IPv6 Support in Azure

Question

IPv6 Support in Azure

Alex 495

Hello,

I am looking to enable IPv6 on Vnet, Subnet, VMs, and other resources.

What private IPv6 address range I can use and the corresponding subnet ranges to use? Are there any Azure recommended or best practiced address ranges defined?

For eg: Can I use something like below?

Address Range - fd00::61:0/112

Subnet - fd00::61:2100/120

Thank you in advance.

Accepted answer

0 additional answers

Your answer

Answer 1

GitaraniSharma-MSFT 50,021 Microsoft Employee Moderator

Hello @Alex ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know what private IPv6 address range you can use in Azure and if there are any Azure recommended or best practiced address ranges defined.

IPv6 for Azure Virtual Network enables you to host applications in Azure with IPv6 and IPv4 connectivity both within a virtual network and to and from the Internet.

You can define your own IPv6 virtual network address space to meet the needs of your applications.

Refer: https://azure.microsoft.com/en-in/updates/ipv6-for-azure-virtual-network-is-now-generally-available-2/

The subnets for IPv6 must be exactly /64 in size. This ensures future compatibility should you decide to enable routing of the subnet to an on-premises network since some routers can only accept /64 IPv6 routes.

So, your IPv6 range should be something like fd00:db8:deca:deed::/64 or 2001:db8:3c4d:15::/64 and not /112 or /120.

All the information for IPv6 usage and limitations can be found in the below docs:

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-ipv6-overview

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Alex 495 Reputation points

2023-12-12T08:55:48.37+00:00

Hello @GitaraniSharma-MSFT ,

Thank you for the quick response.

If the subnets must be exactly /64 in size, then the Vnet address range should be /48 or /32, correct?

Is the below holds good then?

Vnet address range - fd00:0:61::/48

Subnet - fd00:0:61:21::/64
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-12T09:05:51.8766667+00:00

Yes @Alex , that is correct.

You can add a /48 Vnet with /64 subnet as below:

Regards,

Gita
Alex 495 Reputation points

2023-12-12T09:46:52.7966667+00:00
Great, thank you.

Two more queries.

I am confused with the NIC part now.

I have a VM with only IPv4 NIC attached, but still Linux OS shows that interface eth0 has ipv6 (inet6) address as well and I am able to generate traffic using this ipv6 link local address and get the success response locally in the server, not sure how.

But is it still required to have another NIC with IPv6 attached to the VM?

Can I associate an IPv6 public IP to Azure firewall and have a DNAT rule translating that public IP to a ULA private IPv6 NIC/LB?
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-12T11:31:08.2+00:00

Hello @Alex ,

I have a VM with only IPv4 NIC attached, but still Linux OS shows that interface eth0 has ipv6 (inet6) address as well and I am able to generate traffic using this ipv6 link local address and get the success response locally in the server, not sure how.

How about the ipconfigs on your NIC? Do you have an IPv6 ipconfig added to the NIC as below?

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface?tabs=azure-portal#view-network-interface-settings

And how are you generating traffic using the IPv6 address? Could you try to ping this IPv6 from another VM in the same subnet?

Can I associate an IPv6 public IP to Azure firewall and have a DNAT rule translating that public IP to a ULA private IPv6 NIC/LB?

No, Azure Firewall doesn't currently support IPv6. It can operate in a dual stack virtual network using only IPv4, but the firewall subnet must be IPv4-only. If you add an IPv6 address to a rule, the firewall fails.

Refer: https://learn.microsoft.com/en-us/azure/firewall/firewall-known-issues

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview#limitations

Regards,

Gita
Alex 495 Reputation points

2023-12-13T06:39:35.4733333+00:00
Hello @GitaraniSharma-MSFT ,

No, I do not have a IPv6 secondary IP attached to the NIC, but it still shows the link local inet6 address in the VM for the IPv4 primary IP of the NIC.

I generated traffic using curl and openssl s_client connect commands locally in the VM.

I tried to do the same from other VM in the same subnet to the test VM, but it was not connecting - maybe that is the behavior of link local IPv6 address.

And I need to have the secondary IPv6 config in the NIC for the traffic to be routed across other VMs in the Vnet.

Regarding the Azure Firewall limitation of IPv6 - when can we expect it to support IPv6? like running the firewall on IPv6 subnet, associating IPv6 public IP to the firewall and using it for firewall rules?

Thanks in advance.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-13T08:04:35.41+00:00

Hello @Alex ,

No, I do not have a IPv6 secondary IP attached to the NIC, but it still shows the link local inet6 address in the VM for the IPv4 primary IP of the NIC.

I think now I understand which IPv6 address you are referring to. You are referring to the Link-local IPv6 address which is always available in a network node.

This IPv6 address is present in all VMs and machines as below:

Link-local addresses:

These addresses are used on a single link and have the following format: FE80::InterfaceID. Link-local addresses are used between nodes on a link for auto-address configuration, neighbor discovery, or when no routers are present. A link-local address is used primarily at startup and when the system has not yet acquired addresses of larger scope. In general, a node always has a link-local address. Link-local addresses are not guaranteed to be unique beyond a single network segment. Routers therefore do not forward packets with link-local addresses.

Refer: https://learn.microsoft.com/en-us/dotnet/fundamentals/networking/ipv6-overview#address-types

https://learn.microsoft.com/en-us/windows/win32/winsock/link-local-and-site-local-addresses-2

https://learn.microsoft.com/en-us/answers/questions/47184/ipv6-link-local-address-and-client-server-applicat

You can ignore this IPv6 address as this is not used for VM-to-VM communication.

And as I mentioned earlier, you need to add a secondary IPv6 config in the NIC for the traffic to be routed across other VMs in the Vnet.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/add-dual-stack-ipv6-vm-portal#add-ipv6-configuration-to-virtual-machine

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface?tabs=azure-portal#view-network-interface-settings

Regarding the Azure Firewall limitation of IPv6 - when can we expect it to support IPv6? like running the firewall on IPv6 subnet, associating IPv6 public IP to the firewall and using it for firewall rules?

IPv6 support for Azure Firewall is under investigation but we don't have a definite ETA as of yet. I would request you to follow/subscribe Azure updates for any new product/feature updates.

If you wish you may upvote the feedback in the below forum requesting this feature. All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

https://feedback.azure.com/d365community/idea/4ecc570a-6461-ec11-a81a-6045bd78b970

Regards,

Gita
Alex 495 Reputation points

2023-12-13T10:35:38.6833333+00:00
Hello @GitaraniSharma-MSFT ,

Thank you for the detailed clarification about the Link-Local IPv6 address, which helped to confirm my understanding.

And will watch Azure updates for the release of IPv6 support for Azure firewall. I have upvoted the feedback as well! Thank you for providing the same.

To other fellow MSFT/Azure buddies, if you have stumbled upon this QnA, kindly upvote below feedbacks.

https://feedback.azure.com/d365community/idea/a4449626-a399-ee11-a81c-6045bd7fe045

https://feedback.azure.com/d365community/idea/4ecc570a-6461-ec11-a81a-6045bd78b970

Another query,

Is it possible to perform IPv4 to IPv6 communication or vice-versa? In other words, are Tunneling, Translation, etc enabled in a dual-stack Vnet?

Example scenario:

Source VM with only IPv4, trying to do ssh/curl to a VM with IPv6 address
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-13T12:14:56.4966667+00:00

Hello @Alex ,

I don't think NAT64 is natively supported in Azure as you can see it mentioned in the below docs:

Load balancing doesn't perform any protocol translation. NAT64 (translation of IPv6 to IPv4) is not supported.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview#capabilities

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-ipv6-overview#details-and-limitations

I've seen setups using NAT64 proxy in Azure for translation.

Refer: https://learn.microsoft.com/en-us/azure/architecture/guide/aks/aks-dual-stack

https://techcommunity.microsoft.com/t5/azure-architecture-blog/ipv4-ipv6-dual-stack-webservices-in-azure/ba-p/1667283

But I will get it confirmed and update you.

Regards,

Gita
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-12-14T07:04:16.67+00:00

Hello @Alex ,

I checked with the Azure Vnet and IPv6 Product Group team and they confirmed that NAT64 is not supported in Azure as of now. It is being considered for our roadmap but no ETA as of yet.

Regards,

Gita
Alex 495 Reputation points

2023-12-14T10:59:44.2933333+00:00

Thank you, @GitaraniSharma-MSFT .

Share via

IPv6 Support in Azure

0 additional answers

Your answer