{"id":3445,"date":"2016-07-13T17:04:25","date_gmt":"2016-07-13T17:04:25","guid":{"rendered":"https:\/\/live-infoblox-blog.pantheonsite.io\/?p=3445"},"modified":"2025-04-02T11:18:56","modified_gmt":"2025-04-02T18:18:56","slug":"disabling-ipv6-router-advertisements-in-the-data-center","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/","title":{"rendered":"Disabling IPv6 Router Advertisements in the Data Center"},"content":{"rendered":"<p><a href=\"https:\/\/www.infoblox.com\/glossary\/ipv6\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">IPv6<\/a>\u00a0differs from IPv4 in a few key areas, perhaps most significantly in how IPv6 behaves on an Ethernet LAN.\u00a0Organizations looking to optimize IPv6 deployment often turn to an <a href=\"https:\/\/www.infoblox.com\/solutions\/ipv6-readiness\/ipv6-center-excellence\/\" target=\"_blank\"><strong>IPv6 Center of Excellence<\/strong><\/a>, ensuring their network design and implementation adhere to best practices. IPv6 has far more reliance on\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Internet_Control_Message_Protocol_version_6\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ICMPv6<\/a>\u00a0and on multicast, whereas IPv4 uses broadcasts for most administrative LAN traffic like\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Address_Resolution_Protocol\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ARP<\/a>.\u00a0 The IPv6\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Neighbor_Discovery_Protocol\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Neighbor Discovery Protocol<\/a>\u00a0(NDP) (<a href=\"https:\/\/tools.ietf.org\/html\/rfc4861\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">RFC 4861<\/a>) process includes essential functions that IPv6-capable nodes rely on.\u00a0 However, the environment that you set up for your end-user access LANs will be different than your perimeter networks and the data center environment.\u00a0 Therefore, you will likely want to have a different configuration in the data center than in other parts of the enterprise network.<\/p>\n<h2 id=\"toc-hId-649904256\">ICMPv6 Router Advertisement Functionality<\/h2>\n<p>When a host joins the network, it sends an ICMPv6 Type 135 Neighbor Solicitation (NS) packet to perform Duplicate Address Detection (DAD) for its link-local address.\u00a0 After the host determines its link-local address is safe to use, it then sends an ICMPv6 Type 133 Router Solicitation (RS) message to attempt to learn details about the network from the local router. \u00a0Upon receiving this RS, the router sends out an ICMPv6 type 134 Router Advertisement (RA) message so that the requesting host, and all others on that LAN segment, will have information about the LAN and how they should go about obtaining their global unicast address.\u00a0 The router also periodically sends out the RA messages, typically every 200 seconds, to make sure all the nodes on the LAN have the current information about the local IPv6 prefix.\u00a0 The RA also includes the prefix lifetime, the MTU size for the network, the router\u2019s link-local IPv6 address and MAC address, among other details.\u00a0 The\u00a0<a href=\"\/ipv6-coe\/why-you-must-use-icmpv6-router-advertisements-ras\/\" target=\"_blank\" rel=\"noopener noreferrer\">ICMPv6 Router Advertisements (RAs) is an essential function<\/a>\u00a0on an IPv6 LAN and IPv6 will not properly function without it.<\/p>\n<p>The ICMPv6 Router Advertisement (RA) that the router sends to the IPv6 all-nodes link-local multicast group address (FF02::1) will be received and processed by all the nodes on the LAN.\u00a0Leveraging <a href=\"https:\/\/www.infoblox.com\/products\/network-insight\/\" target=\"_blank\"><strong>Network Insight<\/strong><\/a> tools can help administrators monitor RA behavior and ensure optimal network performance. The RA contains a variety of valuable information within it, in addition to guidance to the nodes on the LAN about how they will obtain their IPv6 address.\u00a0 The RA contains several bits that tell the node how it should behave:<\/p>\n<ul>\n<li>Address Autoconfiguration Flag (A flag) indicates if stateless auto-configuration (SLAAC) should be used.<\/li>\n<li>On-Link Flag (L flag) indicates that the prefix is \u201con-link\u201d and local to this network.<\/li>\n<li>Managed Address Configuration Flag (M flag) indicates that the nodes should use DHCPv6 to determine their interface identifier.<\/li>\n<li>Other Stateful Configuration Flag (O flag) indicates that other information is available to help the node (e.g. DNS server information).<\/li>\n<\/ul>\n<p>As soon as an IPv6 address is added to the router\u2019s interface configuration, it immediately sends out an ICMPv6 Type 134 RA with the following flags set: A=1, L=1, M=0, O=0. These indicate to the nodes on the LAN that they should use SLAAC using the IPv6 prefix included in the RA.\u00a0 Sending an RA to all-nodes on the LAN activates the global Internet reachability functionality within the IPv6 stack in all hosts on that network.\u00a0 Those hosts immediately start to operate as if they are connected to the IPv6 Internet.\u00a0 Therefore, all of the AAAA DNS query responses a host has been receiving from any DNS queries it sent are now seemingly reachable over IPv6 and IPv6 connections are attempted to these resolved addresses.<\/p>\n<h2 id=\"toc-hId-678533407\">Do You Really Want RAs in your Data Center?<\/h2>\n<p>The multicast behavior of the RA sends this information to all IPv6-capable nodes on the LAN simultaneously.\u00a0 On an end-user wired or wireless access network, it would be beneficial to have all the systems activate IPv6.\u00a0 However, in a data center environment this may not be what you intend or want.\u00a0 In a data center environment or server farm, you may prefer to turn up one server at a time with IPv6 connectivity.<\/p>\n<p>In a data center environment, servers are typically statically addressed and this is certainly true for IPv4.\u00a0 While, there exists the ability to use DHCP for IPv4 and create a static reservation for a server, this method is not as common as the technique to simply statically configure the server\u2019s IPv4 address, default gateway, and DNS information.<\/p>\n<p>In a data center environment, it may be desirable to turn up servers with IPv6 one at a time to allow for a greater degree of precision and reduce the amount of simultaneous application troubleshooting taking place.\u00a0 IPv6-enabled servers with statically configured global IPv6 addresses do not need to receive the RA to learn their first-hop router: The first-hop router\u2019s IPv6 address will be configured manually on the server.\u00a0 This next-hop address can be either a global address for the local router, or the router\u2019s link-local address for the interface to the server.\u00a0 The IPv6-enabled host in the data center will also have static entries for its DNS server(s) and the DNS domain suffix search order list.<\/p>\n<h2 id=\"toc-hId-707162558\">Disabling RAs on Routers<\/h2>\n<p>You may want to adjust the A\/L\/M\/O bits sent in the RA to adjust behavior of how the end-nodes on the network will perform their dynamic IPv6 addressing.\u00a0 On a typical end-node network where you might want to use SLAAC, the RA would contain the bits A=1, L=1, M=0, O=0.\u00a0 If you wanted to provide DNS information to the end-nodes that would be using SLAAC, then you would configure stateless DHCPv6 and the RA would contain the bits A=1, L=1, M=0, O=1.\u00a0 Alternatively, if you wanted to have the end-nodes use stateful DHCPv6, then the RA would contain the bits A=0, L=1, M=1, O=1.\u00a0 However, in a data center environment you may want to use static addresses and disable dynamic addressing methods of SLAAC and DHCPv6.<\/p>\n<p>Another alternative would be to completely suppress RA and RS messages altogether.\u00a0 Suppressing IPv6 RSs and RAs allows you to turn on IPv6 one server at a time and much more deliberately deploy IPv6.\u00a0 The trick is how you apply the configuration commands to the router and give it an IPv6 address without having it immediately send out the RA with the default SLAAC settings.\u00a0 This can often lead to confusion because there are many IPv6 configuration commands available on a Cisco IOS router interface that seem like they result in the same behavior.<\/p>\n<p>The first step to configuring a Cisco IOS interface for IPv6 is to\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios-xml\/ios\/ipv6\/command\/ipv6-cr-book\/ipv6-i1.html#wp1851466636\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">enable the protocol<\/a>\u00a0on the interface.\u00a0 This is done with the following commands:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>interface vlan 100<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 enable<\/strong><\/span><\/p>\n<p>As soon as IPv6 is enabled on the router\u2019s interface, the router will send out an RA. However, it won\u2019t contain any prefix information and the M and O bits will be set to zero.\u00a0 The host will then receive the RA and configure the router as its local default gateway. But the host will not have a global IPv6 address with which to communicate with the Internet or any other host (though communication between hosts on the same Layer-2 network could still take place via the link-local address).<\/p>\n<p>Now, before we configure the IPv6 address on the router interface, we will want to disable RAs.\u00a0 There are many IPv6 ND commands available on a Cisco IOS router and it may be confusing which technique we want to use to block the RAs from being sent by the data center router out to all the servers.<\/p>\n<p>In your reading of Cisco IOS IPv6 commands, you might have come across the\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios-xml\/ios\/ipv6\/command\/ipv6-cr-book\/ipv6-i3.html#wp1103499300\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">following command<\/a>\u00a0that looks like what we want.\u00a0 But this command actually sends a periodic RA with the A-bit set to zero:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd prefix 2001:db8:1234::\/64 300 300 no-autoconfig<\/strong><\/span><\/p>\n<p>The\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios-xml\/ios\/ipv6\/command\/ipv6-cr-book\/ipv6-i3.html#wp1103499300\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">following command<\/a>\u00a0also looks promising but it too periodically sends RAs (though they don\u2019t have the prefix information and the M and O bits are set to zero):<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd prefix default no-advertise<\/strong><\/span><\/p>\n<p>Here\u2019s another command that looks promising, but it actually prevents the router from configuring itself with information from RAs it receives from other routers connected via this interface.\u00a0 The default behavior is already set to prevent the router from using RAs sent by other routers and using SLAAC to configure its own IPv6 interface address:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0no ipv6 nd autoconfig prefix<\/strong><\/span><\/p>\n<p>Another creative approach would be to set the\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios-xml\/ios\/ipv6\/command\/ipv6-cr-book\/ipv6-i3.html#wp3927083515\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">RA lifetime<\/a>\u00a0to zero as a way to stop the RA from affecting hosts on the LAN.\u00a0 This would be configured with the following command for the VLAN 100 interface:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd ra lifetime 0<\/strong><\/span><\/p>\n<p>Another conceivable option would be to use an\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/ip-version-6\/113126-ipv6-acl-00.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">access control list<\/a>\u00a0(ACL) in the outbound direction on the router\u2019s interface to stop the RA from being sent.\u00a0 The following ACL will be configured first, which is set up to block all RAs, but allow all other IPv6 packets:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>ipv6 access-list BLOCKRA<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0deny icmp any any router-advertisement log<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0permit ipv6 any any<\/strong><\/span><\/p>\n<p>The next step is to enable IPv6 on the interface, but not give it an IPv6 address yet:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>interface vlan 100<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 enable<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 traffic-filter BLOCKRA out<\/strong><\/span><\/p>\n<p>Once this configuration is complete, you can configure the IPv6 address on the router\u2019s interface and then check that the ACL entry is being used by inspecting the packet counter using the following command:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>show ipv6 access-list<\/strong><\/span><\/p>\n<p>However, the problem with this approach is that the ACL doesn\u2019t block packets that are originated by the router.\u00a0 It would only block packets passing through the router\u2019s data plane.\u00a0 Therefore, this technique is ineffective at blocking RAs originated by the router itself.<\/p>\n<p>It is possible to create an inbound ACL such as the one below, which blocks the router from receiving RS messages sent by the local hosts.\u00a0 This ACL is applied in the inbound direction on the router\u2019s interface to the hosts sending the Router Solicitations:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>ipv6 access-list BLOCKRS<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0deny icmp any any router-solicitation log<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0permit ipv6 any any<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>interface vlan 100<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 traffic-filter BLOCKRS in<\/strong><\/span><\/p>\n<p>Another way to disable RAs from being sent out a router\u2019s interface is to use the\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios-xml\/ios\/ipv6\/command\/ipv6-cr-book\/ipv6-i3.html#wp2583862361\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">following command<\/a>\u00a0on the interface (in this example, VLAN 100):<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd ra suppress<\/strong><\/span><\/p>\n<p>This commands seems like it might do what we want. However, on some versions of Cisco IOS, this command will cause the router to respond to an RS but\u00a0<em>not<\/em>\u00a0send periodic RAs.\u00a0 This is a problem, because today, virtually all modern operating systems are IPv6-enabled by default and would send an RS as soon as they join the network.\u00a0 If only one system sends an RS to the FF02::2 all-routers link-local multicast group address, the router will respond with an RA, and the default RA settings will indicate that SLAAC should be used.\u00a0 In newer Cisco IOS versions, it appears that this commands stops both the periodic RAs and prevents the response to a host-sent RS.<\/p>\n<p>The command we are really searching for is the following:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>ipv6 nd ra suppress all<\/strong><\/span><\/p>\n<p>This command\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/ios-xml\/ios\/ipv6\/command\/ipv6-cr-book\/ipv6-i3.html#wp2583862361\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">suppresses RAs<\/a>, even in response to RSs that the router might receive from a host.\u00a0 This command is available in IOS 15.X, so hopefully you are using a newer Cisco IOS version.<\/p>\n<p>At this point, you are free to add the IPv6 address to the first-hop router\u2019s interface and no RAs will be sent, immediately or otherwise.\u00a0 In other words, all outgoing RAs would be blocked.<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 address 2001:db8:1000:1230::1\/64<\/strong><\/span><\/p>\n<p>We can then check the IPv6 settings for this interface to make sure that we entered the configuration correctly.<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>show ipv6 interface vlan 100<\/strong><\/span><\/p>\n<p>When it comes to\u00a0<a href=\"http:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/switches\/datacenter\/nexus7000\/sw\/unicast\/command\/reference\/n7k_unicast_cmds\/l3_cmds_i.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">configuring a Cisco NX-OS<\/a>\u00a0switch, the commands are similar, but not exactly the same.\u00a0 The following is an example of a similar routed interface.\u00a0 However, the NX-OS switches lack the ability to completely suppress all RAs, in particular those sent in response to an RS.\u00a0 Because of this, you might want to use the ACL technique shown above to block the incoming RS packets:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>interface Ethernet 1\/10<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 enable<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd suppress-ra<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd ra-lifetime lifetime 0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 nd prefix default no-advertise<\/strong><\/span><\/p>\n<p>After this configuration is in place, we would then be ready to configure the IPv6 address on the interface:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>\u00a0ipv6 address 2001:db8:1000:1230::1\/64<\/strong><\/span><\/p>\n<p>After this configuration, we can then inspect the configuration of the interface:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>show ipv6 interface Ethernet 1\/10<\/strong><\/span><\/p>\n<h2 id=\"toc-hId-735791709\">Disable RAs on Hosts<\/h2>\n<p>Another approach would be to disable receiving RAs on the servers in the data center.\u00a0 This would prevent the servers from receiving any RA, regardless of the A\/L\/M\/O bits, and prevent it from performing any type of dynamic address configuration.\u00a0 This technique is a more difficult approach to administer because it must be performed on every single node on the LAN prior to IPv6 being enabled on the first-hop router.\u00a0 The administrative burden is much higher because it requires configuration on all servers rather than on the router itself.\u00a0 However, the advantage of this technique is that it would prevent against any\u00a0<a href=\"\/ipv6-coe\/getting-to-know-your-neighbors-with-ipv6-first-hop-security\/\" target=\"_blank\" rel=\"noopener noreferrer\">rogue RAs<\/a>\u00a0on the LAN from an attacker wanting to perform a man-in-the-middle attack.<\/p>\n<p>To disable receiving RAs on a Windows host, you can use the following\u00a0<a href=\"https:\/\/support.microsoft.com\/en-us\/kb\/961433\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">netsh command<\/a>\u00a0using the interface number:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>netsh interface ipv6 set interface &#8220;Local Area Connection&#8221; routerdiscovery=disabled<\/strong><\/span><\/p>\n<p>Alternatively, you can check the settings of the interface using a command like this:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>netsh interface ipv6 show interface &#8220;Local Area Connection&#8221;<\/strong><\/span><\/p>\n<p>Alternatively, you can use the PowerShell\u00a0<a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/hh826125(v=wps.630).aspx\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Set-NetIPInterface<\/a>\u00a0command as follows:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>Set-NetIPInterface -InterfaceIndex 12 -RouterDiscovery Disabled -Dhcp Disabled<\/strong><\/span><\/p>\n<p>You can check the configuration using the PowerShell\u00a0<a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/hh826135(v=wps.630).aspx\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Get-NetIPInterface<\/a>\u00a0command.<\/p>\n<p>It is possible to disable receiving and processing RAs on a Linux host using the following commands:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>sudo sysctl -w net.ipv6.conf.eth1.accept_ra=0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>echo 0 &gt; \/proc\/sys\/net\/ipv6\/conf\/eth0\/accept_ra<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>echo 0 &gt; \/proc\/sys\/net\/ipv6\/conf\/all\/accept_ra<\/strong><\/span><\/p>\n<p>Another option is to put configuration entries, like the following, into the \/etc\/sysctl.conf file:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>net.ipv6.conf.all.autoconf = 0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>net.ipv6.conf.all.accept_ra = 0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>net.ipv6.conf.default.accept_ra=0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>net.ipv6.conf.all.accept_ra=0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>net.ipv6.conf.eth0.accept_ra=0<\/strong><\/span><\/p>\n<p>To disable RAs on a BSD system, you would use the following sysctl commands:<\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>sysctl net.inet6.ip6.accept_rtadv=0<\/strong><\/span><\/p>\n<p><span style=\"font-family: courier new,courier;\"><strong>sysctl -w net.inet6.ip6.accept_rtadv=0<\/strong><\/span><\/p>\n<p>Keep in mind that this technique does not work on an Apple Mac OS X system because this is a read-only parameter.\u00a0 See section 5.2 of the \u201c<a class=\" bf_ungated_init\" href=\"http:\/\/www.ipv6now.com.au\/primers\/ERNW_Hardening_IPv6_MacOS-X_v1_0.pdf\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">IPv6 Hardening Guide for OS-X<\/a>\u201d by Antonios Atlasis.<\/p>\n<p>It should also be mentioned that you could configure a host-based firewall such as NetFilter (<a href=\"http:\/\/ipset.netfilter.org\/ip6tables.man.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ip6tables<\/a>) to block the RA from being received on the host\u2019s interface.<\/p>\n<h2 id=\"toc-hId-764420860\">Summary<\/h2>\n<p>Manually configuring IT systems falls on one end of the spectrum.\u00a0 Allowing devices and systems to self-provision and leverage automation is at the other end.\u00a0 Each of these two generic configuration techniques has its advantages and disadvantages (as compared in the table below).<\/p>\n<table>\n<tbody>\n<tr>\n<td width=\"312\"><strong>Manual Configuration<\/strong><\/td>\n<td width=\"312\"><strong>Automatic Configuration<\/strong><\/td>\n<\/tr>\n<tr>\n<td width=\"312\">High administrative overhead\/burden<\/td>\n<td width=\"312\">Low administrative overhead\/burden<\/td>\n<\/tr>\n<tr>\n<td width=\"312\">Static, no variability, deterministic<\/td>\n<td width=\"312\">Dynamic, some variability, subject to change<\/td>\n<\/tr>\n<tr>\n<td width=\"312\">Requires operator, prone to human error<\/td>\n<td width=\"312\">Closed-loop software-driven system, some human error still possible<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The choice of which method to use should be based on the requirements of the system and your overall IT practice.\u00a0 When configuring IPv6, it may be preferable to more deliberately (and manually) configure it.\u00a0 In a data center, this would mean using the manual configuration technique for addressing servers.\u00a0 However, in the end-user access networks, dynamic configuration using DHCPv6 is preferred.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>IPv6\u00a0differs from IPv4 in a few key areas, perhaps most significantly in how IPv6 behaves on an Ethernet LAN.\u00a0Organizations looking to optimize IPv6 deployment often turn to an IPv6 Center of Excellence, ensuring their network design and implementation adhere to best practices. IPv6 has far more reliance on\u00a0ICMPv6\u00a0and on multicast, whereas IPv4 uses broadcasts for [&hellip;]<\/p>\n","protected":false},"author":321,"featured_media":2221,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[17],"tags":[50,38],"class_list":{"0":"post-3445","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-ipv6-coe","8":"tag-dhcp","9":"tag-ipv6","10":"entry"},"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Disabling IPv6 Router Advertisements in the Data Center<\/title>\n<meta name=\"description\" content=\"Different configurations of IPv6 should be used to get the most out of it. Learn more about the different configurations and which one is best for your servers\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Disabling IPv6 Router Advertisements in the Data Center\" \/>\n<meta property=\"og:description\" content=\"Different configurations of IPv6 should be used to get the most out of it. Learn more about the different configurations and which one is best for your servers\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/\" \/>\n<meta property=\"og:site_name\" content=\"Infoblox Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-07-13T17:04:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-04-02T18:18:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/june-16.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"660\" \/>\n\t<meta property=\"og:image:height\" content=\"454\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Scott Hogg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Scott Hogg\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/\"},\"author\":{\"name\":\"Scott Hogg\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/ee71ac61fe2ea349f6e991e628d22f4c\"},\"headline\":\"Disabling IPv6 Router Advertisements in the Data Center\",\"datePublished\":\"2016-07-13T17:04:25+00:00\",\"dateModified\":\"2025-04-02T18:18:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/\"},\"wordCount\":2581,\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/june-16.jpg\",\"keywords\":[\"DHCP\",\"IPv6\"],\"articleSection\":[\"IPv6 CoE\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/\",\"name\":\"Disabling IPv6 Router Advertisements in the Data Center\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/june-16.jpg\",\"datePublished\":\"2016-07-13T17:04:25+00:00\",\"dateModified\":\"2025-04-02T18:18:56+00:00\",\"description\":\"Different configurations of IPv6 should be used to get the most out of it. Learn more about the different configurations and which one is best for your servers\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/june-16.jpg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/june-16.jpg\",\"width\":660,\"height\":454},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/ipv6-coe\\\/disabling-ipv6-router-advertisements-in-the-data-center\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"IPv6 CoE\",\"item\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/category\\\/ipv6-coe\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Disabling IPv6 Router Advertisements in the Data Center\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"name\":\"infoblox.com\\\/blog\\\/\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#organization\",\"name\":\"Infoblox\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"contentUrl\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/wp-content\\\/uploads\\\/infoblox-logo-2.svg\",\"width\":137,\"height\":30,\"caption\":\"Infoblox\"},\"image\":{\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/#\\\/schema\\\/person\\\/ee71ac61fe2ea349f6e991e628d22f4c\",\"name\":\"Scott Hogg\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_321_1574118215-96x96.jpg\",\"url\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_321_1574118215-96x96.jpg\",\"contentUrl\":\"https:\\\/\\\/blogs.infoblox.com\\\/wp-content\\\/uploads\\\/avatar_user_321_1574118215-96x96.jpg\",\"caption\":\"Scott Hogg\"},\"description\":\"Scott Hogg has 30 years of network and security experience and is president of Hogg Networking with. Scott Hogg specializes in teaching Internet Protocol version 6 (IPv6) and providing implementation guidance. Scott is CCIE #5133 (Emeritus) and CISSP #4610. Scott is Chair Emeritus of the Rocky Mountain IPv6 Task Force (RMv6TF), a member of the IPv6 Center of Excellence (COE), and co-author of the Cisco Press book on IPv6 Security.\",\"sameAs\":[\"https:\\\/\\\/hexabuild.io\"],\"url\":\"https:\\\/\\\/www.infoblox.com\\\/blog\\\/author\\\/scott-hogg\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Disabling IPv6 Router Advertisements in the Data Center","description":"Different configurations of IPv6 should be used to get the most out of it. Learn more about the different configurations and which one is best for your servers","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/","og_locale":"en_US","og_type":"article","og_title":"Disabling IPv6 Router Advertisements in the Data Center","og_description":"Different configurations of IPv6 should be used to get the most out of it. Learn more about the different configurations and which one is best for your servers","og_url":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/","og_site_name":"Infoblox Blog","article_published_time":"2016-07-13T17:04:25+00:00","article_modified_time":"2025-04-02T18:18:56+00:00","og_image":[{"width":660,"height":454,"url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/june-16.jpg","type":"image\/jpeg"}],"author":"Scott Hogg","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Scott Hogg","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#article","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/"},"author":{"name":"Scott Hogg","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/ee71ac61fe2ea349f6e991e628d22f4c"},"headline":"Disabling IPv6 Router Advertisements in the Data Center","datePublished":"2016-07-13T17:04:25+00:00","dateModified":"2025-04-02T18:18:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/"},"wordCount":2581,"publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/june-16.jpg","keywords":["DHCP","IPv6"],"articleSection":["IPv6 CoE"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/","url":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/","name":"Disabling IPv6 Router Advertisements in the Data Center","isPartOf":{"@id":"https:\/\/www.infoblox.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#primaryimage"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#primaryimage"},"thumbnailUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/june-16.jpg","datePublished":"2016-07-13T17:04:25+00:00","dateModified":"2025-04-02T18:18:56+00:00","description":"Different configurations of IPv6 should be used to get the most out of it. Learn more about the different configurations and which one is best for your servers","breadcrumb":{"@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#primaryimage","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/june-16.jpg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/june-16.jpg","width":660,"height":454},{"@type":"BreadcrumbList","@id":"https:\/\/www.infoblox.com\/blog\/ipv6-coe\/disabling-ipv6-router-advertisements-in-the-data-center\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.infoblox.com\/blog\/"},{"@type":"ListItem","position":2,"name":"IPv6 CoE","item":"https:\/\/www.infoblox.com\/blog\/category\/ipv6-coe\/"},{"@type":"ListItem","position":3,"name":"Disabling IPv6 Router Advertisements in the Data Center"}]},{"@type":"WebSite","@id":"https:\/\/www.infoblox.com\/blog\/#website","url":"https:\/\/www.infoblox.com\/blog\/","name":"infoblox.com\/blog\/","description":"","publisher":{"@id":"https:\/\/www.infoblox.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.infoblox.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.infoblox.com\/blog\/#organization","name":"Infoblox","url":"https:\/\/www.infoblox.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","contentUrl":"https:\/\/www.infoblox.com\/blog\/wp-content\/uploads\/infoblox-logo-2.svg","width":137,"height":30,"caption":"Infoblox"},"image":{"@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.infoblox.com\/blog\/#\/schema\/person\/ee71ac61fe2ea349f6e991e628d22f4c","name":"Scott Hogg","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_321_1574118215-96x96.jpg","url":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_321_1574118215-96x96.jpg","contentUrl":"https:\/\/blogs.infoblox.com\/wp-content\/uploads\/avatar_user_321_1574118215-96x96.jpg","caption":"Scott Hogg"},"description":"Scott Hogg has 30 years of network and security experience and is president of Hogg Networking with. Scott Hogg specializes in teaching Internet Protocol version 6 (IPv6) and providing implementation guidance. Scott is CCIE #5133 (Emeritus) and CISSP #4610. Scott is Chair Emeritus of the Rocky Mountain IPv6 Task Force (RMv6TF), a member of the IPv6 Center of Excellence (COE), and co-author of the Cisco Press book on IPv6 Security.","sameAs":["https:\/\/hexabuild.io"],"url":"https:\/\/www.infoblox.com\/blog\/author\/scott-hogg\/"}]}},"_links":{"self":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/3445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/users\/321"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/comments?post=3445"}],"version-history":[{"count":6,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/3445\/revisions"}],"predecessor-version":[{"id":11345,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/posts\/3445\/revisions\/11345"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media\/2221"}],"wp:attachment":[{"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/media?parent=3445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/categories?post=3445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infoblox.com\/blog\/wp-json\/wp\/v2\/tags?post=3445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}