Wiki › Infrastructure, Protocols & Environments › Network Protocols › IPv6 Architecture

IPv6 Architecture

2 min read

Jump to:

Overview

IPv6 Architecture defines the structure and operational principles of the Internet Protocol version 6, the successor to IPv4, designed to address the limitations of its predecessor. It is foundational for modern network infrastructure, enabling scalable addressing, improved routing, and enhanced security features critical to contemporary digital systems.

Core Components

128-bit addressing scheme providing a vastly expanded address space
Header structure with fixed length and simplified fields for efficient processing
Extension headers supporting optional network functions such as fragmentation and security
Neighbor Discovery Protocol (NDP) for address autoconfiguration and network topology discovery
Internet Control Message Protocol version 6 (ICMPv6) for error messaging and diagnostics
Stateless Address Autoconfiguration (SLAAC) enabling devices to self-assign addresses

How It Works

IPv6 operates by encapsulating data packets with a standardized header containing source and destination addresses, routing them across networks based on hierarchical addressing. Devices establish trust relationships through NDP and SLAAC for address configuration and reachability. Control boundaries are defined by network segments and routing policies, with data flow managed end-to-end using IPv6 addresses and extension headers to support optional features.

Trust & Security Model

Authentication primarily relies on IPsec for encryption and integrity, integrated as a native protocol option
Trust boundaries are established at network edges and routing domains, with NDP vulnerable without additional protections
Cryptographic keys and certificates are used in IPsec for securing communication channels

Common Misconfigurations & Weaknesses

Improperly secured NDP leading to spoofing or man-in-the-middle attacks
Failure to deploy IPsec or other encryption mechanisms, leaving traffic exposed
Overreliance on SLAAC without supplementary address management controls
Insufficient filtering of extension headers, enabling evasion or exploitation

Attack Surface & Abuse Scenarios

Exploitation of NDP vulnerabilities such as rogue router advertisements
Denial of Service (DoS) attacks targeting ICMPv6 or extension header processing
Address spoofing and reconnaissance facilitated by large address space and autoconfiguration
Cross-protocol risks involving IPv4/IPv6 transition mechanisms

Visibility & Monitoring

Logs from routers and firewalls capturing IPv6 traffic and ICMPv6 messages
Challenges in monitoring due to vast address space and extension header complexity
Need for specialized tools to analyze NDP and IPv6-specific traffic patterns

Hardening & Security Controls

Implementing Secure Neighbor Discovery (SEND) to protect NDP
Enforcing IPsec policies for confidentiality and integrity
Filtering and validating extension headers at network boundaries
Disabling unnecessary IPv6 features and services to reduce attack surface

Operational Considerations

Careful lifecycle management of IPv6 address allocation and decommissioning
Ensuring high availability through redundant routing and failover mechanisms
Scalability planning to accommodate large address spaces and diverse devices
Managing dependencies with IPv4 and transition technologies

Related Domains & Dependencies

Interaction with IPv4 networks and dual-stack environments
Dependency on routing protocols such as OSPFv3 and BGP for IPv6
Integration with identity and access management systems for endpoint authentication
Shared responsibility models between network operators and service providers

Standards & References

RFC 8200: Internet Protocol, Version 6 (IPv6) Specification
RFC 4861: Neighbor Discovery for IP version 6 (IPv6)
RFC 4301: Security Architecture for the Internet Protocol
RFC 3971: Secure Neighbor Discovery (SEND)

Tags: architecture cloud identity infrastructure ipv6 network protocol saas security trust