires, a new interface identifier and temporary address are generated.

The IPv6 protocol for the Windows Server 2003 family does not create temporary addresses for global address prefixes by default. You can modify this default setting with the netsh interface ipv6 set privacy state=enabled command. For more information, see Netsh commands for Interface IPv6.


IPv6 and network applications

This section covers:

  • Support for Windows Sockets
  • IPv6 applications


Support for Windows Sockets

Changes to existing Windows Sockets functions for IPv6 are documented in RFC 2553, "Basic Socket Interface Extensions for IPv6." The IPv6 protocol for the Windows Server 2003 family supports RFC 2553 with the following exceptions:

  • The header files listed in the RFC do not apply to the Windows Server 2003 family. The Windows Server 2003 family header files are Winsock2.h and Ws2tcpip.h.
  • The Windows Server 2003 family socket structure does not include the sa_len member. Therefore, section 3.3 applies, but section 3.4 does not.
  • IPv4-mapped addresses, as described in section 3.7, are not supported.
  • The interface identification functions described in Section 4 are not supported.
  • Sections 6.1 through 6.3 and 6.6 are not supported because they are in the process of being made obsolete by the Internet Engineering Task Force (IETF).

Tools for IPv6 application development

For Winsock IPv6 application development, the following are required:

  • Microsoft Platform SDK (January 2000 or later)
  • Microsoft Visual C++ 6.0 or later
  • IPv6 protocol for the Windows Server 2003 family


IPv6 applications

The Windows Server 2003 family includes the following IPv6-enabled applications and components:

  • FTP client

    • The File Transfer Protocol (FTP) client, Ftp.exe, can be used to establish FTP sessions with IPv4 and IPv6 FTP servers.

  • Telnet client

    • The Telnet client, Telnet.exe, can be used to establish Telnet sessions with IPv4 and IPv6 Telnet servers.

  • Internet Explorer

    • The new Internet extensions dynamic link library, Wininet.dll, enables Web browsers to access IPv6-enabled Web servers. For example, Wininet.dll is used by Microsoft Internet Explorer to make connections with a Web server to view Web pages. Internet Explorer uses IPv6 to download Web pages when the Domain Name System (DNS) query for the name of the Web server in the URL returns an IPv6 address.

    URLs that use the format for literal IPv6 addresses described in RFC 2732, "Format for Literal IPv6 Addresses in URLs," are not supported by the version of Internet Explorer provided with Windows 2000.

    For a list of IPv6-only Web sites, see the IPv6 Web site. Accessing IPv6-only Web sites assumes that you can connect to the IPv6 Internet. For more information about connecting to the IPv6 Internet, see Connecting to the IPv6 Internet.

Additionally, the Remote Procedure Call (RPC) components of Windows Server 2003 family are IPv6-enabled and the versions of Network Monitor provided with the Windows Server 2003 family, Windows 2000, and Systems Management Server 2.0 support the parsing of IPv6 headers.

Notes

  • XOX
  • Internet Explorer cannot browse IPv6 Web sites if it is configured to use a proxy server. When Internet Explorer is configured to use a proxy server, all name resolution requests for Web sites are forwarded to the proxy server. Until the proxy server is IPv6-enabled, proxy-based requests for local or remote IPv6 Web pages are unsuccessful. For information about how to configure Internet Explorer to operate without the use of a proxy server, see Internet Explorer Help.


Administering IPv6

This section covers:

  • IPv6 configuration items
  • IPv6 configuration methods
  • IPv6 configurations
  • Setting up an IPv6 test lab


IPv6 configuration items

You can configure the following for the IPv6 protocol:

  • IPv6 address
  • Default router
  • DNS server

IPv6 address

By default, link-local addresses are automatically configured for each interface on each IPv6 node (host or router) with a unique link-local IPv6 address. If you want to communicate with IPv6 nodes that are not on attached links, the host must have additional site-local or global unicast addresses. Additional addresses for hosts are either obtained from router advertisements sent by a router or assigned manually. Additional addresses for routers must be assigned manually.

For more information, see Unicast IPv6 addresses, To configure IPv6 with manual addresses, and IPv6 address autoconfiguration.

Default router

To communicate with IPv6 nodes on other network segments, IPv6 must use a default router. A default router is automatically assigned based on the receipt of a router advertisement. Alternately, you can add a default route to the IPv6 routing table. You do not need to configure a default router for a network that consists of a single network segment.

For more information, see IPv6 address autoconfiguration and To add an IPv6 route.

DNS server

You can use a Domain Name System (DNS) server to resolve host names to IPv6 addresses. When an IPv6 host is configured with the address of a DNS server, the host sends DNS name queries to the server for resolution. AAAA (quad-A) resource records, which are stored on your DNS servers, enable mapping from a host name to its IPv6 address.

To enable DNS name resolution, configure an IPv6 router with forwarding enabled and a global prefix that is advertised to clients. You can do this by using the netsh interface ipv6 add route and netsh interface ipv6 set interface commands. For more information, see To add an IPv6 route and To enable IPv6 forwarding.

By default, DNS is configured to allow DNS dynamic updates. You can either leave dynamic update enabled when you use IPv6 with DNS, or you can manually add DNS records for IPv6 clients.

Configuring clients with the DNS server address

To provide communication between DNS clients and servers, you can configure the clients with the IPv6 address of the DNS server, or you can configure your DNS server with one of the three default DNS server IPv6 addresses that are automatically configured on all IPv6 clients.

You can configure clients with the IPv6 address of the DNS server by using the netsh interface ipv6 add dns command at each client computer or in a logon script that is run each time a client logs on to the network.

To configure the DNS server with one of the three IPv6 addresses that are available on IPv6 client computers by default, use the netsh interface ipv6 add address command. The three default DNS server addresses are:

  • FEC0:0:0: FFFF::1
  • FEC0:0:0: FFFF::2
  • FEC0:0:0:FFFF::3

If your DNS server is on a different subnet than your IPv6 clients, configure a static route to the DNS server on any IPv6 router that is available on the DNS server's subnet.

Configuring the DNS server to listen on IPv6

You can configure the DNS server to listen for DNS name registration and resolution requests over IPv6. When your DNS server is configured to listen on both IPv4 and IPv6:

  • Devices that function over IPv6 but not IPv4 will function properly with your DNS server.
  • Computers and other devices that are configured with both IPv4 and IPv6 use IPv6 by default.

To configure your DNS server to listen over IPv6, do the following:

  1. Install Windows Support Tools.

    2. For more information, see To install Windows Support Tools

  2. Open Command Prompt.
  3. Type the following command:

    4. dnscmd /config /EnableIPv6 1

  4. Restart the DNS Server service.

    5. For more information, see To start or stop a DNS server.

For more information, see Name resolution, Domain Name System (DNS), and Netsh commands for Interface IPv6.


IPv6 configuration methods

The IPv6 protocol can use the following configuration methods:

  • Automatic configuration using stateless addresses
  • Manual configuration

Automatic configuration

The IPv6 protocol supports address autoconfiguration for stateless addresses as defined in RFC 2462, "IPv6 Stateless Address Autoconfiguration." IPv6 nodes (hosts and routers) automatically create unique link-local addresses for all LAN interfaces that appear to be Ethernet or FDDI interfaces. IPv6 hosts use received Router Advertisement messages to automatically configure:

  • A default router.
  • The default setting for the Hop Limit field in the IPv6 header.
  • The determination of whether the node should use a stateful address configuration protocol, such as Dynamic Host Configuration Protocol for IPv6 (DHCPv6), for addresses and other configuration requirements. The IPv6 protocol for the Windows Server 2003 family does not currently support DHCPv6 or any other stateful address configuration protocol.
  • The timers used in Neighbor Discovery processes.
  • The maximum transmission unit (MTU) of the local link.
  • The list of network prefixes that are defined for the link. Each network prefix contains both the IPv6 network prefix and its valid and preferred lifetimes. If indicated, a network prefix is combined with the interface identifier to create a stateless IPv6 address configuration for the receiving interface. A network prefix also defines the range of addresses for nodes on the local link.

For more information, see IPv6 address autoconfiguration.

Additionally, the IPv6 protocol for the Windows Server 2003 family automatically configures:

  • 6to4 addresses on a 6to4 tunneling interface for all public IPv4 addresses that are assigned to the computer (if a Router Advertisement is not received and the computer is configured with a public IPv4 address).
  • Intrasite Automatic Tunnel Addressing Protocol (ISATAP) addresses on the Automatic Tunneling Pseudo-Interface for all IPv4 addresses that are assigned to the computer.
  • Routes to off-link prefixes (if the off-link address prefix is advertised by a router running a member of the Windows Server 2003 family).

Manual configuration

You can manually configure IPv6 addresses and routes by using the Netsh commands for Interface IPv6 command-line tool. Manual configuration might be required in a network that has multiple IPv6 network segments within which routers are not configured to send router advertisements.

For more information, see Netsh commands for Interface IPv6, To configure IPv6 with manual addresses, and To add an IPv6 route.


IPv6 configurations

This section covers:

  • Single subnet with link-local addresses
  • Using IPSec between two local link hosts
  • IPv6 traffic between nodes on different subnets of an IPv6 internetwork
  • IPv6 traffic between nodes on different subnets of an IPv4 internetwork
  • IPv6 traffic between nodes in different sites across the Internet (6to4)
  • Connecting to the IPv6 Internet
  • Using IPv4-compatible addresses


Single subnet with link-local addresses

This configuration requires only the installation of the IPv6 protocol on at least two nodes on the same network segment (also known as a link or subnet) with no intermediate routers.

The following illustration shows the configuration of two nodes on a single subnet using link-local addresses.

Two nodes on a single subnet using link-local addresses

By default, the IPv6 protocol for the Windows Server 2003 family and XOX configures link-local addresses for each interface that corresponds to installed Ethernet network adapters. Link-local addresses have the prefix of FE80::/64. The last 64 bits of the IPv6 address is known as the interface identifier. It is derived from the 48-bit MAC address of the network adapter. For more information, see IPv6 interface identifiers.

To create the IPv6 interface identifier from the 48-bit (6-byte) Ethernet MAC address:

  • The hexadecimal digits 0xFF-FE are inserted between the third and fourth bytes of the MAC address.
  • The Universal/Local bit (the second low-order bit of the first byte of the MAC address) is complemented. If it is a 1, it is set to 0; and if it is a 0, it is set to 1.

For example, for the MAC address of 00-60-08-52-F9-D8:

  • The hexadecimal digits 0xFF-FE are inserted between 0x08 (the third byte) and 0x52 (the fourth byte) of the MAC address, forming the 64-bit address of 00-60-08-FF-FE-52-F9-D8.
  • The Universal/Local bit, the second low-order bit of 0x00 (the first byte) of the MAC address, is complemented. The second low-order bit of 0x00 is 0 which, when complemented, becomes 1. The result is that for the first byte, 0x00 becomes 0x02.

As a result, the IPv6 interface identifier that corresponds to the Ethernet MAC address of 00-60-08-52-F9-D8 is 02-60-08-FF-FE-52-F9-D8.

The link-local address of a node is the combination of the prefix FE80::/64 and the 64-bit interface identifier expressed in colon-hexadecimal notation. As a result, the link-local address of this example node, with the prefix of FE80::/64 and the interface identifier 02-60-08-FF-FE-52-F9-D8, is FE80::260:8FF:FE52:F9D8.

You can view your link local address by using netsh interface ipv6 show interface. When you run this command without any additional parameters, a simple list is provided as output:

Idx  Met   MTU    State         Name
---  ----  -----  ------------  -----
  5     0   1500  Connected     Local Area Connection
  4     0   1500  Connected     Local Area Connection 2
  3     1   1280  Connected     6to4 Tunneling Pseudo-Interface
  2     1   1280  Connected     Automatic Tunneling Pseudo-Interface
  1     0   1500  Connected     Loopback Pseudo-Interface

For more detailed output, you can designate a connection name as a command parameter (for example, netsh interface ipv6 show interface "Local Area Connection 2"). Using the interface parameter (with either an interface name or an interface index number) results in the following output, which includes the link local address for the connection:

Interface 4: Local Area Connection 2

Addr Type  DAD State  Valid Life   Pref. Life   Address
---------  ---------- ------------ ------------ -----------------------------
Temporary  Preferred    6d4h41m33s     4h38m46s 3ffe:2900:d005:f282:4063:32a8:5c81:62f2
Temporary  Deprecated   5d4h44m24s           0s 3ffe:2900:d005:f282:cd74:3dd7:857b:b57
Temporary  Deprecated   4d4h47m16s           0s 3ffe:2900:d005:f282:d880:d193:f2dd:d929
Temporary  Deprecated    3d4h50m7s           0s 3ffe:2900:d005:f282:7482:2f05:8129:54ba
Temporary  Deprecated   2d4h52m59s           0s 3ffe:2900:d005:f282:d530:25de:57b:7ee0
Temporary  Deprecated   1d4h55m50s           0s 3ffe:2900:d005:f282:c58c:4290:22c6:7b3b
Temporary  Deprecated     4h58m42s           0s 3ffe:2900:d005:f282:8464:acf0:8393:cf6
Public     Preferred  29d23h57m19s  6d23h57m19s fec0::f282:2c0:4fff:fe19:bad3
Public     Preferred  29d23h57m19s  6d23h57m19s 3ffe:2900:d005:f282:2c0:4fff:fe19:bad3
Link       Preferred      infinite     infinite fe80::2c0:4fff:fe19:bad3

Connection Name          : Local Area Connection 2
GUID                     : {433F15CA-E3FD-4DE4-B3FF-7EF4B30CA4E7}
State                    : Connected
Metric                   : 0
Link MTU                 : 1500 bytes
True Link MTU            : 1500 bytes
Current Hop Limit        : 64
Reachable Time           : 4h43m20s
Base Reachable Time      : 8h20m
Retransmission Interval  : 16m40s
DAD Transmits            : 1
DNS Suffix               : example.microsoft.com
Zone ID for Link         : 4
Zone ID for Site         : 1
Uses Neighbor Discovery  : Yes
Sends RA's               : No
Forwards Packets         : No
Link-Layer Address       : 00-c0-4f-19-ba-d3

Interface 4 is an interface that corresponds to an installed Ethernet adapter with a link-local address of FE80::2C0:4FFF:FE19:BAD3.

Testing connectivity between two link-local hosts

You can perform a simple ping (an exchange of ICMPv6 Echo Request and Echo Reply messages) with IPv6 between two link-local hosts by completing the following steps:

  1. Install IPv6 on two computers. For more information, see To install IPv6.
  2. Use netsh interface ipv6 show interface on Host A to obtain the link-local address and the interface index for the Ethernet interface.

    3. For example, the link-local address of Host A is FE80::210:5AFF:FEAA:20A2, and the interface index of the Ethernet interface is 4.

  3. Use netsh interface ipv6 show interface on Host B to obtain the link-local address and the interface index for the Ethernet interface.

    4. For example, the link-local address of Host B is FE80::260:97FF:FE02:6EA5, and the interface index for the Ethernet interface is 3.

  4. From Host A, use Ping.exe to ping Host B.

    5. For example, ping FE80::260:97FF:FE02:6EA5%4

When you specify a link-local or site-local destination address, you can specify the zone ID to make the zone (an area of the network of a specific scope) of the traffic specific.

  • For example, on a computer with multiple Ethernet adapters that are connected to separate links, each Ethernet adapter is assigned a link-local address. Destination link-local addresses in this configuration are ambiguous because a specific link-local address can be assigned to multiple nodes located on the links that are reachable from all of the installed Ethernet adapters. To define the area of the network for which the destination is intended, the zone ID is used to indicate the Ethernet adapter over which traffic is sent and received. In the IPv6 protocol, the zone ID for link-local addresses is typically the interface index from the display of the netsh interface ipv6 show interface command. The interface index is defined locally on each IPv6 host. Because of this, the interface index used by Host A to reach Host B might not be the same as the interface index used by Host B to reach Host A.
  • When using site-local addresses, it is possible to be connected to multiple sites. In this case, each site is assigned a site identifier. To define the area of the network for which the destination is intended, the zone ID is used to indicate the site identifier. In the IPv6 protocol, the zone ID is the Zone ID for Site from the display of the netsh interface ipv6 show interface level=verbose command. If you are connected only to a single site, the default site identifier is 1 and the zone ID does not have to be specified. The site identifier is defined locally on each IPv6 host. Because of this, the site identifier used by Host A to reach Host B might not be the same as the site identifier used by Host B to reach Host A.

The notation that is used to specify the zone ID with an address is Address%ZoneID.

For additional information about configurations, see IPv6 configurations.

For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.

For more information about the netsh interface ipv6 show interface command, see Netsh commands for Interface IPv6.


Using IPSec between two local link hosts

Caution

  • This implementation of IPSec for IPv6 is not recommended for use in a production environment because it relies on static keying and has no provisions for updating keys upon sequence number reuse.
  • When you manually configure Security Parameters Indexes (SPIs), always use random numbers. Do not use sequential numbers for SPIs, or you will compromise the security of your IPSec for IPv6 policies.
  • The IPv6 protocol for the Windows Server 2003 family does not support the use of IPSec Encapsulating Security Payload (ESP) encryption. However, the use of ESP with NULL encryption is supported. Although NULL encryption uses the ESP header, only data origin authentication and data integrity services are provided.

This configuration creates an IPSec security association (SA) between two hosts on the same subnet. The SA performs authentication by using the Authentication Header (AH) and the Message Digest 5 (MD5) hashing algorithm. In this example, the configuration secures all traffic between two neighboring hosts. Host 1 has the link-local address of FE80::2AA:FF:FE53:A92C, and Host 2 has the link-local address of FE80::2AA:FF:FE92:D0F1.

  1. On Host 1, create blank security association (.sad) and security policy (.spd) files by using the ipsec6 s command. In this example, the Ipsec6.exe command is ipsec6 s test. This creates two files with blank entries for manually configuring security associations (Test.sad) and security policies (Test.spd).
  2. On Host 1, edit the .spd file, adding a security policy that secures all traffic between Host 1 and Host 2.

    3. The following table shows the security policy entry that is added to Test.spd before the first entry (the first entry in Test.spd is not modified):

    .spd file field name | Example value
Policy | 2
RemoteIPAddr | - FE80::2AA:FF:FE92:D0F1
LocalIPAddr | - *
Protocol | - *
RemotePort | - *
LocalPort | - *
IPSecProtocol | AH
IPSecMode | TRANSPORT
RemoteGWIPAddr | *
SABundleIndex | NONE
Direction | BIDIRECT
Action | APPLY
InterfaceIndex | 0

    Type a semicolon at the end of the entry configuring this security policy. Policy entries must be placed in decreasing numerical order.

  3. On Host 1, edit the .sad file, adding SA entries to secure all traffic between Host 1 and Host 2. Two security associations must be created, one for traffic to Host 2 and one for traffic from Host 2.

    4. The following table shows the first SA entry that is added to Test.sad (for traffic to Host 2):

    .sad file field name | Example value
SAEntry | 2
SPI | 3001
SADestIPAddr | FE80::2AA:FF:FE92:D0F1
DestIPAddr | POLICY
SrcIPAddr | POLICY
Protocol | POLICY
DestPort | POLICY
SrcPort | POLICY
AuthAlg | HMAC-MD5
KeyFile | Test.key
Direction | OUTBOUND
SecPolicyIndex | 2

    Type a semicolon at the end of the entry configuring this SA.

    The following table shows the second SA entry that is added to Test.sad (for traffic from Host 2):

    .sad file field name | Example value
SAEntry | 1
SPI | 3000
SADestIPAddr | FE80::2AA:FF:FE53:A92C
DestIPAddr | POLICY
SrcIPAddr | POLICY
Protocol | POLICY
DestPort | POLICY
SrcPort | POLICY
AuthAlg | HMAC-MD5
KeyFile | Test.key
Direction | INBOUND
SecPolicyIndex | 2

    Type a semicolon at the end of the entry configuring this SA. SA entries must be placed in decreasing numerical order.

  4. On Host 1, create a file that contains data used to create and validate the Message Digest 5 (MD5) keyed hash on each IPSec-protected packet that is exchanged with Host 2. In this example, a text file is used. Test.key is created with the contents This is a test. There are no extra characters, spaces, or lines.

    5. The IPv6 protocol supports only manually configured keys for quick mode SAs (also known as IPSec or Phase II SAs), because main mode negotiation through Internet Key Exchange (IKE) is not performed. Manual keys are configured by creating files that contain either the text or binary data of the manual key. In this example, the same key for the SAs is used in both directions. You can use different keys for inbound and outbound SAs by creating different key files and referencing them with the KeyFile field in the .sad file.

  5. On Host 2, use the ipsec6 s command to create blank security association (.sad) and security policy (.spd) files. In this example, the Ipsec6.exe command is ipsec6 s test. This creates two files with blank entries for manually configuring security associations (Test.sad) and security policies (Test.spd).

    6. To simplify the example, the same file names for the .sad and .spd files are used on Host 2. You can choose to use different file names on each host.

  6. On Host 2, edit the .spd file, adding a security policy that secures all traffic between Host 2 and Host 1.

    7. The following table shows the security policy entry that is added to Test.spd before the first entry (the first entry in Test.spd is not modified):

    .spd file field name | Example value
Policy | 2
RemoteIPAddr | - FE80::2AA:FF:FE53:A92C
LocalIPAddr | - *
Protocol | - *
RemotePort | - *
LocalPort | - *
IPSecProtocol | AH
IPSecMode | TRANSPORT
RemoteGWIPAddr | *
SABundleIndex | NONE
Direction | BIDIRECT
Action | APPLY
InterfaceIndex | 0

    Type a semicolon at the end of the entry configuring this security policy. Policy entries must be placed in decreasing numerical order.

  7. On Host 2, edit the .sad file, adding SA entries to secure all traffic between Host 2 and Host 1. Two security associations must be created: one for traffic to Host 1 and one for traffic from Host 1.

    8. The following table shows the first SA entry that is added to Test.sad (for traffic to Host 1):

    .sad file field name | Example value
SAEntry | 2
SPI | 3000
SADestIPAddr | FE80::2AA:FF:FE53:A92C
DestIPAddr | POLICY
SrcIPAddr | POLICY
Protocol | POLICY
DestPort | POLICY
SrcPort | POLICY
AuthAlg | HMAC-MD5
KeyFile | Test.key
Direction | OUTBOUND
SecPolicyIndex | 2

    Type a semicolon at the end of the entry configuring this SA.

    The following table shows the second SA entry that is added to Test.sad (for traffic from Host 1):

    .sad file field name | Example value
SAEntry | 1
SPI | 3001
SADestIPAddr | FE80::2AA:FF:FE92:D0F1
DestIPAddr | POLICY
SrcIPAddr | POLICY
Protocol | POLICY
DestPort | POLICY
SrcPort | POLICY
AuthAlg | HMAC-MD5
KeyFile | Test.key
Direction | INBOUND
SecPolicyIndex | 2

    Type a semicolon at the end of the entry configuring this SA. SA entries must be placed in decreasing numerical order.

  8. On Host 2, create a text file that contains a text string that is used to authenticate the SAs created with Host 1. In this example, Test.key is created with the contents This is a test. There are no extra characters, spaces, or lines.
  9. On Host 1, use the ipsec6 l command to add the configured security policies and SAs from the .spd and .sad files. In this example, the ipsec6 l test command is run on Host 1.
  10. On Host 2, use the ipsec6 l command to add the configured security policies and SAs from the .spd and .sad files. In this example, the ipsec6 l test command is run on Host 2.
  11. On Host 2, use the ping command to ping Host 1's link-local address.

    12. If you use Network Monitor to capture the traffic, you should see the exchange of ICMPv6 Echo Request and Echo Reply messages, with an Authentication Header (AH) listed between the IPv6 header and the ICMPv6 header.

For additional information about configurations, see IPv6 configurations.

For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.


IPv6 traffic between nodes on different subnets of an IPv6 internetwork

This configuration requires three computers (two hosts and one router) and additional router configuration beyond the installation of the IPv6 protocol. There are two separate network segments (also known as links or subnets) and an IPv6-capable router that forwards IPv6 packets between hosts on the segments.

The following illustration shows the configuration of two hosts on separate network segments that are connected by a router.

Two hosts on separate network segments connected by a router

By default, the IPv6 protocol for the Windows Server 2003 family configures link-local IP addresses for each interface that correspond to installed Ethernet network adapters. Link-local addresses have the prefix of FE80::/64. The last 64 bits of the IPv6 address are the interface identifier, as derived from the 48-bit MAC address of the network adapter. For more information, see IPv6 interface identifiers. With link-local addresses, Host A and Host B can communicate with the router computer, but not with each other.

In this configuration, additional site-local prefixes are advertised by the router. The site-local prefixes are used by Host A and Host B to automatically configure site-local addresses that are derived from the 48-bit MAC address of the network adapter. After Host A and Host B have site-local addresses, they can communicate with each other.

To obtain the interface index numbers of the two Ethernet adapters on the router computer, type the following command for each adapter:

netsh interface ipv6 show interface [interface=]String

Where String is the name or index of the interface, (for example, Local Area Connection). Subnet 1 is the network segment to which Host A is attached. Subnet 2 is the network segment to which Host B is attached.

After you have obtained the interface index numbers, type the following commands on the router computer:

netsh interface ipv6 set interface [interface=]Subnet1InterfaceIndex [forwarding=]enabled [advertise=]enabled

netsh interface ipv6 set interface [interface=]Subnet2InterfaceIndex [forwarding=]enabled [advertise=]enabled

netsh interface ipv6 add route [prefix=]FEC0:0:0:1::/64 [interface=]Subnet1InterfaceIndex [publish=]yes

netsh interface ipv6 add route [prefix=]FEC0:0:0:2::/64 [interface=]Subnet2InterfaceIndex [publish=]yes

Where:

  • Subnet1InterfaceIndex is the interface index of the adapter on the router computer that is attached to Subnet 1.
  • Subnet2InterfaceIndex is the interface index of the adapter on the router computer that is attached to Subnet 2.

For example, if the Subnet 1 and Subnet 2 interface indexes of the router computer are 4 and 3 respectively, the commands are:

netsh interface ipv6 set interface 4 enabled enabled

netsh interface ipv6 set interface 3 enabled enabled

netsh interface ipv6 add route FEC0:0:0:1::/64 4 publish=yes

netsh interface ipv6 add route FEC0:0:0:2::/64 3 publish=yes

Wait about 30 seconds for both the router computer to advertise new site-local prefixes on Subnets 1 and 2 and for Hosts A and B to automatically configure site-local addresses based on these prefixes.

On Host A, type the netsh interface ipv6 show interface command to check for a new IPv6 address for the Ethernet adapter that is based on the site-local prefix of FEC0:0:0:1::/64. On Host B, type the netsh interface ipv6 show interface command to check for a new IPv6 address for the Ethernet adapter that is based on the site-local prefix of FEC0:0:0:2::/64.

On Host A, use the ping command and the site-local address of Host B to ping Host B. For example, if the Host B site-local address is FEC0::2:260:97FF:FE02:6EA5, the command is ping FEC0::2:260:97FF:FE02:6EA5.

For more information about Netsh commands, see Netsh overview and Netsh commands for Interface IPv6.

For additional information about configurations, see IPv6 configurations.

For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.


IPv6 traffic between nodes on different subnets of an IPv4 internetwork

The IPv6 protocol for the Windows Server 2003 family and XOX provides the following methods for communicating between IPv6 nodes on different subnets of an IPv4 internetwork:

  • Intrasite Automatic Tunnel Addressing Protocol addresses
  • 6over4

    • 6over4 requires that the IPv4 internetwork be multicast-capable. Because most IPv4 networks are not multicast-capable, 6over4 is rarely used. For more information about 6over4, see IPv6 protocol features and RFC 2529.

  • 6to4

    • While 6to4 is primarily designed to allow communication between separate IPv6-enabled 6to4 sites, 6to4 hosts that are using the IPv6 protocol can also use 6to4 addresses and 6to4 tunneling to communicate across the IPv4 Internet. For more information, see IPv6 traffic between nodes in different sites across the Internet (6to4).

  • IPv4-compatible addresses

    • IPv4-compatible addresses derived from IPv4 public addresses provide a method for connecting IPv6 hosts or sites over the existing IPv4 Internet infrastructure. For more information, see Using IPv4-compatible addresses.

In all of these cases, while IPv6 traffic is being carried as the payload of an IPv4 packet (treating the IPv4 infrastructure as an IPv6 link-layer), it remains IPv6 traffic. Applications that use the addresses associated with these methods are using the same Windows Sockets functions as if global IPv6 addresses and an IPv6 infrastructure were being used.

Using Intrasite Automatic Tunnel Addressing Protocol addresses

Another address assignment and tunneling mechanism that can be used for communication between IPv6/IPv4 nodes on an IPv4 network is described in the Internet draft titled "Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)" (draft-ietf-ngtrans-isatap-Ox.txt). These addresses are called Intrasite Automatic Tunnel Addressing Protocol (ISATAP) addresses. ISATAP addresses use the locally administered interface ID ::0:5EFE:w.x.y.z where:

  • The 0:5EFE portion is formed from the combination of both the organizational unit identifier that is assigned to the Internet Assigned Numbers Authority (IANA) (00-00-5E) and a type that indicates an embedded IPv4 address (FE).
  • The w.x.y.z portion is any unicast IPv4 address, which includes both public and private addresses.

The ISATAP interface ID can be combined with any 64-bit prefix that is valid for IPv6 unicast addresses. This includes the link-local address prefix (FE80::/64), site-local prefixes, and global prefixes.

Like IPv4-compatible addresses, 6over4 addresses, and 6to4 addresses, ISATAP addresses contain an embedded IPv4 address that is used to determine either the source or destination IPv4 addresses within the IPv4 header when ISATAP-addressed IPv6 traffic is sent across an IPv4 network.

By default, the IPv6 protocol for the Windows Server 2003 family and XOX automatically configures the ISATAP address of FE80::5EFE:w.x.y.z on the Automatic Tunneling Pseudo-Interface for each IPv4 address that is assigned to the node. This link-local ISATAP address allows two hosts to communicate over an IPv4 network by using each other's ISATAP addresses.

For example, Host A is configured with the IPv4 address of 10.40.1.29 and Host B is configured with the IPv4 address of 192.168.41.30. When the IPv6 protocol for the Windows Server 2003 family and XOX is started, Host A is automatically configured with the ISATAP address of FE80::5EFE:10.40.1.29 and Host B is automatically configured with the ISATAP address of FE80::5EFE:192.168.41.30. When Host A sends IPv6 traffic to Host B by using Host B's ISATAP address, the source and destination addresses for the IPv4 and IPv6 headers are listed in the following table.

Field | Value
Source address in IPv6 header | FE80::5EFE:10.40.1.29
Destination address in IPv6 header | FE80::5EFE:192.168.41.30
Source address in IPv4 header | 10.40.1.29
Destination address in IPv4 header | 192.168.41.30

To test connectivity, you can use the ping command. For example, Host A would use the following command to ping Host B by using its link-local ISATAP address:

ping FE80::5EFE:192.168.41.30%2

The %ZoneID portion of the command is used to specify the interface index of the interface from which traffic is sent. In this case, %2 specifies interface 2, which is the interface index assigned to the Automatic Tunneling Pseudo-Interface on Host A.

The use of link-local ISATAP addresses allows IPv6/IPv4 hosts on an IPv4 intranet to communicate with each other, but not with other IPv6 hosts outside of the site. To communicate outside of the site, the following additional configuration is required:

  • A host must receive a router advertisement from the site border router that contains a global address prefix. The site border router is placed between the intranet and either the IPv4 Internet or the IPv6 Internet. A site border router is most often a 6to4 router that is connected to the Internet. Upon receiving the router advertisement, additional ISATAP addresses that are based on the global prefix are automatically added.

    • For example, if the site is connected to the IPv6 Internet and Host A receives the global prefix of 3FFE:FFF::/64 in a router advertisement, the ISATAP address of 3FFE:FFFF::5EFE:10.40.1.29 is automatically configured. Without a global address prefix and an IPv6 Internet connection, a site can use a 6to4-based global address prefix and connect to other 6to4 sites, 6to4 hosts, and the IPv6 Internet, by using the IPv4 Internet. If the site is using the 6to4 address prefix of 2002:836B:1:5::/64 (based on the public address of 131.107.0.1 and an SLA ID of 5), the ISATAP address of 2002:836B:1:5:0:5EFE:10.40.1.29 is automatically configured.

    ISATAP router addresses are auto-configured in XOX when IPv6 queries for "_ISATAP" and receives responses from ISATAP routers. For members of the Windows Server 2003 family and for XOX Service Pack 1, IPv6 queries for "ISATAP" (without the underscore character) and auto-configures ISATAP router addresses when responses from ISATAP routers are received.

  • A host must have a default route, pointing to an ISATAP address that corresponds to the intranet interface of the site border router.

    • For example, if the intranet interface of the site border router is configured with the IPv4 address of 172.16.0.1, Host A must be configured with a default route (::/0), which uses the ISATAP address of FE80::5EFE:172.16.0.1 as the next-hop address. As the result, all IPv6 traffic that matches this default route (as the closest matching route) is encapsulated and forwarded to the site border router. The site border router then forwards the traffic. If the site border router is a 6to4 router, it encapsulates the IPv6 traffic and forwards it on the Internet.

    For more information, see To add an IPv6 route.

For additional information about configurations, see IPv6 configurations. For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.


IPv6 traffic between nodes in different sites across the Internet (6to4)

6to4 is a tunneling technique that is described in RFC 3056. When 6to4 is used, IPv6 traffic is encapsulated with an IPv4 header before it is sent over the IPv4 Internet.

6to4 uses the global address prefix of 2002:WWXX:YYZZ::/48, where WWXX:YYZZ is both the Next Level Aggregation ID (NLA ID) portion of a global address and the colon-hexadecimal representation of a public IPv4 address (w.x.y.z) that is assigned to the site or host. The complete 6to4 address of a 6to4 host is 2002:WWXX:YYZZ:[SLAID]:[InterfaceID].

RFC 3056 defines the following:

  • 6to4 host

    • An IPv6 host that is configured with at least one 6to4 address.

  • 6to4 router

    • An IPv4/IPv6 router that forwards 6to4-addressed traffic both between the 6to4 hosts within a site and to other 6to4 routers or 6to4 relay routers on the IPv6 Internet.

  • 6to4 relay router

    • An IPv4/IPv6 router that forwards 6to4-addressed traffic between 6to4 routers on the Internet and hosts on the IPv6 Internet.

When you use 6to4 hosts, an IPv6 routing infrastructure within 6to4 sites, a 6to4 router at site boundaries, and a 6to4 relay router, the following types of communication are possible:

  1. A 6to4 host can communicate with another 6to4 host within the same site.

    2. This type of communication is available through the IPv6 routing infrastructure, which provides reachability to all hosts within the site.

  2. A 6to4 host can communicate with 6to4 hosts in other sites across the IPv4 Internet.

    3. This type of communication occurs when a 6to4 host forwards IPv6 traffic, which is destined to a 6to4 host in another site, to the local site 6to4 router. The local site 6to4 router encapsulates the IPv6 traffic with an IPv4 header and sends it to the 6to4 router at the destination site on the Internet. At the destination site, the 6to4 router removes the IPv4 header and forwards the IPv6 packet to the appropriate 6to4 host by using the IPv6 routing infrastructure of the destination site.

  3. A 6to4 host can communicate with hosts on the IPv6 Internet.

    4. This type of communication occurs when a 6to4 host forwards IPv6 traffic, which is destined for an IPv6 Internet host, to the local site 6to4 router. The local site 6to4 router encapsulates the IPv6 traffic with an IPv4 header and sends it to a 6to4 relay router that is connected to both the IPv4 Internet and the IPv6 Internet. The 6to4 relay router removes the IPv4 header and forwards the IPv6 packet to the appropriate IPv6 Internet host by using the IPv6 routing infrastructure of the IPv6 Internet.

All of these types of communication use IPv6 traffic without the requirement of obtaining either a direct connection to the IPv6 Internet or an IPv6 global address prefix from an Internet service provider (ISP).

Support for 6to4 hosts and routers is provided in the IPv6 Helper service that is included with the IPv6 protocol for Windows Server 2003 family and XOX. The IPv6 Helper service:

  • Automatically configures 6to4 addresses on the interface (named 6to4 Pseudo-Interface or interface index 3) that is used for all public IPv4 addresses that are assigned to interfaces on the computer. For more information, see Single subnet with link-local addresses.
  • Automatically creates a 2002::/16 route that forwards all 6to4 traffic with the 6to4 Pseudo-Interface (interface index 3). All traffic forwarded by this host to 6to4 destinations is encapsulated with an IPv4 header.
  • Automatically performs a Domain Name System (DNS) query for the name 6to4.ipv6.microsoft.com to obtain the IPv4 address of the Microsoft 6to4 relay router on the Internet. You can use the netsh interface ipv6 6to4 set relay command to specify which DNS name to query. For more information, see IPv6 utilities.

With the IPv6 Helper service configuration, computers are automatically configured as a 6to4 host when:

  • The host is running the IPv6 protocol.
  • The host is configured with an IPv4 public IP address.
  • The host does not receive a Router Advertisement from an IPv6 router.

A 6to4 host can perform its own tunneling to reach either 6to4 hosts in other sites or hosts on the IPv6 Internet.

For more information about connecting to the IPv6 Internet, see Connecting to the IPv6 Internet.

If Internet Connection Sharing (ICS) is enabled on an interface that is assigned a public IPv4 address, the IPv6 Helper service:

  • Enables routing on the private interface.
  • Sends Router Advertisements that contain 6to4 address prefixes, which are based on the public IPv4 address of the public interface. The SLA ID in the 6to4 address prefix is set to the interface ID of the interface on which the advertisements are sent.

By enabling ICS, you can use a computer running the IPv6 protocol for XOX as a 6to4 router, which is capable of both encapsulating and forwarding 6to4 traffic to other 6to4 hosts or sites on the Internet, and forwarding IPv6 Internet traffic to a 6to4 relay router on the Internet.

The following illustration shows how 6to4 is used to communicate between two 6to4 sites.

Using 6to4 to communicate between two 6to4 sites

Each site uses a computer with ICS enabled on the public interface to create a 6to4 router. Host computers on the private network segments receive the Router Advertisement that is sent by their site's 6to4 router and contains a 6to4 address prefix. As the result, two 6to4 hosts can communicate by using 6to4 addresses over the Internet.

For additional information about configurations, see IPv6 configurations.

For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.


Connecting to the IPv6 Internet

The simplest way to connect to the IPv6 Internet is to use 6to4, which is included with the IPv6 protocol for the Windows Server 2003 family. You can use 6to4 as either a 6to4 host or as a 6to4 router by enabling Internet Connection Sharing (ICS) on a computer that is connected to the Internet. The IPv6 Helper service automatically configures itself with the appropriate 6to4 addresses and uses a specific 6to4 relay router on the Internet. For more information, see IPv6 traffic between nodes in different sites across the Internet (6to4). The following illustration shows the configuration of a host that is using 6to4 to communicate on the IPv6 Internet through a 6to4 relay router.

Using a 6to4 relay router to communicate with the IPv6 Internet

With 6to4, you can ping other computers on the IPv6 Internet (for example, ping -6 ipv6.research.microsoft.com). The IPv6 Web site provides a list of IPv6-accessible servers that communicate on the IPv6 Internet. Additionally, the registry available at this site contains the names of other IPv6 Internet computers.

Some IPv6 Internet sites might be inaccessible. You might also experience connectivity problems. The tracert -d Address command might be helpful in either case. The -d parameter prevents reverse DNS lookup on intermediate router addresses. For more information about the IPv6 Internet, see the 6bone Web site.

For additional information about configurations, see IPv6 configurations.

For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.

Note

  • XOX


Using IPv4-compatible addresses

IPv4-compatible addresses, derived from IPv4 public addresses, provide a method for connecting IPv6 hosts or sites over the existing IPv4 Internet infrastructure. IPv6 traffic, when used with IPv4-compatible addresses, does not require the addition of IPv6 routers. Its traffic is encapsulated with an IPv4 header.

The following illustration shows the configuration of two nodes on separate subnets using IPv4-compatible addresses to communicate across an IPv4 router.

Using IPv4-compatible addresses to communicate across an IPv4 router

When IPv4-compatible IPv6 addresses are enabled, the IPv6 protocol for the Windows Server 2003 family and XOX automatically configures IPv4-compatible addresses for IPv4 public addresses on the Automatic Tunneling Pseudo-Interface (interface ID 2). An IPv4-compatible address takes the form ::w.x.y.z, where w.x.y.z is an IPv4 public address assigned to an interface on the computer. When IPv4-compatible addresses are enabled, the IPv6 protocol also automatically creates a ::/96 route that forwards all IPv4-compatible addressed traffic with the Automatic Tunneling Pseudo-Interface (interface ID 2). All traffic forwarded by this host to IPv4-compatible destinations is encapsulated with an IPv4 header.

IPv4-compatible addresses are disabled by default. To enable IPv4-compatible addresses, open Command Prompt and type:

netsh interface ipv6 set state v4compat=enabled

When you send traffic to an IPv4-compatible address, the traffic is sent from an IPv4-compatible address and is encapsulated with an IPv4 header. The Protocol field is set to 41 in the IPv4 header to indicate that the payload is an IPv6 packet. The IPv4 header allows the traffic to travel across an IPv4 infrastructure. The IPv4 addresses that are embedded in the source and destination IPv4-compatible addresses of the IPv6 header become the IPv4 source and destination addresses in the IPv4 header.

For example, when Host A (which is configured with the IPv4 address of 131.107.41.17) uses IPv4-compatible addresses to send IPv6 traffic to Host B (which is configured with the IPv4 address of 157.60.15.93), the source and destination addresses for the IPv4 and IPv6 headers are listed in the following table.

Field | Value
Source address in IPv6 header | ::131.107.41.17
Destination address in IPv6 header | ::157.60.15.93
Source address in IPv4 header | 131.107.41.17
Destination address in IPv4 header | 157.60.15.93

The IPv4 routing infrastructure forwards the packet from Host A to Host B, based on the IPv4 destination address of 157.60.15.93. After it is received at Host B, the IPv4 packet payload (the IPv6 packet) is passed to the IPv6 protocol.

To test connectivity, use the ping command. For example, Host A would use the following command to ping Host B by using its IPv4-compatible address:

ping ::157.60.15.93

For more information, see To add an IPv6 route.

For additional information about configurations, see IPv6 configurations.

For information about using IPv6 in a test lab, see Setting up an IPv6 test lab.


Setting up an IPv6 test lab

This section provides information about how you can use five computers to create a test lab to configure and test the IPv6 protocol. These instructions are designed to walk you through a set of tasks, exposing you to the IPv6 protocol and its associated functionality. Beyond the set of tasks, these instructions allow you to create a functioning IPv6 configuration. You can use this configuration to learn about and experiment with IPv6 features and functionality, to aid in developing applications for IPv6 or porting existing IPv4 applications.

This section covers:

  • Setting up the infrastructure
  • IPv6 test lab tasks

Note

  • XOX


Setting up the infrastructure

The infrastructure for the IPv6 test lab network consists of five computers performing the following services:

  • A computer running XOX, that is used as a Domain Name System (DNS) server. This computer is named DNS1.
  • A computer running XOX that is used as a client. This computer is named CLIENT1.
  • A computer running XOX, that is used as a router. This computer is named ROUTER1.
  • A computer running XOX, that is used as a router. This computer is named ROUTER2.
  • A computer running XOX that is used as a client. This computer is named CLIENT2.

Note

  • You can configure the computers named ROUTER1 and ROUTER2 with XOX. The computer named DNS1, however, must be configured with XOX.

The following illustration shows the configuration of the IPv6 test lab.

IPv6 test lab configuration

There are three network segments:

  • A network segment known as Subnet 1 that uses the private IP network ID of 10.0.1.0/24 and site-local subnet ID of FEC0:0:0:1::/64.
  • A network segment known as Subnet 2 that uses the private IP network ID of 10.0.2.0/24 and site-local subnet ID of FEC0:0:0:2::/64.
  • A network segment known as Subnet 3 that uses the private IP network ID of 10.0.3.0/24 and site-local subnet ID of FEC0:0:0:3::/64.

All computers on each subnet are connected to a separate common hub or Layer 2 switch. The two router computers, ROUTER1 and ROUTER2, have two network adapters installed.

For the IPv4 configuration, each computer is manually configured with the appropriate IP address, subnet mask, default gateway, and DNS server IP address. Dynamic Host Configuration Protocol (DHCP) and Windows Internet Name Service (WINS) servers are not used. For the IPv6 configuration, link-local addresses are used initially.

The following sections describe how each of the computers in the test lab are configured. To reconstruct this test lab, please configure the computers in the order presented.

Note

  • XOX

DNS1

DNS1 is a computer running XOX. It is providing DNS Server services for the testlab.microsoft.com DNS domain. To configure DNS1 for this service, perform the following steps:

  1. Install XOX, as a stand-alone server. Set the Administrator password.
  2. After restarting, log on as Administrator.
  3. Install the IPv6 protocol. For more information, see To install IPv6.
  4. Install the Domain Name System (DNS) Server service. During installation of DNS, define a forward lookup zone named testlab.microsoft.com that allows dynamic updates. For more information, see To install a DNS server. You can also create a forward lookup zone after DNS installation. For more information, see To add a forward lookup zone
  5. Configure the TCP/IP protocol with the IP address of 10.0.1.2, the subnet mask of 255.255.255.0, and the default gateway of 10.0.1.1. For more information, see To configure TCP/IP for static addressing.

Note

  • When you install DNS using Configure Your Server, the Configure Your DNS Server Wizard runs after the DNS service is installed. The Configure Your DNS Server Wizard prompts you to define either a forward or reverse lookup zone. To complete the test lab tasks, you must define a forward lookup zone that allows dynamic updates. The definition of a reverse lookup zone is optional.

CLIENT1

CLIENT1 is a computer running XOX that is being used as a client. To configure CLIENT1 as a client computer, perform the following steps:

  1. On CLIENT1, install XOX as a workgroup computer. Set the Administrator password.
  2. After restarting, log on as Administrator.
  3. Install the IPv6 protocol. For more information, see To install IPv6.
  4. Configure the TCP/IP protocol with the IP address of 10.0.1.3, the subnet mask of 255.255.255.0, a default gateway of 10.0.1.1, and the DNS server IP address of 10.0.1.2. For more information, see To configure TCP/IP for static addressing and To configure TCP/IP to use DNS.

ROUTER1

ROUTER1 is a computer running XOX, that is being used as a router between Subnet 1 and Subnet 2. To configure ROUTER1 as a router, perform the following steps:

  1. On ROUTER1, install XOX, as a workgroup computer. Set the Administrator password.
  2. After restarting, log on as Administrator.
  3. Install the IPv6 protocol. For more information, see To install IPv6.
  4. For the interface on Subnet 1, configure the TCP/IP protocol with the IP address of 10.0.1.1, the subnet mask of 255.255.255.0, and the DNS server IP address of 10.0.1.2. For more information, see To configure TCP/IP for static addressing and To configure TCP/IP to use DNS.
  5. For the interface on Subnet 2, configure the TCP/IP protocol with the IP address of 10.0.2.1, the subnet mask of 255.255.255.0, and a default gateway of 10.0.2.2. For more information, see To configure TCP/IP for static addressing.
  6. Enable IP forwarding using Routing and Remote Access. For more information, see To enable Routing and Remote Access service.

ROUTER2

ROUTER2 is a computer running XOX, that is being used as a router between Subnet 2 and Subnet 3. To configure ROUTER2 as a router, perform the following steps:

  1. On ROUTER2, install XOX, as a workgroup computer. Set the Administrator password.
  2. After restarting, log on as Administrator.
  3. Install the IPv6 protocol. For more information, see To install IPv6.
  4. For the interface on Subnet 2, configure the TCP/IP protocol with the IP address of 10.0.2.2, the subnet mask of 255.255.255.0, and a default gateway of 10.0.2.1. For more information, see To configure TCP/IP for static addressing.
  5. For the interface on Subnet 3, configure the TCP/IP protocol with the IP address of 10.0.3.1, and the subnet mask of 255.255.255.0. For more information, see To configure TCP/IP for static addressing.
  6. Enable IP forwarding using Routing and Remote Access. For more information, see To enable Routing and Remote Access service.

CLIENT2

CLIENT2 is a computer running XOX that is being used as a client. To configure CLIENT2 as a client computer, perform the following steps:

  1. On CLIENT2, install XOX as a workgroup computer. Set the Administrator password.
  2. After restarting, log on as Administrator.
  3. Install the IPv6 protocol. For more information, see To install IPv6.
  4. Configure the TCP/IP protocol with the IP address of 10.0.3.2, the subnet mask of 255.255.255.0, and a default gateway of 10.0.3.1. For more information, see To configure TCP/IP for static addressing.
  5. Verify the integrity of the IPv4 routing infrastructure by pinging 10.0.1.3 from the CLIENT2 computer.


IPv6 test lab tasks

The following tasks are designed to take you through the common IPv6 configurations by using the test lab infrastructure configured in Setting up the infrastructure.

  • Link-local ping
  • Creating a static routing infrastructure
  • Using name resolution
  • Using temporary addresses

To complete these tasks, you must use the Netsh commands for Interface IPv6 at the command prompt. For information about how to use Netsh, see Netsh overview. For the complete IPv6 Netsh reference, see Netsh commands for Interface IPv6.

Note

  • XOX

Link-local ping

To ping a host using link-local addresses and view the entries created in the neighbor and route caches, complete the following steps:

  1. On DNS1, type the command netsh interface ipv6 show interface "Local Area Connection" to obtain the link-local address of the interface named Local Area Connection.
  2. On CLIENT1, type the command netsh interface ipv6 show interface "Local Area Connection" to obtain the link-local address and interface index of the interface named Local Area Connection.
  3. On CLIENT1, type the following command to ping the link-local address of DNS1:

    4. ping DNS1LinkLocalAddress%InterfaceIdentifier

    For example, if the link-local address of DNS1 is FE80::2AA:FF:FE9D:10C5, and the interface index for the Local Area Connection interface on CLIENT1 is 3, the command is:

    ping FE80::2AA:FF:FE9D:10C5%3

  4. On CLIENT1, type the following command:

    5. netsh interface ipv6 show neighbors

    to view the entry in the CLIENT1 neighbor cache for DNS1. For more information, see Neighbor Discovery (ND)

  5. On CLIENT1, type the following command:

    6. netsh interface ipv6 show destinationcache

    to view the entry in the CLIENT1 destination cache for DNS1. For more information, see Neighbor Discovery (ND).

  6. On CLIENT1, type the following command:

    7. netsh interface ipv6 show routes

    to view the entries in the CLIENT1 routing table. For more information, see The IPv6 routing table

Creating a static routing infrastructure

To configure a static routing infrastructure so that all test lab nodes are reachable using IPv6 traffic, complete the following steps:

  1. On ROUTER1, use the netsh interface ipv6 show interface command to obtain the link-local addresses and interface index numbers of the Subnet 1 (Local Area Connection) and Subnet 2 (Local Area Connection 2) interfaces:

    netsh interface ipv6 show interface "Local Area Connection"

    netsh interface ipv6 show interface "Local Area Connection 2"

  2. On ROUTER1, type the following commands:

    3. netsh interface ipv6 set interface [interface=]Subnet1InterfaceIndex [forwarding=]enabled [advertise=]enabled

    netsh interface ipv6 set interface [interface=]Subnet2InterfaceIndex [forwarding=]enabled [advertise=]enabled

    netsh interface ipv6 add route [prefix=]FEC0:0:0:1::/64 [interface=]Subnet1InterfaceIndex [publish=]yes

    netsh interface ipv6 add route [prefix=]FEC0:0:0:2::/64 [interface=]Subnet2InterfaceIndex [publish=]yes

    netsh interface ipv6 add route [prefix=]::/0 [interface=]Subnet2InterfaceIndex [nexthop=]ROUTER2AddressOnSubnet2 [publish=]yes

    Where:

    • Subnet1InterfaceIndex is the interface index of the ROUTER1 interface on Subnet 1
    • Subnet2InterfaceIndex is the interface index of the ROUTER1 interface on Subnet 2
    • ROUTER2AddressOnSubnet2 is the link-local address of the ROUTER2 interface on Subnet 2

    For example, if the Subnet 1 interface index is 4, the Subnet 2 interface index is 3, and the link-local address of the ROUTER2 Subnet 2 interface is FE80::2AA:FF:FE87:4D5C, the commands should be typed as follows:

    netsh interface ipv6 set interface 4 forwarding=enabled advertise=enabled

    netsh interface ipv6 set interface 3 forwarding=enabled advertise=enabled

    netsh interface ipv6 add route FEC0:0:0:1::/64 4 publish=yes

    netsh interface ipv6 add route FEC0:0:0:2::/64 3 publish=yes

    netsh interface ipv6 add route ::/0 3 nexthop=FE80::2AA:FF:FE87:4D5C publish=yes

  3. On ROUTER2, type the netsh interface ipv6 show interface command to obtain the link-local addresses and interface index numbers of the Subnet 2 (Local Area Connection) and Subnet 3 (Local Area Connection 2) interfaces:

    netsh interface ipv6 show interface "Local Area Connection"

    netsh interface ipv6 show interface "Local Area Connection 2"

  4. On ROUTER2, type the following commands:

    5. netsh interface ipv6 set interface [interface=]Subnet2InterfaceIndex [forwarding=]enabled [advertise=]enabled

    netsh interface ipv6 set interface [interface=]Subnet3InterfaceIndex [forwarding=]enabled [advertise=]enabled

    netsh interface ipv6 add route [prefix=]FEC0:0:0:2::/64 [interface=]Subnet2InterfaceIndex [publish=]yes

    netsh interface ipv6 add route [prefix=]FEC0:0:0:3::/64 [interface=]Subnet3InterfaceIndex [publish=]yes

    netsh interface ipv6 add route [prefix=]::/0 [interface=]Subnet2InterfaceIndex [nexthop=]ROUTER1AddressOnSubnet2 [publish=]yes

    For example, if the Subnet 2 interface index is 4, the Subnet 3 interface index is 3, and the link-local address of the ROUTER1 Subnet 2 interface is FE80::2AA:FF:FE9A:203F, the commands should be typed as follows:

    netsh interface ipv6 set interface 4 enabled enabled

    netsh interface ipv6 set interface 3 enabled enabled

    netsh interface ipv6 add route FEC0:0:0:2::/64 4 yes

    netsh interface ipv6 add route FEC0:0:0:3::/64 3 yes

    netsh interface ipv6 add route ::/0 4 FE80::2AA:FF:FE9A:203F publish=yes

  5. On CLIENT1, type the netsh interface ipv6 show interface command to view a new address on the LAN interface that is based on the site-local prefix of FEC0:0:0:1::/64.
  6. On CLIENT1, type the netsh interface ipv6 show routes command to view new routes for FEC0:0:0:1::/64, FEC0:0:0:2::/64, and ::/0.
  7. On CLIENT2, type the netsh interface ipv6 show interface command to view a new address on the LAN interface that is based on the site-local prefix of FEC0:0:0:3::/64.
  8. On CLIENT2, type the netsh interface ipv6 show routes command to view new routes for FEC0:0:0:2::/64, FEC0:0:0:3::/64, and ::/0.
  9. On CLIENT1, type the ping command to ping the CLIENT2 site-local address as follows:

    10. ping CLIENT2SiteLocalAddress

  10. On CLIENT1, type the tracert command with the -d option to trace the route between CLIENT1 and CLIENT2:

    11. tracert -d CLIENT2SiteLocalAddress

    In the tracert display, you can view the link-local address of the Subnet 1 interface for ROUTER1 and the link-local address of the Subnet 2 interface for ROUTER2.

  11. On ROUTER1, type the following commands:

    12. netsh interface ipv6 show neighbors

    to view the entries in the ROUTER1 neighbor cache for CLIENT1 and ROUTER2.

    netsh interface ipv6 show destinationcache

    to view the entries in the ROUTER1 destination cache for CLIENT1 and ROUTER2.

Note

  • The IPv6 protocol advertises off-link prefixes in Router Advertisement messages. Route Information options for off-link prefixes become routes in the routing table of the receiving host.

Using name resolution

To view DNS AAAA (quad-A) records and test the use of DNS with IPv6, do the following:

  1. On DNS1, open the DNS console. Under the server DNS1, click Forward Lookup Zones. In the right pane, double-click microsoft.com. In the right pane, you can view both IPv4 A records and IPv6 AAAA records. To view the quad-A record properties for one of the clients on your network, double-click the quad-A record.

    For example, for the CLIENT2 site-local address of FEC0::3:260:8FF:FE52:F9D8, the contents of the AAAA resource record are:

    Name: client2.testlab.microsoft.com

    Address: FEC0::3:260:8FF:FE52:F9D8

  2. On CLIENT1, type the following command:

    ping -6 client2.testlab.microsoft.com

    The name client2.testlab.microsoft.com is resolved to its site-local address by sending a DNS query to DNS1.

  3. On CLIENT2, create the following entry in the Hosts file (located in the systemroot\System32\Drivers\Etc folder):

    4. client1 Client1SiteLocalAddress

  4. On CLIENT2, type the following command:

    5. ping -6 client1

    The name client1.testlab.microsoft.com is resolved to its site-local address by using the local Hosts file.

Using temporary addresses

To use temporary addresses for global address prefixes, complete the following steps:

  1. On ROUTER1, type the following command:

    2. netsh interface ipv6 add route 3FFE:FFFF:0:1::/64 Subnet1InterfaceIndex publish=yes

    where Subnet1InterfaceIndex is the interface index of the ROUTER1 interface on Subnet 1.

    For example, if the Subnet 1 interface index is 4, the command is:

    netsh interface ipv6 add route 3FFE:FFFF:0:1::/64 4 publish=yes

  2. On CLIENT1, type the netsh interface ipv6 show interface command to view a new address on the LAN interface that is based on the global prefix of 3FFE:FFFF:0:1::/64.

    3. There should be two addresses that are based on the 3FFE:FFFF:0:1::/64 prefix. One address uses an interface identifier that is based on the EUI-64 address of the interface. The other address is a temporary address from which the interface identifier is randomly derived. For more information, see IPv6 interface identifiers.

  3. On ROUTER1, type the following command:

    4. netsh interface ipv6 delete route 3FFE:FFFF:0:1::/64 Subnet1InterfaceIndex store=persistent

    where Subnet1InterfaceIndex is the interface index of the ROUTER1 interface on Subnet 1.

    For example, if the Subnet 1 interface index is 4, the command is:

    netsh interface ipv6 delete route 3FFE:FFFF:0:1::/64 4 store=persistent

    This command removes the global prefix from the ROUTER1 routing table and prevents ROUTER1 from advertising the global prefix on its interfaces.

XOX


Resources

This section covers:

  • IPv6 RFCs and Internet drafts
  • IPv6 references
  • IPv6 utilities


IPv6 RFCs and Internet drafts

The following table displays the RFCs and Internet drafts that are implemented by the IPv6 protocol for the Windows Server 2003 family and XOX.

RFC number or Internet draft | Title
1752 | The Recommendation for the IP Next Generation Protocol
1828 | IP Authentication Using Keyed MD5
1886 | DNS Extensions to support IP version 6
1933 | Transition Mechanisms for IPv6 Hosts and Routers
1981 | Path MTU Discovery for IP version 6
2185 | Routing Aspects of IPv6 Transition
2373 | IP Version 6 Addressing Architecture
2374 | An IPv6 Aggregatable Global Unicast Address Format
2401 | Security Architecture for the Internet Protocol
2402 | IP Authentication Header
2403 | The Use of HMAC-MD5-96 within ESP and AH (implemented for AH only)
2404 | The Use of HMAC-SHA-1-96 within ESP and AH (implemented for AH only)
2406 | IP Encapsulating Security Payload (ESP)
2428 | FTP Extensions for IPv6 and NATs
2460 | Internet Protocol, Version 6 (IPv6) Specification
2461 | Neighbor Discovery for IP Version 6 (IPv6)
2462 | IPv6 Stateless Address Autoconfiguration
2463 | Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification
2464 | Transmission of IPv6 Packets over Ethernet Networks
2467 | Transmission of IPv6 Packets over FDDI Networks
2526 | Reserved IPv6 Subnet Anycast Addresses
2529 | Transmission of IPv6 over IPv4 Domains without Explicit Tunnels
2553 | Basic Socket Interface Extensions for IPv6
2710 | Multicast Listener Discovery (MLD) for IPv6 (implemented for host only)
2711 | IPv6 Router Alert Option (implemented for host only)
2732 | Format for Literal IPv6 Addresses in URLs
3041 | Privacy Extensions for Stateless Address Autoconfiguration in IPv6
3056 | Connection of IPv6 Domains via IPv4 Clouds
Internet draft | An Extension of Format for IPv6 Scoped Addresses
Internet draft | Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)
Internet draft | Default Address Selection for IPv6
Internet draft | IP Version 6 Addressing Architecture
Internet draft | IP Version 6 Scoped Address Architecture
Internet draft | Mobility Support in IPv6 (host only)
Internet draft | Routing of Scoped Addresses in the Internet Protocol Version 6 (IPv6)
Internet draft | Site Prefixes in Neighbor Discovery
Internet draft | The UDP Lite Protocol

Obtaining RFCs and Internet drafts

You can obtain RFCs and Internet drafts from the Internet Engineering Task Force Web site.

Note

  • XOX


IPv6 references

For more information about the IPv6 protocol suite, you can consult the following references:

  • Davies, J. Understanding IPv6. Redmond, WA: Microsoft Press, 2002.
  • Huitema, C. IPv6: The New Internet Protocol. Second edition. Upper Saddle River, NJ: Prentice Hall, 1998.
  • Miller, M. Implementing IPv6: Supporting the Next Generation of Protocols. Second edition. Foster City, CA: M&T Books, 2000.


IPv6 utilities

The following IPv6 command-line utilities are available for making configuration changes.

Netsh commands for Interface IPv6

You can configure the IPv6 protocol with the interface IPv6 context of Netsh.exe, which is used for both configuring and displaying the configuration of interfaces, addresses, caches, and routes.

Netsh commands for Interface IPv6 is a set of commands, each with its own set of parameters. In addition, you can use commands that are available in the netsh interface IPv6 6to4 context to both configure or display the configuration of the IPv6 Helper service on either a 6to4 host or a 6to4 router.

For more information about using the IPv6 Helper service, see IPv6 traffic between nodes in different sites across the Internet (6to4).

For more information about Netsh, see Netsh overview.

For the complete Netsh interface IPv6 command reference, see Netsh commands for Interface IPv6.

Ipsec6.exe

You can use Ipsec6.exe to configure IPSec policies and security associations.

Ipsec6.exe has multiple commands, each with its own set of parameters.

  • ipsec6 sp [Interface]

    • Displays the active security policies. Alternately, displays the active security policies for a specific interface.

  • ipsec6 sa

    • Displays the active security associations.

  • ipsec6 l FileNameWithNoExtension

    • Loads the security policies from FileName.spd, and the security associations from FileName.sad.

  • ipsec6 s FileNameWithNoExtension

    • Saves the current security policies to FileName.spd, and the current security associations to FileName.sad. You can use this command to create files that are used to configure security policy and security associations. When there are no security policies or security associations, this command creates FileName.spd for security policies and FileName.sad for security associations. You can use these files as templates to configure the desired security policies or security associations by modifying them with a text editor.

  • ipsec6 d [{sp | sa}] [Index]

    • Deletes the security policies (using the sp parameter) or security associations (using the sa parameter) from the list of active security policies and security associations, as specified by index number. You can use ipsec6 sp or ipsec6 sa to display the index number.

  • ipsec6 m [{on | off}]

    • Specifies whether binding updates that are used for mobile IPv6 are protected by IP security. This is enabled by default.

Caution

  • This implementation of IPSec for IPv6 is not recommended for use in a production environment because it relies on static keying and has no provisions for updating keys upon sequence number reuse.
  • When you manually configure Security Policies Identifiers (SPIs), always use random numbers. Do not use sequential numbers for SPIs, or you will compromise the security of your IPSec for IPv6 policies.
  • The IPv6 protocol for the Windows Server 2003 family does not support the use of IPSec Encapsulating Security Payload (ESP) encryption. However, the use of ESP with NULL encryption is supported. Although NULL encryption uses the ESP header, only data origin authentication and data integrity services are provided.


Troubleshooting

What problem are you having?

A router is not advertising itself as a default router.

Cause: A computer running a member of the Windows Server 2003 family that is being used as an IPv6 router will not advertise itself as a default router unless it is configured with a default route (::/0) that is configured to be published.

Solution: Add a default route to the router computer and configure it to be published with the netsh interface ipv6 add route command.

See also: Netsh commands for Interface IPv6; To add an IPv6 route; IPv6 utilities; Setting up an IPv6 test lab

A default route is not present on the host.

Cause: A computer running a member of the Windows Server 2003 family that is being used as an IPv6 router will not advertise itself as a default router unless it is configured with a default route (::/0) that is configured to be published.

Solution: Add a default route to the router computer and configure it to be published with the netsh interface ipv6 add route command.

See also: Netsh commands for Interface IPv6; To add an IPv6 route; IPv6 utilities; Setting up an IPv6 test lab

Address has unexpected interface identifier.

Cause: A local router is configured to advertise a global prefix. By default, a temporary address that is based on the global prefix is automatically configured.

Solution: Use the netsh interface ipv6 set privacy state=disabled command to disable temporary addresses.

See also: Netsh commands for Interface IPv6; IPv6 interface identifiers; IPv6 utilities

Internet Explorer is not connecting when literal IPv6 addresses are used in the URL.

Cause: The version of the Internet Explorer provided with Windows Server 2003 family does not support the format for literal IPv6 addresses in URLs that is described in RFC 2732, "Format for Literal IPv6 Addresses."

Solution: Create DNS AAAA resource records that resolve Web server names to an IPv6 address and then use Web server names in the URL.

See also: IPv6 applications; Name resolution

Off-link routes are in the routing table.

Cause: When a router running a member of the Windows Server 2003 family sends a Router Advertisement message, it includes Route Information options for directly attached subnets.

Solution: None. This is intended.

See also: IPv6 routing

Ping fails Echo Request messages when specifying a link-local destination.

Cause: The zone ID is not specified.

Solution: This is a common problem when a link-local destination address is used. Link-local addresses are often configured automatically for multiple interfaces. To specify the exact interface over which to send Echo Request messages, use the ping Address%ZoneID syntax where ZoneID is the interface index for the interface over which the ping traffic is sent.

See also: Single subnet with link-local addresses; IPv6 utilities

IPSec traffic is not encrypted.

Cause: The IPv6 protocol for Windows Server 2003 family does not support the use of IPSec Encapsulating Security Payload (ESP) encryption. However, the use of ESP with NULL encryption is supported. Although NULL encryption uses the ESP header, only data origin authentication and data integrity services are provided.

Solution: None. This is a current limitation of the IPv6 protocol for Windows Server 2003 family and XOX.

See also: Security features for IPv6; Using IPSec between two local link hosts

IPSec in IPv6 is not operating according to local or domain-based IPSec policies.

Cause: IPSec support for IPv4 traffic is separate from IPSec support for IPv6 traffic. Local or domain-based IPSec policies configured with the IP Security Policies or Group Policy snap-ins are for IPv4 traffic only. These policies have no effect on IPv6 traffic.

Solution: None. This is a current limitation of the IPv6 protocol for Windows Server 2003 family and XOX.

See also: Security features for IPv6; Using IPSec between two local link hosts

Tunneled traffic is not reaching the destination.

Cause: Routers or firewalls are dropping IPv4 traffic that has the IP Protocol field value set to 41.

Solution: All IPv6 traffic that is encapsulated (tunneled) inside of an IPv4 header has the IPv4 Protocol field in the header set to 41. IPv6 tunneled traffic includes traffic that uses IPv4-compatible addresses, 6over4 addresses, ISATAP addresses, and 6to4 addresses. To allow IPv6 tunneled traffic to be forwarded, configure your routers or firewalls to pass IPv4 traffic that has the Protocol field set to 41.

See also: Security features for IPv6; Using IPSec between two local link hosts

No IPv4-compatible address is configured on my Automatic Tunneling Pseudo-Interface.

Cause: You do not have a public IPv4 address assigned to any of your interfaces or IPv4-compatible addresses are not enabled.

Solution: Because IPv4-compatible addresses have a global scope and are globally unique, IPv4-compatible addresses that are derived from private addresses are not allowed. Private addresses for the IPv6 protocol for Windows Server 2003 family and XOX are defined by the following ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16. Configure a public IPv4 address on one of your interfaces using the netsh interface ipv6 set state command.

See also: Netsh commands for Interface IPv6

Unable to reach other 6to4 sites or the IPv6 Internet by using the 6to4 router.

Cause: Your firewall or Internet router is dropping IPv4 traffic that has the IP Protocol field value set to 41.

Solution: All IPv6 traffic that is encapsulated (tunneled) inside of an IPv4 header has the IPv4 Protocol field in the header set to 41. IPv6 tunneled traffic includes traffic that uses IPv4-compatible addresses, 6over4 addresses, and 6to4 addresses. To allow IPv6 tunneled traffic to be forwarded, configure your firewall or Internet router to pass IPv4 traffic that has the Protocol field set to 41.

Cause: You are unable to resolve the DNS name 6to4.ipv6.microsoft.com.

Solution: By default, the IPv6 Helper service attempts to first resolve the name 6to4.ipv6.microsoft.com to its IPv4 addresses and then choose a relay router. If you cannot resolve the name 6to4.ipv6.microsoft.com, a relay router is not configured and you cannot reach any locations on the IPv6 Internet. Type ping 6to4.ipv6.microsoft.com to determine whether you can resolve the name 6to4.ipv6.microsoft.com.

Cause: You do not have the correct route.

Solution: View the display of the netsh interface ipv6 show routes command. You should see a 2002::/16 route that uses the 6to4 Tunneling Pseudo-Interface to send all traffic.

Cause: You do not have the correct address.

Solution: Verify that you have a 6to4 address assigned before attempting to reach a destination. For example, without a 6to4 address, you might be using a link-local address to reach a 6to4 global address. Use the display of the netsh interface ipv6 show interface command to determine your address configuration.