Megian

IPv6 - Best practices

IPv6 - Best practices

Don't think in IPv4 patterns

Whenever IPv6 is similar to IPv4. Don't take over IPv4 patterns as is. IPv6 has their own ways.

IPv6 is inteded to use multiple addresses on interfaces (RFC7934).

Clients are no longer behind a NAT IP and should use private extentions / privacy addressing. More modern Android use a random generated MAC address to hide the phyiscal MAC being exposed to the public. Server however should use private extentions.

Typical IPv6 Rollout

  1. IPv6 readiness audit - from network devices to applications
  2. Get public (Provider Independent) address space
  • Minimum: /48 for each public-facing site (Data Center)
  • Preferably a larger contiguus address block (traffic engineering with BGP)
  • Prefixes longer than /48 are not advertised through the Internet
  1. Get IPv6 connectivity from your ISPs (all of them!)
  2. Pilot IPv6 project in a non-critical part of DMZ
  3. Enterprise-wide rollout in a few years

Security

Network scans

To increase security on IPv6 hosts, particularly focusing on the Neighbor Discovery Protocol (NDP) and ICMPv6. Since scanners use multicast pings and NDP tables rather than sequential sweeps, your defense strategy should prioritize hardening these discovery layers.

  1. Implement RA Guard and NDP Protection The most critical step is preventing rogue Router Advertisement (RA) messages, which can redirect traffic or man-in-the-middle connections. Enable RA Guard on all switch ports facing end-users; this ensures only authorized routers can send RA messages. Additionally, use NDP Inspection (or SEND – Secure Neighbor Discovery) to validate that the link-layer addresses in NDP messages match the actual sender, preventing NDP spoofing attacks.

  2. Configure Stateful Firewalls for ICMPv6 Unlike IPv4, where ICMP is often blocked entirely, IPv6 requires specific ICMPv6 types for basic functionality (like Neighbor Solicitation and Advertisement). Configure your firewall to allow only the necessary ICMPv6 types for NDP to function while blocking everything else. Do not allow unrestricted ICMPv6 traffic; instead, create explicit rules that permit type 133–137 (NDP messages) and type 2 (Packet Too Big) for Path MTU Discovery, while denying general echo requests from untrusted zones.

  3. Disable Unnecessary Multicast Listening Since scanners rely on multicast pings (ff02::1), configure hosts to not respond to multicast echo requests unless explicitly required. On individual hosts, you can tune the network stack to ignore multicast pings or filter them at the host-based firewall level. This reduces the visibility of your hosts to network-wide discovery sweeps.

  4. Use Privacy Extensions and Stable Addressing Enable IPv6 Privacy Extensions (RFC 4941) on client devices to generate temporary, random interface identifiers for outgoing connections, making it harder to track specific hosts over time. For servers, use stable, manually configured addresses but ensure they are not derived directly from MAC addresses (EUI-64) to prevent hardware fingerprinting.

  5. Apply IP Source Guard Deploy IP Source Guard (or similar binding tables) on access switches. This technique, often used with DHCPv6 snooping, prevents hosts from sending traffic using IPv6 addresses they do not own, effectively stopping address spoofing within the local segment.