IPv6 Address Types, NDP, and Router Advertisements

IPv6 Address Types, NDP, and Router Advertisements

Overview

IPv6 is fundamentally different from IPv4 in how hosts discover routers, resolve neighbors, and configure their own addresses. Three mechanisms underpin this: a rich address type hierarchy, the Neighbor Discovery Protocol (NDP), and Router Advertisements (RAs). Understanding these is prerequisite to correctly configuring and troubleshooting any IPv6 deployment on RouterOS.

This guide covers:

• All IPv6 address types and their RouterOS-specific behavior
• NDP message types and the RouterOS neighbor table
• Full RA configuration options with CLI syntax
• SLAAC vs DHCPv6 decision guide and M/O flag semantics

For ISP prefix delegation and dual-stack setup see IPv6 Configuration. For DHCPv6 server/client details see IPv6 Prefix Delegation and DHCPv6.

---

IPv6 Address Types

IPv6 addresses are 128-bit values written as eight colon-separated groups of four hex digits. Consecutive all-zero groups collapse to :: (used once per address).

Address Type Reference

Type	Prefix	Scope	RouterOS Behavior
Link-local	fe80::/10	Single link	Auto-generated on every IPv6-capable interface
Unique Local (ULA)	fc00::/7	Organization	Manually assigned; not globally routable
Global Unicast	2000::/3	Internet	Assigned by ISP or added manually
Loopback	::1/128	Host	Internal; equivalent to 127.0.0.1
Unspecified	::/128	—	Source in DAD probes before address confirmed
Multicast	ff00::/8	Varies	Used by NDP, DHCPv6, routing protocols

Link-Local Addresses (fe80::/10)

RouterOS automatically generates a link-local address on every interface where IPv6 is active. Link-local addresses are mandatory — NDP, RAs, and DHCPv6-PD responses all use them as source addresses. You cannot disable link-local address generation.

The default generation method is EUI-64: the interface MAC address is split at byte 3, ff:fe is inserted, and the seventh bit is flipped to form a 64-bit interface identifier.

# View all addresses including auto-generated link-locals
/ipv6 address print

Example output:

Flags: X - disabled, I - invalid, D - dynamic, G - global, L - link-local
 #   ADDRESS                    INTERFACE  ADVERTISE
 0 D fe80::1234:56ff:fe78:9abc/64  ether1  no
 1   2001:db8:cafe::1/64           bridge  yes

You can also add a static link-local if you want a predictable address for management:

/ipv6 address add address=fe80::1/64 interface=bridge advertise=no

Global Unicast (2000::/3)

Publicly routable addresses assigned by your ISP (via DHCPv6-PD or static) or from your own allocation. RouterOS address flags that apply:

Flag	CLI	Effect
eui-64	eui-64=yes	Auto-complete the host portion using EUI-64 from the MAC
advertise	advertise=yes	Include this address’s prefix in RA prefix advertisements
no-dad	no-dad=yes	Skip Duplicate Address Detection (use for static addresses on routers)

# Static global address, advertise the prefix via RA
/ipv6 address add address=2001:db8:cafe::1/64 interface=bridge advertise=yes

# EUI-64 address — host bits filled from MAC automatically
/ipv6 address add address=2001:db8:cafe::/64 interface=bridge eui-64=yes advertise=yes

# Static address, skip DAD (safe for known-unique router addresses)
/ipv6 address add address=2001:db8:cafe::1/64 interface=bridge no-dad=yes

Unique Local Addresses — ULA (fc00::/7)

ULA (fc00::/7, with fd::/8 being the locally assigned range) is the IPv6 equivalent of RFC 1918 private space. ULA addresses are stable and do not change when your ISP prefix changes, making them useful for internal services, management VLANs, and ACLs.

# Assign a ULA address — generate your own /48 from fd00::/8
/ipv6 address add address=fd12:3456:789a::1/64 interface=bridge advertise=yes

Note: ULA addresses are not globally routable. If you use ULA for internal services, ensure your IPv6 firewall does not inadvertently forward ULA-sourced traffic to the internet.

Multicast (ff00::/8)

Multicast is pervasive in IPv6 — it replaces broadcast for neighbor resolution and is used by routing protocols and DHCPv6. RouterOS joins multicast groups automatically as needed:

Multicast Address	Name	Used By
ff02::1	All nodes	General; every IPv6 node on link
ff02::2	All routers	Router discovery; RS targets this group
ff02::1:2	All DHCP relay/servers	DHCPv6 client solicitations
ff02::1:ff00::/104	Solicited-node	NDP neighbor resolution (per-address)
ff02::9	All RIP routers	RIPng
ff02::5, ff02::6	OSPFv3	OSPFv3 routing

Every unicast address has a corresponding solicited-node multicast address at ff02::1:ff + last 24 bits of the unicast address. RouterOS joins these automatically when addresses are configured.

---

Neighbor Discovery Protocol (NDP)

NDP (RFC 4861) is the IPv6 replacement for ARP. It runs over ICMPv6 and handles neighbor resolution, router discovery, prefix distribution, and redirect. RouterOS implements NDP fully — do not block ICMPv6 types 133–137 in your firewall.

NDP Message Types

ICMPv6 Type	Name	Purpose
133	Router Solicitation (RS)	Host requests RA immediately on interface up
134	Router Advertisement (RA)	Router announces prefixes, gateway, flags
135	Neighbor Solicitation (NS)	Resolve link-layer address; also used for DAD
136	Neighbor Advertisement (NA)	Reply to NS with MAC address
137	Redirect	Router tells host of a better next-hop

Neighbor Table

RouterOS maintains a per-interface neighbor table (equivalent to the IPv4 ARP table):

# View the neighbor table
/ipv6 neighbor print

# View with full detail (state, interface, expiry)
/ipv6 neighbor print detail

Neighbor states:

State	Meaning
reachable	Recently confirmed reachable via upper-layer protocol or NA
stale	No recent confirmation; will probe before next use
delay	In delay period before sending probe
probe	Actively sending NS probes to confirm reachability
failed	NS probes received no response; neighbor unreachable
noarp	Interface does not support NDP (e.g., point-to-point)

# Flush the neighbor table (forces re-resolution)
/ipv6 neighbor flush

Duplicate Address Detection (DAD)

Before using a new unicast address, RouterOS sends a Neighbor Solicitation from the unspecified address (::) targeting the solicited-node multicast of the new address. If a NA is received in response, a duplicate exists and the address is marked invalid.

DAD is enabled by default. To skip it for a known-unique static address (e.g., a router’s WAN address):

/ipv6 address add address=2001:db8::1/64 interface=ether1 no-dad=yes

NDP Global Settings

/ipv6 settings print

Key settings:

Property	Default	Description
accept-router-advertisements	yes-if-forwarding-disabled	Whether to process received RAs; set yes on WAN interface if ISP uses SLAAC instead of DHCPv6-PD
forward	no	Enable IPv6 packet forwarding between interfaces
max-neighbor-entries	8192	Limit on neighbor table entries (increase for large networks)

# Enable RA acceptance on a router acting as a client on ISP's SLAAC WAN
/ipv6 settings set accept-router-advertisements=yes

# Enable forwarding (required for routing between interfaces)
/ipv6 settings set forward=yes

Important: Setting forward=yes automatically changes accept-router-advertisements to yes-if-forwarding-disabled behavior — the router stops accepting RAs on forwarding interfaces unless explicitly overridden. This prevents the router from misconfiguring its own routes from client-facing RAs.

---

Router Advertisement Configuration

RAs are the mechanism by which RouterOS announces the default gateway, prefixes for SLAAC, and flags that direct clients toward DHCPv6. All RA settings live in /ipv6 nd (per-interface ND profiles) and /ipv6 nd prefix (per-prefix advertisements).

ND Interface Settings (/ipv6 nd)

RouterOS creates a default ND entry for each interface. View and modify:

/ipv6 nd print
/ipv6 nd set [find interface=bridge] <property>=<value>

Full property reference:

Property	Default	Description
interface	—	Interface this ND profile applies to
ra-interval	3m20s-10m	Min–max interval between unsolicited RAs. Format: <min>-<max>
ra-lifetime	30m	How long clients treat this router as default gateway. Set 0 to suppress default route advertisement
reachable-time	unspecified	How long (ms) after confirmation a neighbor is considered reachable. 0 = let client decide
retransmit-interval	unspecified	Interval (ms) between NS retransmissions for unreachable detection
managed-address-configuration	no	M flag: yes tells clients to use stateful DHCPv6 for address assignment
other-configuration	no	O flag: yes tells clients to use DHCPv6 for other config (DNS, domain) only
advertise-dns	yes	Include DNS server addresses in RA via RDNSS option
dns	—	DNS server IPv6 address(es) to advertise via RDNSS. Comma-separated
advertise-mac-address	yes	Include router’s MAC in RA source link-layer option
hop-limit	64	Recommended hop limit for clients to use on outgoing packets

# Typical SLAAC setup: advertise prefix, provide DNS via RDNSS, no DHCPv6
/ipv6 nd set [find interface=bridge] \
    ra-interval=1m-3m \
    ra-lifetime=1h \
    managed-address-configuration=no \
    other-configuration=no \
    advertise-dns=yes \
    dns=2001:db8::53

# Stateless DHCPv6 for DNS (O=1, M=0) — SLAAC for addresses, DHCPv6 for DNS
/ipv6 nd set [find interface=bridge] \
    managed-address-configuration=no \
    other-configuration=yes

# Stateful DHCPv6 (M=1) — clients use DHCPv6 for both address and DNS
/ipv6 nd set [find interface=bridge] \
    managed-address-configuration=yes \
    other-configuration=yes

# Suppress default route advertisement (router is not the default gateway)
/ipv6 nd set [find interface=bridge] ra-lifetime=0

ND Prefix Settings (/ipv6 nd prefix)

RouterOS can advertise specific prefixes in RAs independently of the address configured on the interface. Use this for fine-grained control over what clients receive.

/ipv6 nd prefix print
/ipv6 nd prefix add interface=bridge prefix=2001:db8:cafe::/64 <properties>

Property	Default	Description
prefix	—	The IPv6 prefix to advertise (must be /64 for SLAAC)
interface	—	Interface to advertise on
autonomous	yes	A flag: clients may use this prefix for SLAAC
on-link	yes	L flag: prefix is on-link; clients can reach it directly
valid-lifetime	4w2d	How long a SLAAC address derived from this prefix remains valid
preferred-lifetime	1w	How long the address is preferred (before deprecation)
6to4-interface	—	For 6to4 tunnels; embeds IPv4 address into prefix

# Standard SLAAC prefix advertisement
/ipv6 nd prefix add interface=bridge prefix=2001:db8:cafe::/64 \
    autonomous=yes \
    on-link=yes \
    valid-lifetime=4w2d \
    preferred-lifetime=1w

# Prefix for routing only (not SLAAC) — L flag off, A flag off
/ipv6 nd prefix add interface=bridge prefix=2001:db8:cafe::/64 \
    autonomous=no \
    on-link=no

# Deprecate a prefix (gracefully migrate clients away)
/ipv6 nd prefix set [find prefix=2001:db8:old::/64] \
    valid-lifetime=2h \
    preferred-lifetime=0s

Automatic prefix advertisements: When you add a global unicast address to an interface with advertise=yes, RouterOS automatically creates an /ipv6 nd prefix entry for that prefix. You can view and override this entry in /ipv6 nd prefix.

---

SLAAC vs DHCPv6: M and O Flags

The M (Managed) and O (Other) flags in RAs tell clients where to get their configuration. Understanding them is key to deploying IPv6 correctly.

Flag Semantics

M flag	O flag	Client Behavior
no	no	SLAAC for address; RDNSS in RA for DNS (if advertised)
no	yes	SLAAC for address; DHCPv6 for DNS and other options
yes	yes	DHCPv6 for address + all options (stateful DHCPv6)
yes	no	DHCPv6 for address; no other DHCPv6 options (uncommon)

SLAAC Only (Recommended for Simple LANs)

Clients self-configure addresses from the advertised prefix. DNS is delivered in the RA itself via RDNSS. No DHCPv6 server required.

/ipv6 nd set [find interface=bridge] \
    managed-address-configuration=no \
    other-configuration=no \
    advertise-dns=yes \
    dns=2001:4860:4860::8888,2001:4860:4860::8844

/ipv6 nd prefix add interface=bridge prefix=2001:db8:cafe::/64 \
    autonomous=yes on-link=yes

Limitations: RDNSS is not supported by all older clients. Some embedded devices and older Android versions may not receive DNS via RDNSS.

Stateless DHCPv6 (SLAAC + O flag)

Clients use SLAAC for addresses but contact a DHCPv6 server for DNS and other options. Useful when RDNSS compatibility is a concern.

# Set O flag
/ipv6 nd set [find interface=bridge] \
    managed-address-configuration=no \
    other-configuration=yes

# Configure DHCPv6 server to provide DNS only (no address pool)
/ipv6 dhcp-server add name=dhcpv6-stateless interface=bridge \
    address-pool=none lease-time=1h

Stateful DHCPv6 (M flag)

Router assigns IPv6 addresses from a pool via DHCPv6, similar to IPv4 DHCP. Provides address logging and per-client control at the cost of complexity. Required when you need to assign specific addresses to specific clients.

# Create a pool
/ipv6 pool add name=lan6-pool prefix=2001:db8:cafe::/64 prefix-length=64

# Set M+O flags
/ipv6 nd set [find interface=bridge] \
    managed-address-configuration=yes \
    other-configuration=yes

# Configure DHCPv6 server with address pool
/ipv6 dhcp-server add name=dhcpv6-stateful interface=bridge \
    address-pool=lan6-pool lease-time=12h

Android note: Android 12 and earlier do not support stateful DHCPv6 — they rely on SLAAC regardless of M flag. Plan SLAAC as the baseline for mobile client networks, using DHCPv6 only for supplemental options.

Decision Guide

Need per-client address control or logging?
    YES → Stateful DHCPv6 (M=1, O=1)
    NO  → Continue

Supporting RDNSS-capable clients only (modern Linux, Windows 10+, iOS)?
    YES → SLAAC only (M=0, O=0) with advertise-dns=yes
    NO  → Stateless DHCPv6 (M=0, O=1) for DNS compatibility

---

IPv6 Firewall Essentials

IPv6 addresses are publicly routable — there is no NAT. Every device with a global unicast address is directly reachable from the internet. A firewall on /ipv6 firewall filter is mandatory.

ICMPv6 Must Not Be Blocked

NDP depends entirely on ICMPv6. At minimum, always permit:

/ipv6 firewall filter add chain=input action=accept protocol=icmpv6 \
    comment="accept ICMPv6 — required for NDP, PMTUD, SLAAC"
/ipv6 firewall filter add chain=forward action=accept protocol=icmpv6 \
    comment="accept ICMPv6 forwarded — required for clients"

For a complete firewall ruleset including input, forward, and address list examples, see IPv6 Configuration — IPv6 Firewall Basics.

---

Troubleshooting

Clients Not Receiving RA

# Confirm ND is advertising on the interface
/ipv6 nd print

# Trigger an immediate RA (useful for testing)
# RouterOS sends RAs automatically; RS from client triggers an immediate response
# Check that ICMPv6 type 133/134 are not blocked
/ipv6 firewall filter print

Also verify the interface has a global unicast address with advertise=yes or a manual /ipv6 nd prefix entry exists.

SLAAC Addresses Not Forming on Clients

1. Confirm the RA prefix has autonomous=yes in /ipv6 nd prefix print
2. Confirm the prefix is exactly /64 — SLAAC requires /64
3. Check the client is not ignoring RAs (Windows: netsh interface ipv6 show interface)
4. Verify valid-lifetime and preferred-lifetime are non-zero

Link-Local Address Missing

RouterOS auto-generates link-locals when IPv6 is enabled. If missing:

# Check if IPv6 is enabled on the interface
/ipv6 settings print

# Verify the interface is up
/interface print where name=bridge

Neighbor Resolution Failing

# Check neighbor table state
/ipv6 neighbor print

# Verify solicited-node multicast is not blocked
# ICMPv6 types 135 (NS) and 136 (NA) must be permitted

# Ping a known address to trigger NS
/ping 2001:db8:cafe::2

---

Related Features

• IPv6 Configuration — Address setup, routing, DHCPv6-PD, dual-stack example
• IPv6 Prefix Delegation and DHCPv6 — ISP prefix delegation, DHCPv6 server/client
• DNS over HTTPS and Static DNS — Advertising DNS resolvers

References

• MikroTik IPv6 Neighbor Discovery
• MikroTik IPv6 Address
• RFC 4861 — Neighbor Discovery for IPv6
• RFC 4862 — IPv6 Stateless Address Autoconfiguration
• RFC 4890 — ICMPv6 Filtering Recommendations
• RFC 8106 — IPv6 Router Advertisement Options for DNS