IPv6 ULA Generator
A ULA prefix must be randomly generated to make collisions improbable when two networks merge. Picking fd00::/48 by hand, as most people do, defeats the entire point.
/48 prefix — allocate this to your organisation
First /64 subnet — one per VLAN
Example subnet allocation
| Subnet | Suggested use |
|---|---|
Why this must be random
RFC 4193 reserves fc00::/7, of which only
fd00::/8 is defined for local assignment. The 40 bits after that are
the global ID, and the specification requires them to be generated randomly.
The reason is collisions. ULA prefixes are supposed to survive two networks being connected — after
an acquisition, or a site-to-site VPN. If both sides picked fd00::/48
because it looked tidy, they now overlap and one of them has to renumber. With 40 random bits the
chance of collision between two networks is about one in a trillion.
fd00::/48, fd12:3456:789a::/48, and
every other memorable value are the ones everybody else also chose. That is precisely why they are
the wrong answer.
Using it
- Always subnet on /64
- SLAAC requires it, and so do several neighbour discovery behaviours. A /48 gives you 65,536 /64s, which is more VLANs than you will ever have. Do not economise here — there is nothing to save.
- ULA is not a firewall
- The addresses are not globally routed by convention, not by enforcement. Border filtering is still your job — treat it as you would RFC 1918 space.
- Address selection will surprise you
- RFC 6724 ranks ULA below global addresses but above IPv4 in some stacks and below it in others. A dual-stack host with both a ULA and a GUA will not necessarily use the one you expect for internal traffic. Test rather than assume.
- Record the allocation
- A random prefix is unmemorable by design, so it must be written down — in the IP allocation register, not in one engineer's terminal history.