Dual-stack rollout plan for a mid-size company network

Running IPv6 alongside IPv4 is the most common way to introduce it, and it can be done in stages without disrupting users. This article lays out a phased dual-stack plan for a company with several sites, some data centre or cloud presence and a small network team, with checkpoints at each stage.

Phase 1: assess readiness

Start with an honest picture of where you stand before touching any configuration.

• Upstream connectivity: confirm that each ISP can deliver native IPv6 on your existing circuits, and what prefix size it assigns.
• Network equipment: check that routers, switches, firewalls, load balancers and wireless controllers support IPv6 in hardware, including IPv6 access lists and first-hop security features.
• Systems and applications: identify software that hard-codes IPv4 addresses, stores addresses in fields too short for IPv6, or logs and filters by IPv4 only.
• Operational tools: IPAM, monitoring, SIEM, DNS and DHCP must all handle IPv6 before you depend on it.
• Skills: plan training early. The engineers who will troubleshoot IPv6 at 2 a.m. should have worked with it in a lab first.

Phase 2: obtain address space and write the address plan

You can use provider-assigned space from your ISP, or obtain provider-independent space or your own allocation through an LIR. Provider-assigned space is simpler to start with; independent space avoids renumbering if you change providers and makes multihoming straightforward. Check the current RIPE NCC policy for eligibility and assignment sizes.

Then write an address plan before configuring anything:

• Per site: a /48 per site is common practice and provides 65,536 /64 subnets.
• Per segment: use a /64 for every LAN segment, since SLAAC and many features assume it.
• Point-to-point links: use /127 on router links (RFC 6164), reserving a /64 for each to keep the plan tidy.
• Loopbacks: take them from a dedicated /64, per site or for the whole network.
• Readable structure: encode site, function or VLAN ID in the subnet bits along nibble boundaries, so engineers can tell where an address lives by reading it.

Phase 3: reach security parity before users get addresses

Every IPv4 control needs an IPv6 equivalent before clients receive IPv6 addresses. Most current operating systems prefer IPv6 when it is available, so a gap in policy becomes a gap in production straight away.

• Mirror firewall policy for IPv6, including outbound rules and segmentation between internal zones.
• Permit the ICMPv6 types IPv6 depends on, such as Packet Too Big and neighbour discovery; RFC 4890 gives guidance on what to allow.
• Enable RA Guard and DHCPv6 Guard on access switches to block rogue router advertisements and DHCPv6 servers.
• Make sure logging, SIEM correlation and intrusion detection parse IPv6 addresses correctly.
• Decide how logs and access policies will handle temporary privacy addresses, which change over time.

Phase 4: enable the core, then services, then users

Roll out from the inside out, verifying each layer before moving on.

1. Core and edge: enable IPv6 on core links and upstream connections, configure your routing protocols for IPv6, and confirm reachability with external tests.
2. Data centre and servers: assign static addresses to servers and infrastructure services, then add AAAA records and reverse DNS where needed. Start with internal services and a few low-risk external ones.
3. Public services: enable IPv6 on the website, mail and remote access, checking load balancers, certificates and monitoring for each.
4. Pilot users: turn on IPv6 for one IT VLAN or one office first. Watch for application faults, slow connections and helpdesk tickets.
5. Wider rollout: extend site by site, with a clear rollback method per VLAN, such as stopping router advertisements.

For client addressing, choose between SLAAC, SLAAC with stateless DHCPv6 for options, or stateful DHCPv6. Check client operating system support before relying on stateful DHCPv6, as not every platform implements it.

Phase 5: operate and measure

Dual-stack adds operational work, so plan for it rather than discover it.

• Monitor reachability, latency and errors for IPv4 and IPv6 separately. Clients fall back automatically, so a fault on one protocol can hide behind the other.
• Track the share of traffic carried over IPv6 to confirm the rollout is having an effect.
• Add IPv6 to change templates, runbooks and acceptance tests, so new subnets and services are dual-stacked by default.
• Review the plan after each phase and update the address plan wherever reality has diverged from it.

The long-term aim is for IPv6 to be the default in every new design, with IPv4 kept only where it is still needed.

How TACS can help

TACS supports companies through each phase, from obtaining address space to the address plan and rollout; see our IPv6 page for details. If you need provider-independent space or your own allocation, our LIR services team handles the registry side, and Training & support can prepare your engineers before go-live.