IPv6 Migration

We design an IPv6 addressing scheme using your allocated /48 (or larger) prefix. Subnets get /64 prefixes — standard for SLAAC and sufficient for any workload density. Address allocation follows a structured plan: site bits, environment bits, subnet function bits. Documentation maps every subnet to its purpose. No more NAT — every host gets globally routable addresses, with firewall rules controlling access.

VPCs, subnets, route tables, and security groups get updated for dual-stack. Load balancers accept IPv6 connections. DNS records include AAAA entries alongside A records. We configure IPv6 on compute instances with proper firewall rules — the 'no NAT' model means firewall rules are your only perimeter defense. NDP (Neighbor Discovery Protocol) security prevents local network attacks.

We test applications for IPv6 compatibility — socket bindings, address parsing, logging, and geolocation. Common issues: hardcoded IPv4 addresses, regex-based IP validation that rejects IPv6, and libraries that don't handle IPv6 address formats. We identify and fix these before enabling IPv6 traffic. Load testing verifies performance parity between IPv4 and IPv6 paths.

IPv6 traffic gets monitored separately during rollout — latency, error rates, and throughput compared against IPv4 baselines. DNS returns AAAA records initially only for non-critical services, expanding to production after validation. Happy Eyeballs (RFC 8305) ensures clients fall back to IPv4 if IPv6 connectivity fails. You get a phased migration, not a flag day.