Reserved IPv6 Subnet Anycast Addresses
Extracted elements (12)
Only 128 values (7-bit anycast ID space) are reserved rather than 256 to ensure the minimum possible interface identifier size is 8 bits, allowing the subnet prefix / interface identifier boundary to be byte-aligned even in the smallest case.
The highest addresses within each subnet are reserved (rather than the lowest) to avoid conflicts with existing official and unofficial uses of low-numbered addresses, such as point-to-point link endpoints, tunnel endpoints, and manually configured static router addresses.
Reserved subnet anycast addresses are allocated from the IPv6 unicast address space, consistent with the general rule for all IPv6 anycast addresses defined in RFC 2373.
For IPv6 address types with 64-bit EUI-64 interface identifiers, the universal/local bit MUST be set to 0 (local) in all reserved subnet anycast addresses, indicating the interface identifier is not globally unique.
New anycast identifiers assigned for reserved subnet anycast addresses MUST be reserved within all subnet prefixes; new values SHOULD be assigned in descending numerical order and are expected to require IESG approval.
Reserved subnet anycast addresses MUST NOT be used for unicast addresses assigned to any interface; they are reserved on all links with all subnet prefixes.
The Mobile IPv6 Home-Agents subnet anycast address uses anycast identifier 126 (0x7E). For EUI-64 addresses, its 64-bit interface identifier is 0xFDFFFFFFFFFFFFFF (with universal/local bit = 0); for non-EUI-64, it is 0xFFFFFFFFFFFFFFFE.
Within each subnet, the highest 128 interface identifier values are reserved for assignment as subnet anycast addresses, identified by a 7-bit anycast identifier field.
A set of anycast identifiers (0–127) is defined within each subnet prefix. Anycast ID 127 (0x7F) is reserved; ID 126 (0x7E) is assigned to Mobile IPv6 Home-Agents anycast; IDs 0–125 (0x00–0x7D) are reserved for future assignment.
Reserving well-known anycast addresses for specific services allows attackers to target those services directly. The document recommends that each service using a reserved anycast address address this risk within its own security mechanisms.
For EUI-64 address types (format prefixes 001–111 except multicast), the reserved subnet anycast address is: 64-bit subnet prefix | 57-bit field of all 1s with universal/local bit forced to 0 | 7-bit anycast ID. The interface identifier is 64 bits total.
For non-EUI-64 address types with an n-bit subnet prefix, the interface identifier field is formed as: (121-n) bits of all 1s followed by a 7-bit anycast ID, with no universal/local bit constraint.