A municipal hospital documents addressing for an air-gapped lab that must never be Internet-routed. Which IPv6 unicast type fits that internal-only design?

Unique-local unicast (fc00::/7, commonly administered as fd00::/8 with a locally chosen 40-bit Global ID) is IPv6’s counterpart to internal-only campus space. It supports multi-host and multi-subnet addressing inside the organization without intending public Internet routing, fitting an air-gapped lab that still needs proper IPv6 unicast numbering behind the isolation boundary. Global unicast from the ISP’s publicly routed /32 is Internet-routable and conflicts with the requirement that the lab never be Internet-routed. Link-local addresses alone fail as the lab’s only server addressing plan for multi-hop routing because link-local addresses are not forwarded across routers, so they cannot support a routed multi-subnet lab. Multicast FF05:: site-local groups are multicast group space, not host unicast addresses; using them for host numbering confuses two different addressing purposes. Exam caveat: unique-local approximates “IPv6 private,” link-local means “on-link only,” and global means provider-routable. For this air-gapped design, choose unique-local rather than ISP global unicast or multicast-as-unicast. Operational check: assign fd00::/8-based /64s to lab VLANs, ensure no default route leads toward the Internet, and verify border filters drop unique-local traffic and deny lab prefixes from WAN advertisements. Ping between lab subnets through internal routers while confirming external reachability remains blocked.