1

I have the following IPv6 addresses range, with netmask 64 :

A:B:C:D:E:0000:0000:0000 -> A:B:C:D:E:0000:0000:FFFF

I have to assign some of them to virtual machines.

Should I use A:B:C:D:E:0000:0000:0000 or should I start with ::1 ?

Improve this question

1 Answer 1

Reset to default
0

Though it is possible to allocate addresses to virtual machines from the link prefix connecting the physical machine to a router, that is not the approach I would recommend.

Rather I would recommend that you get the hosting provider to route a shorter prefix to your physical machine. The prefix length you need depend on the number of VMs:

  • For 1 VM you need a /64
  • For 2 - 14 VMs you need a /60
  • For 9 - 194 VMs you need a /56
  • For 84 - 2702 VMs you need a /52
  • For 776 - 37641 VMs you need a /48

Those numbers are assuming the provider only hand out prefixes on nibble boundaries and that you want a /64 per VM. The overlap between the ranges is because I allowed for an HD-ratio anywhere between 80% and 95%.

The reasons I would recommend getting a prefix routed to the physical machine and subdivide that into a link prefix per VM are twofold.

  • A link prefix per VM give you better isolation between the VMs.
  • The router no longer need to do neighbor discovery for each VM, which reduce memory usage on the router and traffic on the physical link.

If the hosting provider for some reason refuse to route a prefix to your physical machine, then you can instead bridge between virtual and physical interfaces. This has multiple drawbacks:

  • Some VM network bridging implementations have problems with packets being transferred between guest and host. This can lead to scenarios where your guests can communicate with the world but not with the host.
  • The MAC address you allocate to each VM will be directly visible to the hosting provider's router. In case the hosting provider are filtering traffic based on MAC address, it may cause legitimate traffic from your VMs to be dropped. That can require dirty workarounds.
  • It would be possible for the VMs to spoof each other's IP addresses.
  • More traffic and memory will be needed for neighbor discovery.
  • More CPU cycles will be needed since each VM need to process each ND packet. This can be mitigated if the bridging implementation understands IPv6 anycast and limits which VM will see each packet.
Improve this answer
9
  • I don't follow the math. A /60 gives you 16 /64 subnets. Why is it only 14 in your answer? You seem to subtract 2 from each real value.
    – Ron Maupin ♦
    Apr 1, 2016 at 19:03
  • @RonMaupin You get 16 if you assume an HD-ratio of 100%. But I think there is more or less general agreement that reaching an HD-ratio of 100% is not realistic. I gave numbers assuming an HD-ratio between 80% and 95%. Which HD-ratio do you consider to be realistic?
    – kasperd
    Apr 1, 2016 at 19:11
  • That ratio doesn't really apply to IPv6 since you can never use the full capacity of a single subnet. You can effectively use every IPv6 subnet because they are all the same size, and you don't slide the mask around. We have various nibbles of the Network ID set up to mean certain things, but the last bye is for the subnet, giving 256 different subnets. We can use all those subnets. If we assign 00 to a particular site, then we can use subnets 00 to ff for the site.
    – Ron Maupin ♦
    Apr 1, 2016 at 19:21
  • @RonMaupin The ratio does not apply to the host ID part of the address. But it still applies to the network part of the address, because that is managed hierarchically. And it was made 64 bits large to accommodate for operating with HD-ratio in the 80-90% range.
    – kasperd
    Apr 1, 2016 at 19:27
  • 1
    "And it was made 64 bits large to accommodate for operating with HD-ratio in the 80-90% range" isn't how it happened. The original design of IPv6 allocation was for 80 bits of network addressing and 48 bits of host addressing. After that was shared with the IEEE they pointed out that future ethernet-follow-on protocols which would use a 64 bit EUI rather than a 48bit MAC. Thus the IPv6 network:host split was moved from 80:48 to 64:64. In short, the design of the addressing scheme was determined by the host requirements and not so much the network hierarchy requirements. Source: was there.
    – vk5tu
    Jul 12, 2017 at 5:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.