01Introduction
Dual-Stack IPv6 Across 50K-Seat Enterprise
02Problem Statement
- Global ISP and enterprise client: 50,000 seats across 12 countries
- IPv4 exhaustion forcing expensive CGNAT workarounds; DDoS surface expanding
- Legacy network stack: F5 BIG-IP LTM, Cisco ACI, Palo Alto NGFW, edge routers
- Challenge: enable IPv6 end-to-end without disrupting existing IPv4 traffic flows
- Regulatory driver: government contracts requiring IPv6 compliance by deadline
03Proposed Solution
Phase 1
ISP > DDoS Scrubbing > Edge > Firewall > F5 > ACI > Server
- Upstream ISP BGP peering updated for IPv6 prefix advertisement (/48 allocation)
- DDoS scrubbing center configured for dual-stack traffic inspection
- Edge routers: OSPFv3 + BGP dual-stack; RA guard and DHCPv6 snooping enabled
- Palo Alto NGFW: security policies mirrored for IPv6 with same zone architecture
- F5 BIG-IP: virtual servers updated for dual-stack; iRules reviewed for IPv4 assumptions
Phase 2
ACI Fabric & Server-Level Enablement
- Cisco ACI: EPGs updated with IPv6 subnets; contracts extended to v6 traffic
- ESXi hosts: VMkernel interfaces dual-stacked; VMs opt-in via SLAAC
- DNS: AAAA records published for all dual-stack services; split-horizon validated
- Testing: 6to4 fallback disabled post-validation to prevent security bypass
- Rollout: country-by-country over 16 weeks; IPv4 maintained in parallel
04Technologies
- Routing
- BGP dual-stackOSPFv3DHCPv6SLAACRA Guard
- Firewalls
- Palo Alto NGFW (dual-stack security policy)
- Load Balancing
- F5 BIG-IP LTM dual-stack virtual servers
- Fabric
- Cisco ACI (EPGs, contracts, L3Out for IPv6)
- DDoS
- Scrubbing center dual-stack inspection rules