1. Ch. 6 Link-Local Address CIS 116 IPv6 Fundamentals Rick Graziani
Cabrillo College

2. Purpose and Format of Link-Local Addresses

4. Link-Local Unicast Address
IPv6 Source – Always a unicast
IPv6 Destination – Unicast, multicast, or anycast.
Unicast, including a link-local address
IPv4
IPv6

5. Link-Local Unicast Address Link-Local Communications
Used to communicate with other devices on the link.
Are NOT routable off the link (network).
Only have to be unique on the link.
Not included in the IPv6 routing table.
Only one link-local address per interface.
An “IPv6 device” must have at least a link-local address.
Might mention here that link local addresses are intended to provide a stable communications address as global addresses may change over time whereas link local addresses are consistent and constantly available (for the most part)

6. Most Networks Are Already Running IPv6
I’m not running IPv6… or am I?
I can now communicate with you and give you a GUA and be your default gateway using SLAAC.
But I am really a bad guy and I can do a DoS or MITM attack.
PC> ipconfig Windows IP Configuration Ethernet adapter Local Area Connection: Connection-specific DNS Suffix : Link-local IPv6 Address : fe80::50a5:8a35:a5bb:66e1 IPv4 Address : Subnet Mask : Default Gateway :
Even if IPv6 is not deployed, must understand and secure IPv6.
Cisco IOS provides IPv6 Router Advertisement Guard, DHCPv6 Guard, and other tools to protect against these types of threats.
Similar security issues and solutions as IPv4.
Highlight on the second bullet that IPv6 comms can happen even if constructs are in place to prevent such comms (e.g. IPv4 acl) I think the graphic build up gets to it but maybe worth highlighting.
Might also be worth highlighting that even if you don’t intend to deploy IPv6 you still need to secure and provide instrumentation and processes to detect IPv6.
People Icon: Occupations set 5 © Copyright Fredy Sujono

7. An Important Role in IPv6
Routing Protocol Messaging
From: Link-local
To: Multicast
ICMPv6 Router Solicitation
From: Link-local or unspecified address
To: Multicast
ICMPv6 Router Advertisement
From: Link-local
To: Multicast
I will use your link-local as my default gateway,
LLA is used as a source IPv6 address before a device gets one dynamically (SLAAC and DHCPv6).
Router’s link-local address is used by devices as the default gateway.
Routers exchange routing messages.
Router use the link-local address as the next-hop address in the routing table: via link-local address.

9. Link-Local Unicast Range
First 10 bits
Remaining 54 bits
xx xxxx
64-bit Interface ID
Range: fe80:
febf: : :
First hextet
Link – Network segment (or subnet)
Link-local means, local to that link or network.
RFC 4291 doesn’t give specific guidance on the remaining 54 bits, but best practice is to leave them all 0s.
Also, best practice is to use fe80 (as OS’s have had issues)
Link-local Unicast

10. Automatically Created Link-Local Addresses

11. Link-Local Unicast Address
First 10 bits
Remaining 54 bits
xx xxxx
64-bit Interface ID
fe80::Interface ID
Link-local addresses are created
Automatically :
fe80 (usually) – First 10 bits
Interface ID
EUI-64 (Cisco routers)
Random 64 bits (many host operating systems)
Static (manual) configuration – Common practice for routers.

12. Cryptographically Generated Addresses (CGA)
Cryptographically Generated Addresses (CGA) is a third option and is beyond our scope of this book.
The Interface ID is computed from a cryptographic hash function.
This procedure is a method for binding a public signature key to an IPv6 address in the Secure Neighbor Discovery Protocol (SEND).
Our Mac OS examples use Mac OS
Mac OS (Sierra) now uses Cryptographically Generated Addresses (CGA), RFC 3972, to generate the Interface ID.
To disable CGA add the command net.inet6.send.opmode=0 to the /etc/sysctl.conf file and reboot.
For more information about CGA, I recommend the book IPv6
Security, by Eric Vynke.

13. Displaying the Link-Local Address
R1# show interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 58ac.7893.da00 (bia 58ac.7893.da00)
<output omitted for brevity>
R1# show ipv6 interface gigabitethernet 0/0
IPv6 is enabled, link-local address is FE80::5AAC:78FF:FE93:DA00
No Virtual link-local address(es):
Global unicast address(es):
2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64
R1# show ipv6 interface brief gigabitethernet 0/0
GigabitEthernet0/0 [up/up]
FE80::5AAC:78FF:FE93:DA00
2001:DB8:CAFE:1::1
R1#

14. Automatic Link-Local Address Using EUI-64
R1# show interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 58ac.7893.da00 (bia 58ac.7893.da00)
<Output Omitted>
Link-local address: fe80:: 64-bit Interface ID
A 64-bit Interface ID is created with EUI-64 using:
48-bit MAC address
Inserting 16 bits: ff-fe
Flipping the U/L (Universal/Local) bit

15. Modified EUI-64 Format (Extended Unique Identifier–64)
OUI (24 bits)
Device Identifier (24 bits) 58 ac 78 93 da 00
Insert ff-fe 58 ac 78 ff fe 93 da 00 ac 78 ff fe 93 da 00 58
U/L bit flipped 5a ac 78 ff fe 93 da 00
Insert FFFE gives us a 64 bit Interface ID
IPv6 64-bit interface IDs are on a 64 bit boundary and accommodate IEEE specification for 64 bit MAC addresses
IEEE has chosen FFFE as a reserved value which can only appear in EUI-64 generated from the an EUI-48 MAC address. IEEE's Guidelines for EUI-64 Registration Authority,
Reason for U/L bit flipped can be found in RFC 4291 IP Version 6 Addressing Architecture

16. Verifying the Router’s Link-Local Address
Link-local addresses only have to be unique on the link.
R1# show interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 58ac.7893.da00 (bia 58ac.7893.da00)
<Output Omitted>
R1# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::5AAC:78FF:FE93:DA00
2001:DB8:CAFE:1::1
GigabitEthernet0/1 [up/up]
FE80::5AAC:78FF:FE93:DA01
2001:DB8:CAFE:2::1
Serial0/0/ [up/up]
2001:DB8:CAFE:99::1
R1#
Wait! Two Link-locals are the same!
EUI-64
FF:FE = EUI-64 (most likely)
Serial interfaces will use a MAC address of an Ethernet interface.
Mystery © Copyright sato00

17. Verifying the LinuxPC’s Link-Local Address
LinuxPC$ ifconfig eth0 Link encap:Ethernet HWaddr 00:50:56:af:14:1b inet6 addr: Bcast: Mask: inet6 addr: 2001:db8:cafe:4::400/64 Scope:Global inet6 addr: fe80::250:56ff:feaf:141b/64 Scope:Link <output omitted>

19. Randomly Generated Interface ID
EUI-64 or random 64-bit value
WinPC> ipconfig /all Windows IP Configuration <output omitted for brevity> Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description: Intel<R> PRO/1000 MT Network Connection Physical Address: AF DHCP Enabled : Yes Autoconfiguration Enabled: : Yes IPv6 Address : 2001:db8:cafe:1::100 Link-local IPv6 Address : fe80::d0f8:9ff6:4201:7086%11
Zone ID
Many operating systems will use a random 64-bit Interface IDs for GUA and Link-Local IPv6 Addresses.

20. Zone ID
Operating systems such as Windows, Linux, and Mac OS use the Zone ID to associate a link-local address with a specific interface.
The Zone ID helps determine which interface to use when sending packets destined for a link-local address.
This is particularly important when a device has multiple interfaces, each on a separate link (subnet). The Zone ID is only locally significant.
A computer with two interfaces will have two link-local addresses.
When sending a packet to a link-local address, the device needs to know on which interface to send that packet.
Linux and Mac OS X devices use %eth (Linux) and %en (Mac) followed by the Zone ID or Interface Scope value.

21. Zone ID
Windows-Host> ipconfig <Selected output Wireless LAN adapter Wireless Network Connection: IPv6 Address : 2001:db8:face:1::aaaa Link-local IPv6 Address : fe80::6c51:4f86:ff70:67f5%12 Default Gateway : fe80::481d:70ff:fe6f:9503%12 Ethernet adapter Local Area Connection: IPv6 Address : 2001:db8:face:1::bbbb Link-local IPv6 Address : fe80::9d23:50de:14ce:c8ab%11 Default Gateway : fe80::481d:70ff:fe6f:9503%11 Windows-Host> netsh interface ipv6 show interfaces Idx Met MTU State Name connected Loopback Pseudo-Interface connected Wireless Network Connection connected Local Area Connection

22. Zone ID – Pinging the default gateway
Windows-Host> ping fe80::481d:70ff:fe6f:9503%11 <Selected output> Pinging fe80::481d:70ff:fe6f:9503%11 with 32 bytes of data: Reply from fe80::481d:70ff:fe6f:9503%11: time=2ms <output omitted for brevity> Windows-Host> ping fe80::481d:70ff:fe6f:9503%12 Pinging fe80::481d:70ff:fe6f:9503%12 with 32 bytes of data: Reply from fe80::481d:70ff:fe6f:9503%12: time=13ms Windows-Host> ping fe80::481d:70ff:fe6f:9503 Pinging fe80::481d:70ff:fe6f:9503 with 32 bytes of data: Reply from fe80::481d:70ff:fe6f:9503: time=4ms Windows-Host> ping fe80::481d:70ff:fe6f:9503%16 Pinging fe80::481d:70ff:fe6f:9503%16 with 32 bytes of data: Request timed out.
Required by Windows only when there are multiple interfaces and communicating to a link-local address.
Linux and Mac OS X both require the use of the Zone ID when pinging a link-local address. (later)
More information on Zone ID is found in RFC 4007, IPv6 Scoped Address.
A Zone ID is not necessary when there are multiple global unicast address because of the default source address selection process, which is discussed in Chapter 9.

23. Manually Created Link-Local Addresses

24. Link-Local Unicast Address
First 10 bits
Remaining 54 bits
xx xxxx
64-bit Interface ID
fe80::Interface ID
Link-local addresses are created
Automatically :
fe80 (usually) – First 10 bits
Interface ID
EUI-64 (Cisco routers)
Random 64 bits (many host operating systems)
Static (manual) configuration
Only needed on devices where it helps the network administrator remember the address… routers, default gateways.

25. Static Link-Local Addresses
Static addresses are more easily remembered and recognizable.
R1(config)#interface gigabitethernet 0/0
R1(config-if)#ipv6 address fe80::1 ?
link-local Use link-local address
R1(config-if)#ipv6 address fe80::1 link-local
R1(config-if)#exit
R1(config)#interface gigabitethernet 0/1
Link-Local Addresses have to be unique only on the link!
Practical method on routers with point-to-point links, but there are other options for routers with client-facing links, which use this address as the default gateway.
Common that client-facing links include vlan number or other information.
Have to use link-local option – IOS knows it’s link-local but the first 10 bits (FE80) but it wants to make sure YOU know.
Can use the same for all interfaces – when you want to reach router R1 from any directly connect link using the link-local address we now that it is fe80::1 .
Can also use an address that identifies the router and the link/network. On my network, I use FE80::<RouterID>:<VLAN>

26. Static Link-Local Addresses
R2(config)# interface gigabitethernet 0/0
R2(config-if)# ipv6 address fe80::2 link-local
R2(config-if)# exit
R2(config)# interface gigabitethernet 0/1
R3(config)# interface gigabitethernet 0/0
R3(config-if)# ipv6 address fe80::3 link-local
R3(config-if)# exit
R3(config)# interface gigabitethernet 0/1
Have to use link-local option – IOS knows it’s link-local but the first 10 bits (FE80) but it wants to make sure YOU know.
Can use the same for all interfaces – when you want to reach router R1 from any directly connect link using the link-local address we now that it is fe80::1 .
Can also use an address that identifies the router and the link/network. On my network, I use FE80::<RouterID>:<VLAN>

27. Link-Local Addresses: Local and Unique
FE80::2
G0/0 FE80::1
S0/0/0
FE80::1
S0/0/0
FE80::2
G0/1
FE80::1 RA RB
FE80::2
Link-local addresses have to be unique only on the link but …
Link-local addresses must be unique on the link!
Hosts don’t need to their link-local address statically configured – automatically created is fine.
Can use the same for all interfaces – when you want to reach router R1 from any directly connect link using the link-local address we now that it is fe80::1 .
Can also use an address that identifies the router and the link/network. On my network, I use FE80::<RouterID>:<VLAN>

28. Verifying Link-Local Addresses

29. Verifying Router’s Link-Local Address
Dynamically Created
R1# show interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 58ac.7893.da00 (bia 58ac.7893.da00)
<Output Omitted>
R1# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::5AAC:78FF:FE93:DA00
2001:DB8:CAFE:1::1
Relationship between MAC address and LLA
Also, show running-config

30. Verifying Router’s Link-Local Address
Statically Created
R1# show interface gigabitethernet 0/0
GigabitEthernet0/0 is up, line protocol is up
Hardware is CN Gigabit Ethernet, address is 58ac.7893.da00 (bia 58ac.7893.da00)
<Output Omitted>
R1# show ipv6 interface brief
GigabitEthernet0/0 [up/up]
FE80::1
2001:DB8:CAFE:1::1
GigabitEthernet0/1 [up/up]
2001:DB8:CAFE:2::1
R1#
No relationship between MAC address and LLA
Also, show running-config

31. IPv6 Routing Table and Link-Local Addresses
R2# show ipv6 route ospf
IPv6 Routing Table - default - 7 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
<output omitted for brevity>
O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
O :DB8:CAFE:1::/64 [110/2]
via FE80::1, GigabitEthernet0/1
O :DB8:CAFE:4::/64 [110/2]
via FE80::3, GigabitEthernet0/0
R2#
Link-local addresses are used as next hop addresses
IPv6 dynamic routing protocols like OSPFv3 and EIGRP form neighbor adjacencies and exchange messages using their link-local address as the source address.
More in dynamic routing lessons

32. Link-Local Addresses and Duplicate Address Detection

33. Duplicate Address Detection
2001:db8:cafe:1::/64
2001:db8:cafe:2::/64 R1
G0/0
::1
fe80::1
G0/1
::1
fe80::1
WinPC
2001:db8:cafe:1::100/64 1
Link-local address: fe80:: + locally generated Interface ID 2
NDP Neighbor Solicitation Message – DAD
Is anyone else on this link using this link-local address?
Whoever has this address, send me your Ethernet MAC address….
fe80::d0f8:9ff6:4201:7086

34. Duplicate Address Detection
If a router is configured with a link-local address that already exists on the link, Cisco IOS displays a warning message:
*%IPV6-4-DUPLICATE: Duplicate address FE80::1 on GigabitEthernet0/1
R2# show ipv6 interface gigabitethernet 0/1
GigabitEthernet0/1 is up, line protocol is up
IPv6 is stalled, link-local address is FE80::1 [DUP]
<output omitted for brevity>
Although the address is still accepted, the interface detects that the address it wants to use is a duplicate and deems the address unusable. (Duplicate Address Detection is discussed in more detail in Chapter 13.)
Static link-local address is another option

35. Link-Local Addresses and Default Gateways

36. The default gateway address can only be obtained dynamically
from the Router Advertisement message. DHCPv6 does not provide the default gateway
address.
2001:db8:cafe:1::/64
2001:db8:cafe:2::/64 R1
G0/0
::1
fe80::1
G0/1
::1
fe80::1
WinPC 1
NDP Router Solicitation “I need IPv6 addressing information from the router” 2
Source IPv6 Address: fe80::1 NDP Router Advertisement Prefix: 2001:db8:cafe:1:: Prefix-length: /64
WinPC> ipconfig
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
IPv6 Address : 2001:db8:cafe:1:d0f8:9ff6:4201:7086
Link-local IPv6 Address : fe80::d0f8:9ff6:4201:7086%11
Default Gateway : fe80::1%11

37. ipv6 enable: Isolated Link-Local Address

38. Do I Need to Use the ipv6 enable Command?
Router(config)# interface gigabitethernet 0/1
Router(config-if)# ipv6 enable
Router(config-if)# end
Router# show ipv6 interface brief
GigabitEthernet0/ [up/up]
FE80::20C:30FF:FE10:92E1
Router#
Link-local unicast address only
Link-local addresses are automatically created whenever a global unicast address is configured on the interface.
The ipv6 enable command will:
Automatically create a link-local address when there is no global unicast address or static link-local address
Maintain the link-local address even when the global unicast address is removed
Static link-local address is another option

39. Do I Need to Use the ipv6 enable Command?
Router(config)# interface gigabitethernet 0/0
Router(config-if)# ipv6 address fe80::99 link-local
Router(config-if)# end
Router# show ipv6 interface brief g 0/0
GigabitEthernet0/ [up/up]
FE80::99
Router#
The ipv6 enable command isn’t required to have just a link-local address on a router interface.
A link-local address can be configured manually, without a global unicast address and without using the ipv6 enable command.
Static link-local address is another option

40. Pinging a Link-Local Address

41. Pinging a Link-Local Address
A# ping fe80::2 ?
G0/0 fe80::1
fe80::2
S0/0/0
fe80::1
S0/0/0
fe80::2 A B
G0/1
fe80::1
fe80::2

42. Pinging a Link-Local Address
R2# ping fe80::1
Output Interface: g0/1
% Invalid interface. Use full interface name without spaces (e.g. Serial0/1)
Output Interface: gigabitethernet0/1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to FE80::1, timeout is 2 seconds:
Packet sent with a source address of FE80::2%GigabitEthernet0/1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
R2#
Must include exit-interface
a link local that an egress interface MUST be associated w/ that use.
(Might also show an example of a PC using a LL to ping a link local address. Rick – Windows 7 didn’t have to specify egress interface)

43. Pinging a Link-Local Address
WinPC> ping fe80::1
Pinging fe80::1 with 32 bytes of data:
Reply from fe80::1: time=2ms
Reply from fe80::1: time=1ms
<output omitted for brevity>
WinPC>
a link local that an egress interface MUST be associated w/ that use.
(Might also show an example of a PC using a LL to ping a link local address. Rick – Windows 7 didn’t have to specify egress interface)

44. Pinging a Link-Local Address
WinPC> netsh interface ipv6 show interfaces
Idx Met MTU State Name
connected Loopback Pseudo-Interface 1
connected Local Area Connection
<output omitted for brevity>
WinPC> ping fe80::1%11
Pinging fe80::1%11 with 32 bytes of data:
Reply from fe80::1%11: time=1ms
a link local that an egress interface MUST be associated w/ that use.
(Might also show an example of a PC using a LL to ping a link local address. Rick – Windows 7 didn’t have to specify egress interface)

45. Pinging a Link-Local Address
The Zone ID (or Interface Scope) is required for Linux and Mac OS
LinuxPC$ ping6 fe80::3
Connect: Invalid argument
LinuxPC$ ifconfig
eth Link encap:Ethernet HWaddr 00:50:56:af:14:1b
inet6 addr: Bcast: Mask:
inet6 addr: 2001:db8:cafe:4::400/64 Scope:Global
inet6 addr: fe80::250:56ff:feaf:141b/64 Scope:Link
<output omitted>
LinuxPC$ ping6 fe80::3%eth0
PING fe80::3%eth0(fe80::3) 56 data bytes
64 bytes from fe80::3: icmp_seq=0 ttl=64 time=0.552 ms
64 bytes from fe80::3: icmp_seq=1 ttl=64 time=0.429 ms
<output omitted for brevity>
a link local that an egress interface MUST be associated w/ that use.
(Might also show an example of a PC using a LL to ping a link local address. Rick – Windows 7 didn’t have to specify egress interface)

46. Pinging a Link-Local Address
Two options using the ping6 command:
Using %interface at the end of the address or the –I interface parameter.
LinuxPC$ ping6 fe80::3%eth0
PING fe80::3%eth0(fe80::3) 56 data bytes
64 bytes from fe80::3: icmp_seq=0 ttl=64 time=0.552 ms
64 bytes from fe80::3: icmp_seq=1 ttl=64 time=0.429 ms
<output omitted for brevity>
LinuxPC$ ping6 –I eth0 fe80::3
64 bytes from fe80::3: icmp_seq=1 ttl=64 time=0.551 ms
a link local that an egress interface MUST be associated w/ that use.
(Might also show an example of a PC using a LL to ping a link local address. Rick – Windows 7 didn’t have to specify egress interface)

47. ping6: sendmsg: No route to host <output omitted for brevity>
MacOS$ ping6 fe80::1
ping6: sendmsg: No route to host
<output omitted for brevity>
MacOS$ ifconfig
en4: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=10b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV>
ether a8:20:66:2c:9d:97
inet6 fe80::aa20:66ff:fe2c:9d97%en4 prefixlen 64 scopeid 0x9
inet6 2001:db8:cafe:1::200 prefixlen 64
MacOS$ ping6 fe80::1%en4
PING6(56= bytes) fe80::aa20:66ff:fe2c:9d97%en4 --> fe80::1%en4
16 bytes from fe80::1%en4, icmp_seq=0 hlim=64 time=5.205 ms
16 bytes from fe80::1%en4, icmp_seq=1 hlim=255 time=1.676 ms
MacOS$ ping6 –I en4 fe80::1
16 bytes from fe80::1%en4, icmp_seq=0 hlim=64 time=1.772 ms
16 bytes from fe80::1%en4, icmp_seq=1 hlim=255 time=1.086 ms
a link local that an egress interface MUST be associated w/ that use.
(Might also show an example of a PC using a LL to ping a link local address. Rick – Windows 7 didn’t have to specify egress interface)

48. Ch. 6 Link-Local Address CIS 116 IPv6 Fundamentals Rick Graziani
Cabrillo College