Read IPv6 addresses, distinguish scope and configuration mechanisms, and close dual-stack control gaps.
50 min 150 XPSkills: IPv6 addressing, Host configuration, Dual-stack assurance
Brief
Halcyon Clinics blocks an unapproved service on its IPv4 address, yet a test workstation still reaches the same service by name. The service has both A and AAAA DNS records. The firewall owner insists that the IPv4 deny rule proves isolation; a packet capture instead shows a successful IPv6 connection to the service.
Your assignment is to interpret the addresses, determine how hosts acquired them, and define evidence that covers both protocol families. A device can have several IPv6 addresses with different scopes and lifetimes. Neither a familiar hostname nor a successful IPv4 test tells you which IPv6 paths exist or which controls inspect them.
An IPv4 deny is evidence about one protocol family, not proof that a dual-stack service is isolated.
128 bits, eight groups, one compression marker
An IPv6 address contains 128 bits, written as eight 16-bit hexadecimal groups separated by colons. Each hexadecimal digit represents four bits. For example, 2001:0db8:0042:0000:0000:0000:0000:0017 expands into eight groups even when written as 2001:db8:42::17. Leading zeros within a group may be removed; trailing zeros may not. Changing 0042 to 42 preserves its value, while changing 4200 to 42 does not.
A double colon replaces one contiguous run of all-zero groups and may appear only once: two runs would make expansion ambiguous. For canonical output, compress the longest run, choose the leftmost on a tie, use lowercase, and do not compress a single zero group. The prefix length counts network bits, not hexadecimal characters: /64 fixes the first four complete groups and leaves 64 interface-identifier bits. The address 2001:db8:42:7::17 therefore belongs to 2001:db8:42:7::/64; a /48 allocation contains 65,536 distinct /64 subnets.
For inventory and audit joins, parse addresses into a consistent representation rather than treating two equivalent strings as different assets. Retain prefix lengths as separate data when needed: address equivalence does not make different subnet assignments equivalent. An auditor can ask whether compressed addresses were missed by a text-only asset search.
Compression changes notation; the /64 boundary still splits the address into two 64-bit halves.
Scope is not a firewall rule
Global unicast addresses are generally drawn from 2000::/3 and can be globally routed when routing and policy permit. Examples here use 2001:db8::/32, reserved for documentation rather than public deployment. Link-local addresses belong to fe80::/10 and are not forwarded by routers beyond their link; common host addresses use fe80:: with zero subnet bits. A link-local destination may require an interface scope identifier because the same address could exist on several local links.
Unique local addresses occupy fc00::/7; locally assigned networks use fd00::/8 with a pseudo-random 40-bit global ID, normally yielding a /48 site prefix. They can be routed internally or through private interconnections but are not intended for the public Internet. Multicast addresses occupy ff00::/8 and identify groups: ff02::1 reaches all IPv6 nodes on a link. IPv6 has no broadcast address; Neighbor Discovery uses ICMPv6 and multicast, including solicited-node groups, instead of IPv4 ARP broadcasts.
Scope classification supports segmentation review but cannot prove authorization. An internal unique local address can still expose a sensitive service to an unauthorized internal segment. Preserve route tables, interface assignments and source-to-destination tests as evidence; ask which boundary actually enforces the allowed communications, not whether an address looks private.
SLAAC, DHCPv6 and the router's separate job
With stateless address autoconfiguration (SLAAC), a host receives Router Advertisements containing a prefix information option. An autonomous /64 prefix allows it to form an address from that prefix and an interface identifier; modern identifiers need not encode a hardware address. Preferred and valid lifetimes govern address use, and Duplicate Address Detection checks for a local collision before normal use. Temporary addresses can rotate, so one device does not necessarily equal one stable address.
Stateful DHCPv6 can lease host addresses; stateless DHCPv6 can deliver other configuration without assigning an address. DHCPv6 clients use UDP 546 and servers use UDP 547. Router Advertisements and local host policy influence configuration choices, but DHCPv6 does not normally provide the default router: hosts learn that through Router Advertisements with an appropriate router lifetime. DNS server information may arrive through DHCPv6 or a Router Advertisement option, depending on host support and policy.
Rogue Router Advertisements can redirect traffic even if address leases are centrally managed. Apply authorized-router controls at appropriate access boundaries and permit necessary ICMPv6 rather than indiscriminately blocking it. Evidence should combine authorized router configuration, observed advertisements, host routes and address history; a DHCPv6 lease list alone omits SLAAC hosts and cannot establish gateway integrity.
Address assignment and default-router discovery are separate responsibilities.
Dual stack doubles the paths to verify
Dual stack means IPv4 and IPv6 operate together, not that IPv6 packets are automatically inspected by IPv4 rules. A service may listen on both address families and publish an A record and an AAAA record. A client able to reach either may select IPv6, so an IPv4-only access list, scanner or traffic sensor can miss the active route. IPv6 is not inherently a bypass: the gap is a control deployed or tested for only one family.
Replicate intended access policy across families, inventory listeners and DNS records, and test permitted and denied paths explicitly over each family from relevant segments. Include IPv6 in endpoint policy, flow logging and vulnerability coverage. Do not copy a blanket ICMP deny: ICMPv6 supports Neighbor Discovery and Packet Too Big messages used in path MTU discovery. Failure can look like intermittent application trouble rather than a clean security block.
For a segmentation control, retain dated IPv4 and IPv6 rule exports plus matching connection tests showing source segment, destination, protocol family, port and outcome. A blocked IPv4 connection paired with an allowed IPv6 connection is a failed control for a dual-stack service. An auditor should ask whether the tested population includes AAAA records and temporary addresses rather than accepting an IPv4 scan as complete coverage.
Tasks
Answers are graded on the server: the answer key never reaches your browser.
Task 1: The shortened address
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
An inventory reviewer calls 2001:0db8:0042:0007:0000:0000:0000:0017 a 64-bit address because its subnet is /64. She suggests 2001::42:7::17 as the canonical spelling. The approved worksheet instead requires the shortest canonical address and the unchanged subnet length.
Term bank, not all of these are right
2001:db8:42:7::17/642001::42:7::17/128
1.1What is the canonical compressed form of the full address in the brief? (IPv6 notation)
1.2What prefix length identifies its approved subnet? (CIDR notation)
Task 2: Private does not mean unreachable
Scenario sim+50 XP
Read the brief and answer both questions.
Incident brief
A technician labels fe80::27 as a unique local address and requests a router change to reach it from another building. A capture on the destination link also shows traffic sent to ff02::1, which the technician calls an IPv6 broadcast. You must correct the address categories, not propose a route around their scope.
A host forms its own address using an autonomous /64 prefix received from a router, with no address lease exchange. An operator calls this stateful DHCPv6 and says the lease register proves complete host coverage. The host also reaches a service over IPv6 while the same service is denied over IPv4; the service and host intentionally run both protocol families.
Term bank, not all of these are right
SLAACdual stackstateful DHCPv6IPv4 only
3.1Which mechanism formed this host address? (an acronym)
3.2What deployment model runs both protocol families on these systems? (two words)
Labs
80 bonus XP
Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.
The clinic assigns a documentation-only segment to a simulation. An operator sets a /48 on the host VLAN and claims a DHCPv6 lease will supply the default router. The intended host model is autonomous address construction, not address leasing.
Complete the plan using the fixture's host and required controls. Write the canonical compressed subnet address, classify the observed local address, and name the address-formation mechanism and default-router discovery message. Enable IPv6 filtering and IPv6 logging; describe a test of the denied service path explicitly over IPv6, using deny, block or reject to state the expected outcome.
Simulation allocation and acceptance criteria
site_allocation: 2001:db8:42::/48
host: 2001:db8:42:7::17
host_subnet_length: 64
observed_local_address: fe80::27
router: advertises autonomous prefix and nonzero router lifetime
address_leasing: not required
service_policy: workstation segment must not reach records service TCP 8443
acceptance: IPv6 enforcement and traffic logs enabled; denied service test retained
The network owner submits six independent claims for a dual-stack rollout. The memo is titled 'IPv4 audit sufficient' and asks you to accept it without checking IPv6 behavior.
Judge each claim on its own technical merits. Reject incorrect claims using scope-error, compression-error, configuration-error or coverage-gap; accept correct claims even when a neighboring claim is wrong.
Verdicts are accept or reject. Every rejection needs one reason code from: scope-error | compression-error | configuration-error | coverage-gap.
Memo claims
N6-1 | fe80::27 can be routed between buildings by adding a normal router route.
N6-2 | 2001::42::17 is a valid compressed IPv6 address.
N6-3 | A stateful DHCPv6 address lease supplies the normal IPv6 default router without Router Advertisements.
N6-4 | An IPv4 deny test alone proves a dual-stack records service is isolated.
N6-5 | fd12:3456:789a::/48 is within the locally assigned unique local address range; internal routing still needs access controls.
N6-6 | IPv6 has no broadcast; ff02::1 is link-local all-nodes multicast.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
Checks
Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code
Next on your path · Networking Fundamentals
Routing and NAT
Trace forwarding decisions, distinguish routing convergence from loop protection, and separate address translation from access control.
