At many regional ISPs, IPv6 already works from the concentrator upward. The block was allocated years ago, the edge announces the prefix, and the BNG hands out an address and a delegated prefix over DHCPv6. Even so, a test on the subscriber's phone still shows IPv4 only, going out through CGNAT. The missing piece is the most scattered part of the network: the ONT or router in each home.
In practice, IPv6 for ISPs means dual stack. The subscriber gets an IPv4 address (usually private, behind CGNAT) and global IPv6 addressing at the same time, and each application uses whichever protocol is available, preferring IPv6. For that to reach the phone, the CPE has to get an address on the WAN, receive a prefix for the internal network and advertise that prefix to the devices in the home. If any of those steps fails, the phone never even learns that IPv6 exists.
In support, we often see the core get ready in a few maintenance windows while the migration stalls for months in the CPE fleet, because nobody knows exactly which models and firmware versions are out in the field or how many of them have already received the configuration.
Why does IPv6 stop at the subscriber's CPE?
IPv6 usually stops at the CPE because many devices ship with it turned off, or set to an addressing mode that doesn't match what the BNG offers. The technician installs the device, PPPoE comes up, the subscriber browses, and nobody looks at the IPv6 stack because nothing seems broken.
Some models give more trouble, because they accept the activation and then lose IPv6 after a power outage or a restart. Tier 2 logs into the device and fixes it, the power goes out again in the neighborhood, and the subscriber falls back to IPv4 without anyone noticing. Logging into each router's web interface works for ten customers. With a few thousand homes, manual fixes never catch up with the next outage.
CGNAT or IPv6: does the ISP have to choose?
The ISP doesn't have to choose, and during the transition it will run both. CGNAT (Carrier-Grade NAT) is address translation done in the ISP's network, where several subscribers share the same public IPv4 address, each one on a range of ports.
CGNAT comes with an operational cost. You have to keep records of which subscriber used which port at what time in order to answer identification requests, and anything that depends on inbound connections (cameras, game servers, remote access to a DVR) turns into a support ticket. With IPv6 active in the home, traffic to destinations that already serve over IPv6, such as the big video platforms, stops going through the translator. Plenty of services are still IPv4-only, so CGNAT stays in the network, just carrying fewer sessions.
What the ONT or router must support to deliver IPv6
The reference is RFC 7084 from the IETF, which sets the basic requirements for a residential IPv6 router, called a CE router in the document. In an ISP's day-to-day work, that means the CPE configures its own WAN, requests a delegated prefix for the LAN over DHCPv6 and advertises that prefix to the devices in the home.
The RFC also forbids the CPE from forwarding IPv6 traffic between LAN and WAN before it has finished obtaining its address and prefix, and from advertising itself as the default router on the LAN when it has no default route on the WAN. That's why the CPE screen can show IPv6 on the WAN while the subscriber's laptop only has a link-local address (fe80::). Most of the time the delegated prefix never arrived, and the CPE, correctly, stayed silent on the internal network.
On the WAN, the address can come from SLAAC, built from the BNG's router advertisement, or from DHCPv6. The mode configured on the CPE has to match what the concentrator delivers. If the BNG only sends advertisements and the CPE expects DHCPv6, many firmwares leave the WAN without a global address. The LAN prefix comes through DHCPv6 prefix delegation in both cases.
All of this varies by vendor, firmware and even hardware revision. Two devices with the same commercial name can expose different parameters in the data model (TR-181 or the vendor's own tree), which is why certifying each model before a mass rollout saves a lot of surprises.
How to enable IPv6 without visiting every home
To enable IPv6 across the whole fleet without truck rolls (sending a technician to the home), the ISP needs an ACS that writes the configuration to each CPE and later checks that it's still there. In IXC ACS, that job belongs to automatic IPv6 provisioning, under Tools > Routines > Automatic provisioning. The ACS only manages devices that point to it, so check your ACS URL coverage first, which in multi-vendor networks has its own details.
The order of work we recommend:
- Confirm the network side. The ACS only touches the CPE. The WAN address and the delegated prefix still come from your BNG and RADIUS, and they need to be delivering IPv6 first.
- Using the gear icon on that screen, pick the CPE addressing mode (DHCP, SLAAC or None) according to what the concentrator offers, and confirm in the pilot that the model honors the setting.
- Turn on the routine and choose its mode. Whenever possible checks IPv6 on every inform and resends the parameter when it finds it disabled. On restart detects that the device came back from a reboot without IPv6 and reactivates it, which covers the models that lose the configuration.
- Track the share of the fleet with IPv6 active, without IPv6 and disabled, with data collected every 30 minutes. The More information button opens a per-model breakdown, and from there you can ask support to analyze a model that doesn't appear to be supported.
- For models held back by firmware, use the bulk firmware update, filtering by vendor, model, hardware and current version. The documentation recommends testing on two or three devices first.
The routine acts on the inform, which the CPE itself initiates, so it works with the device behind CGNAT and only takes as long as the configured inform interval. A one-off command is different: it depends on the ACS reaching the CPE right away, usually can't get through under CGNAT, and waits in the queue until the next contact.
Does IPv6 leave the subscriber's home exposed?
It can, if the CPE doesn't do stateful filtering on IPv6. With IPv4 and NAT, a connection from outside had nowhere to go without port forwarding, and subscribers got used to that barrier without knowing it was there. With IPv6, every device in the home has a global address, and the barrier now depends on an explicit filter in the CPE.
RFC 6092 recommends exactly that for residential CPE: outside traffic only gets in if a device inside requested it or if it matches a configured exception. The same RFC points out that most devices never leave their factory configuration, and for an ISP that means the firmware default ends up being the security policy for the entire subscriber base. Before turning on IPv6 in bulk for a model, check in the pilot whether the IPv6 firewall comes enabled and test, from an outside network, whether a device inside answers an unsolicited connection.
Frequently asked questions
Why does IPv6 disappear after the ONT restarts? On some models, IPv6 activation doesn't survive a reboot or a power outage, and the device comes back without it. The permanent fix usually comes through firmware. Until then, an ACS that detects the device returning without IPv6 and reapplies the configuration keeps the subscriber from quietly staying on IPv4.
Does IPv6 eliminate CGNAT? Not during the transition. As long as there are IPv4-only services, subscribers need IPv4, which for most bases means CGNAT. IPv6 takes the traffic that can go direct off the translator, easing the load on the equipment and on log retention.
How do I know how many subscribers already have IPv6? The most reliable data comes from the CPE, which reports to the ACS whether IPv6 is active. In IXC ACS, the automatic provisioning screen shows the share of the fleet with IPv6 active, without IPv6 and disabled, broken down by model. Counting IPv6 sessions on the BNG tells you who got a prefix, but not whether the CPE is advertising that prefix inside the home.
Next steps for your ISP
Start with a pilot on a certified model that has many units in the field, with subscribers you can follow closely. There you check the addressing mode, the behavior after a forced reboot and the IPv6 firewall, before any mass activation.
Then expand model by model rather than region by region. How IPv6 behaves on the CPE depends mostly on firmware, so a validated model can go to the whole base, while one that loses its configuration on restart goes in with the On restart mode or waits for the update.
If you'd like to see how this works with the models in your fleet, click the button below and talk to our team.