How to Configure IPv6 Identifier-Locator Addressing (ILA) in Linux Terminal Using ip ila

In distributed cloud environments, containerized microservices, and mobile cellular topologies, virtual workloads continuously migrate across physical servers, data center availability zones, and carrier radio towers. Under standard IPv6 addressing, when a container or mobile node moves to a new physical host, its IP address must change to conform to the new network topology, which abruptly terminates active TCP/UDP sockets and breaks stateful connections. Identifier-Locator Addressing (ILA, RFC 6741), integrated directly into the upstream Linux kernel, solves this mobility challenge by decoupling identity from location. Through the ip ila command, administrators can configure address translation tables, manage locator mappings, and maintain persistent connections across distributed infrastructures.

Understanding IPv6 Identifier-Locator Addressing Architecture

Standard IPv6 addresses overload a single 128-bit string to represent both who a host is (identity) and where it is located on the global network (location). ILA divides the 128-bit IPv6 address into two distinct 64-bit halves:

• Locator (Top 64 bits): Defines the physical network routing topology (the Standard Identifier-Locator / SIR prefix). Routers on the internet or within enterprise backbones forward packets strictly based on this top 64-bit locator.
• Identifier (Bottom 64 bits): A globally unique, immutable 64-bit value assigned to a specific container, virtual machine, or mobile user session. The identifier never changes regardless of where the workload migrates.
• ILA Router / Translator: Edge Linux routers running ILA intercept packets destined for an identifier, look up the node’s current physical location in an ILA table, rewrite the top 64-bit locator, and forward the packet. Upon arrival at the target destination host, a reverse translation restores the original identifier.

Enabling Kernel ILA Modules and Checking Prerequisites

Linux kernels (version 4.3 and later) include native kernel support for ILA via the ila kernel module. On modern Linux distributions, load the module and verify iproute2 compatibility:

# Load the ILA kernel driver module
sudo modprobe ila

# Verify module initialization
lsmod | grep ila

# Confirm iproute2 ip ila command availability
ip ila help

The ip ila utility provides management interfaces for mapping (translation rules), table (routing namespaces), and kernel translation modes.

Configuring an ILA Translation Mapping

To configure an ILA translation rule on an edge gateway host, bind an immutable 64-bit Identifier to a target physical 64-bit Locator using ip ila mapping add:

# Map Virtual Identifier to Physical Server Locator
sudo ip ila mapping add \
    loc_match 2001:db8:1000:0 \
    locator 2001:db8:2000:0 \
    id 0000:0000:0000:0042

Parameter breakdown:

• loc_match 2001:db8:1000:0: Specifies the incoming SIR locator prefix to intercept.
• locator 2001:db8:2000:0: The real physical destination locator (e.g., Host Server Rack B) where the container currently executes.
• id 0000:0000:0000:0042: The persistent 64-bit container identifier.

Auditing Active ILA Mapping Tables

To query configured identifier-to-locator mappings registered in the kernel routing cache:

# List all active ILA mappings
ip ila mapping list

The output prints active translation pairs, checksum adjustment types, and reference counters:

Parameter	Sample Value	Operational Meaning
loc_match	2001:db8:1000:0	Incoming virtual locator matched on ingress packets.
locator	2001:db8:2000:0	Physical routing locator rewritten into the packet header.
csum-mode	adj-transport	Adjusts L4 TCP/UDP transport checksum to compensate for header rewrite.

Handling Live Workload Migration

When a container migrates to a different physical server in another rack or data center (e.g., moving from 2001:db8:2000:0 to 2001:db8:3000:0), update the mapping rule in real time without dropping client connections:

# Update the physical locator for the migrated container
sudo ip ila mapping set \
    loc_match 2001:db8:1000:0 \
    locator 2001:db8:3000:0 \
    id 0000:0000:0000:0042

All subsequent packets addressing Identifier 0x42 are immediately forwarded to the new physical host, while the container’s internal socket continues operating without interruption.

Configuring Checksum and Translation Modes

Because modifying the top 64 bits of an IPv6 address alters the pseudo-header used by upper-layer transport protocols (TCP, UDP, ICMPv6), ILA provides multiple checksum preservation modes:

# Add mapping with neutral checksum adjustment
sudo ip ila mapping add \
    loc_match 2001:db8:1000:0 \
    locator 2001:db8:2000:0 \
    id 0000:0000:0000:0042 \
    csum-mode neutral-map

• adj-transport: Directly updates the transport layer (TCP/UDP) checksum in the payload.
• neutral-map: Modifies a dedicated neutral bit pattern within the IPv6 address itself, leaving the transport layer checksum intact.

Capturing and Verifying ILA Rewritten Headers

To verify that edge routers are actively translating locators on live network interfaces, execute tcpdump capturing IPv6 traffic:

# Capture packets destined for the container identifier
sudo tcpdump -i eth0 -nn -vvv "ip6 and ip6[24:8] == 0x0000000000000042" -c 10

The trace confirms that the destination locator corresponds to the updated physical server host while preserving the internal container identifier.

Deleting Obsolete ILA Mappings

When a container or virtual machine is decommissioned, remove its translation mapping from the kernel table:

# Delete mapping rule
sudo ip ila mapping del \
    loc_match 2001:db8:1000:0 \
    id 0000:0000:0000:0042

Configuring IPv6 Identifier-Locator Addressing via ip ila delivers transparent container and workload mobility at scale, eliminating the complex overhead of SDN overlays and dynamic routing churn.