How to deal with the automatic 6to4 addresses in the network

[zhenningx]

As we use public IPv4 address in our network, each computer automatically gets an 6to4 address. I understand after the World IPv6 Lauch, these computers may use the 6to4 address to talk to IPv6 enabled websites through the free and unmanaged 6to4 gateways on internet. This may cause unmanaged connectiviy issues. How to prevent this? How would you deal with this? Is there a way to stop these computers to get the automatic 6to4 addresses?

Thanks.

[Service Spring]

On windows you can do a

netsh int ipv6 6to4 set state disabled

[zhenningx]

Thanks. But how to deal with thousands of "unmanaged" client computers?

[Jonatan Jonasson]

I know this may not be the answer you're looking for...

But what about considering implementing IPv6 within your network? (dual-stack)

When the computers have native IPv6 connectivity, they should always prefer using the native IPv6 connection rather than any of the tunneling mechanisms such as 6to4.

Instead of looking at this as a "unmanaged" problem, look at this as "managed" connectivity service.

So by enabling IPv6 within your network, you get two things done.

1) Your network steps into the future.

2) Your clients (managed and unmanaged) will have native connectivity to both IPv4 and IPv6 resources, just like you do with IPv4-only resources today, and then you don't have to worry too much about 6to4.

[zhenningx]

Thanks. Enable native ipv6 is the best option. But we can not enable native ipv6 in a few days.

By consulting with our dns vendor (infoblox), I think we find the best resolution for now. We can setup the dns appliance to filter aaaa records. So when a client query a name with both AAAA and A records, our dns servers will only return A record to the clients. In this way, we can have everything under control before we built our native ipv6 network.

Sent from Cisco Technical Support iPad App