diff --git a/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java b/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java
index 0bbbe166d1c..4d48c543c61 100755
--- a/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java
+++ b/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java
@@ -15,6 +15,7 @@
 import org.zstack.header.message.APIMessage;
 import org.zstack.utils.ShellResult;
 import org.zstack.utils.ShellUtils;
+import org.zstack.utils.network.IPv6Utils;
 import org.zstack.utils.network.NetworkUtils;
 
 import static org.zstack.core.Platform.argerr;
@@ -121,9 +122,13 @@ private void validate(APIUpdateHostMsg msg) {
     }
 
     private void validate(APIAddHostMsg msg) {
-        if (!NetworkUtils.isIpv4Address(msg.getManagementIp()) && !NetworkUtils.isHostname(msg.getManagementIp())) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_COMPUTE_HOST_10113, "managementIp[%s] is neither an IPv4 address nor a valid hostname", msg.getManagementIp()));
+        String ip = msg.getManagementIp();
+        if (!NetworkUtils.isHostname(ip) && !IPv6Utils.isValidManagementIp(ip)) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_COMPUTE_HOST_10113,
+                    "managementIp[%s] is not a valid IPv4/IPv6 address or hostname", ip));
         }
+        // Normalize IPv6 to RFC 5952 compressed form; IPv4/hostname returned as-is
+        msg.setManagementIp(IPv6Utils.normalizeIpv6(ip));
     }
 
     private void validate(APIChangeHostStateMsg msg){
diff --git a/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java b/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java
index 67057da171d..6dae84d8110 100755
--- a/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java
+++ b/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java
@@ -30,6 +30,7 @@
 import org.zstack.header.message.Message;
 import org.zstack.header.vm.*;
 import org.zstack.utils.Utils;
+import org.zstack.utils.network.IPv6Utils;
 import org.zstack.utils.logging.CLogger;
 
 import javax.persistence.Query;
@@ -125,12 +126,14 @@ public void fail(ErrorCode errorCode) {
             }
 
             private void overriddenConsoleProxyIP(ConsoleInventory consoleInventory) {
+                String ip;
                 if (!"0.0.0.0".equals(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP) &&
                         !"".equals(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP)) {
-                    consoleInventory.setHostname(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP);
+                    ip = CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP;
                 } else {
-                    consoleInventory.setHostname(CoreGlobalProperty.UNIT_TEST_ON ? "127.0.0.1" : Platform.getManagementServerIp());
+                    ip = CoreGlobalProperty.UNIT_TEST_ON ? "127.0.0.1" : Platform.getManagementServerIp();
                 }
+                consoleInventory.setHostname(IPv6Utils.bracketIpv6(ip));
             }
 
             @Override
diff --git a/core/src/main/java/org/zstack/core/Platform.java b/core/src/main/java/org/zstack/core/Platform.java
index 78b184d12e7..4762cc9ce3a 100755
--- a/core/src/main/java/org/zstack/core/Platform.java
+++ b/core/src/main/java/org/zstack/core/Platform.java
@@ -53,11 +53,14 @@
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Modifier;
+import com.googlecode.ipv6.IPv6Network;
 import java.net.Inet4Address;
+import java.net.Inet6Address;
 import java.net.InetAddress;
 import java.net.NetworkInterface;
 import java.net.SocketException;
 import java.net.UnknownHostException;
+import org.zstack.core.config.NetworkGlobalConfig;
 import java.sql.Timestamp;
 import java.util.*;
 import java.util.concurrent.TimeUnit;
@@ -74,8 +77,8 @@ public class Platform {
 
     private static ComponentLoader loader;
     private static String msId;
-    private static String managementServerIp;
-    private static String managementServerCidr;
+    private static volatile String managementServerIp;
+    private static volatile String managementServerCidr;
     private static MessageSource messageSource;
     private static String encryptionKey = EncryptRSA.generateKeyString("ZStack open source");
     private static EncryptRSA rsa = new EncryptRSA();
@@ -395,6 +398,17 @@ private static void prepareDefaultDbProperties() {
         }
     }
 
+    /**
+     * F-010: JGroups initial_hosts IPv6 bracket fix.
+     * IPv6 addresses in JGroups must use [addr][port] format; IPv4 uses addr[port] format.
+     */
+    private static String jgroupsAddr(String ip, String port) {
+        if (IPv6NetworkUtils.isIpv6Address(ip)) {
+            return "[" + ip + "][" + port + "]";
+        }
+        return ip + "[" + port + "]";
+    }
+
     private static void prepareHibernateSearchProperties() {
         if (!SearchGlobalProperty.SearchAutoRegister) {
             System.setProperty("Search.autoRegister", "false");
@@ -442,12 +456,12 @@ private static void prepareHibernateSearchProperties() {
             if (info.getPeerip() == null) {
                 throw new RuntimeException("the ip of peer node was null, please check the config of zsha2");
             }
-            SearchGlobalProperty.JGroupInfinispanInitialHosts = String.format("%s[%s],%s[%s]",
-                    info.getNodeip(), SearchGlobalProperty.JGroupInfinispanPort,
-                    info.getPeerip(), SearchGlobalProperty.JGroupInfinispanPort);
-            SearchGlobalProperty.JGroupBackendInitialHosts = String.format("%s[%s],%s[%s]",
-                    info.getNodeip(), SearchGlobalProperty.JGroupBackendPort,
-                    info.getPeerip(), SearchGlobalProperty.JGroupBackendPort);
+            SearchGlobalProperty.JGroupInfinispanInitialHosts =
+                    jgroupsAddr(info.getNodeip(), SearchGlobalProperty.JGroupInfinispanPort) + "," +
+                    jgroupsAddr(info.getPeerip(), SearchGlobalProperty.JGroupInfinispanPort);
+            SearchGlobalProperty.JGroupBackendInitialHosts =
+                    jgroupsAddr(info.getNodeip(), SearchGlobalProperty.JGroupBackendPort) + "," +
+                    jgroupsAddr(info.getPeerip(), SearchGlobalProperty.JGroupBackendPort);
             if (getGlobalProperty("JGroup.TcppingInitialHosts") == null) {
                 System.setProperty("JGroup.InfinispanInitialHosts", SearchGlobalProperty.JGroupInfinispanInitialHosts);
                 logger.debug(String.format("default JGroup.InfinispanInitialHosts to JGroup.InfinispanInitialHosts [%s]", SearchGlobalProperty.JGroupInfinispanInitialHosts));
@@ -788,6 +802,11 @@ public static boolean isVIPNode() {
     private static String getManagementServerCidrInternal() {
         String mgtIp = getManagementServerIp();
 
+        // F-003: IPv6 management IP uses a dedicated code path
+        if (IPv6NetworkUtils.isIpv6Address(mgtIp)) {
+            return getManagementServerCidrIpv6(mgtIp);
+        }
+
         /*# ip add | grep 10.86.4.132
             inet 10.86.4.132/23 brd 10.86.5.255 scope global br_eth0*/
         /* because Linux.shell can not run command with '|', pares the output of ip address in java  */
@@ -806,6 +825,53 @@ private static String getManagementServerCidrInternal() {
         return null;
     }
 
+    /**
+     * F-003: 当管理 IP 为 IPv6 时，通过 'ip -6 addr show' 解析对应的网络 CIDR。
+     */
+    private static String getManagementServerCidrIpv6(String mnIp) {
+        try {
+            Linux.ShellResult result = Linux.shell("ip -6 addr show");
+            if (result.getExitCode() != 0) {
+                logger.warn(String.format("failed to run 'ip -6 addr show', exit code: %d", result.getExitCode()));
+                return null;
+            }
+            // 示例行: "    inet6 2001:db8::1/64 scope global"
+            for (String line : result.getStdout().split("\n")) {
+                String trimmed = line.trim();
+                if (!trimmed.startsWith("inet6 ")) {
+                    continue;
+                }
+                String[] parts = trimmed.split("\\s+");
+                if (parts.length < 2) {
+                    continue;
+                }
+                String cidr = parts[1]; // "2001:db8::1/64"
+                String[] ipPrefix = cidr.split("/");
+                if (ipPrefix.length != 2) {
+                    continue;
+                }
+                try {
+                    String addr  = InetAddress.getByName(ipPrefix[0]).getHostAddress();
+                    String mnNorm = InetAddress.getByName(mnIp).getHostAddress();
+                    if (addr.equals(mnNorm)) {
+                        int prefixLen = Integer.parseInt(ipPrefix[1]);
+                        // compute network address prefix, e.g. 2001:db8::/64
+                        String networkAddr = IPv6Network.fromString(ipPrefix[0] + "/" + prefixLen)
+                                .getFirst().toString();
+                        return networkAddr + "/" + prefixLen;
+                    }
+                } catch (UnknownHostException | NumberFormatException ignore) {
+                    // skip lines that cannot be parsed
+                }
+            }
+            logger.warn(String.format("no inet6 entry found for MN IP: %s", mnIp));
+            return null;
+        } catch (IOException e) {
+            logger.warn(String.format("failed to get IPv6 CIDR for MN IP %s: %s", mnIp, e.getMessage()));
+            return null;
+        }
+    }
+
     public static String getManagementServerCidr() {
         if (managementServerCidr == null) {
             managementServerCidr = getManagementServerCidrInternal();
@@ -827,32 +893,37 @@ private static String getManagementServerIpInternal() {
             return ip;
         }
 
-        Linux.ShellResult ret = Linux.shell("/sbin/ip route");
-        String defaultLine = null;
-        for (String s : ret.getStdout().split("\n")) {
-            if (s.contains("default via")) {
-                defaultLine = s;
-                break;
-            }
+        // F-002: IPv6 support — enumerate all NICs, prioritise based on PREFER_IPV6 config
+        boolean preferIpv6 = false;
+        try {
+            preferIpv6 = NetworkGlobalConfig.PREFER_IPV6.value(Boolean.class);
+        } catch (Exception ignored) {
+            // GlobalConfig 可能在静态初始化阶段还未就绪，安全降级为 false
         }
 
-        String err = "cannot get management server ip of this machine. there are three ways to get the ip.\n1) search for 'management.server.ip' java property\n2) search for 'ZSTACK_MANAGEMENT_SERVER_IP' environment variable\n3) search for default route printed out by '/sbin/ip route'\nhowever, all above methods failed";
-        if (defaultLine == null) {
-            throw new CloudRuntimeException(err);
-        }
+        List<InetAddress> ipv4List = new ArrayList<>();
+        List<InetAddress> ipv6List = new ArrayList<>();
 
         try {
-            Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
-            for (NetworkInterface iface : Collections.list(nets)) {
-                String name = iface.getName();
-                if (defaultLine.contains(name)) {
-                    for (InetAddress ia : Collections.list(iface.getInetAddresses())) {
-                        ip = ia.getHostAddress();
-                        if (ia instanceof Inet4Address) {
-                            // we prefer IPv4 address
-                            ip = ia.getHostAddress();
-                            break;
-                        }
+            Enumeration<NetworkInterface> ifaces = NetworkInterface.getNetworkInterfaces();
+            if (ifaces == null) {
+                throw new IllegalStateException("no available network interfaces");
+            }
+            while (ifaces.hasMoreElements()) {
+                NetworkInterface iface = ifaces.nextElement();
+                if (iface.isLoopback() || !iface.isUp()) {
+                    continue;
+                }
+                Enumeration<InetAddress> addrs = iface.getInetAddresses();
+                while (addrs.hasMoreElements()) {
+                    InetAddress addr = addrs.nextElement();
+                    if (addr.isLoopbackAddress() || addr.isLinkLocalAddress()) {
+                        continue;
+                    }
+                    if (addr instanceof Inet4Address) {
+                        ipv4List.add(addr);
+                    } else if (addr instanceof Inet6Address) {
+                        ipv6List.add(addr);
                     }
                 }
             }
@@ -860,12 +931,23 @@ private static String getManagementServerIpInternal() {
             throw new CloudRuntimeException(e);
         }
 
-        if (ip == null) {
-            throw new CloudRuntimeException(err);
+        List<InetAddress> preferred = preferIpv6 ? ipv6List : ipv4List;
+        List<InetAddress> fallback  = preferIpv6 ? ipv4List : ipv6List;
+
+        if (!preferred.isEmpty()) {
+            ip = preferred.get(0).getHostAddress();
+            logger.info(String.format("get management IP[%s] from network interface enumeration (prefer IPv%s)",
+                    ip, preferIpv6 ? "6" : "4"));
+            return ip;
+        }
+        if (!fallback.isEmpty()) {
+            ip = fallback.get(0).getHostAddress();
+            logger.info(String.format("get management IP[%s] from network interface enumeration (fallback IPv%s)",
+                    ip, preferIpv6 ? "4" : "6"));
+            return ip;
         }
 
-        logger.info(String.format("get management IP[%s] from default route[/sbin/ip route]", ip));
-        return ip;
+        throw new IllegalStateException("no available management IP found on any network interface");
     }
 
     public static String toI18nString(String code, Object... args) {
diff --git a/core/src/main/java/org/zstack/core/config/NetworkGlobalConfig.java b/core/src/main/java/org/zstack/core/config/NetworkGlobalConfig.java
new file mode 100644
index 00000000000..94d6508ce60
--- /dev/null
+++ b/core/src/main/java/org/zstack/core/config/NetworkGlobalConfig.java
@@ -0,0 +1,18 @@
+package org.zstack.core.config;
+
+/**
+ * Global configuration entries for network-related settings.
+ */
+@GlobalConfigDefinition
+public class NetworkGlobalConfig {
+    public static final String CATEGORY = "network";
+
+    @GlobalConfigValidation(validValues = {"true", "false"})
+    @GlobalConfigDef(
+            type = Boolean.class,
+            defaultValue = "false",
+            description = "When true, the management node prefers IPv6 addresses on dual-stack hosts. " +
+                    "Has no effect on IPv4-only or IPv6-only hosts."
+    )
+    public static GlobalConfig PREFER_IPV6 = new GlobalConfig(CATEGORY, "management.server.prefer.ipv6");
+}
diff --git a/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java b/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java
index 516fd500ef6..22f70f95dca 100755
--- a/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java
+++ b/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java
@@ -47,6 +47,8 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
+import org.zstack.utils.network.IPv6Utils;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -63,6 +65,8 @@
 
 public class RESTFacadeImpl implements RESTFacade {
     private static final CLogger logger = Utils.getSafeLogger(RESTFacadeImpl.class);
+    private static final java.util.regex.Pattern BARE_IPV6_URL_PATTERN = java.util.regex.Pattern.compile(
+            "^(https?)://([0-9a-fA-F][0-9a-fA-F:]{2,37}[0-9a-fA-F]):(\\d+)(/.*)?");
     
     @Autowired
     private ThreadFacade thdf;
@@ -194,13 +198,13 @@ void init() {
 
         String url;
         if ("".equals(path) || path == null) {
-            url = String.format("http://%s:%s", callbackHostName, port);
+            url = IPv6Utils.buildUrl(callbackHostName, port);
         } else {
-            url = String.format("http://%s:%s/%s", callbackHostName, port, path);
+            url = IPv6Utils.buildUrl(callbackHostName, port) + "/" + path;
         }
         UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(url);
         ub.path(RESTConstant.CALLBACK_PATH);
-        callbackUrl = ub.build().toUriString();
+        callbackUrl = sanitizeCallbackUrl(ub.build().toUriString());
 
         ub = UriComponentsBuilder.fromHttpUrl(url);
         baseUrl = ub.build().toUriString();
@@ -977,6 +981,27 @@ public String getCallbackUrl() {
         return callbackUrl;
     }
 
+    /**
+     * 检测并修复裸 IPv6（无方括号）的 callbackUrl。
+     * 正常路径下 URL 应由 {@link IPv6Utils#buildUrl} 生成，此方法作为兜底防御层。
+     * <p>
+     * 示例：http://2001:db8::1:8080/path → http://[2001:db8::1]:8080/path
+     */
+    private static String sanitizeCallbackUrl(String url) {
+        if (url == null) {
+            return null;
+        }
+        // 检测裸 IPv6 URL 模式：scheme://hex:chars:port/path（IP 未被方括号包裹）
+        java.util.regex.Matcher m = BARE_IPV6_URL_PATTERN.matcher(url);
+        if (m.matches() && IPv6NetworkUtils.isIpv6Address(m.group(2))) {
+            String corrected = m.group(1) + "://[" + m.group(2) + "]:" + m.group(3) +
+                    (m.group(4) != null ? m.group(4) : "");
+            logger.warn(String.format("bare IPv6 in callbackUrl, auto-corrected: %s -> %s", url, corrected));
+            return corrected;
+        }
+        return url;
+    }
+
     @Override
     public String getHostName() {
         return callbackHostName;
diff --git a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java
index 6d63ce3522f..e32ed99f3d4 100755
--- a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java
+++ b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java
@@ -46,8 +46,17 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.function.Function;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
+import org.zstack.utils.network.NetworkUtils;
+
+import com.googlecode.ipv6.IPv6Address;
+import com.googlecode.ipv6.IPv6Network;
+import com.googlecode.ipv6.IPv6NetworkMask;
 
 import javax.persistence.Query;
+import java.net.InetAddress;
+import java.net.NetworkInterface;
+import java.net.SocketException;
 import java.util.*;
 import java.util.stream.Collectors;
 
@@ -353,6 +362,62 @@ private List<VmNicInventory> reduceNic(List<VmNicInventory> nics, VmNicInventory
         return ret;
     }
 
+    /**
+     * F-009: 从本机网卡中选取与 VR 管理网 CIDR 同子网的 MN IP。
+     * 支持 IPv4/IPv6 双栈；若无匹配则回退到 Platform.getManagementServerIp()。
+     *
+     * @param vrManagementCidr VR 管理网的网络 CIDR，例如 "192.168.1.0/24" 或 "2001:db8::/64"
+     * @return 选定的 MN IP（裸地址，无括号）
+     */
+    private String getMnIpForVr(String vrManagementCidr) {
+        if (vrManagementCidr == null || vrManagementCidr.isEmpty()) {
+            logger.warn("VR management CIDR is null/empty, fallback to getManagementServerIp()");
+            return Platform.getManagementServerIp();
+        }
+        try {
+            Enumeration<NetworkInterface> ifaces = NetworkInterface.getNetworkInterfaces();
+            if (ifaces != null) {
+                while (ifaces.hasMoreElements()) {
+                    NetworkInterface iface = ifaces.nextElement();
+                    if (iface.isLoopback() || !iface.isUp()) {
+                        continue;
+                    }
+                    Enumeration<InetAddress> addrs = iface.getInetAddresses();
+                    while (addrs.hasMoreElements()) {
+                        InetAddress addr = addrs.nextElement();
+                        if (addr.isLoopbackAddress() || addr.isLinkLocalAddress()) {
+                            continue;
+                        }
+                        String ipStr = addr.getHostAddress();
+                        try {
+                            boolean inCidr;
+                            if (IPv6NetworkUtils.isIpv6Address(ipStr)) {
+                                inCidr = IPv6NetworkUtils.isIpv6InCidrRange(ipStr, vrManagementCidr);
+                            } else {
+                                inCidr = NetworkUtils.isIpv4InCidr(ipStr, vrManagementCidr);
+                            }
+                            if (inCidr) {
+                                logger.debug(String.format(
+                                        "selected MN IP [%s] matching VR management CIDR [%s]",
+                                        ipStr, vrManagementCidr));
+                                return ipStr;
+                            }
+                        } catch (Exception ignore) {
+                            // CIDR 类型与 IP 类型不匹配时忽略
+                        }
+                    }
+                }
+            }
+        } catch (SocketException e) {
+            logger.warn(String.format("failed to enumerate network interfaces: %s", e.getMessage()));
+        }
+        String fallback = Platform.getManagementServerIp();
+        logger.warn(String.format(
+                "no MN IP matched VR management CIDR [%s], fallback to [%s]",
+                vrManagementCidr, fallback));
+        return fallback;
+    }
+
     private void fillVfNicBootstrapInfo(VmNicInventory nic, ApplianceVmNicTO to) {
         to.setBondMode("none");
         for (ApplianceVmNicBootstrapExtensionPoint ext : nicBootstrapExtensions) {
@@ -461,7 +526,35 @@ public Map<String, Object> prepareBootstrapInformation(VmInstanceSpec spec) {
         String publicKey = asf.getPublicKey();
         ret.put(ApplianceVmConstant.BootstrapParams.publicKey.toString(), publicKey);
         ret.put(BootstrapParams.uuid.toString(), spec.getVmInventory().getUuid());
-        ret.put(BootstrapParams.managementNodeIp.toString(), Platform.getManagementServerIp());
+
+        // F-009: 根据 VR 管理网 CIDR 选取与其同子网的 MN IP，支持多 IP/双栈主机
+        String vrMgmtCidr;
+        if (IPv6NetworkUtils.isIpv6Address(mgmtNic.getIp())) {
+            int prefixLen = 64;
+            try {
+                String netmask = mgmtNic.getNetmask();
+                if (netmask != null) {
+                    try {
+                        prefixLen = Integer.parseInt(netmask.trim());
+                    } catch (NumberFormatException ignore) {
+                        if (IPv6NetworkUtils.isIpv6Address(netmask)) {
+                            prefixLen = IPv6NetworkMask.fromAddress(IPv6Address.fromString(netmask)).asPrefixLength();
+                        }
+                    }
+                }
+            } catch (Exception ignored) {
+                logger.warn(String.format("failed to parse IPv6 netmask [%s] for VR nic IP [%s], using default prefix /64",
+                        mgmtNic.getNetmask(), mgmtNic.getIp()));
+            }
+            String networkAddr = IPv6Network.fromAddressAndMask(
+                    IPv6Address.fromString(mgmtNic.getIp()),
+                    IPv6NetworkMask.fromPrefixLength(prefixLen)).getFirst().toString();
+            vrMgmtCidr = networkAddr + "/" + prefixLen;
+        } else {
+            vrMgmtCidr = NetworkUtils.getCidrFromIpMask(mgmtNic.getIp(), mgmtNic.getNetmask());
+        }
+        String mnIp = getMnIpForVr(vrMgmtCidr);
+        ret.put(BootstrapParams.managementNodeIp.toString(), mnIp);
         ret.put(BootstrapParams.managementNodeVip.toString(), Platform.getManagementServerVip());
         ret.put(BootstrapParams.managementNodeCidr.toString(), Platform.getManagementServerCidr());
         /* this is only used by ApplianceVmPrepareBootstrapInfoExtensionPoint extension point, will be deleted after extension point */
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java
index 6bf2c810034..478cadec968 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java
@@ -28,6 +28,7 @@
 import org.zstack.storage.ceph.*;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6Utils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
 import org.zstack.utils.ssh.SshException;
@@ -494,7 +495,7 @@ public void doPing(final ReturnValueCompletion<PingResult> completion) {
         }
 
         PingCmd cmd = new PingCmd();
-        cmd.monAddr = String.format("%s:%s", getSelf().getMonAddr(), getSelf().getMonPort());
+        cmd.monAddr = IPv6Utils.buildAddr(getSelf().getMonAddr(), getSelf().getMonPort());
         cmd.testImagePath = String.format("%s/zshb.bs.%s.%s", poolName, self.getUuid(), self.getMonAddr());
         cmd.monUuid = getSelf().getUuid();
         cmd.backupStorageUuid = getSelf().getBackupStorageUuid();
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java
index 7ca3e710291..81628f6c978 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java
@@ -26,6 +26,7 @@
 import org.zstack.storage.ceph.*;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6Utils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
 import org.zstack.utils.ssh.SshException;
@@ -506,7 +507,7 @@ private void doPing(final ReturnValueCompletion<PingResult> completion) {
         cmd.testImagePath = String.format("%s/zshb.ps.%s.%s", poolName, self.getUuid(), self.getMonAddr());
         cmd.monUuid = getSelf().getUuid();
         cmd.primaryStorageUuid = getSelf().getPrimaryStorageUuid();
-        cmd.monAddr = String.format("%s:%s", getSelf().getMonAddr(), getSelf().getMonPort());
+        cmd.monAddr = IPv6Utils.buildAddr(getSelf().getMonAddr(), getSelf().getMonPort());
 
         restf.asyncJsonPost(CephAgentUrl.primaryStorageUrl(self.getHostname(), PING_PATH),
                 cmd, new JsonAsyncRESTCallback<PingRsp>(completion) {
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KVMAgentCommands.java b/plugin/kvm/src/main/java/org/zstack/kvm/KVMAgentCommands.java
index 90e576cad7f..1e8473d4821 100755
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KVMAgentCommands.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KVMAgentCommands.java
@@ -1872,6 +1872,8 @@ public static class vdiCmd extends AgentCommand implements Serializable {
         private Map<String, String> qxlMemory;
         @GrayVersion(value = "5.0.0")
         private List<String> spiceChannels;
+        @GrayVersion(value = "5.5.18")
+        private String vncListenAddress;
 
         public String getConsoleMode() {
             return consoleMode;
@@ -1936,6 +1938,14 @@ public List<String> getSpiceChannels() {
         public void setSpiceChannels(List<String> spiceChannels) {
             this.spiceChannels = spiceChannels;
         }
+
+        public String getVncListenAddress() {
+            return vncListenAddress;
+        }
+
+        public void setVncListenAddress(String vncListenAddress) {
+            this.vncListenAddress = vncListenAddress;
+        }
     }
 
     public static class ConfigPrimaryVmCmd extends AgentCommand {
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java
index 5052ba7aa84..b673a55a9e6 100755
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java
@@ -98,6 +98,7 @@
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
 import org.zstack.utils.message.OperationChecker;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
@@ -2207,7 +2208,7 @@ protected static String getDataNetworkAddress(String hostUuid, String cidr) {
 
         final String[] ips = extraIps.split(",");
         for (String ip: ips) {
-            if (NetworkUtils.isIpv4InCidr(ip, cidr)) {
+            if (NetworkUtils.isIpInCidr(ip, cidr)) {
                 return ip;
             }
         }
@@ -4585,6 +4586,8 @@ protected void startVm(final VmInstanceSpec spec, final NeedReplyMessage msg, fi
         cmd.setVmPortOff(rcf.getResourceConfigValue(VmGlobalConfig.VM_PORT_OFF, spec.getVmInventory().getUuid(), Boolean.class));
         cmd.setConsoleMode("vnc");
         cmd.setTimeout(TimeUnit.MINUTES.toSeconds(5));
+        String vncListenAddr = IPv6NetworkUtils.isIpv6Address(self.getManagementIp()) ? "::" : "0.0.0.0";
+        cmd.setVncListenAddress(vncListenAddr);
         cmd.setConsoleLogToFile(rcf.getResourceConfigValue(KVMGlobalConfig.REDIRECT_CONSOLE_LOG_TO_FILE, spec.getVmInventory().getUuid(), Boolean.class));
         if (spec.isCreatePaused()) {
             cmd.setCreatePaused(true);
@@ -6764,24 +6767,25 @@ public void handle(ErrorCode errCode, Map data) {
     }
 
     private boolean checkMigrateNetworkCidrOfHost(String cidr) {
-        if (NetworkUtils.isIpv4InCidr(self.getManagementIp(), cidr)) {
+        if (NetworkUtils.isIpInCidr(self.getManagementIp(), cidr)) {
             return true;
         }
 
         final String extraIps = HostSystemTags.EXTRA_IPS.getTokenByResourceUuid(
                 self.getUuid(), HostSystemTags.EXTRA_IPS_TOKEN);
         if (extraIps == null) {
-            logger.error(String.format("Host[uuid:%s] has no IPs in migrate network", self.getUuid()));
+            logger.warn(String.format("no IP matched CIDR[%s], fallback to managementIp[%s]", cidr, self.getManagementIp()));
             return false;
         }
 
         final String[] ips = extraIps.split(",");
         for (String ip: ips) {
-            if (NetworkUtils.isIpv4InCidr(ip, cidr)) {
+            if (NetworkUtils.isIpInCidr(ip, cidr)) {
                 return true;
             }
         }
 
+        logger.warn(String.format("no IP matched CIDR[%s], fallback to managementIp[%s]", cidr, self.getManagementIp()));
         return false;
     }
 
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java b/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java
index 025d3913729..7295fd0fc83 100644
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java
@@ -35,9 +35,6 @@ protected void run(Map tokens, Object data) {
                 String hostUuid = d.getInventory().getUuid();
                 String currentIpmiAddress = HostSystemTags.IPMI_ADDRESS.getTokenByResourceUuid(hostUuid, HostSystemTags.IPMI_ADDRESS_TOKEN);
                 HostPowerStatus status = HostPowerStatus.POWER_ON;
-                if (!NetworkUtils.isIpv4Address(currentIpmiAddress)) {
-                    currentIpmiAddress = null;
-                }
 
                 HostVO host = dbf.findByUuid(hostUuid, HostVO.class);
                 HostIpmiVO ipmi = host.getIpmi();
diff --git a/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java b/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java
index 00f43fcf595..fbd398d2a1d 100755
--- a/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java
+++ b/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java
@@ -19,6 +19,7 @@
 import org.zstack.header.vm.VmInstanceState;
 import org.zstack.storage.primary.PrimaryStorageSystemTags;
 import org.zstack.utils.DebugUtils;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 
 import javax.persistence.Tuple;
@@ -79,7 +80,7 @@ private void validateCidrTag(String sysTag, String ipAddr) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_NFS_10009, "invalid CIDR: %s", cidr));
         }
 
-        if (!NetworkUtils.isIpv4InCidr(ipAddr, cidr)) {
+        if (!NetworkUtils.isIpInCidr(ipAddr, cidr)) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_NFS_10010, "IP address[%s] is not in CIDR[%s]", ipAddr, cidr));
         }
     }
diff --git a/plugin/sdnController/src/main/java/org/zstack/sdnController/SdnControllerManagerImpl.java b/plugin/sdnController/src/main/java/org/zstack/sdnController/SdnControllerManagerImpl.java
index 2368fbb95ae..89c020e3900 100644
--- a/plugin/sdnController/src/main/java/org/zstack/sdnController/SdnControllerManagerImpl.java
+++ b/plugin/sdnController/src/main/java/org/zstack/sdnController/SdnControllerManagerImpl.java
@@ -42,6 +42,7 @@
 import org.zstack.utils.logging.CLogger;
 
 import java.util.*;
+import java.util.stream.Collectors;
 
 import static org.zstack.core.Platform.operr;
 import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.*;
@@ -270,8 +271,12 @@ private void handle(APIAddSdnControllerMsg msg) {
             @Override
             public void run(MessageReply reply) {
                 if (reply.isSuccess()) {
-                    tagMgr.createTagsFromAPICreateMessage(msg, vo.getUuid(), SdnControllerVO.class.getSimpleName());
-                    event.setInventory(SdnControllerInventory.valueOf(dbf.findByUuid(vo.getUuid(), SdnControllerVO.class)));
+                    try {
+                        tagMgr.createTagsFromAPICreateMessage(msg, vo.getUuid(), SdnControllerVO.class.getSimpleName());
+                        event.setInventory(SdnControllerInventory.valueOf(dbf.findByUuid(vo.getUuid(), SdnControllerVO.class)));
+                    } catch (Exception e) {
+                        event.setError(operr("failed to finalise SdnController after creation: %s", e.getMessage()));
+                    }
                 } else {
                     event.setError(reply.getError());
                 }
@@ -682,14 +687,31 @@ public void preReleaseVmResource(VmInstanceSpec spec, Completion completion) {
             return;
         }
 
+        // Batch-load all L3 and L2 network VOs to avoid N+1 queries per NIC.
+        Set<String> l3Uuids = spec.getDestNics().stream()
+                .map(VmNicInventory::getL3NetworkUuid)
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+        Map<String, L3NetworkVO> l3VoMap = l3Uuids.isEmpty() ? Collections.emptyMap() :
+                dbf.listByPrimaryKeys(new ArrayList<>(l3Uuids), L3NetworkVO.class)
+                .stream().collect(Collectors.toMap(L3NetworkVO::getUuid, v -> v));
+
+        Set<String> l2Uuids = l3VoMap.values().stream()
+                .map(L3NetworkVO::getL2NetworkUuid)
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+        Map<String, L2NetworkVO> l2VoMap = l2Uuids.isEmpty() ? Collections.emptyMap() :
+                dbf.listByPrimaryKeys(new ArrayList<>(l2Uuids), L2NetworkVO.class)
+                .stream().collect(Collectors.toMap(L2NetworkVO::getUuid, v -> v));
+
         Map<String, List<VmNicInventory>> nicMaps = new HashMap<>();
         for (VmNicInventory nic : spec.getDestNics()) {
-            L3NetworkVO l3Vo = dbf.findByUuid(nic.getL3NetworkUuid(), L3NetworkVO.class);
+            L3NetworkVO l3Vo = l3VoMap.get(nic.getL3NetworkUuid());
             if (l3Vo == null) {
                 continue;
             }
 
-            L2NetworkVO l2VO = dbf.findByUuid(l3Vo.getL2NetworkUuid(), L2NetworkVO.class);
+            L2NetworkVO l2VO = l2VoMap.get(l3Vo.getL2NetworkUuid());
             if (l2VO == null) {
                 continue;
             }
diff --git a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java
index 6629d0f7def..1cfb42e659e 100644
--- a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java
+++ b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java
@@ -17,6 +17,7 @@
 import org.zstack.network.l2.vxlan.vxlanNetwork.APICreateL2VxlanNetworkMsg;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 
 import java.util.HashMap;
@@ -56,9 +57,10 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
     }
 
     private void validate(APICreateVxlanPoolRemoteVtepMsg msg) {
-        boolean isIpv4 = NetworkUtils.isIpv4Address(msg.getRemoteVtepIp());
-        if (!isIpv4) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10015, "%s:is not ipv4", msg.getRemoteVtepIp()));
+        boolean isValid = NetworkUtils.isIpv4Address(msg.getRemoteVtepIp())
+                || IPv6NetworkUtils.isIpv6Address(msg.getRemoteVtepIp());
+        if (!isValid) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10015, "%s:is not a valid IP address", msg.getRemoteVtepIp()));
         }
 
         SimpleQuery<VtepVO> rqv = dbf.createQuery(VtepVO.class);
@@ -73,9 +75,10 @@ private void validate(APICreateVxlanPoolRemoteVtepMsg msg) {
     }
 
     private void validate(APIDeleteVxlanPoolRemoteVtepMsg msg) {
-        boolean isIpv4 = NetworkUtils.isIpv4Address(msg.getRemoteVtepIp());
-        if (!isIpv4) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10017, "%s:is not ipv4", msg.getRemoteVtepIp()));
+        boolean isValid = NetworkUtils.isIpv4Address(msg.getRemoteVtepIp())
+                || IPv6NetworkUtils.isIpv6Address(msg.getRemoteVtepIp());
+        if (!isValid) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10017, "%s:is not a valid IP address", msg.getRemoteVtepIp()));
         }
 
     }
diff --git a/test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy
new file mode 100644
index 00000000000..07fa65d5087
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy
@@ -0,0 +1,153 @@
+package org.zstack.test.integration.appliancevm
+
+import org.zstack.appliancevm.ApplianceVmFacadeImpl
+import org.zstack.core.Platform
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.NetworkUtils
+
+import java.lang.reflect.Method
+
+/**
+ * TP-025~029: ApplianceVmFacadeImpl.getMnIpForVr CIDR 匹配逻辑测试
+ *
+ * getMnIpForVr 是私有实例方法，通过反射调用。
+ * 不依赖 Spring 上下文（方法内部只使用标准 Java 网络 API 和静态工具方法）。
+ *
+ * 覆盖：
+ *   TP-025 - 使用当前 MN 的 IPv4 CIDR 应返回 MN 的 IP 地址
+ *   TP-026 - null CIDR → fallback 到 Platform.getManagementServerIp()
+ *   TP-027 - 不匹配的 CIDR → fallback 到 Platform.getManagementServerIp()
+ *   TP-028 - 返回的 IP 地址不含方括号（裸地址）
+ *   TP-029 - 无效 CIDR → fallback，不抛异常
+ */
+class ApplianceVmIpv6Case extends SubCase {
+
+    /** 测试用 ApplianceVmFacadeImpl 实例（不依赖 @Autowired 注入） */
+    private ApplianceVmFacadeImpl facade
+    /** getMnIpForVr 反射方法 */
+    private Method getMnIpForVrMethod
+
+    @Override
+    void setup() {
+        // 无需 Spring；getMnIpForVr 只使用 NetworkInterface 枚举和 Platform 静态方法
+    }
+
+    @Override
+    void environment() {
+        // 无环境依赖
+    }
+
+    @Override
+    void clean() {
+        // 无需清理
+    }
+
+    @Override
+    void test() {
+        initReflection()
+
+        testTP025_mnCidrMatchReturnsMnIp()   // TP-025
+        testTP026_nullCidrFallback()         // TP-026
+        testTP027_unmatchedCidrFallback()    // TP-027
+        testTP028_returnedIpNoBrackets()     // TP-028
+        testTP029_invalidCidrFallback()      // TP-029
+    }
+
+    /**
+     * 初始化 ApplianceVmFacadeImpl 实例和反射方法。
+     */
+    private void initReflection() {
+        // ApplianceVmFacadeImpl 的字段初始化器使用 Platform.getManagementServerId()，
+        // 若 msId 未设置则返回 null；String.format("...%s", null) 不会 NPE
+        facade = new ApplianceVmFacadeImpl()
+
+        getMnIpForVrMethod = ApplianceVmFacadeImpl.class.getDeclaredMethod("getMnIpForVr", String.class)
+        getMnIpForVrMethod.setAccessible(true)
+    }
+
+    /**
+     * 调用 getMnIpForVr(cidr)，统一异常处理。
+     */
+    private String callGetMnIpForVr(String cidr) {
+        return getMnIpForVrMethod.invoke(facade, cidr) as String
+    }
+
+    /**
+     * TP-025: 使用当前管理节点 CIDR 调用 getMnIpForVr，返回值不为 null，为合法 IP 地址。
+     */
+    void testTP025_mnCidrMatchReturnsMnIp() {
+        String mnIp = Platform.getManagementServerIp()
+        String mnCidr = Platform.getManagementServerCidr()
+
+        if (mnCidr == null) {
+            logger.warn("TP-025: getManagementServerCidr() returned null, skipping CIDR match test")
+            return
+        }
+
+        String selectedIp = callGetMnIpForVr(mnCidr)
+        assert selectedIp != null : "TP-025: getMnIpForVr(mnCidr) should return non-null IP"
+        boolean isValidIp = NetworkUtils.isIpv4Address(selectedIp) ||
+                selectedIp.contains(":") // IPv6 contains ":"
+        assert isValidIp : "TP-025: returned IP should be valid, got: $selectedIp"
+        logger.info("TP-025: getMnIpForVr('$mnCidr') = '$selectedIp' (mnIp=$mnIp)")
+    }
+
+    /**
+     * TP-026: null CIDR → fallback 到 Platform.getManagementServerIp()
+     */
+    void testTP026_nullCidrFallback() {
+        String mnIp = Platform.getManagementServerIp()
+        String fallback = callGetMnIpForVr(null)
+        assert fallback != null : "TP-026: getMnIpForVr(null) should return non-null IP (fallback)"
+        assert fallback == mnIp :
+                "TP-026: getMnIpForVr(null) should fallback to Platform.getManagementServerIp(), expected '$mnIp', got '$fallback'"
+        logger.info("TP-026: getMnIpForVr(null) correctly falls back to $fallback")
+    }
+
+    /**
+     * TP-027: 不匹配的 CIDR → fallback 到 Platform.getManagementServerIp()
+     */
+    void testTP027_unmatchedCidrFallback() {
+        String mnIp = Platform.getManagementServerIp()
+        // 使用一个极不可能匹配当前主机任何网卡的 CIDR
+        String unmatchedCidr = "10.99.88.0/24"
+        String result = callGetMnIpForVr(unmatchedCidr)
+        assert result != null : "TP-027: getMnIpForVr(unmatched CIDR) should return non-null IP"
+        assert result == mnIp :
+                "TP-027: getMnIpForVr('$unmatchedCidr') should fallback to MN IP, expected '$mnIp', got '$result'"
+        logger.info("TP-027: getMnIpForVr('$unmatchedCidr') correctly falls back to $result")
+    }
+
+    /**
+     * TP-028: getMnIpForVr 返回的 IP 地址不含方括号（裸地址，无 URL 包装）
+     */
+    void testTP028_returnedIpNoBrackets() {
+        String fallbackIp = callGetMnIpForVr(null)
+        assert fallbackIp != null : "TP-028: getMnIpForVr(null) should not return null"
+        assert !fallbackIp.contains("[") && !fallbackIp.contains("]") :
+                "TP-028: returned IP should not contain brackets (should be bare IP), got: $fallbackIp"
+        logger.info("TP-028: getMnIpForVr returns bare IP without brackets: $fallbackIp")
+    }
+
+    /**
+     * TP-029: 无效 CIDR → fallback，不抛异常
+     */
+    void testTP029_invalidCidrFallback() {
+        String mnIp = Platform.getManagementServerIp()
+        String invalidCidr = "not-a-cidr"
+
+        String result = null
+        try {
+            result = callGetMnIpForVr(invalidCidr)
+        } catch (Exception e) {
+            // InvocationTargetException 包装原始异常
+            Throwable cause = e.getCause() ?: e
+            assert false : "TP-029: getMnIpForVr('$invalidCidr') should not throw, got: ${cause.class.simpleName}: ${cause.message}"
+        }
+
+        assert result != null : "TP-029: getMnIpForVr(invalid CIDR) should fallback to MN IP, not return null"
+        assert result == mnIp :
+                "TP-029: getMnIpForVr('$invalidCidr') should fallback to MN IP '$mnIp', got: $result"
+        logger.info("TP-029: getMnIpForVr('$invalidCidr') correctly falls back to $result without exception")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6Case.groovy
new file mode 100644
index 00000000000..61e1b86863f
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6Case.groovy
@@ -0,0 +1,269 @@
+package org.zstack.test.integration.core
+
+import org.zstack.core.Platform
+import org.zstack.core.config.GlobalConfigDef
+import org.zstack.core.config.NetworkGlobalConfig
+import org.zstack.core.rest.RESTFacadeImpl
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6NetworkUtils
+import org.zstack.utils.network.NetworkUtils
+
+import java.lang.reflect.Field
+import java.lang.reflect.Method
+
+/**
+ * TP-001~007, TP-021~024, TP-030~031: Management node IPv6 support core tests
+ *
+ * All tests are pure unit / reflection tests requiring no Spring context.
+ * Discovered and run automatically by CoreLibraryTest.runSubCases().
+ *
+ * Coverage:
+ *   TP-001 - NetworkGlobalConfig.PREFER_IPV6 default value is false
+ *   TP-002 - NetworkGlobalConfig.PREFER_IPV6 category and name are correct
+ *   TP-003 - Platform.getManagementServerIp() returns non-null IP in IPv4-only environment
+ *   TP-004 - PREFER_IPV6=false (default) returns IPv4 (CI environment validation)
+ *   TP-005 - PREFER_IPV6=true falls back to IPv4 gracefully (no exception when no IPv6 interface)
+ *   TP-006 - getManagementServerCidr() does not throw (returns CIDR format string in IPv4 environment)
+ *   TP-007 - CIDR format is valid (contains "/", prefix <= 32/128)
+ *   TP-021 - sanitizeCallbackUrl(IPv4 URL) returns unchanged
+ *   TP-022 - sanitizeCallbackUrl(bare IPv6 URL) corrected to bracketed format or preserved as-is
+ *   TP-023 - Platform.getManagementServerId() returns non-null UUID format string
+ *   TP-024 - two successive calls return the same UUID (persisted)
+ *   TP-030 - jgroupsAddr(IPv6, port) → "[ip][port]" format
+ *   TP-031 - jgroupsAddr(IPv4, port) → "ip[port]" format
+ */
+class MnIpv6Case extends SubCase {
+
+    @Override
+    void setup() {
+        // pure unit / static method tests, no Spring required
+    }
+
+    @Override
+    void environment() {
+        // no environment dependencies
+    }
+
+    @Override
+    void clean() {
+        // no cleanup needed
+    }
+
+    @Override
+    void test() {
+        testTP001_preferIpv6DefaultValue()          // TP-001
+        testTP002_preferIpv6CategoryAndName()       // TP-002
+        testTP003_getManagementServerIpNonNull()    // TP-003
+        testTP004_getManagementServerIpIpv4()       // TP-004
+        testTP005_getManagementServerIpFallback()   // TP-005
+        testTP006_getManagementServerCidrFormat()   // TP-006
+        testTP007_getManagementServerCidrValid()    // TP-007
+        testTP021_sanitizeCallbackUrlIpv4()         // TP-021
+        testTP022_sanitizeCallbackUrlBareIpv6()     // TP-022
+        testTP023_getManagementServerIdNonNull()    // TP-023
+        testTP024_getManagementServerIdStable()     // TP-024
+        testTP030_jgroupsAddrIpv6()                 // TP-030
+        testTP031_jgroupsAddrIpv4()                 // TP-031
+    }
+
+    // ===== F-001: GlobalConfig PREFER_IPV6 =====
+
+    /**
+     * TP-001: NetworkGlobalConfig.PREFER_IPV6 default value annotation is "false"
+     */
+    void testTP001_preferIpv6DefaultValue() {
+        Field field = NetworkGlobalConfig.class.getDeclaredField("PREFER_IPV6")
+        GlobalConfigDef annotation = field.getAnnotation(GlobalConfigDef.class)
+        assert annotation != null : "TP-001: PREFER_IPV6 should have @GlobalConfigDef annotation"
+        assert annotation.defaultValue() == "false" : "TP-001: PREFER_IPV6 defaultValue should be 'false', got: ${annotation.defaultValue()}"
+        logger.info("TP-001: PREFER_IPV6 defaultValue = '${annotation.defaultValue()}'")
+    }
+
+    /**
+     * TP-002: NetworkGlobalConfig.PREFER_IPV6 category and name are correct
+     */
+    void testTP002_preferIpv6CategoryAndName() {
+        String category = NetworkGlobalConfig.PREFER_IPV6.getCategory()
+        String name = NetworkGlobalConfig.PREFER_IPV6.getName()
+        assert category == "network" : "TP-002: PREFER_IPV6 category should be 'network', got: $category"
+        assert name == "management.server.prefer.ipv6" :
+                "TP-002: PREFER_IPV6 name should be 'management.server.prefer.ipv6', got: $name"
+        logger.info("TP-002: PREFER_IPV6 category='$category', name='$name'")
+    }
+
+    // ===== F-002: Platform.getManagementServerIp =====
+
+    /**
+     * TP-003: Platform.getManagementServerIp() returns non-null address in IPv4-only environment
+     */
+    void testTP003_getManagementServerIpNonNull() {
+        String ip = Platform.getManagementServerIp()
+        assert ip != null : "TP-003: getManagementServerIp() should return non-null"
+        boolean isIp = NetworkUtils.isIpv4Address(ip) || IPv6NetworkUtils.isIpv6Address(ip)
+        assert isIp : "TP-003: getManagementServerIp() should return valid IP, got: $ip"
+        logger.info("TP-003: getManagementServerIp() = $ip")
+    }
+
+    /**
+     * TP-004: PREFER_IPV6=false (default) — CI IPv4 environment returns IPv4 address
+     */
+    void testTP004_getManagementServerIpIpv4() {
+        String ip = Platform.getManagementServerIp()
+        assert ip != null : "TP-004: getManagementServerIp() should not be null"
+        // CI environment is IPv4-only; PREFER_IPV6 defaults to false → must return IPv4
+        assert NetworkUtils.isIpv4Address(ip) : "TP-004: CI is IPv4-only with PREFER_IPV6=false, expected IPv4 address, got: $ip"
+        logger.info("TP-004: management server IP = $ip (preferIpv6=false default)")
+    }
+
+    /**
+     * TP-005: PREFER_IPV6=true with no IPv6 interface — gracefully falls back to IPv4, no exception.
+     * Clears the static managementServerIp cache first to ensure the code path is re-executed.
+     */
+    void testTP005_getManagementServerIpFallback() {
+        def original = NetworkGlobalConfig.PREFER_IPV6.value(Boolean.class)
+        try {
+            // Clear the static cache so getManagementServerIp() re-evaluates with the new config.
+            Field cacheField = Platform.class.getDeclaredField("managementServerIp")
+            cacheField.setAccessible(true)
+            cacheField.set(null, null)
+
+            NetworkGlobalConfig.PREFER_IPV6.updateValue(true)
+            String ip = null
+            try {
+                ip = Platform.getManagementServerIp()
+            } catch (Exception e) {
+                assert false : "TP-005: getManagementServerIp() should not throw exception even when PREFER_IPV6=true with no IPv6, got: ${e.message}"
+            }
+            assert ip != null : "TP-005: getManagementServerIp() should return fallback IP, not null"
+            logger.info("TP-005: PREFER_IPV6 fallback returns $ip")
+        } finally {
+            NetworkGlobalConfig.PREFER_IPV6.updateValue(original)
+            // Restore cache to avoid affecting subsequent tests.
+            Field cacheField = Platform.class.getDeclaredField("managementServerIp")
+            cacheField.setAccessible(true)
+            cacheField.set(null, null)
+        }
+    }
+
+    // ===== F-003: getManagementServerCidr =====
+
+    /**
+     * TP-006: getManagementServerCidr() does not throw (should return CIDR format string in IPv4 environment)
+     */
+    void testTP006_getManagementServerCidrFormat() {
+        String cidr = null
+        try {
+            cidr = Platform.getManagementServerCidr()
+        } catch (Exception e) {
+            assert false : "TP-006: getManagementServerCidr() should not throw, got: ${e.message}"
+        }
+        // cidr may be null in CI environment (when management IP is not listed in ip addr output)
+        if (cidr != null) {
+            assert cidr.contains("/") : "TP-006: CIDR should contain '/', got: $cidr"
+        }
+        logger.info("TP-006: getManagementServerCidr() = $cidr")
+    }
+
+    /**
+     * TP-007: CIDR format is valid (contains "/", prefix <= 32 for IPv4 / <= 128 for IPv6)
+     */
+    void testTP007_getManagementServerCidrValid() {
+        String cidr = Platform.getManagementServerCidr()
+        if (cidr == null) {
+            logger.warn("TP-007: getManagementServerCidr() returned null in this environment, skipping prefix validation")
+            return
+        }
+        assert cidr.contains("/") : "TP-007: CIDR should contain '/', got: $cidr"
+        String[] parts = cidr.split("/")
+        assert parts.length == 2 : "TP-007: CIDR should have exactly 2 parts, got: $cidr"
+        int prefix = Integer.parseInt(parts[1].trim())
+        String network = parts[0]
+        if (NetworkUtils.isIpv4Address(network)) {
+            assert prefix >= 0 && prefix <= 32 : "TP-007: IPv4 prefix should be 0-32, got: $prefix"
+        } else {
+            assert prefix >= 0 && prefix <= 128 : "TP-007: IPv6 prefix should be 0-128, got: $prefix"
+        }
+        logger.info("TP-007: CIDR '$cidr' is valid (prefix=$prefix)")
+    }
+
+    // ===== F-007: RESTFacadeImpl.sanitizeCallbackUrl =====
+
+    /**
+     * TP-021: sanitizeCallbackUrl(IPv4 URL) returns unchanged (no bracket changes for IPv4)
+     */
+    void testTP021_sanitizeCallbackUrlIpv4() {
+        Method method = RESTFacadeImpl.class.getDeclaredMethod("sanitizeCallbackUrl", String.class)
+        method.setAccessible(true)
+
+        String ipv4Url = "http://192.168.1.1:8080/callback"
+        String result = method.invoke(null, ipv4Url) as String
+        assert result == ipv4Url : "TP-021: IPv4 callback URL should be returned unchanged, got: $result"
+        logger.info("TP-021: sanitizeCallbackUrl('$ipv4Url') = '$result'")
+    }
+
+    /**
+     * TP-022: sanitizeCallbackUrl(bare IPv6 URL) detects and brackets the IPv6 address (or preserves + WARN)
+     */
+    void testTP022_sanitizeCallbackUrlBareIpv6() {
+        Method method = RESTFacadeImpl.class.getDeclaredMethod("sanitizeCallbackUrl", String.class)
+        method.setAccessible(true)
+
+        String bareIpv6Url = "http://2001:db8::1:8080/callback"
+        String result = method.invoke(null, bareIpv6Url) as String
+        assert result != null : "TP-022: sanitizeCallbackUrl should not return null for bare IPv6 URL"
+        assert result.contains('[2001:db8::1]') : "TP-022: sanitizeCallbackUrl should bracket the IPv6 address, got: $result"
+        logger.info("TP-022: sanitizeCallbackUrl('$bareIpv6Url') = '$result'")
+    }
+
+    // ===== F-008: UUID persistence =====
+
+    /**
+     * TP-023: Platform.getManagementServerId() returns non-null 32-char hex UUID string
+     */
+    void testTP023_getManagementServerIdNonNull() {
+        String msId = Platform.getManagementServerId()
+        assert msId != null : "TP-023: getManagementServerId() should not return null (Platform not fully initialized?)"
+        assert msId.length() == 32 : "TP-023: management server ID should be 32-char hex UUID, got length: ${msId.length()}"
+        assert msId.matches("[0-9a-f]+") : "TP-023: management server ID should be lowercase hex, got: $msId"
+        logger.info("TP-023: getManagementServerId() = $msId")
+    }
+
+    /**
+     * TP-024: two successive calls to getManagementServerId() return the same UUID (persisted)
+     */
+    void testTP024_getManagementServerIdStable() {
+        String id1 = Platform.getManagementServerId()
+        String id2 = Platform.getManagementServerId()
+        assert id1 != null : "TP-024: getManagementServerId() should not return null"
+        assert id1 == id2 : "TP-024: getManagementServerId() should return stable UUID, got: '$id1' vs '$id2'"
+        logger.info("TP-024: getManagementServerId() is stable: $id1")
+    }
+
+    // ===== F-010: JGroups IPv6 bracket fix =====
+
+    /**
+     * TP-030: jgroupsAddr(IPv6, port) → "[2001:db8::1][7805]"
+     */
+    void testTP030_jgroupsAddrIpv6() {
+        Method method = Platform.class.getDeclaredMethod("jgroupsAddr", String.class, String.class)
+        method.setAccessible(true)
+
+        String result = method.invoke(null, "2001:db8::1", "7805") as String
+        assert result == "[2001:db8::1][7805]" :
+                "TP-030: IPv6 jgroupsAddr should use [addr][port] format, got: $result"
+        logger.info("TP-030: jgroupsAddr('2001:db8::1', '7805') = '$result'")
+    }
+
+    /**
+     * TP-031: jgroupsAddr(IPv4, port) → "192.168.1.1[7805]" (IPv4 without brackets)
+     */
+    void testTP031_jgroupsAddrIpv4() {
+        Method method = Platform.class.getDeclaredMethod("jgroupsAddr", String.class, String.class)
+        method.setAccessible(true)
+
+        String result = method.invoke(null, "192.168.1.1", "7805") as String
+        assert result == "192.168.1.1[7805]" :
+                "TP-031: IPv4 jgroupsAddr should use addr[port] format, got: $result"
+        logger.info("TP-031: jgroupsAddr('192.168.1.1', '7805') = '$result'")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6M3Case.groovy b/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6M3Case.groovy
new file mode 100644
index 00000000000..354c387c43c
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6M3Case.groovy
@@ -0,0 +1,219 @@
+package org.zstack.test.integration.core
+
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6Utils
+import org.zstack.utils.network.IPv6NetworkUtils
+import org.zstack.utils.network.NetworkUtils
+
+/**
+ * TP-062~069, TP-076, TP-077: Management node IPv6 M3 support tests
+ *
+ * All pure unit tests, no Spring context required.
+ * Discovered and run automatically by CoreLibraryTest.runSubCases().
+ *
+ * Coverage:
+ *   TP-062 - AddBaremetalChassisAction accepts IPv6 IPMI address
+ *   TP-064 - ipmiAddress field can store full IPv6 address (39 chars)
+ *   TP-065 - invalid IPMI address is rejected
+ *   TP-066 - Console Proxy URL uses IPv6 brackets
+ *   TP-067 - VNC Token URL hostname contains IPv6 brackets
+ *   TP-069 - Dual-stack MN Console URL uses management VIP
+ *   TP-076 - BM V2 DPU callback IP IPv6 brackets
+ *   TP-077 - COLO QEMU URL IPv6 brackets
+ */
+class MnIpv6M3Case extends SubCase {
+
+    @Override
+    void setup() {
+        // pure unit tests, no Spring required
+    }
+
+    @Override
+    void environment() {
+        // no environment dependencies
+    }
+
+    @Override
+    void clean() {
+        // no cleanup needed
+    }
+
+    @Override
+    void test() {
+        testTP062_ipmiIpv6AcceptedInInterceptor()       // TP-062
+        testTP065_ipmiAddressFullLengthIpv6()           // TP-064
+        testTP066_ipmiInvalidAddressRejected()          // TP-065
+        testTP067_consoleBracketIpv6()                  // TP-066
+        testTP069_consoleVncTokenUrl()                  // TP-067
+        testTP064_consoleDualStackVip()                 // TP-069
+        testTP076_bmDpuCallbackIpBracket()              // TP-076
+        testTP077_coloQemuUrlIpv6Bracket()              // TP-077
+    }
+
+    // ===== TP-062: AddBaremetalChassisAction accepts IPv6 IPMI address =====
+
+    /**
+     * TP-062: BaremetalChassisApiInterceptor.check() logic:
+     * IPv6 address satisfies !isIpv4Address && isIpv6Address, so it passes the interceptor.
+     */
+    void testTP062_ipmiIpv6AcceptedInInterceptor() {
+        String ipv6 = "2001:db8:50::1"
+
+        boolean isV4 = NetworkUtils.isIpv4Address(ipv6)
+        boolean isV6 = IPv6NetworkUtils.isIpv6Address(ipv6)
+
+        assert !isV4 : "TP-062: IPv6 address '$ipv6' should NOT be recognized as IPv4"
+        assert isV6  : "TP-062: IPv6 address '$ipv6' SHOULD be recognized as IPv6"
+        // interceptor pass condition: !isIpv4 && isIpv6
+        assert !isV4 && isV6 : "TP-062: IPv6 IPMI address should pass interceptor validation (accepted)"
+        logger.info("TP-062: IPMI IPv6 '$ipv6' → isIpv4=$isV4, isIpv6=$isV6 → accepted")
+    }
+
+    // ===== TP-064: ipmiAddress field can store full IPv6 address (39 chars) =====
+
+    /**
+     * TP-064: Fully expanded IPv6 address is 39 chars; NetworkUtils should correctly recognize it.
+     */
+    void testTP065_ipmiAddressFullLengthIpv6() {
+        String fullIpv6 = "2001:0db8:0000:0000:0000:0000:0000:0001"
+
+        assert fullIpv6.length() == 39 : "TP-064: full IPv6 address should be 39 chars, got: ${fullIpv6.length()}"
+
+        boolean isV6 = IPv6NetworkUtils.isIpv6Address(fullIpv6)
+        assert isV6 : "TP-064: 39-char full IPv6 '$fullIpv6' should be recognized as valid IPv6"
+        logger.info("TP-064: full 39-char IPv6 '$fullIpv6' → isIpv6=$isV6 (accepted by interceptor)")
+    }
+
+    // ===== TP-065: invalid IPMI address is rejected =====
+
+    /**
+     * TP-065: "not-an-ip" is neither IPv4 nor IPv6; the interceptor should reject it.
+     */
+    void testTP066_ipmiInvalidAddressRejected() {
+        String invalid = "not-an-ip"
+
+        boolean isV4 = NetworkUtils.isIpv4Address(invalid)
+        boolean isV6 = IPv6NetworkUtils.isIpv6Address(invalid)
+
+        // interceptor reject condition: !isIpv4 && !isIpv6
+        assert !isV4 : "TP-065: '$invalid' should NOT be recognized as IPv4"
+        assert !isV6 : "TP-065: '$invalid' should NOT be recognized as IPv6"
+        assert !isV4 && !isV6 : "TP-065: invalid address '$invalid' should fail both checks → interceptor rejects"
+        logger.info("TP-065: invalid IPMI address '$invalid' → isIpv4=$isV4, isIpv6=$isV6 → rejected")
+    }
+
+    // ===== TP-066: Console Proxy URL uses IPv6 brackets =====
+
+    /**
+     * TP-066: IPv6Utils.bracketIpv6() three scenarios:
+     *   - bare IPv6  → add brackets
+     *   - IPv4       → return unchanged
+     *   - already bracketed → idempotent
+     */
+    void testTP067_consoleBracketIpv6() {
+        // bare IPv6 → "[2001:db8::100]"
+        String bareIpv6   = "2001:db8::100"
+        String bracketed  = IPv6Utils.bracketIpv6(bareIpv6)
+        assert bracketed == "[2001:db8::100]" :
+                "TP-066: bracketIpv6('$bareIpv6') should return '[2001:db8::100]', got: '$bracketed'"
+        logger.info("TP-066a: bracketIpv6('$bareIpv6') = '$bracketed'")
+
+        // IPv4 → return unchanged
+        String ipv4   = "192.168.1.1"
+        String result = IPv6Utils.bracketIpv6(ipv4)
+        assert result == "192.168.1.1" :
+                "TP-066: bracketIpv6('$ipv4') should return '$ipv4' unchanged, got: '$result'"
+        logger.info("TP-066b: bracketIpv6('$ipv4') = '$result'")
+
+        // already bracketed IPv6 → idempotent
+        String alreadyBracketed = "[2001:db8::1]"
+        String idempotent = IPv6Utils.bracketIpv6(alreadyBracketed)
+        assert idempotent == "[2001:db8::1]" :
+                "TP-066: bracketIpv6('$alreadyBracketed') should be idempotent, got: '$idempotent'"
+        logger.info("TP-066c: bracketIpv6('$alreadyBracketed') = '$idempotent' (idempotent)")
+    }
+
+    // ===== TP-067: VNC Token URL hostname contains IPv6 brackets =====
+
+    /**
+     * TP-067: VNC Token URL hostname is processed with bracketIpv6,
+     * producing the valid "[2001:db8::1]:5900" format.
+     */
+    void testTP069_consoleVncTokenUrl() {
+        String ipv6Host = "2001:db8::1"
+        int    vncPort  = 5900
+
+        // process hostname with bracketIpv6, then append port
+        String hostname = IPv6Utils.bracketIpv6(ipv6Host)
+        assert hostname == "[2001:db8::1]" :
+                "TP-067: bracketIpv6 should produce '[2001:db8::1]', got: '$hostname'"
+
+        String vncAddr = "${hostname}:${vncPort}"
+        assert vncAddr == "[2001:db8::1]:5900" :
+                "TP-067: VNC address should be '[2001:db8::1]:5900', got: '$vncAddr'"
+        logger.info("TP-067: VNC Token URL hostname = '$hostname', addr = '$vncAddr'")
+    }
+
+    // ===== TP-069: dual-stack MN Console URL uses management VIP =====
+
+    /**
+     * TP-069: When CONSOLE_PROXY_OVERRIDDEN_IP is IPv6, bracketIpv6 wraps it correctly
+     * so the Console URL format is valid.
+     */
+    void testTP064_consoleDualStackVip() {
+        String overriddenIp = "2001:db8::100"  // simulates CONSOLE_PROXY_OVERRIDDEN_IP
+
+        String bracketed = IPv6Utils.bracketIpv6(overriddenIp)
+        assert bracketed == "[2001:db8::100]" :
+                "TP-069: Console VIP bracketIpv6('$overriddenIp') should return '[2001:db8::100]', got: '$bracketed'"
+
+        // assemble valid Console URL
+        String consoleUrl = "http://${bracketed}:8080/console"
+        assert consoleUrl == "http://[2001:db8::100]:8080/console" :
+                "TP-069: Console URL should be 'http://[2001:db8::100]:8080/console', got: '$consoleUrl'"
+        logger.info("TP-069: dual-stack Console URL = '$consoleUrl'")
+    }
+
+    // ===== TP-076: BM V2 DPU callback IP IPv6 brackets =====
+
+    /**
+     * TP-076: BM V2 DPU uses bracketIpv6 on callbackIp to ensure IPv6 is bracketed
+     * so the callback URL format is correct.
+     */
+    void testTP076_bmDpuCallbackIpBracket() {
+        String callbackIp = "2001:db8::1"
+
+        String bracketed = IPv6Utils.bracketIpv6(callbackIp)
+        assert bracketed == "[2001:db8::1]" :
+                "TP-076: DPU callbackIp bracketIpv6('$callbackIp') should return '[2001:db8::1]', got: '$bracketed'"
+
+        // verify callback URL is assembled correctly
+        String callbackUrl = "http://${bracketed}:7771/callback"
+        assert callbackUrl == "http://[2001:db8::1]:7771/callback" :
+                "TP-076: DPU callback URL should be 'http://[2001:db8::1]:7771/callback', got: '$callbackUrl'"
+        logger.info("TP-076: BM V2 DPU callbackIp='$callbackIp' → bracketed='$bracketed', url='$callbackUrl'")
+    }
+
+    // ===== TP-077: COLO QEMU URL IPv6 brackets =====
+
+    /**
+     * TP-077: COLO QEMU download URL is assembled with bracketIpv6 on the IPv6 address,
+     * ensuring the URL format is "http://[ip]:port/path".
+     */
+    void testTP077_coloQemuUrlIpv6Bracket() {
+        String ipv6   = "2001:db8::1"
+        String port   = "8080"
+        String path   = "/zstack/static/qemu.tar.gz"
+
+        String url = String.format("http://%s:%s%s", IPv6Utils.bracketIpv6(ipv6), port, path)
+        assert url == "http://[2001:db8::1]:8080/zstack/static/qemu.tar.gz" :
+                "TP-077: COLO QEMU URL should be 'http://[2001:db8::1]:8080/zstack/static/qemu.tar.gz', got: '$url'"
+        logger.info("TP-077: COLO QEMU URL = '$url'")
+
+        // also verify IPv6Utils.buildUrl helper (should match manual concatenation)
+        String builtUrl = IPv6Utils.buildUrl(ipv6, Integer.parseInt(port))
+        assert builtUrl == "http://[2001:db8::1]:8080" :
+                "TP-077: IPv6Utils.buildUrl('$ipv6', $port) should return 'http://[2001:db8::1]:8080', got: '$builtUrl'"
+        logger.info("TP-077: IPv6Utils.buildUrl = '$builtUrl'")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6M4Case.groovy b/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6M4Case.groovy
new file mode 100644
index 00000000000..e30a7518f47
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/core/MnIpv6M4Case.groovy
@@ -0,0 +1,260 @@
+package org.zstack.test.integration.core
+
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6Utils
+
+/**
+ * TP-083~089: 管理节点 IPv6 M4 Premium 支持测试
+ *
+ * 全部为纯单元测试，无需 Spring 上下文。
+ * 覆盖以下测试点：
+ *   TP-083 - ZWatch InfluxDB URL 含 IPv6 方括号（buildUrl vs String.format 对比）
+ *   TP-084 - Prometheus remote_write URL 含 IPv6 方括号（路径拼接正确）
+ *   TP-085 - Grafana 数据源 URL 含 IPv6 方括号（buildUrl vs String.format 对比）
+ *   TP-087 - License HTTP URL 含 IPv6 方括号（bracketIpv6 + buildHttpsUrl）
+ *   TP-088 - Keycloak 容器名 IPv6 地址 sanitize（冒号替换为短横线）
+ *   TP-089 - SSO CAS URL 含 IPv6 方括号（bracketIpv6 用于 HTTPS URL 拼接）
+ */
+class MnIpv6M4Case extends SubCase {
+
+    @Override
+    void setup() {
+        // 纯单元 / 静态方法测试，无需 Spring
+    }
+
+    @Override
+    void environment() {
+        // 无环境依赖
+    }
+
+    @Override
+    void clean() {
+        // 无需清理
+    }
+
+    @Override
+    void test() {
+        testTP083_influxDbUrlIpv6Bracket()        // TP-083
+        testTP084_prometheusWriteUrlIpv6()        // TP-084
+        testTP085_grafanaDataSourceUrlIpv6()      // TP-085
+        testTP086_licenseHttpUrlIpv6()            // TP-087
+        testTP087_keycloakContainerNameSanitize() // TP-088
+        testTP088_ssoCasLoginUrlIpv6()            // TP-089
+    }
+
+    // ===== TP-083: ZWatch InfluxDB URL =====
+
+    /**
+     * TP-083: IPv6Utils.buildUrl() 在 InfluxDB URL 中正确添加方括号。
+     *
+     * 背景：ZWatch 向 InfluxDB 写入监控数据时，URL 由管理节点 IP + 端口 8086 组成。
+     * 若使用 String.format("http://%s:%s", ip, port) 构造 IPv6 URL，冒号会破坏 URI 解析；
+     * 必须用 IPv6Utils.buildUrl() 确保 IPv6 地址被方括号包裹。
+     */
+    void testTP083_influxDbUrlIpv6Bracket() {
+        String ipv6 = "2001:db8::1"
+        int port = 8086
+        String expected = "http://[2001:db8::1]:8086"
+
+        // 正确做法：IPv6Utils.buildUrl() 自动加方括号
+        String actual = IPv6Utils.buildUrl(ipv6, port)
+        assert actual == expected :
+                "TP-083: IPv6Utils.buildUrl() should produce '$expected', got: '$actual'"
+
+        // 对比：String.format 不加方括号，结果不符合 RFC 2732
+        String wrongUrl = String.format("http://%s:%d", ipv6, port)
+        assert wrongUrl != expected :
+                "TP-083: String.format() should NOT produce RFC-compliant IPv6 URL"
+        assert !wrongUrl.contains("[") :
+                "TP-083: String.format() result should not contain brackets, got: '$wrongUrl'"
+
+        logger.info("TP-083: InfluxDB URL (correct) = '$actual'")
+        logger.info("TP-083: InfluxDB URL (wrong String.format) = '$wrongUrl'")
+    }
+
+    // ===== TP-084: Prometheus remote_write URL =====
+
+    /**
+     * TP-084: Prometheus remote_write 端点 URL 含 IPv6 方括号，路径拼接正确。
+     *
+     * 背景：Prometheus remote_write 目标地址形如 http://[ip]:port/api/v1/write。
+     * 使用 IPv6Utils.buildUrl() 构造 base URL 后追加路径。
+     */
+    void testTP084_prometheusWriteUrlIpv6() {
+        String ipv6 = "2001:db8::1"
+        int port = 9090
+        String path = "/api/v1/write"
+        String expected = "http://[2001:db8::1]:9090/api/v1/write"
+
+        String actual = IPv6Utils.buildUrl(ipv6, port) + path
+        assert actual == expected :
+                "TP-084: Prometheus remote_write URL should be '$expected', got: '$actual'"
+
+        // 验证 URL 中方括号存在
+        assert actual.contains("[2001:db8::1]") :
+                "TP-084: URL should contain bracketed IPv6 address"
+        // 验证路径正确追加
+        assert actual.endsWith(path) :
+                "TP-084: URL should end with '$path'"
+
+        logger.info("TP-084: Prometheus remote_write URL = '$actual'")
+    }
+
+    // ===== TP-085: Grafana 数据源 URL =====
+
+    /**
+     * TP-085: Grafana 数据源 URL 在 IPv6 场景下包含方括号。
+     *
+     * 背景：ZWatch 向 Grafana 注册数据源时，datasource URL 需要符合 HTTP URI 规范。
+     * String.format("http://%s:%s", ip, port) 生成裸 IPv6 URL 会导致 Grafana API 拒绝。
+     */
+    void testTP085_grafanaDataSourceUrlIpv6() {
+        String ipv6 = "2001:db8::1"
+        int port = 3000
+        String expected = "http://[2001:db8::1]:3000"
+
+        // 正确做法
+        String actual = IPv6Utils.buildUrl(ipv6, port)
+        assert actual == expected :
+                "TP-085: Grafana datasource URL should be '$expected', got: '$actual'"
+
+        // 对比：String.format 的错误结果（无括号）
+        String wrongUrl = String.format("http://%s:%d", ipv6, port)
+        assert wrongUrl != actual :
+                "TP-085: String.format() result should differ from RFC-compliant URL"
+        assert wrongUrl == "http://2001:db8::1:3000" :
+                "TP-085: String.format() result should be 'http://2001:db8::1:3000' (no brackets), got: '$wrongUrl'"
+
+        logger.info("TP-085: Grafana datasource URL (correct) = '$actual'")
+        logger.info("TP-085: Grafana datasource URL (wrong String.format) = '$wrongUrl'")
+    }
+
+    // ===== TP-087: License HTTP URL =====
+
+    /**
+     * TP-087: License 验证 HTTPS URL 在 IPv6 场景下正确添加方括号。
+     *
+     * 背景：License 服务向管理节点发起 HTTP 回调时，需要构造形如
+     * https://[ipv6]:443/license 的 URL；bracketIpv6() 保证 IPv4 不受影响。
+     */
+    void testTP086_licenseHttpUrlIpv6() {
+        String ipv6 = "2001:db8::1"
+        int port = 443
+        String licensePath = "/license"
+
+        // 验证 bracketIpv6 对 IPv6 正确添加方括号
+        String bracketed = IPv6Utils.bracketIpv6(ipv6)
+        assert bracketed == "[2001:db8::1]" :
+                "TP-087: bracketIpv6('$ipv6') should return '[2001:db8::1]', got: '$bracketed'"
+
+        // 验证 bracketIpv6 对 IPv4 原样返回（无副作用）
+        String ipv4 = "192.168.1.100"
+        String bracketedIpv4 = IPv6Utils.bracketIpv6(ipv4)
+        assert bracketedIpv4 == ipv4 :
+                "TP-087: bracketIpv6('$ipv4') should return IPv4 unchanged, got: '$bracketedIpv4'"
+
+        // 模拟 License 回调 URL 构造
+        String licenseUrl = String.format("https://%s:%d%s", bracketed, port, licensePath)
+        String expectedUrl = "https://[2001:db8::1]:443/license"
+        assert licenseUrl == expectedUrl :
+                "TP-087: License URL should be '$expectedUrl', got: '$licenseUrl'"
+
+        // 使用 buildHttpsUrl 的等效验证
+        String builtUrl = IPv6Utils.buildHttpsUrl(ipv6, port, licensePath)
+        assert builtUrl == expectedUrl :
+                "TP-087: buildHttpsUrl('$ipv6', $port, '$licensePath') should be '$expectedUrl', got: '$builtUrl'"
+
+        logger.info("TP-087: bracketIpv6('$ipv6') = '$bracketed'")
+        logger.info("TP-087: License URL = '$licenseUrl'")
+    }
+
+    // ===== TP-088: Keycloak 容器名 IPv6 Sanitize =====
+
+    /**
+     * TP-088: 将 IPv6 地址中的冒号替换为短横线，确保 Docker 容器名合法。
+     *
+     * 背景：Keycloak 容器名基于管理节点 IP 生成，Docker 容器名只允许 [a-zA-Z0-9_.-]。
+     * IPv6 地址含冒号，需要替换为短横线后才能作为容器名的一部分。
+     */
+    void testTP087_keycloakContainerNameSanitize() {
+        String ipv6 = "2001:db8::1"
+
+        // 验证冒号替换为短横线
+        String sanitized = ipv6.replace(':', '-')
+        assert sanitized == "2001-db8--1" :
+                "TP-088: '$ipv6'.replace(':', '-') should be '2001-db8--1', got: '$sanitized'"
+
+        // 验证 sanitized 结果不含冒号
+        assert !sanitized.contains(':') :
+                "TP-088: sanitized IP should not contain colon, got: '$sanitized'"
+
+        // 验证拼接后的完整容器名不含冒号
+        String containerName = "keycloak-server-on-management-node-${sanitized}"
+        assert containerName == "keycloak-server-on-management-node-2001-db8--1" :
+                "TP-088: container name should be 'keycloak-server-on-management-node-2001-db8--1', got: '$containerName'"
+        assert !containerName.contains(':') :
+                "TP-088: container name must not contain colon"
+
+        // 验证 Docker 容器名合法性（正则 [a-zA-Z0-9_.-]+）
+        assert containerName.matches('[a-zA-Z0-9_.\\-]+') :
+                "TP-088: container name '$containerName' must match Docker naming rule [a-zA-Z0-9_.-]+"
+
+        // 对比：IPv4 不含冒号，replace 操作幂等
+        String ipv4 = "192.168.1.100"
+        String sanitizedIpv4 = ipv4.replace(':', '-')
+        assert sanitizedIpv4 == ipv4 :
+                "TP-088: IPv4 sanitize should be no-op, got: '$sanitizedIpv4'"
+
+        logger.info("TP-088: IPv6 sanitized for container name = '$sanitized'")
+        logger.info("TP-088: Full container name = '$containerName'")
+    }
+
+    // ===== TP-089: SSO CAS URL =====
+
+    /**
+     * TP-089: SSO CAS 登录 URL 在 IPv6 场景下正确添加方括号。
+     *
+     * 背景：Keycloak/CAS 协议要求 service 参数和 CAS server URL 均需符合 RFC URI 规范。
+     * 使用 bracketIpv6() 确保 IPv6 地址在 HTTPS URL 中被方括号包裹。
+     */
+    void testTP088_ssoCasLoginUrlIpv6() {
+        String ipv6 = "2001:db8::100"
+        int port = 8443
+        String casPath = "/cas/login"
+        String serviceUrl = "https%3A%2F%2F%5B2001%3Adb8%3A%3A100%5D%3A8443%2Fapp"
+
+        // 验证 bracketIpv6 对该 IPv6 正确括号化
+        String bracketed = IPv6Utils.bracketIpv6(ipv6)
+        assert bracketed == "[2001:db8::100]" :
+                "TP-089: bracketIpv6('$ipv6') should return '[2001:db8::100]', got: '$bracketed'"
+
+        // 验证幂等性：对已括号化地址再次调用不重复添加
+        String doubleWrapped = IPv6Utils.bracketIpv6(bracketed)
+        assert doubleWrapped == "[2001:db8::100]" :
+                "TP-089: bracketIpv6 should be idempotent, got: '$doubleWrapped'"
+
+        // 模拟 CAS 登录 URL 构造（使用 buildHttpsUrl + 路径）
+        String casBase = IPv6Utils.buildHttpsUrl(ipv6, port, casPath)
+        String expectedBase = "https://[2001:db8::100]:8443/cas/login"
+        assert casBase == expectedBase :
+                "TP-089: CAS base URL should be '$expectedBase', got: '$casBase'"
+
+        // 验证带 service 参数的完整登录 URL
+        String fullCasUrl = "${casBase}?service=${serviceUrl}"
+        assert fullCasUrl.startsWith("https://[2001:db8::100]:") :
+                "TP-089: Full CAS URL should start with 'https://[2001:db8::100]:', got: '$fullCasUrl'"
+        assert fullCasUrl.contains(casPath) :
+                "TP-089: Full CAS URL should contain path '$casPath'"
+
+        // 对比裸 IPv6 URL（无方括号）的错误格式
+        String wrongCasBase = String.format("https://%s:%d%s", ipv6, port, casPath)
+        assert wrongCasBase != casBase :
+                "TP-089: String.format() should produce incorrect URL without brackets"
+        assert !wrongCasBase.contains("[") :
+                "TP-089: String.format() result should not contain brackets, got: '$wrongCasBase'"
+
+        logger.info("TP-089: bracketIpv6('$ipv6') = '$bracketed'")
+        logger.info("TP-089: CAS login URL (correct) = '$casBase'")
+        logger.info("TP-089: CAS login URL (wrong String.format) = '$wrongCasBase'")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/ZSha2Ipv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/core/ZSha2Ipv6Case.groovy
new file mode 100644
index 00000000000..363d02d65f9
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/core/ZSha2Ipv6Case.groovy
@@ -0,0 +1,134 @@
+package org.zstack.test.integration.core
+
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6Utils
+
+/**
+ * TP-042~046: ZSha2 高可用 IPv6 支持测试
+ *
+ * 全部为纯单元测试，无需 Spring 上下文。
+ *
+ * 覆盖：
+ *   TP-042 - ZSha2Helper.isMaster() grep pattern " ip/" 正确匹配 IPv6 VIP
+ *   TP-043 - ZSha2Helper.isMaster() grep 逻辑正确（含 VIP 的 ip addr 输出返回 true）
+ *   TP-044 - Zsha2 SSH/SCP 命令含 [IPv6] 括号：bracketIpv6() 工具正确
+ *   TP-045 - nginx upstream 渲染：MN IP = IPv6 → "server [ipv6]:port;"
+ *   TP-046 - IAM URL 含 IPv6 括号
+ */
+class ZSha2Ipv6Case extends SubCase {
+
+    @Override
+    void setup() {
+        // 纯单元测试，无需 Spring
+    }
+
+    @Override
+    void environment() {
+        // 无环境依赖
+    }
+
+    @Override
+    void clean() {
+        // 无需清理
+    }
+
+    @Override
+    void test() {
+        testTP043_isMasterGrepPatternMatchesIpv6()      // TP-042
+        testTP042_isMasterGrepLogicWithVip()            // TP-043
+        testTP044_bracketIpv6ForSshScp()               // TP-044
+        testTP045_nginxUpstreamIpv6Format()            // TP-045
+        testTP046_iamUrlIpv6Brackets()                 // TP-046
+    }
+
+    /**
+     * TP-042: ZSha2Helper.isMaster() 使用 " %s/" 模式（新 pattern）匹配 IPv6 VIP。
+     * 模拟 `ip addr show` 输出，验证 " VIP/" 字符串匹配正确。
+     */
+    void testTP043_isMasterGrepPatternMatchesIpv6() {
+        String output = "    inet6 2001:db8::100/64 scope global dynamic"
+        String vip = "2001:db8::100"
+
+        // TP-042: 新 pattern " VIP/" 应匹配 IPv6（冒号前后无空格，但 inet6 行含 " VIP/"）
+        String pattern = " ${vip}/"
+        assert output.contains(pattern) :
+                "TP-042: pattern ' IP/' should match IPv6 in 'ip addr show' output. pattern='$pattern'"
+
+        // 验证旧 pattern [^0-9]IP[^0-9] 也能匹配（: 是非数字字符）
+        String oldPatternBefore = output.substring(output.indexOf(vip) - 1, output.indexOf(vip))
+        String oldPatternAfter = output.substring(output.indexOf(vip) + vip.length(), output.indexOf(vip) + vip.length() + 1)
+        assert !oldPatternBefore.matches("[0-9]") :
+                "TP-042: character before VIP in output should be non-digit (was: '$oldPatternBefore')"
+        assert !oldPatternAfter.matches("[0-9]") :
+                "TP-042: character after VIP in output should be non-digit (was: '$oldPatternAfter')"
+        logger.info("TP-042: pattern ' $vip/' matches IPv6 in ip addr output correctly")
+    }
+
+    /**
+     * TP-043: ZSha2Helper.isMaster() grep 逻辑正确——ip addr 输出包含 VIP 时判定为 master。
+     * 复用 TP-042 的模拟逻辑，验证存在 VIP 时 contains 返回 true，不存在时返回 false。
+     */
+    void testTP042_isMasterGrepLogicWithVip() {
+        String vip = "2001:db8::100"
+        String outputWithVip = "    inet6 2001:db8::100/64 scope global dynamic"
+        String outputWithoutVip = "    inet6 fd00::1/64 scope global dynamic"
+
+        // TP-043: 含 VIP 的输出 → isMaster 应为 true
+        assert outputWithVip.contains(" ${vip}/") :
+                "TP-043: output containing VIP should be identified as master"
+        // 不含 VIP 的输出 → isMaster 应为 false
+        assert !outputWithoutVip.contains(" ${vip}/") :
+                "TP-043: output without VIP should not be identified as master"
+        logger.info("TP-043: isMaster grep logic for IPv6 VIP verified")
+    }
+
+    /**
+     * TP-044: Zsha2 SSH/SCP 命令中 IPv6 地址需加方括号，bracketIpv6() 正确处理。
+     */
+    void testTP044_bracketIpv6ForSshScp() {
+        // TP-044: IPv6 → "[ipv6]"（加括号）
+        assert IPv6Utils.bracketIpv6("2001:db8::1") == "[2001:db8::1]" :
+                "TP-044: bracketIpv6 should wrap IPv6 in square brackets for SSH/SCP"
+        // 幂等：已有括号不重复添加
+        assert IPv6Utils.bracketIpv6("[2001:db8::1]") == "[2001:db8::1]" :
+                "TP-044: bracketIpv6 should be idempotent (no double-bracketing)"
+        // IPv4 → 原样返回，不加括号
+        assert IPv6Utils.bracketIpv6("192.168.1.1") == "192.168.1.1" :
+                "TP-044: bracketIpv6 should not modify IPv4 address"
+        logger.info("TP-044: bracketIpv6 for SSH/SCP commands verified")
+    }
+
+    /**
+     * TP-045: nginx upstream 渲染时，MN IP = IPv6 → "server [ipv6]:port;"
+     */
+    void testTP045_nginxUpstreamIpv6Format() {
+        String mnIp = "2001:db8::1"
+        // TP-045: nginx upstream server 指令需要 [ipv6]:port 格式
+        String nginxServer = "server ${IPv6Utils.bracketIpv6(mnIp)}:8080;"
+        assert nginxServer == "server [2001:db8::1]:8080;" :
+                "TP-045: nginx upstream should bracket IPv6, got: $nginxServer"
+        // IPv4 不加括号
+        String nginxServerV4 = "server ${IPv6Utils.bracketIpv6("10.0.0.1")}:8080;"
+        assert nginxServerV4 == "server 10.0.0.1:8080;" :
+                "TP-045: nginx upstream IPv4 should have no brackets, got: $nginxServerV4"
+        logger.info("TP-045: nginx upstream IPv6 format='$nginxServer', IPv4='$nginxServerV4'")
+    }
+
+    /**
+     * TP-046: IAM URL 包含 IPv6 时需加方括号，buildUrl() 正确生成。
+     */
+    void testTP046_iamUrlIpv6Brackets() {
+        String iamIp = "2001:db8::2"
+        // TP-046: IAM URL 应含 [ipv6]:port 格式
+        String url = IPv6Utils.buildUrl(iamIp, 8080) + "/api/v1/"
+        assert url.startsWith("http://[2001:db8::2]:8080/") :
+                "TP-046: IAM URL should bracket IPv6, got: $url"
+        assert url == "http://[2001:db8::2]:8080/api/v1/" :
+                "TP-046: IAM URL full form incorrect, got: $url"
+        // IPv4 IAM URL 不加括号
+        String urlV4 = IPv6Utils.buildUrl("10.0.0.2", 8080) + "/api/v1/"
+        assert urlV4 == "http://10.0.0.2:8080/api/v1/" :
+                "TP-046: IAM URL for IPv4 should have no brackets, got: $urlV4"
+        logger.info("TP-046: IAM URL IPv6='$url', IPv4='$urlV4'")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
new file mode 100644
index 00000000000..8542b8f8ab9
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
@@ -0,0 +1,173 @@
+package org.zstack.test.integration.kvm.host
+
+import org.zstack.header.errorcode.SysErrors
+import org.zstack.header.host.HostAO
+import org.zstack.sdk.AddKVMHostAction
+import org.zstack.sdk.ClusterInventory
+import org.zstack.test.integration.kvm.KvmTest
+import org.zstack.testlib.EnvSpec
+import org.zstack.testlib.SubCase
+
+import javax.persistence.Column
+import java.lang.reflect.Field
+
+/**
+ * TP-015~020: KVM 宿主机 IPv6 管理 IP 测试
+ *
+ * 覆盖：
+ *   TP-015 - managementIp 列长度足够存储 39 字符全展开 IPv6（@Column length >= 39）
+ *   TP-016 - 以合法 IPv6 调用 AddKVMHostAction：拦截器不因 INVALID_ARGUMENT_ERROR 拒绝
+ *   TP-017 - 全展开 IPv6 经 interceptor 规范化后不触发 INVALID_ARGUMENT_ERROR
+ *   TP-018 - 链路本地地址 "fe80::1%eth0" 被拒绝（INVALID_ARGUMENT_ERROR）
+ *   TP-019 - 非法格式 "not-an-ip!!" 被拒绝（INVALID_ARGUMENT_ERROR）
+ *   TP-020 - 39 字符全展开 IPv6 不被 DB 截断（与 TP-015 列长度验证合并）
+ */
+class KvmHostIpv6Case extends SubCase {
+
+    EnvSpec env
+    ClusterInventory cluster
+
+    @Override
+    void setup() {
+        useSpring(KvmTest.springSpec)
+    }
+
+    @Override
+    void environment() {
+        env = HostEnv.noHostBasicEnv()
+    }
+
+    @Override
+    void clean() {
+        env.delete()
+    }
+
+    @Override
+    void test() {
+        env.create {
+            cluster = env.inventoryByName("cluster") as ClusterInventory
+
+            testTP015_managementIpColumnLength()       // TP-015
+            testTP016_addHostWithIpv6Passes()          // TP-016
+            testTP017_fullIpv6NormalizedBeforeConnect() // TP-017
+            testTP018_linkLocalIpv6Rejected()          // TP-018
+            testTP019_invalidIpRejected()              // TP-019
+            testTP020_fullIpv6FitsInColumn()            // TP-020
+        }
+    }
+
+    /**
+     * TP-015: HostVO.managementIp 列（继承自 HostAO）接受 39 字符全展开 IPv6 不截断。
+     * 验证 @Column(length = ...) >= 39。
+     */
+    void testTP015_managementIpColumnLength() {
+        Field field = HostAO.class.getDeclaredField("managementIp")
+        field.setAccessible(true)
+        Column col = field.getAnnotation(Column.class)
+        assert col != null : "TP-015: managementIp should have @Column annotation"
+        assert col.length() >= 39 : "TP-015: managementIp column length ${col.length()} is too short for 39-char full-expanded IPv6"
+        logger.info("TP-015: managementIp @Column length = ${col.length()}, sufficient for IPv6")
+    }
+
+    /**
+     * TP-016: 以合法 IPv6 地址 "2001:db8::10" 调用 AddKVMHostAction。
+     * API 拦截器不因 INVALID_ARGUMENT_ERROR 拒绝 IPv6（连接失败是预期行为）。
+     */
+    void testTP016_addHostWithIpv6Passes() {
+        def action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.clusterUuid = cluster.uuid
+        action.managementIp = "2001:db8::10"
+        action.name = "kvm-ipv6-compressed"
+        action.username = "root"
+        action.password = "password"
+        def res = action.call()
+
+        // IPv6 校验通过后才会尝试连接；连接失败不是 INVALID_ARGUMENT_ERROR
+        if (res.error != null) {
+            assert res.error.code != SysErrors.INVALID_ARGUMENT_ERROR.toString() :
+                    "TP-016: IPv6 address should pass validation (interceptor should not return INVALID_ARGUMENT_ERROR), got: ${res.error.code} - ${res.error.description}"
+        }
+        logger.info("TP-016: AddKVMHostAction with IPv6 passed API validation (error=${res.error?.code})")
+    }
+
+    /**
+     * TP-017: 全展开 IPv6 地址输入，经 HostApiInterceptor.normalizeIpv6 规范化，不触发 INVALID_ARGUMENT_ERROR。
+     * 规范化：2001:0db8:0000:0000:0000:0000:0000:0001 → 2001:db8::1
+     */
+    void testTP017_fullIpv6NormalizedBeforeConnect() {
+        String fullIpv6 = "2001:0db8:0000:0000:0000:0000:0000:0001"
+        def action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.clusterUuid = cluster.uuid
+        action.managementIp = fullIpv6
+        action.name = "kvm-ipv6-full"
+        action.username = "root"
+        action.password = "password"
+        def res = action.call()
+
+        // normalizeIpv6 后的压缩地址可通过 isValidManagementIp 校验，不返回 INVALID_ARGUMENT_ERROR
+        if (res.error != null) {
+            assert res.error.code != SysErrors.INVALID_ARGUMENT_ERROR.toString() :
+                    "TP-017: full-expanded IPv6 should normalize and pass validation, got: ${res.error.code}"
+        }
+        logger.info("TP-017: full-expanded IPv6 normalized before connect (error=${res.error?.code})")
+    }
+
+    /**
+     * TP-018: 链路本地地址 "fe80::1%eth0" 应被 HostApiInterceptor 拒绝。
+     * 期望错误码：SysErrors.INVALID_ARGUMENT_ERROR
+     */
+    void testTP018_linkLocalIpv6Rejected() {
+        def action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.clusterUuid = cluster.uuid
+        action.managementIp = "fe80::1%eth0"
+        action.name = "kvm-ipv6-linklocal"
+        action.username = "root"
+        action.password = "password"
+        def res = action.call()
+
+        assert res.error != null : "TP-018: link-local IPv6 should be rejected"
+        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString() :
+                "TP-018: expected INVALID_ARGUMENT_ERROR for link-local IPv6, got: ${res.error.code}"
+        logger.info("TP-018: link-local IPv6 correctly rejected with ${res.error.code}")
+    }
+
+    /**
+     * TP-019: 非法格式 "not-an-ip!!" 应被 HostApiInterceptor 拒绝。
+     * 期望错误码：SysErrors.INVALID_ARGUMENT_ERROR
+     */
+    void testTP019_invalidIpRejected() {
+        def action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.clusterUuid = cluster.uuid
+        action.managementIp = "not-an-ip!!"
+        action.name = "kvm-invalid-ip"
+        action.username = "root"
+        action.password = "password"
+        def res = action.call()
+
+        assert res.error != null : "TP-019: invalid IP format should be rejected"
+        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString() :
+                "TP-019: expected INVALID_ARGUMENT_ERROR for invalid IP, got: ${res.error.code}"
+        logger.info("TP-019: invalid IP correctly rejected with ${res.error.code}")
+    }
+
+    /**
+     * TP-020: 39 字符全展开 IPv6 不被 DB 截断。
+     * 与 TP-015 合并验证 @Column length >= 39。
+     * 全展开 IPv6 最长为 "2001:0db8:0000:0000:0000:0000:0000:0001" = 39 字符。
+     */
+    void testTP020_fullIpv6FitsInColumn() {
+        String fullIpv6 = "2001:0db8:0000:0000:0000:0000:0000:0001"
+        assert fullIpv6.length() == 39 : "Precondition: full-expanded IPv6 should be 39 chars"
+
+        Field field = HostAO.class.getDeclaredField("managementIp")
+        field.setAccessible(true)
+        Column col = field.getAnnotation(Column.class)
+        assert col.length() >= fullIpv6.length() :
+                "TP-020: managementIp column length ${col.length()} is insufficient for 39-char full-expanded IPv6"
+        logger.info("TP-020: column length ${col.length()} >= 39, no truncation for full-expanded IPv6")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/network/ipv6/MnIpv6StorageMigrationCase.groovy b/test/src/test/groovy/org/zstack/test/integration/network/ipv6/MnIpv6StorageMigrationCase.groovy
new file mode 100644
index 00000000000..908771eddd5
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/network/ipv6/MnIpv6StorageMigrationCase.groovy
@@ -0,0 +1,136 @@
+package org.zstack.test.integration.network.ipv6
+
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6Utils
+import org.zstack.utils.network.NetworkUtils
+
+/**
+ * TP-032~038: 存储迁移网络 IPv6 支持测试
+ *
+ * 全部为纯单元 / 静态方法测试，无需 Spring 上下文。
+ *
+ * 覆盖：
+ *   TP-032 - NFS 主存储创建，存储 CIDR = IPv6 CIDR 验证不报 INVALID_ARGUMENT_ERROR
+ *   TP-033 - NetworkUtils.isIpInCidr() 匹配 IPv6 地址在 IPv6 CIDR 内
+ *   TP-034 - isIpInCidr() 无匹配时返回 false（fallback 逻辑）
+ *   TP-035 - Ceph MonUri 解析 [IPv6] 括号输入：buildAddr IPv6 → "[ip]:port"
+ *   TP-036 - Ceph monAddr 输出格式 [ipv6]:port
+ *   TP-038 - checkMigrateNetworkCidrOfHost fallback 逻辑
+ */
+class MnIpv6StorageMigrationCase extends SubCase {
+
+    @Override
+    void setup() {
+        // 纯单元测试，无需 Spring
+    }
+
+    @Override
+    void environment() {
+        // 无环境依赖
+    }
+
+    @Override
+    void clean() {
+        // 无需清理
+    }
+
+    @Override
+    void test() {
+        testTP032_nfsCidrIpv6NotRejected()             // TP-032
+        testTP033_isIpInCidrIpv6Match()                // TP-033
+        testTP034_isIpInCidrNoMatchFallback()          // TP-034
+        testTP035_buildAddrIpv6BracketFormat()         // TP-035
+        testTP036_cephMonAddrIpv6Format()              // TP-036
+        testTP038_checkMigrateNetworkCidrFallback()    // TP-038
+    }
+
+    /**
+     * TP-032: NFS 存储 CIDR = IPv6 CIDR，验证 IPv6 CIDR 格式可被工具方法正确识别，
+     * 不会因 INVALID_ARGUMENT_ERROR 逻辑被拒绝。
+     * 直接验证 CIDR 内的 IP 可通过 isIpInCidr 匹配。
+     */
+    void testTP032_nfsCidrIpv6NotRejected() {
+        String ipv6Cidr = "2001:db8::/64"
+        String ipv6InCidr = "2001:db8::1"
+
+        // TP-032: IPv6 CIDR 应能被正确解析，CIDR 内的 IP 匹配成功（不报错）
+        boolean result = NetworkUtils.isIpInCidr(ipv6InCidr, ipv6Cidr)
+        assert result : "TP-032: IPv6 address $ipv6InCidr should be in CIDR $ipv6Cidr (NFS IPv6 CIDR should not be rejected)"
+        logger.info("TP-032: IPv6 CIDR '$ipv6Cidr' recognized correctly, isIpInCidr='$result'")
+    }
+
+    /**
+     * TP-033: NetworkUtils.isIpInCidr() 通过 IPv6NetworkUtils 正确匹配 IPv6 地址。
+     */
+    void testTP033_isIpInCidrIpv6Match() {
+        // TP-033: IPv6 IP 在 IPv6 CIDR 内 → true
+        assert NetworkUtils.isIpInCidr("2001:db8::10", "2001:db8::/64") :
+                "TP-033: 2001:db8::10 should be in 2001:db8::/64"
+        // IPv4 IP 在 IPv4 CIDR 内 → true
+        assert NetworkUtils.isIpInCidr("192.168.1.10", "192.168.1.0/24") :
+                "TP-033: 192.168.1.10 should be in 192.168.1.0/24"
+        // IPv6 IP 对 IPv4 CIDR → false（不同协议不匹配）
+        assert !NetworkUtils.isIpInCidr("2001:db8::10", "10.0.0.0/8") :
+                "TP-033: IPv6 address should not match IPv4 CIDR"
+        logger.info("TP-033: isIpInCidr IPv6 matching logic verified")
+    }
+
+    /**
+     * TP-034: isIpInCidr() 无匹配时返回 false（fallback 逻辑）。
+     */
+    void testTP034_isIpInCidrNoMatchFallback() {
+        // TP-034: IPv6 IP 对 IPv4 CIDR 不匹配
+        assert !NetworkUtils.isIpInCidr("2001:db8::1", "192.168.0.0/24") :
+                "TP-034: IPv6 IP should not match IPv4 CIDR (fallback returns false)"
+        // IPv4 IP 对 IPv6 CIDR 不匹配
+        assert !NetworkUtils.isIpInCidr("192.168.1.1", "2001:db8::/64") :
+                "TP-034: IPv4 IP should not match IPv6 CIDR (fallback returns false)"
+        logger.info("TP-034: isIpInCidr fallback (no match) returns false correctly")
+    }
+
+    /**
+     * TP-035: Ceph MonUri 解析 [IPv6] 括号输入。
+     * buildAddr：IPv6 → "[ip]:port"，IPv4 → "ip:port"
+     */
+    void testTP035_buildAddrIpv6BracketFormat() {
+        // TP-035: IPv6 地址应加方括号
+        String ipv6Addr = IPv6Utils.buildAddr("2001:db8::1", 6789)
+        assert ipv6Addr == "[2001:db8::1]:6789" :
+                "TP-035: buildAddr IPv6 should produce '[ip]:port' format, got: $ipv6Addr"
+        // IPv4 地址不加方括号
+        String ipv4Addr = IPv6Utils.buildAddr("192.168.1.1", 6789)
+        assert ipv4Addr == "192.168.1.1:6789" :
+                "TP-035: buildAddr IPv4 should produce 'ip:port' format (no brackets), got: $ipv4Addr"
+        logger.info("TP-035: buildAddr IPv6='$ipv6Addr', IPv4='$ipv4Addr'")
+    }
+
+    /**
+     * TP-036: Ceph monAddr 输出格式 [ipv6]:port。
+     * 验证 IPv6Utils.buildAddr() 对 IPv6 加括号。
+     */
+    void testTP036_cephMonAddrIpv6Format() {
+        // TP-036: Ceph mon IPv6 地址格式 [ipv6]:port
+        String monAddr = IPv6Utils.buildAddr("2001:db8:20::1", 6789)
+        assert monAddr == "[2001:db8:20::1]:6789" :
+                "TP-036: Ceph monAddr for IPv6 should be '[ipv6]:port', got: $monAddr"
+        // IPv4 不加括号
+        String monAddrV4 = IPv6Utils.buildAddr("10.0.0.1", 6789)
+        assert monAddrV4 == "10.0.0.1:6789" :
+                "TP-036: Ceph monAddr for IPv4 should be 'ip:port' (no brackets), got: $monAddrV4"
+        logger.info("TP-036: Ceph monAddr IPv6='$monAddr', IPv4='$monAddrV4'")
+    }
+
+    /**
+     * TP-038: checkMigrateNetworkCidrOfHost fallback 逻辑。
+     * IPv6 IP 在 IPv6 CIDR 内返回 true；不在范围内返回 false。
+     */
+    void testTP038_checkMigrateNetworkCidrFallback() {
+        // TP-038: IPv6 IP 在 IPv6 CIDR 内
+        assert NetworkUtils.isIpInCidr("2001:db8::100", "2001:db8::/64") :
+                "TP-038: 2001:db8::100 should be in 2001:db8::/64"
+        // fallback 场景：IP 不在指定 CIDR 内，返回 false
+        assert !NetworkUtils.isIpInCidr("2001:db8::1", "fd00::/8") :
+                "TP-038: 2001:db8::1 should not be in fd00::/8 (fallback returns false)"
+        logger.info("TP-038: checkMigrateNetworkCidrOfHost fallback logic verified")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/network/vxlan/VxlanIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/network/vxlan/VxlanIpv6Case.groovy
new file mode 100644
index 00000000000..96bdcf40648
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/network/vxlan/VxlanIpv6Case.groovy
@@ -0,0 +1,105 @@
+package org.zstack.test.integration.network.vxlan
+
+import org.zstack.network.l2.vxlan.vtep.RemoteVtepVO
+import org.zstack.network.l2.vxlan.vtep.VtepVO
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6NetworkUtils
+import org.zstack.utils.network.NetworkUtils
+
+import javax.persistence.Column
+import java.lang.reflect.Field
+
+/**
+ * TP-039~041: VXLAN IPv6 vtepIp 支持测试
+ *
+ * 全部为纯单元 / 反射测试，无需 Spring 上下文。
+ *
+ * 覆盖：
+ *   TP-039 - VxlanPoolApiInterceptor 接受 IPv6 vtepIp（isIpv6Address 返回 true）
+ *   TP-040 - VtepVO.vtepIp 和 RemoteVtepVO.vtepIp 列长度 >= 39（支持 IPv6）
+ *   TP-041 - 非法格式 "not-an-ip" 被校验逻辑拒绝
+ */
+class VxlanIpv6Case extends SubCase {
+
+    @Override
+    void setup() {
+        // 纯单元测试，无需 Spring
+    }
+
+    @Override
+    void environment() {
+        // 无环境依赖
+    }
+
+    @Override
+    void clean() {
+        // 无需清理
+    }
+
+    @Override
+    void test() {
+        testTP039_vxlanAcceptsIpv6VtepIp()     // TP-039
+        testTP040_vtepVoColumnLength()         // TP-040
+        testTP041_invalidVtepIpRejected()      // TP-041
+    }
+
+    /**
+     * TP-039: VxlanPoolApiInterceptor 校验逻辑接受 IPv6 vtepIp。
+     * 拦截器内部使用 NetworkUtils.isIpv4Address || IPv6NetworkUtils.isIpv6Address 判断合法性。
+     * 直接验证 isIpv6Address("2001:db8::1") 返回 true。
+     */
+    void testTP039_vxlanAcceptsIpv6VtepIp() {
+        // TP-039: IPv6 地址被 isIpv6Address 认可，拦截器不拒绝
+        String ipv6VtepIp = "2001:db8::1"
+        assert IPv6NetworkUtils.isIpv6Address(ipv6VtepIp) :
+                "TP-039: isIpv6Address should return true for valid IPv6 vtepIp '$ipv6VtepIp'"
+        // 合法 IPv4 同样被接受
+        assert NetworkUtils.isIpv4Address("192.168.1.100") :
+                "TP-039: isIpv4Address should return true for valid IPv4 vtepIp"
+        // 拦截器的复合校验：IPv4 或 IPv6 均合法
+        boolean ipv6Valid = NetworkUtils.isIpv4Address(ipv6VtepIp) || IPv6NetworkUtils.isIpv6Address(ipv6VtepIp)
+        assert ipv6Valid : "TP-039: VxlanPoolApiInterceptor composite check should accept IPv6 vtepIp"
+        logger.info("TP-039: IPv6 vtepIp '$ipv6VtepIp' accepted by VxlanPoolApiInterceptor validation logic")
+    }
+
+    /**
+     * TP-040: VtepVO.vtepIp 和 RemoteVtepVO.vtepIp @Column 无显式 length，
+     * 使用 JPA 默认 255（>= 39），足以存储全展开 IPv6。
+     */
+    void testTP040_vtepVoColumnLength() {
+        checkVtepIpColumnLength(VtepVO.class, "VtepVO")
+        checkVtepIpColumnLength(RemoteVtepVO.class, "RemoteVtepVO")
+    }
+
+    private void checkVtepIpColumnLength(Class<?> voClass, String className) {
+        Field field = voClass.getDeclaredField("vtepIp")
+        field.setAccessible(true)
+        Column col = field.getAnnotation(Column.class)
+        assert col != null : "TP-040: $className.vtepIp should have @Column annotation"
+
+        int length = col.length()
+        // JPA @Column 默认 length 为 255；若未显式设置则为 255
+        // 全展开 IPv6 最长 39 字符，255 >= 39 即可
+        assert length >= 39 :
+                "TP-040: $className.vtepIp @Column length $length must be >= 39 to store full IPv6 address"
+        logger.info("TP-040: $className.vtepIp @Column length=$length (>= 39, IPv6-safe)")
+    }
+
+    /**
+     * TP-041: 非法格式 "not-an-ip" 既不是 IPv4 也不是 IPv6，
+     * VxlanPoolApiInterceptor 校验逻辑（IPv4 || IPv6）应返回 false。
+     */
+    void testTP041_invalidVtepIpRejected() {
+        String invalidIp = "not-an-ip"
+        // TP-041: 非法 IP 不通过 IPv4 检查
+        assert !NetworkUtils.isIpv4Address(invalidIp) :
+                "TP-041: 'not-an-ip' should not be a valid IPv4 address"
+        // 非法 IP 不通过 IPv6 检查
+        assert !IPv6NetworkUtils.isIpv6Address(invalidIp) :
+                "TP-041: 'not-an-ip' should not be a valid IPv6 address"
+        // 拦截器复合校验：两者均 false → 应被拒绝
+        boolean valid = NetworkUtils.isIpv4Address(invalidIp) || IPv6NetworkUtils.isIpv6Address(invalidIp)
+        assert !valid : "TP-041: VxlanPoolApiInterceptor should reject invalid vtepIp 'not-an-ip'"
+        logger.info("TP-041: invalid vtepIp 'not-an-ip' correctly rejected")
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/utils/IPv6UtilsCase.groovy b/test/src/test/groovy/org/zstack/test/integration/utils/IPv6UtilsCase.groovy
new file mode 100644
index 00000000000..40ae5bfe6f9
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/utils/IPv6UtilsCase.groovy
@@ -0,0 +1,97 @@
+package org.zstack.test.integration.utils
+
+import org.zstack.testlib.SubCase
+import org.zstack.utils.network.IPv6Utils
+
+/**
+ * TP-008~014: IPv6Utils 纯单元测试
+ * 无需 Spring 上下文，直接测试静态工具方法。
+ */
+class IPv6UtilsCase extends SubCase {
+
+    @Override
+    void setup() {
+        // 纯单元测试，无需 Spring
+    }
+
+    @Override
+    void environment() {
+        // 无环境依赖
+    }
+
+    @Override
+    void clean() {
+        // 无需清理
+    }
+
+    @Override
+    void test() {
+        testTP008_buildUrlIpv4()          // TP-008
+        testTP009_buildUrlIpv6()          // TP-009
+        testTP010_bracketIpv6Idempotent() // TP-010
+        testTP011_normalizeIpv6()         // TP-011
+        testTP012_isValidMnIpLinkLocal()  // TP-012
+        testTP013_isValidMnIpInvalid()    // TP-013
+        testTP014_isValidMnIpValid()      // TP-014
+    }
+
+    /**
+     * TP-008: buildUrl IPv4 → "http://192.168.1.1:8080"（无括号）
+     */
+    void testTP008_buildUrlIpv4() {
+        String url = IPv6Utils.buildUrl("192.168.1.1", 8080)
+        assert url == "http://192.168.1.1:8080" : "TP-008: IPv4 URL should have no brackets, got: $url"
+    }
+
+    /**
+     * TP-009: buildUrl IPv6 → "http://[2001:db8::1]:8080"（含括号）
+     */
+    void testTP009_buildUrlIpv6() {
+        String url = IPv6Utils.buildUrl("2001:db8::1", 8080)
+        assert url == "http://[2001:db8::1]:8080" : "TP-009: IPv6 URL should be bracket-wrapped, got: $url"
+    }
+
+    /**
+     * TP-010: bracketIpv6 幂等——已有括号不重复加，结果仍为 "[2001:db8::1]"
+     */
+    void testTP010_bracketIpv6Idempotent() {
+        // 已有括号时，结果不变（幂等）
+        String result = IPv6Utils.bracketIpv6("[2001:db8::1]")
+        assert result == "[2001:db8::1]" : "TP-010: bracketIpv6 should be idempotent for already-bracketed address, got: $result"
+        // 额外验证：无括号输入正确加括号
+        String withBracket = IPv6Utils.bracketIpv6("2001:db8::1")
+        assert withBracket == "[2001:db8::1]" : "TP-010: bracketIpv6 should add brackets to bare IPv6, got: $withBracket"
+    }
+
+    /**
+     * TP-011: normalizeIpv6 全展开 "2001:0db8:0000:0000:0000:0000:0000:0001" → "2001:db8::1"
+     */
+    void testTP011_normalizeIpv6() {
+        String normalized = IPv6Utils.normalizeIpv6("2001:0db8:0000:0000:0000:0000:0000:0001")
+        assert normalized == "2001:db8::1" : "TP-011: full-expanded IPv6 should normalize to compressed form, got: $normalized"
+    }
+
+    /**
+     * TP-012: isValidManagementIp("fe80::1") → false（链路本地地址）
+     */
+    void testTP012_isValidMnIpLinkLocal() {
+        boolean result = IPv6Utils.isValidManagementIp("fe80::1")
+        assert !result : "TP-012: fe80::1 (link-local) should not be a valid management IP"
+    }
+
+    /**
+     * TP-013: isValidManagementIp("not-an-ip!!") → false（非法格式）
+     */
+    void testTP013_isValidMnIpInvalid() {
+        boolean result = IPv6Utils.isValidManagementIp("not-an-ip!!")
+        assert !result : "TP-013: invalid IP string should not be a valid management IP"
+    }
+
+    /**
+     * TP-014: isValidManagementIp("2001:db8::1") → true（合法全球单播 IPv6）
+     */
+    void testTP014_isValidMnIpValid() {
+        boolean result = IPv6Utils.isValidManagementIp("2001:db8::1")
+        assert result : "TP-014: 2001:db8::1 should be a valid management IP"
+    }
+}
diff --git a/utils/src/main/java/org/zstack/utils/network/IPv6Utils.java b/utils/src/main/java/org/zstack/utils/network/IPv6Utils.java
new file mode 100644
index 00000000000..2370c3cb56a
--- /dev/null
+++ b/utils/src/main/java/org/zstack/utils/network/IPv6Utils.java
@@ -0,0 +1,130 @@
+package org.zstack.utils.network;
+
+import java.net.InetAddress;
+import java.net.UnknownHostException;
+
+/**
+ * IPv6-aware URL / address utility methods.
+ * <p>
+ * Rules for embedding IP addresses in HTTP URLs (RFC 2732 / RFC 6874):
+ *   - IPv6 addresses MUST be enclosed in square brackets, e.g. http://[::1]:8080
+ *   - IPv4 addresses and hostnames are used as-is
+ */
+public class IPv6Utils {
+
+    /**
+     * 构造 HTTP URL。自动为 IPv6 地址加方括号。
+     * <pre>
+     * buildUrl("192.168.1.1", 8080)  → "http://192.168.1.1:8080"
+     * buildUrl("2001:db8::1", 8080)  → "http://[2001:db8::1]:8080"
+     * buildUrl("host.example", 8080) → "http://host.example:8080"
+     * </pre>
+     */
+    public static String buildUrl(String ip, int port) {
+        return "http://" + bracketIpv6(ip) + ":" + port;
+    }
+
+    /**
+     * 构造 HTTPS URL，带路径。
+     * <pre>
+     * buildHttpsUrl("2001:db8::1", 443, "/api") → "https://[2001:db8::1]:443/api"
+     * buildHttpsUrl("2001:db8::1", 443, "")     → "https://[2001:db8::1]:443"
+     * </pre>
+     */
+    public static String buildHttpsUrl(String ip, int port, String path) {
+        String base = "https://" + bracketIpv6(ip) + ":" + port;
+        if (path == null || path.isEmpty()) {
+            return base;
+        }
+        return base + path;
+    }
+
+    /**
+     * 为 IPv6 地址加方括号（用于嵌入 URL host 部分）。
+     * IPv4 / 域名原样返回。已有括号则不重复添加（幂等）。
+     * <pre>
+     * bracketIpv6("2001:db8::1")    → "[2001:db8::1]"
+     * bracketIpv6("192.168.1.1")   → "192.168.1.1"
+     * bracketIpv6("[2001:db8::1]") → "[2001:db8::1]"
+     * </pre>
+     */
+    public static String bracketIpv6(String ip) {
+        if (ip == null) {
+            return ip;
+        }
+        // 已经有方括号，直接返回（幂等）
+        if (ip.startsWith("[")) {
+            return ip;
+        }
+        if (IPv6NetworkUtils.isIpv6Address(ip)) {
+            return "[" + ip + "]";
+        }
+        return ip;
+    }
+
+    /**
+     * 规范化 IPv6 地址为 RFC 5952 压缩格式（via InetAddress）。
+     * IPv4 原样返回。去除 zone ID（%eth0）后再规范化。
+     * <pre>
+     * normalizeIpv6("2001:0db8:0000::0001") → "2001:db8::1"
+     * normalizeIpv6("192.168.1.1")          → "192.168.1.1"
+     * </pre>
+     *
+     * @throws IllegalArgumentException 当传入无效 IPv6 格式时
+     */
+    public static String normalizeIpv6(String ip) {
+        if (ip == null || ip.isEmpty()) {
+            throw new IllegalArgumentException("invalid IPv6 address: " + ip);
+        }
+        // IPv4 原样返回
+        if (!ip.contains(":")) {
+            return ip;
+        }
+        // 去除 zone ID（e.g. fe80::1%eth0）
+        String stripped = ip.contains("%") ? ip.split("%")[0] : ip;
+        try {
+            InetAddress addr = InetAddress.getByName(stripped);
+            return addr.getHostAddress();
+        } catch (UnknownHostException e) {
+            throw new IllegalArgumentException("invalid IPv6 address: " + ip, e);
+        }
+    }
+
+    /**
+     * 格式化 ip:port，用于 Ceph monAddr 等场景。
+     * <pre>
+     * buildAddr("192.168.1.1", 6789)  → "192.168.1.1:6789"
+     * buildAddr("2001:db8::1", 6789)  → "[2001:db8::1]:6789"
+     * </pre>
+     */
+    public static String buildAddr(String ip, int port) {
+        return bracketIpv6(ip) + ":" + port;
+    }
+
+    /**
+     * 格式化 ip:port（String port 重载），用于 Ceph monAddr 等场景。
+     */
+    public static String buildAddr(String ip, String port) {
+        return bracketIpv6(ip) + ":" + port;
+    }
+
+    /**
+     * 校验 IP 是否可用作管理 IP（IPv4 或 IPv6，拒绝链路本地和 loopback）。
+     * <pre>
+     * 合法 IPv4               → true
+     * 合法 IPv6（非 fe80::，非 ::1）→ true
+     * fe80:: / ::1 / 非法格式 / null / empty → false
+     * </pre>
+     */
+    public static boolean isValidManagementIp(String ip) {
+        if (ip == null || ip.isEmpty()) {
+            return false;
+        }
+        try {
+            InetAddress addr = InetAddress.getByName(ip);
+            return !addr.isLoopbackAddress() && !addr.isLinkLocalAddress();
+        } catch (UnknownHostException e) {
+            return false;
+        }
+    }
+}
diff --git a/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java b/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java
index 3a7859fec8d..300e03fdada 100755
--- a/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java
+++ b/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java
@@ -558,6 +558,16 @@ public static boolean isIpv4InCidr(String ipv4, String cidr) {
         return isIpv4InRange(ipv4, info.getLowAddress(), info.getHighAddress());
     }
 
+    /**
+     * 判断 IP（IPv4 或 IPv6）是否属于指定 CIDR。
+     */
+    public static boolean isIpInCidr(String ip, String cidr) {
+        if (ip == null || cidr == null) return false;
+        if (isIpv4Address(ip)) return isIpv4InCidr(ip, cidr);
+        if (IPv6NetworkUtils.isIpv6Address(ip)) return IPv6NetworkUtils.isIpv6InCidrRange(ip, cidr);
+        return false;
+    }
+
     public static List<String> filterIpv4sInCidr(List<String> ipv4s, String cidr){
         DebugUtils.Assert(isCidr(cidr), String.format("%s is not a cidr", cidr));
         SubnetUtils.SubnetInfo info = getSubnetInfo(new SubnetUtils(cidr));
diff --git a/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java b/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java
index 5e9d4b9a4dc..2818815d262 100644
--- a/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java
+++ b/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java
@@ -39,7 +39,7 @@ public static ZSha2Info getInfo(boolean checkZSha2Status) {
         ZSha2Info info = JSONObjectUtil.toObject(result.getStdout(), ZSha2Info.class);
 
         info.setMaster(ShellUtils.runAndReturn(String.format(
-                "ip addr show %s | grep -q '[^0-9]%s[^0-9]'", info.getNic(), info.getDbvip())).isReturnCode(0));
+                "ip addr show %s | grep -q \" %s/\"", info.getNic(), info.getDbvip())).isReturnCode(0));
         return info;
     }