IPv6#

Network → IPv6, at /ipv6. It is the one screen in the product that reads the second address family, and it is read-only: v6 is configured through the same screens as v4 — the interface panel, Static routes, Firewall — and inspected here.

It answers the whole v6 question in one request. GET /api/ipv6 makes exactly four reads of the router — show ipv6 route, show ipv6 neighbors, show firewall statistics and show interfaces detail — and does the rest in the agent. There is no per-object loop; a test asserts the count.

The tiles#

Tile	What it counts
Routable addresses	Addresses whose scope is global or unique-local. Link-local addresses are excluded, because every up interface has one whether or not IPv6 works — counting those would report a v6-less router as configured.
Routes	Rows in the v6 forwarding table.
Default route	What `::/0` does. A blackhole, reject or prohibit route is shown by name and in a warning colour, not as a route with no next hop.
ip6 rulesets	The number of `ipv6 Firewall "…"` blocks. Not the number of ipv6 sections.

That last distinction is the point of the tile. firewall global-options state-policy makes the router print an ipv6 State Policy block on a router with no v6 rule at all, so counting sections reports a filtered v4 box with wide-open v6 as filtered. A state policy alone reads 0, in a warning colour, with state policy only — no ipv6 filter, v6 is forwarded unfiltered beneath it.

The panels#

Addresses — every v6 address the interfaces hold, with its scope. Scope comes from the address itself, so a unique-local address is called unique-local rather than global.

Forwarding table — the v6 FIB, with protocol, distance and whether the route is installed. This is the only place v6 routes are shown: Static routes reads show ip route, which is IPv4.

Neighbours — the NDP table. Again the only place: the neighbour tables on Interfaces and Diagnostics read show arp.

ip6 firewall counters — every ipv6 block of show firewall statistics, with the state policy block labelled not a ruleset so it is not mistaken for one.

When a read does not answer#

Three of the four reads degrade rather than blanking the page. A failure becomes a note, the banner Some reads did not answer lists them, and the part that failed shows — with unknown, not zero rather than a count. A table that was read and was empty says so in different words — the router printed nothing — because an empty NDP table and an unanswered one are not the same fact.

The exception is show ipv6 route. If that fails the endpoint answers 502, because an empty v6 forwarding table is a false all-clear.

What is still IPv4#

Static routes reads show ip route.
The neighbour tables on Interfaces and Diagnostics read show arp.
The uplink model looks for 0.0.0.0/0 and has no IPv6 concept at all.
NAT is v4, which is mostly correct for IPv6 — you route rather than translate.