How to Configure IPv6 Tokenised Interface Identifiers in Linux Using ip token

In modern IPv6 networking, Stateless Address Autoconfiguration (SLAAC) allows hosts to automatically construct global IP addresses without requiring a stateful DHCPv6 server. By default, SLAAC combines the network’s 64-bit prefix broadcast by the local router with a 64-bit Interface Identifier (IID). Traditionally, this identifier was derived from the hardware MAC address using EUI-64 format, or generated using semantically opaque, randomized stable privacy extensions (RFC 7217).

While privacy addresses are ideal for client laptops and workstations, they create severe administration hurdles for servers, containers, and network appliances. If an upstream router advertises a new IPv6 prefix—or if the network multi-homes across multiple internet service providers—the host interface identifier can change unexpectedly, breaking firewall rules, DNS records, and service bindings. Linux solves this with Tokenised Interface Identifiers (codified in RFC 7217 and implemented in the ip token subsystem). In this tutorial, you will learn how to configure, inspect, and persist predictable IPv6 interface tokens in Linux.

What Are IPv6 Tokenised Interface Identifiers?

An IPv6 token is a pre-assigned, administrator-specified 64-bit host suffix (for example, ::1, ::cafe, or ::5001). When an interface is assigned a token:

• The Linux kernel halts the generation of randomised or MAC-derived SLAAC interface identifiers on that interface.
• Whenever an upstream router advertisement (RA) provides an IPv6 prefix (e.g. 2001:db8:acad:1::/64), the kernel automatically attaches the token to the end of the advertised prefix, producing a deterministic address: 2001:db8:acad:1::cafe.
• If the upstream network re-numbers or introduces a secondary prefix (e.g. 2001:db8:acad:2::/64), the kernel immediately configures 2001:db8:acad:2::cafe automatically.

This provides the predictable addressing benefits of static configuration while retaining the dynamic flexibility and multi-homing resilience of stateless SLAAC.

Step 1: Inspecting Existing IPv6 Tokens

To view the current token configuration across all network interfaces, execute the ip token command in your terminal:

ip token list

Alternatively, target a specific network device such as eth0:

ip token get dev eth0

On standard installations where no token has been explicitly set, the command typically returns token :: dev eth0, indicating that default SLAAC generation rules remain active.

Step 2: Assigning a Token to a Network Interface

Before assigning a token, the target interface should ideally have its existing dynamic autoconfigured addresses flushed or be temporarily brought down to allow clean address generation upon re-association.

To assign an IPv6 token (such as ::100) to interface eth0, run:

sudo ip token set ::100 dev eth0

Verify that the token was registered by querying the device:

ip token get dev eth0

The output will now confirm:

token ::100 dev eth0

Step 3: Triggering SLAAC Address Generation with the Token

Once the token is bound to the interface, the kernel requires a fresh router advertisement (RA) to construct the new global IPv6 address. You can trigger this by toggling the interface or sending an RS (Router Solicitation):

# Restart the link state to solicit router advertisements
sudo ip link set dev eth0 down
sudo ip link set dev eth0 up

Now inspect your interface IPv6 addresses:

ip -6 addr show dev eth0

Under the global scope (scope global), you will see that your host address now cleanly ends with your custom token:

inet6 2001:db8:abcd:1::100/64 scope global dynamic mngtmpaddr 
   valid_lft 86400sec preferred_lft 14400sec

Step 4: Removing or Resetting an IPv6 Token

If you no longer wish to use a tokenised identifier and want the kernel to revert to standard SLAAC generation rules, set the token back to unspecified (::):

sudo ip token set :: dev eth0

Cycling the interface will restore RFC 7217 stable privacy addressing or standard EUI-64 generation.

Persisting IPv6 Tokens Across Reboots

Commands executed via ip token set operate directly on the runtime kernel table and are cleared when the system restarts. To ensure your server maintains its tokenised address permanently, configure your distribution’s network manager.

Method A: systemd-networkd Configuration

If your system utilizes systemd-networkd (standard on modern Debian, Arch Linux, and minimal server builds), edit your network configuration file (e.g. /etc/systemd/network/10-eth0.network):

[Match]
Name=eth0

[Network]
IPv6AcceptRA=yes

[IPv6AcceptRA]
Token=::100

Restart the network daemon to apply the persistent setting:

sudo systemctl restart systemd-networkd

Method B: NetworkManager (nmcli) Configuration

On distributions running NetworkManager (such as Fedora, CentOS Stream, Rocky Linux, or Ubuntu Desktop), use nmcli to configure the IPv6 token identifier:

# Set the IPv6 token identifier
sudo nmcli connection modify eth0 ipv6.token "::100"

# Re-activate the connection
sudo nmcli connection up eth0

Troubleshooting Common IPv6 Token Issues

• Token Not Generating an Address: The ip token feature relies strictly on receiving IPv6 Router Advertisements. If your local router does not have RA enabled, or if the interface sysctl accept_ra is disabled (net.ipv6.conf.eth0.accept_ra = 0), no SLAAC address will be created. Verify sysctl settings with:

  sysctl net.ipv6.conf.eth0.accept_ra

  If forwarding is enabled on the Linux host (e.g. router mode), accept_ra must be explicitly set to 2 to accept upstream RAs.
• Prefix Length Conflicts: Tokenised interface identifiers only function on subnets with standard /64 prefix lengths. If an upstream router advertises a prefix longer than 64 bits (such as /80 or /96), SLAAC and tokenisation cannot operate per the IPv6 standard.
• Duplicate Address Detection (DAD) Failure: If another host on the local physical segment is already using the chosen token, the kernel’s DAD check will flag the address as tentative and refuse to bind it. Choose an unused host identifier.

Frequently Asked Questions

Can I assign any hexadecimal value to an IPv6 token?

Yes. Any valid 64-bit hexadecimal host identifier can be assigned as a token, such as ::1, ::cafe:babe, ::192:168:1:10, or ::aaaa:bbbb. The token occupies the lower 64 bits of the 128-bit IPv6 address.

Does using an IPv6 token compromise client privacy?

For client workstations that frequently roam between coffee shops, universities, and offices, using a static token allows trackers to correlate the device across different physical networks. For this reason, tokens are strongly recommended for servers, microservices, and static network appliances, while client laptops should maintain standard RFC 7217 randomised privacy addresses.

Can an interface have multiple tokens simultaneously?

No. Each network interface supports exactly one tokenised interface identifier at any given time. However, if the router advertises multiple /64 prefixes on the same wire, the kernel will generate multiple global addresses, each sharing the same token.

Does ip token affect link-local IPv6 addresses (fe80::)?

No. Link-local addresses are generated before router advertisements arrive and typically continue to use either the modified EUI-64 MAC algorithm or the system’s stable private key.