# Ipv6 Dual Stack

> Plan and review IPv6 dual-stack on campus, DC, and WAN. Use when numbering a VRF, enabling RA, or deciding NAT64 versus native.

- Skill: `gesh75/ipv6-dual-stack` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gesh75/ipv6-dual-stack`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gesh75/ipv6-dual-stack/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: gesh75 (https://skillmd.com/u/gesh75)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/gesh75/ipv6-dual-stack

---


# IPv6 dual-stack

Do not use for IPv4-only RFC1918 cleanup. Not for application socket code.

## Procedure

1. Address plan: /48 per site, /64 per VLAN, GUA from the ISP plus ULA for internal-only. No IPv4-think /127 on p2p unless the platform needs it.
2. RA on access, not on routed p2p. Enable RA guard and DHCP-Guard on campus.
3. Dual-stack BGP with a separate IPv6 AF. Do not carry v6 over v4 6PE unless the core cannot.
4. Prefer native end-to-end. NAT64 only for broken SaaS. Document DNS64.
5. Verify: ping6 to the default GW, traceroute6 off-net, and a v6-only test host.

```text
vlan 24
  ipv6 address 2001:db8:24:24::1/64
  ipv6 nd ra hop-limit 64
  ipv6 nd raguard
```

## Anti-patterns

- Never put GUA on a management VRF that should be ULA-only.
- Do not disable RA to "stop the noise" — fix the flood.

## Safety

RA and prefix changes are change-guarded. A bad RA takes the campus down.