I have taken upon myself the configuration of an ipv6 network in an enterprise lan. There is a single VLAN for all the hosts in the LAN. I am using pfsense 2.3.4 software.
I now have to figure out the address distribution in the LAN. The addresses should not allow identifying any of the hosts from the global network, so there are 2 options. NATv6 with local addresses or global addresses with address rotating, but I`ve read about NATv6 being a bad choice. I could just set up address rotating with global addresses, but that would keep me from creating IP address based firewall rules, since the addresses would change all the time.
Is there a way I could assign an IPv6 address range to each of the hosts to rotate their addresses within that range, so I could still write firewall rules for each of these ranges (instead of static addresses) and hide (to some extent) the public addresses of hosts from global viewers? And is this doable in pfsense?
I could also have just made a VLAN for each different role in the office and rotate global addresses on a per role basis and create firewall rules on a per role basis, but that is not an option.