From 926c4c14ded8ee2a0b96ffdededa693b9fd0622d Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin.ruan@zstack.io>
Date: Sun, 28 Jun 2026 11:25:02 +0800
Subject: [PATCH 1/7] <feature>[mgt-ipv6]: support IPv6 management network

Squash IPv6 management network feature changes onto latest 5.5.28.

Resolves: ZSTAC-79206

Change-Id: I4352b96cb247538cfd59ab5da4f8b1cf16ec570e
---
 .../compute/allocator/TagAllocatorFlow.java   |   3 +-
 .../compute/host/HostApiInterceptor.java      |  67 +-
 .../compute/vm/VmCreateOnHypervisorFlow.java  |   4 +-
 ...InstantiateResourceForChangeImageFlow.java |   8 +-
 .../vm/VmInstantiateResourcePostFlow.java     |   8 +-
 .../vm/VmInstantiateResourcePreFlow.java      |   8 +-
 .../compute/vm/VmReleaseResourceFlow.java     |   7 +-
 ...ManagementNetworkIpVersionManagerImpl.java | 145 +++++
 .../zstack/compute/zone/ZoneManagerImpl.java  |  45 ++
 .../zstack/compute/zone/ZoneSystemTags.java   |   5 +
 conf/db/upgrade/V5.5.28__schema.sql           |  18 +
 conf/deploydb.sh                              |  23 +-
 conf/deployuidb.sh                            |  26 +-
 conf/springConfigXml/DatabaseFacade.xml       |   2 +-
 .../springConfigXml/PrimaryStorageManager.xml |   6 +
 conf/springConfigXml/SftpBackupStorage.xml    |   9 +-
 conf/springConfigXml/ZoneManager.xml          |  16 +-
 conf/springConfigXml/ceph.xml                 |   1 +
 conf/zstack.properties                        |   3 +-
 conf/zstack.xml                               |   1 -
 .../zstack/console/ConsoleApiInterceptor.java |  17 +-
 .../zstack/console/ConsoleManagerImpl.java    | 110 +++-
 .../org/zstack/console/ConsoleProxyBase.java  |  10 +-
 .../ManagementServerConsoleProxyBackend.java  |  63 +-
 .../org/zstack/core/CoreGlobalProperty.java   |   4 +
 .../main/java/org/zstack/core/Platform.java   | 612 ++++++++++++++++--
 .../zstack/core/agent/AgentManagerImpl.java   |   8 +-
 .../zstack/core/ansible/AnsibleRunner.java    |  11 +-
 .../core/ansible/CallBackNetworkChecker.java  |  17 +-
 .../zstack/core/cloudbus/CloudBusImpl3.java   |  13 +-
 .../org/zstack/core/config/GlobalConfig.java  |   5 +
 .../core/config/GlobalConfigConstant.java     |   2 +
 .../core/config/GlobalConfigFacadeImpl.java   |   6 +-
 .../zstack/core/db/DatabaseFacadeImpl.java    |   2 +-
 .../main/java/org/zstack/core/db/GLock.java   |   7 +
 core/src/main/java/org/zstack/core/db/Q.java  |   4 +-
 .../org/zstack/core/db/SimpleQueryImpl.java   |   6 +
 .../org/zstack/core/rest/RESTFacadeImpl.java  |  46 +-
 .../core/search/SearchBackendConstant.java    |   7 +
 .../search/ZStackZSha2JGroupsBackend.java     |  12 +
 .../core/search/ZStackZSha2NodeSelector.java  |  21 +
 .../core/timeout/ApiTimeoutManagerImpl.java   |  11 +-
 .../APIUpdateConsoleProxyAgentMsg.java        |  22 +
 ...UpdateConsoleProxyAgentMsgDoc_zh_cn.groovy |  18 +
 .../console/ConsoleProxyAgentInventory.java   |  20 +
 .../header/console/ConsoleProxyAgentVO.java   |  22 +
 .../console/UpdateConsoleProxyAgentMsg.java   |  18 +
 .../org/zstack/header/host/APIAddHostMsg.java |   4 +-
 .../host/APIUpdateHostMsgDoc_zh_cn.groovy     |   2 +-
 .../org/zstack/header/rest/RESTFacade.java    |   8 +
 .../zstack/header/zone/APICreateZoneMsg.java  |   2 +
 .../ManagementNetworkIpVersionManager.java    |  56 ++
 ...etworkIpVersionResourceExtensionPoint.java |   5 +
 .../network/l3/L3NetworkApiInterceptor.java   |  29 +-
 .../zstack/appliancevm/ApplianceVmBase.java   |  14 +-
 .../appliancevm/ApplianceVmConstant.java      |   1 +
 .../appliancevm/ApplianceVmFacadeImpl.java    |  69 +-
 .../storage/ceph/CephApiInterceptor.java      | 172 ++++-
 .../java/org/zstack/storage/ceph/MonUri.java  |  11 +
 .../CephBackupStorageMetaDataMaker.java       |   9 +-
 .../ceph/backup/CephBackupStorageMonBase.java |   3 +-
 .../ceph/primary/CephPrimaryStorageBase.java  |   7 +-
 .../primary/CephPrimaryStorageMonBase.java    |   3 +-
 .../network/service/flat/FlatDhcpBackend.java |   2 +
 .../kvm/APIAddKVMHostMsgDoc_zh_cn.groovy      |   2 +-
 .../kvm/APIUpdateKVMHostMsgDoc_zh_cn.groovy   |   2 +-
 .../kvm/KVMConsoleHypervisorBackend.java      |   7 +-
 .../src/main/java/org/zstack/kvm/KVMHost.java | 108 ++--
 .../java/org/zstack/kvm/KVMHostFactory.java   |  35 +-
 .../java/org/zstack/kvm/KVMHostUtils.java     |   5 +
 .../zstack/kvm/KvmHostIpmiPowerExecutor.java  |   8 +-
 .../kvm/VmCpuVendorKvmStartVmExtension.java   |  13 +-
 .../primary/local/LocalStorageConstants.java  |   3 +-
 .../primary/nfs/NfsApiParamChecker.java       |  41 +-
 .../backup/sftp/SftpBackupStorage.java        |   3 +-
 .../sftp/SftpBackupStorageApiInterceptor.java |  81 ++-
 .../sftp/SftpBackupStorageMetaDataMaker.java  |   3 +-
 .../service/virtualrouter/VirtualRouter.java  |   6 +-
 .../VirtualRouterApiInterceptor.java          |   5 -
 .../virtualrouter/VirtualRouterManager.java   |   9 +
 .../VirtualRouterManagerImpl.java             |  79 +--
 .../VirtualRouterDeployAgentFlow.java         |   4 +-
 .../virtualrouter/vyos/VyosConnectFlow.java   |   2 +-
 .../APICreateVxlanPoolRemoteVtepMsg.java      |   2 +-
 .../APIDeleteVxlanPoolRemoteVtepMsg.java      |   2 +-
 .../VxlanNetworkPoolConstant.java             |   1 +
 .../VxlanPoolApiInterceptor.java              |  40 +-
 .../java/org/zstack/storage/zbs/MdsUri.java   |   5 +-
 .../org/zstack/storage/zbs/ZbsAgentUrl.java   |  26 +-
 .../ManagementNodeManagerImpl.java            |  19 +
 .../zstack/resourceconfig/ResourceConfig.java |   5 +
 .../ResourceConfigFacadeImpl.java             |   8 +-
 .../sdk/ConsoleProxyAgentInventory.java       |  16 +
 .../sdk/CreateVxlanPoolRemoteVtepAction.java  |   2 +-
 .../sdk/DeleteVxlanPoolRemoteVtepAction.java  |   2 +-
 .../SetIpOnHostNetworkInterfaceAction.java    |   3 +
 .../sdk/UpdateConsoleProxyAgentAction.java    |   6 +
 ...ementNetworkIpVersionStorageExtension.java |  68 ++
 .../backup/BackupStorageApiInterceptor.java   |  14 +
 .../primary/PrimaryStorageApiInterceptor.java |  50 ++
 .../PrimaryStorageFeatureAllocatorFlow.java   |   4 +-
 .../PrimaryStorageTagAllocatorFlow.java       |   7 +-
 .../host/HostApiInterceptorIpv6Case.groovy    |  33 +
 .../zstack/kvm/KVMHostFactoryIpv6Case.groovy  |  21 +
 .../appliancevm/ApplianceVmIpv6Case.groovy    |  85 +++
 .../console/ConsoleProxyCase.groovy           |  58 ++
 .../core/ManagementNetworkIpv6Case.groovy     | 597 +++++++++++++++++
 .../test/integration/core/MustFailCase.groovy |   2 +
 .../kvm/host/KvmHostIpv6Case.groovy           | 149 +++++
 .../l3network/ipv6/IPv6DhcpCase.groovy        |   4 +-
 .../l3network/ipv6/Ipv6RangeCase.groovy       |  56 +-
 .../AddRemoteVxlanVtepIpCase.groovy           | 141 ++--
 .../vxlanNetwork/AddVxlanVtepIpCase.groovy    |  77 +++
 ...tworkIpVersionStorageConstraintCase.groovy | 394 +++++++++++
 .../addon/zbs/ZbsPrimaryStorageCase.groovy    |  33 +
 .../unittest/utils/NetworkUtilsCase.groovy    |  27 +
 .../org/zstack/test/kvm/KVMHostUtilsTest.java |   7 +
 .../unitTestSuiteXml/BackupStorageManager.xml |   9 +-
 .../main/java/org/zstack/utils/TagUtils.java  | 117 +++-
 .../java/org/zstack/utils/URLBuilder.java     |   7 +-
 .../CloudOperationsErrorCode.java             |  98 +++
 .../zstack/utils/network/IPv6Constants.java   |   1 +
 .../utils/network/IPv6NetworkUtils.java       |  74 +++
 .../ManagementNetworkIpVersionUtils.java      | 105 +++
 .../zstack/utils/network/NetworkUtils.java    |  38 +-
 .../main/java/org/zstack/utils/ssh/Ssh.java   |   5 +-
 .../java/org/zstack/utils/ssh/SshShell.java   |  31 +-
 .../org/zstack/utils/zsha2/ZSha2Helper.java   |   2 +-
 128 files changed, 4295 insertions(+), 468 deletions(-)
 create mode 100644 compute/src/main/java/org/zstack/compute/zone/ManagementNetworkIpVersionManagerImpl.java
 create mode 100644 core/src/main/java/org/zstack/core/search/SearchBackendConstant.java
 create mode 100644 core/src/main/java/org/zstack/core/search/ZStackZSha2JGroupsBackend.java
 create mode 100644 core/src/main/java/org/zstack/core/search/ZStackZSha2NodeSelector.java
 create mode 100644 header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionManager.java
 create mode 100644 header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionResourceExtensionPoint.java
 create mode 100644 storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java
 create mode 100644 test/src/test/groovy/org/zstack/compute/host/HostApiInterceptorIpv6Case.groovy
 create mode 100644 test/src/test/groovy/org/zstack/kvm/KVMHostFactoryIpv6Case.groovy
 create mode 100644 test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy
 create mode 100644 test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy
 create mode 100644 test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
 create mode 100644 test/src/test/groovy/org/zstack/test/integration/storage/ManagementNetworkIpVersionStorageConstraintCase.groovy
 create mode 100644 utils/src/main/java/org/zstack/utils/network/ManagementNetworkIpVersionUtils.java

diff --git a/compute/src/main/java/org/zstack/compute/allocator/TagAllocatorFlow.java b/compute/src/main/java/org/zstack/compute/allocator/TagAllocatorFlow.java
index 0d046d2cc7e..c98bb3403bf 100755
--- a/compute/src/main/java/org/zstack/compute/allocator/TagAllocatorFlow.java
+++ b/compute/src/main/java/org/zstack/compute/allocator/TagAllocatorFlow.java
@@ -40,7 +40,7 @@ public class TagAllocatorFlow extends AbstractHostAllocatorFlow {
     private List<InstanceOfferingTagAllocatorExtensionPoint> instanceOfferingExtensions;
     private List<DiskOfferingTagAllocatorExtensionPoint> diskOfferingExtensions;
 
-    public TagAllocatorFlow() {
+    private void loadExtensions() {
         instanceOfferingExtensions = pluginRgty.getExtensionList(InstanceOfferingTagAllocatorExtensionPoint.class);
         diskOfferingExtensions = pluginRgty.getExtensionList(DiskOfferingTagAllocatorExtensionPoint.class);
     }
@@ -48,6 +48,7 @@ public TagAllocatorFlow() {
     @Override
     public void allocate() {
         throwExceptionIfIAmTheFirstFlow();
+        loadExtensions();
 
         if (!instanceOfferingExtensions.isEmpty()) {
             SimpleQuery<SystemTagVO> q  = dbf.createQuery(SystemTagVO.class);
diff --git a/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java b/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java
index 0bbbe166d1c..60e19d32371 100755
--- a/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java
+++ b/compute/src/main/java/org/zstack/compute/host/HostApiInterceptor.java
@@ -11,10 +11,14 @@
 import org.zstack.header.apimediator.ApiMessageInterceptionException;
 import org.zstack.header.apimediator.ApiMessageInterceptor;
 import org.zstack.header.apimediator.StopRoutingException;
+import org.zstack.header.cluster.ClusterVO;
+import org.zstack.header.cluster.ClusterVO_;
 import org.zstack.header.host.*;
 import org.zstack.header.message.APIMessage;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
 import org.zstack.utils.ShellResult;
 import org.zstack.utils.ShellUtils;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 
 import static org.zstack.core.Platform.argerr;
@@ -28,12 +32,19 @@
  * To change this template use File | Settings | File Templates.
  */
 public class HostApiInterceptor implements ApiMessageInterceptor {
+    private static final String INVALID_MANAGEMENT_IP_ERROR =
+            "managementIp[%s] is not a valid IPv4 address, IPv6 address, or hostname";
+    private static final String RESERVED_MANAGEMENT_IPV6_ERROR =
+            "managementIp[%s] is an IPv6 address that cannot be used as a management address";
+
     @Autowired
     private CloudBus bus;
     @Autowired
     private ErrorFacade errf;
     @Autowired
     private DatabaseFacade dbf;
+    @Autowired
+    private ManagementNetworkIpVersionManager managementNetworkIpVersionManager;
 
     private void setServiceId(APIMessage msg) {
         if (msg instanceof HostMessage) {
@@ -112,18 +123,70 @@ private void validate(APIDeleteHostMsg msg) {
 
     private void validate(APIUpdateHostMsg msg) {
         if (msg.getManagementIp() != null) {
+            msg.setManagementIp(validateManagementEndpoint(msg.getManagementIp()));
+
             SimpleQuery<HostVO> q = dbf.createQuery(HostVO.class);
             q.add(HostVO_.managementIp, Op.EQ, msg.getManagementIp());
             if (q.isExists()) {
                 throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_COMPUTE_HOST_10112, "there has been a host having managementIp[%s]", msg.getManagementIp()));
             }
+
+            String zoneUuid = Q.New(HostVO.class)
+                    .select(HostVO_.zoneUuid)
+                    .eq(HostVO_.uuid, msg.getUuid())
+                    .findValue();
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, msg.getManagementIp(),
+                    "host", msg.getUuid(), ORG_ZSTACK_COMPUTE_HOST_10130);
         }
     }
 
     private void validate(APIAddHostMsg msg) {
-        if (!NetworkUtils.isIpv4Address(msg.getManagementIp()) && !NetworkUtils.isHostname(msg.getManagementIp())) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_COMPUTE_HOST_10113, "managementIp[%s] is neither an IPv4 address nor a valid hostname", msg.getManagementIp()));
+        validateManagementEndpoint(msg);
+        String zoneUuid = Q.New(ClusterVO.class)
+                .select(ClusterVO_.zoneUuid)
+                .eq(ClusterVO_.uuid, msg.getClusterUuid())
+                .findValue();
+        managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, msg.getManagementIp(),
+                "host", msg.getName(), ORG_ZSTACK_COMPUTE_HOST_10130);
+    }
+
+    static void validateManagementEndpoint(APIAddHostMsg msg) {
+        String managementIp = msg.getManagementIp();
+        msg.setManagementIp(validateManagementEndpoint(managementIp));
+    }
+
+    static String validateManagementEndpoint(String managementIp) {
+        if (IPv6NetworkUtils.isIpv6Address(managementIp)) {
+            if (!IPv6NetworkUtils.isValidManagementIpv6Address(managementIp)) {
+                throw new ApiMessageInterceptionException(argerr(
+                        ORG_ZSTACK_COMPUTE_HOST_10129,
+                        RESERVED_MANAGEMENT_IPV6_ERROR,
+                        managementIp));
+            }
+        } else if (!isValidManagementEndpoint(managementIp)) {
+            throw new ApiMessageInterceptionException(argerr(
+                    ORG_ZSTACK_COMPUTE_HOST_10128,
+                    INVALID_MANAGEMENT_IP_ERROR,
+                    managementIp));
         }
+
+        if (IPv6NetworkUtils.isIpv6Address(managementIp)) {
+            return IPv6NetworkUtils.getIpv6AddressCanonicalString(managementIp);
+        }
+
+        return managementIp;
+    }
+
+    static String getManagementEndpointValidationErrorCode(String managementIp) {
+        if (IPv6NetworkUtils.isIpv6Address(managementIp)) {
+            return IPv6NetworkUtils.isValidManagementIpv6Address(managementIp) ? null : ORG_ZSTACK_COMPUTE_HOST_10129;
+        }
+
+        return isValidManagementEndpoint(managementIp) ? null : ORG_ZSTACK_COMPUTE_HOST_10128;
+    }
+
+    private static boolean isValidManagementEndpoint(String endpoint) {
+        return IPv6NetworkUtils.isValidManagementEndpoint(endpoint);
     }
 
     private void validate(APIChangeHostStateMsg msg){
diff --git a/compute/src/main/java/org/zstack/compute/vm/VmCreateOnHypervisorFlow.java b/compute/src/main/java/org/zstack/compute/vm/VmCreateOnHypervisorFlow.java
index 5b054dede75..6a40c15c34b 100755
--- a/compute/src/main/java/org/zstack/compute/vm/VmCreateOnHypervisorFlow.java
+++ b/compute/src/main/java/org/zstack/compute/vm/VmCreateOnHypervisorFlow.java
@@ -33,10 +33,8 @@ public class VmCreateOnHypervisorFlow implements Flow {
     @Autowired
     private EventFacade evtf;
 
-    private final List<VmBeforeCreateOnHypervisorExtensionPoint> exts = pluginRgty.getExtensionList(VmBeforeCreateOnHypervisorExtensionPoint.class);
-
     private void fireExtensions(VmInstanceSpec spec) {
-        for (VmBeforeCreateOnHypervisorExtensionPoint ext : exts) {
+        for (VmBeforeCreateOnHypervisorExtensionPoint ext : pluginRgty.getExtensionList(VmBeforeCreateOnHypervisorExtensionPoint.class)) {
             ext.beforeCreateVmOnHypervisor(spec);
         }
     }
diff --git a/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourceForChangeImageFlow.java b/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourceForChangeImageFlow.java
index bbdb2978036..dbf1b574e35 100755
--- a/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourceForChangeImageFlow.java
+++ b/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourceForChangeImageFlow.java
@@ -25,8 +25,9 @@ public class VmInstantiateResourceForChangeImageFlow implements Flow {
     @Autowired
     private PluginRegistry pluginRgty;
 
-    private final List<ChangeVmImageExtensionPoint> extensions = pluginRgty.getExtensionList(ChangeVmImageExtensionPoint.class);
-
+    private List<ChangeVmImageExtensionPoint> getExtensions() {
+        return pluginRgty.getExtensionList(ChangeVmImageExtensionPoint.class);
+    }
 
     private void runExtensions(final Iterator<ChangeVmImageExtensionPoint> it, final VmInstanceSpec spec, final FlowTrigger chain) {
         if (!it.hasNext()) {
@@ -53,6 +54,7 @@ public void fail(ErrorCode errorCode) {
     @Override
     public void run(FlowTrigger chain, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
+        List<ChangeVmImageExtensionPoint> extensions = getExtensions();
         for (ChangeVmImageExtensionPoint extp : extensions) {
             try {
                 extp.preBeforeInstantiateVmResource(spec);
@@ -89,6 +91,6 @@ public void fail(ErrorCode errorCode) {
     @Override
     public void rollback(FlowRollback chain, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
-        rollbackExtensions(extensions.iterator(), spec, chain);
+        rollbackExtensions(getExtensions().iterator(), spec, chain);
     }
 }
diff --git a/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePostFlow.java b/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePostFlow.java
index e6a7f14c34d..a5f8e46bd54 100755
--- a/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePostFlow.java
+++ b/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePostFlow.java
@@ -28,11 +28,13 @@ public class VmInstantiateResourcePostFlow implements Flow {
     @Autowired
     private PluginRegistry pluginRgty;
 
-    private final List<PostVmInstantiateResourceExtensionPoint> extensions = pluginRgty.getExtensionList(PostVmInstantiateResourceExtensionPoint.class);
-
+    private List<PostVmInstantiateResourceExtensionPoint> getExtensions() {
+        return pluginRgty.getExtensionList(PostVmInstantiateResourceExtensionPoint.class);
+    }
 
     public void run(FlowTrigger trigger, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
+        List<PostVmInstantiateResourceExtensionPoint> extensions = getExtensions();
         for (PostVmInstantiateResourceExtensionPoint ext : extensions) {
             ext.postBeforeInstantiateVmResource(spec);
         }
@@ -64,7 +66,7 @@ public void fail(ErrorCode errorCode) {
     @Override
     public void rollback(FlowRollback trigger, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
-        rollbackExtensions(extensions.iterator(), spec, trigger);
+        rollbackExtensions(getExtensions().iterator(), spec, trigger);
     }
 
     private void rollbackExtensions(final Iterator<PostVmInstantiateResourceExtensionPoint> iterator, final VmInstanceSpec spec, final FlowRollback trigger) {
diff --git a/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePreFlow.java b/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePreFlow.java
index 4c7b6eee38f..4f4f7e6ff63 100755
--- a/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePreFlow.java
+++ b/compute/src/main/java/org/zstack/compute/vm/VmInstantiateResourcePreFlow.java
@@ -29,8 +29,9 @@ public class VmInstantiateResourcePreFlow implements Flow {
     @Autowired
     private PluginRegistry pluginRgty;
 
-    private final List<PreVmInstantiateResourceExtensionPoint> extensions = pluginRgty.getExtensionList(PreVmInstantiateResourceExtensionPoint.class);
-    
+    private List<PreVmInstantiateResourceExtensionPoint> getExtensions() {
+        return pluginRgty.getExtensionList(PreVmInstantiateResourceExtensionPoint.class);
+    }
 
     private void runExtensions(final Iterator<PreVmInstantiateResourceExtensionPoint> it, final VmInstanceSpec spec, final FlowTrigger chain) {
         if (!it.hasNext()) {
@@ -61,6 +62,7 @@ public void fail(ErrorCode errorCode) {
     @Override
     public void run(FlowTrigger chain, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
+        List<PreVmInstantiateResourceExtensionPoint> extensions = getExtensions();
         for (PreVmInstantiateResourceExtensionPoint extp : extensions) {
             try {
                 extp.preBeforeInstantiateVmResource(spec);
@@ -97,6 +99,6 @@ public void fail(ErrorCode errorCode) {
     @Override
     public void rollback(FlowRollback chain, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
-        rollbackExtensions(extensions.iterator(), spec, chain);
+        rollbackExtensions(getExtensions().iterator(), spec, chain);
     }
 }
diff --git a/compute/src/main/java/org/zstack/compute/vm/VmReleaseResourceFlow.java b/compute/src/main/java/org/zstack/compute/vm/VmReleaseResourceFlow.java
index a57b93acde1..119ffdb74f5 100755
--- a/compute/src/main/java/org/zstack/compute/vm/VmReleaseResourceFlow.java
+++ b/compute/src/main/java/org/zstack/compute/vm/VmReleaseResourceFlow.java
@@ -26,9 +26,10 @@ public class VmReleaseResourceFlow implements Flow {
     
     @Autowired
     private PluginRegistry pluginRgty;
-    
-    private final List<VmReleaseResourceExtensionPoint> extensions = pluginRgty.getExtensionList(VmReleaseResourceExtensionPoint.class);
 
+    private List<VmReleaseResourceExtensionPoint> getExtensions() {
+        return pluginRgty.getExtensionList(VmReleaseResourceExtensionPoint.class);
+    }
 
     private void fireExtensions(final Iterator<VmReleaseResourceExtensionPoint> it, final VmInstanceSpec spec, final Map<String, Object> ctx, final FlowTrigger chain) {
         if (!it.hasNext()) {
@@ -53,7 +54,7 @@ public void fail(ErrorCode errorCode) {
     @Override
     public void run(FlowTrigger chain, Map data) {
         VmInstanceSpec spec = (VmInstanceSpec) data.get(VmInstanceConstant.Params.VmInstanceSpec.toString());
-        fireExtensions(extensions.iterator(), spec, data, chain);
+        fireExtensions(getExtensions().iterator(), spec, data, chain);
     }
 
     @Override
diff --git a/compute/src/main/java/org/zstack/compute/zone/ManagementNetworkIpVersionManagerImpl.java b/compute/src/main/java/org/zstack/compute/zone/ManagementNetworkIpVersionManagerImpl.java
new file mode 100644
index 00000000000..7117791bfb4
--- /dev/null
+++ b/compute/src/main/java/org/zstack/compute/zone/ManagementNetworkIpVersionManagerImpl.java
@@ -0,0 +1,145 @@
+package org.zstack.compute.zone;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.zstack.core.componentloader.PluginRegistry;
+import org.zstack.core.db.DatabaseFacade;
+import org.zstack.core.db.Q;
+import org.zstack.header.apimediator.ApiMessageInterceptionException;
+import org.zstack.header.host.HostVO;
+import org.zstack.header.host.HostVO_;
+import org.zstack.header.tag.SystemTagInventory;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
+import org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint;
+import org.zstack.header.zone.ZoneVO;
+import org.zstack.utils.network.ManagementNetworkIpVersionUtils;
+
+import java.util.List;
+import java.util.Map;
+
+import static org.zstack.core.Platform.argerr;
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_ZONE_10004;
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_ZONE_10005;
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_ZONE_10006;
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_ZONE_10007;
+
+public class ManagementNetworkIpVersionManagerImpl implements ManagementNetworkIpVersionManager {
+    private static final String DEFAULT_ZONE_IP_VERSION = ManagementNetworkIpVersionUtils.IPV4;
+    private static final String HOST_RESOURCE_TYPE = "host";
+    private static final String MISMATCH_ERROR =
+            "%s[%s] uses %s endpoint[%s], but zone[uuid:%s] management network ipVersion is %s";
+
+    @Autowired
+    private DatabaseFacade dbf;
+    @Autowired
+    private PluginRegistry pluginRgty;
+
+    @Override
+    public void validateEndpointInZone(String zoneUuid, String endpoint, String resourceType, String resourceIdentity, String errorCode) {
+        if (zoneUuid == null || endpoint == null) {
+            return;
+        }
+
+        validateEndpointMatchesIpVersion(zoneUuid, getZoneIpVersion(zoneUuid), endpoint, resourceType, resourceIdentity, errorCode);
+    }
+
+    @Override
+    public void validateEndpointMatchesIpVersion(String zoneUuid, String ipVersion, String endpoint,
+                                                 String resourceType, String resourceIdentity, String errorCode) {
+        if (zoneUuid == null || ipVersion == null || endpoint == null) {
+            return;
+        }
+
+        if (ManagementNetworkIpVersionUtils.isIpv6LinkLocalEndpoint(endpoint)) {
+            throw new ApiMessageInterceptionException(argerr(
+                    ORG_ZSTACK_COMPUTE_ZONE_10007,
+                    "%s[%s] uses IPv6 link-local endpoint[%s], which is not supported for zone[uuid:%s] management network",
+                    resourceType, resourceIdentity, endpoint, zoneUuid));
+        }
+
+        String endpointIpVersion = ManagementNetworkIpVersionUtils.getEndpointIpVersion(endpoint);
+        if (endpointIpVersion == null || endpointIpVersion.equals(ipVersion)) {
+            return;
+        }
+
+        throw new ApiMessageInterceptionException(argerr(errorCode, MISMATCH_ERROR,
+                resourceType, resourceIdentity, endpointIpVersion, endpoint, zoneUuid, ipVersion));
+    }
+
+    @Override
+    public String getZoneIpVersion(String zoneUuid) {
+        Map<String, String> tokens = ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.getTokensByResourceUuid(zoneUuid);
+        if (tokens == null) {
+            return DEFAULT_ZONE_IP_VERSION;
+        }
+
+        return ManagementNetworkIpVersionUtils.normalizeIpVersion(
+                tokens.get(ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION_TOKEN));
+    }
+
+    @Override
+    public void validateZoneCompatibleWithExistingResources(String zoneUuid, String ipVersion) {
+        validateExistingHosts(zoneUuid, ipVersion);
+        for (ManagementNetworkIpVersionResourceExtensionPoint ext :
+                pluginRgty.getExtensionList(ManagementNetworkIpVersionResourceExtensionPoint.class)) {
+            ext.validateExistingResourcesInZone(zoneUuid, ipVersion);
+        }
+    }
+
+    public void validateZoneIpVersionTag(String resourceUuid, String systemTag) {
+        validateZoneIpVersionTag(resourceUuid, systemTag, null);
+    }
+
+    public void validateZoneIpVersionTag(String resourceUuid, String systemTag, String excludedTagUuid) {
+        validateZoneIpVersionTagValue(resourceUuid, systemTag);
+        validateZoneHasNoOtherIpVersionTag(resourceUuid, excludedTagUuid);
+    }
+
+    public void validateZoneIpVersionTagValue(String resourceUuid, String systemTag) {
+        if (!ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.isMatch(systemTag)) {
+            return;
+        }
+
+        if (!dbf.isExist(resourceUuid, ZoneVO.class)) {
+            return;
+        }
+
+        String ipVersion = ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.getTokenByTag(
+                systemTag,
+                ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION_TOKEN);
+        String normalizedIpVersion = ManagementNetworkIpVersionUtils.normalizeIpVersion(ipVersion);
+        if (normalizedIpVersion == null) {
+            throw new ApiMessageInterceptionException(argerr(
+                    ORG_ZSTACK_COMPUTE_ZONE_10004,
+                    "management network ipVersion[%s] is invalid, allowed values are [%s, %s]",
+                    ipVersion,
+                    ManagementNetworkIpVersionUtils.IPV4,
+                    ManagementNetworkIpVersionUtils.IPV6));
+        }
+
+        validateZoneCompatibleWithExistingResources(resourceUuid, normalizedIpVersion);
+    }
+
+    private void validateZoneHasNoOtherIpVersionTag(String zoneUuid, String excludedTagUuid) {
+        for (SystemTagInventory tag : ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.getTagInventories(zoneUuid)) {
+            if (excludedTagUuid != null && excludedTagUuid.equals(tag.getUuid())) {
+                continue;
+            }
+
+            throw new ApiMessageInterceptionException(argerr(
+                    ORG_ZSTACK_COMPUTE_ZONE_10006,
+                    "zone[uuid:%s] already has management network ipVersion system tag[%s], update or delete it before creating another one",
+                    zoneUuid, tag.getTag()));
+        }
+    }
+
+    private void validateExistingHosts(String zoneUuid, String ipVersion) {
+        List<HostVO> hosts = Q.New(HostVO.class)
+                .eq(HostVO_.zoneUuid, zoneUuid)
+                .list();
+
+        for (HostVO host : hosts) {
+            validateEndpointMatchesIpVersion(zoneUuid, ipVersion, host.getManagementIp(),
+                    HOST_RESOURCE_TYPE, host.getUuid(), ORG_ZSTACK_COMPUTE_ZONE_10005);
+        }
+    }
+}
diff --git a/compute/src/main/java/org/zstack/compute/zone/ZoneManagerImpl.java b/compute/src/main/java/org/zstack/compute/zone/ZoneManagerImpl.java
index e450fa75f9b..1537ed30318 100755
--- a/compute/src/main/java/org/zstack/compute/zone/ZoneManagerImpl.java
+++ b/compute/src/main/java/org/zstack/compute/zone/ZoneManagerImpl.java
@@ -20,9 +20,13 @@
 import org.zstack.header.exception.CloudRuntimeException;
 import org.zstack.header.message.APIMessage;
 import org.zstack.header.message.Message;
+import org.zstack.header.tag.AbstractSystemTagOperationJudger;
+import org.zstack.header.tag.SystemTagInventory;
+import org.zstack.header.tag.SystemTagValidator;
 import org.zstack.header.zone.*;
 import org.zstack.search.SearchQuery;
 import org.zstack.tag.TagManager;
+import org.zstack.utils.network.ManagementNetworkIpVersionUtils;
 import org.zstack.utils.ObjectUtils;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
@@ -51,9 +55,13 @@ public class ZoneManagerImpl extends AbstractService implements ZoneManager {
     private TagManager tagMgr;
     @Autowired
     private ThreadFacade thdf;
+    @Autowired
+    private ManagementNetworkIpVersionManagerImpl managementNetworkIpVersionManager;
 
     private Map<String, ZoneFactory> zoneFactories = Collections.synchronizedMap(new HashMap<String, ZoneFactory>());
     private static final Set<Class> allowedMessageAfterSoftDeletion = new HashSet<Class>();
+    private static final String DEFAULT_MANAGEMENT_NETWORK_IP_VERSION_TAG =
+            String.format("managementNetwork::ipVersion::%s", ManagementNetworkIpVersionUtils.IPV4);
 
     static {
         allowedMessageAfterSoftDeletion.add(ZoneDeletionMsg.class);
@@ -156,10 +164,22 @@ protected void scripts() {
         }.execute();
 
         tagMgr.createTagsFromAPICreateMessage(msg, finalVO.getUuid(), ZoneVO.class.getSimpleName());
+        createDefaultManagementNetworkIpVersionTagIfAbsent(finalVO.getUuid());
 
         return ZoneInventory.valueOf(finalVO);
     }
 
+    private void createDefaultManagementNetworkIpVersionTagIfAbsent(String zoneUuid) {
+        if (ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.getTagInventory(zoneUuid) != null) {
+            return;
+        }
+
+        tagMgr.createNonInherentSystemTag(
+                zoneUuid,
+                DEFAULT_MANAGEMENT_NETWORK_IP_VERSION_TAG,
+                ZoneVO.class.getSimpleName());
+    }
+
     private void createZone(APICreateZoneMsg msg, ReturnValueCompletion<ZoneInventory> completion) {
         if (msg.getDefault() == null || !msg.getDefault()) {
             completion.success(createZoneFromApiMessage(msg));
@@ -225,6 +245,31 @@ private void populateExtensions() {
     @Override
     public boolean start() {
         populateExtensions();
+        ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.installValidator(new SystemTagValidator() {
+            @Override
+            public void validateSystemTag(String resourceUuid, Class resourceType, String systemTag) {
+                managementNetworkIpVersionManager.validateZoneIpVersionTagValue(resourceUuid, systemTag);
+            }
+        });
+        ZoneSystemTags.MANAGEMENT_NETWORK_IP_VERSION.installJudger(new AbstractSystemTagOperationJudger() {
+            @Override
+            public void tagPreCreated(SystemTagInventory tag) {
+                managementNetworkIpVersionManager.validateZoneIpVersionTag(
+                        tag.getResourceUuid(), tag.getTag());
+            }
+
+            @Override
+            public void tagPreUpdated(SystemTagInventory old, SystemTagInventory newTag) {
+                managementNetworkIpVersionManager.validateZoneIpVersionTag(
+                        newTag.getResourceUuid(), newTag.getTag(), old.getUuid());
+            }
+
+            @Override
+            public void tagPreDeleted(SystemTagInventory tag) {
+                managementNetworkIpVersionManager.validateZoneCompatibleWithExistingResources(
+                        tag.getResourceUuid(), ManagementNetworkIpVersionUtils.IPV4);
+            }
+        });
         return true;
     }
 
diff --git a/compute/src/main/java/org/zstack/compute/zone/ZoneSystemTags.java b/compute/src/main/java/org/zstack/compute/zone/ZoneSystemTags.java
index e2d68ff9bd8..8de485355e1 100755
--- a/compute/src/main/java/org/zstack/compute/zone/ZoneSystemTags.java
+++ b/compute/src/main/java/org/zstack/compute/zone/ZoneSystemTags.java
@@ -10,4 +10,9 @@
 public class ZoneSystemTags {
     public static PatternedSystemTag HOST_RESERVED_CPU_CAPACITY = new PatternedSystemTag("host::reservedCpu::{capacity}", ZoneVO.class);
     public static PatternedSystemTag HOST_RESERVED_MEMORY_CAPACITY = new PatternedSystemTag("host::reservedMemory::{capacity}", ZoneVO.class);
+    public static final String MANAGEMENT_NETWORK_IP_VERSION_TOKEN = "ipVersion";
+    public static PatternedSystemTag MANAGEMENT_NETWORK_IP_VERSION = new PatternedSystemTag(
+            String.format("managementNetwork::ipVersion::{%s}", MANAGEMENT_NETWORK_IP_VERSION_TOKEN),
+            ZoneVO.class
+    );
 }
diff --git a/conf/db/upgrade/V5.5.28__schema.sql b/conf/db/upgrade/V5.5.28__schema.sql
index 80ba45b1b82..43958fc4b21 100644
--- a/conf/db/upgrade/V5.5.28__schema.sql
+++ b/conf/db/upgrade/V5.5.28__schema.sql
@@ -165,3 +165,21 @@ CREATE TABLE IF NOT EXISTS `zstack`.`ResourceSourceRefVO` (
     KEY `idxResourceSourceRefVOResourceSync` (`resourceType`, `resourceUuid`, `syncType`),
     KEY `idxResourceSourceRefVOSyncType` (`syncType`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+ALTER TABLE `zstack`.`VtepVO` MODIFY COLUMN `vtepIp` varchar(128) NOT NULL;
+ALTER TABLE `zstack`.`RemoteVtepVO` MODIFY COLUMN `vtepIp` varchar(128) NOT NULL;
+
+INSERT INTO `zstack`.`SystemTagVO` (`uuid`, `resourceUuid`, `resourceType`, `inherent`, `type`, `tag`, `createDate`, `lastOpDate`)
+SELECT REPLACE(UUID(), '-', ''), z.uuid, 'ZoneVO', 0, 'System', 'managementNetwork::ipVersion::ipv4', CURRENT_TIMESTAMP(), CURRENT_TIMESTAMP()
+FROM `zstack`.`ZoneVO` z
+WHERE NOT EXISTS (
+    SELECT 1
+    FROM `zstack`.`SystemTagVO` st
+    WHERE st.resourceUuid = z.uuid
+      AND st.resourceType = 'ZoneVO'
+      AND st.type = 'System'
+      AND st.tag LIKE 'managementNetwork::ipVersion::%'
+);
+
+ALTER TABLE `zstack`.`ConsoleProxyAgentVO` ADD COLUMN `consoleProxyOverriddenIpv4` varchar(255) DEFAULT NULL;
+ALTER TABLE `zstack`.`ConsoleProxyAgentVO` ADD COLUMN `consoleProxyOverriddenIpv6` varchar(255) DEFAULT NULL;
diff --git a/conf/deploydb.sh b/conf/deploydb.sh
index 033da079954..c0d27e12d41 100755
--- a/conf/deploydb.sh
+++ b/conf/deploydb.sh
@@ -8,6 +8,16 @@ password="$2"
 host="$3"
 port="$4"
 zstack_user_password="$5"
+mysql_host="$host"
+
+case "$mysql_host" in
+  \[*\]) mysql_host="${mysql_host#\[}"; mysql_host="${mysql_host%\]}" ;;
+esac
+
+jdbc_host="$mysql_host"
+case "$jdbc_host" in
+  *:*) jdbc_host="[$jdbc_host]" ;;
+esac
 
 base=`dirname $0`
 
@@ -30,7 +40,7 @@ if command -v greatdb &> /dev/null; then
 fi
 
 mysql_run() {
-    $MYSQL --user=$user --password=$password --host=$host --port=$port "$@"
+    $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port "$@"
 }
 
 if command -v greatdb &> /dev/null; then
@@ -67,7 +77,7 @@ mkdir -p $flyway_sql
 cp $base/db/V0.6__schema.sql $flyway_sql
 cp $base/db/upgrade/* $flyway_sql
 
-url="jdbc:mysql://$host:$port/zstack"
+url="jdbc:mysql://$jdbc_host:$port/zstack"
 
 bash $flyway -user=$user -password=$password -url=$url clean
 
@@ -81,7 +91,7 @@ eval "rm -f $flyway_sql/*"
 
 cp $base/db/V0.6__schema_buildin_httpserver.sql $flyway_sql
 
-url="jdbc:mysql://$host:$port/zstack_rest"
+url="jdbc:mysql://$jdbc_host:$port/zstack_rest"
 bash $flyway -user=$user -password=$password -url=$url clean
 bash $flyway -user=$user -password=$password -url=$url migrate
 
@@ -92,7 +102,7 @@ hostname=`hostname`
 [ -z $zstack_user_password ] && zstack_user_password=''
 
 if command -v greatdb &> /dev/null; then
-  $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+  $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
     drop user if exists zstack;
     drop user if exists zstack_rest;
     create user if not exists 'zstack'@'localhost' identified by "$zstack_user_password";
@@ -110,7 +120,7 @@ EOF
 else
   db_version=`$MYSQL --version | awk '/Distrib/{print $5}' |awk -F'.' '{print $1}'`
   if [ $db_version -ge 10 ];then
-      $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+      $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
   drop user if exists zstack;
   drop user if exists zstack_rest;
   create user 'zstack' identified by "$zstack_user_password";
@@ -122,7 +132,7 @@ else
   flush privileges;
 EOF
   else
-      $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+      $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
   grant usage on *.* to 'zstack'@'localhost';
   grant usage on *.* to 'zstack'@'%';
   drop user zstack;
@@ -137,4 +147,3 @@ EOF
 EOF
   fi
 fi
-
diff --git a/conf/deployuidb.sh b/conf/deployuidb.sh
index 16a7e659576..cba144bdcad 100755
--- a/conf/deployuidb.sh
+++ b/conf/deployuidb.sh
@@ -6,6 +6,16 @@ password="$2"
 host="$3"
 port="$4"
 zstack_ui_db_password="$5"
+mysql_host="$host"
+
+case "$mysql_host" in
+  \[*\]) mysql_host="${mysql_host#\[}"; mysql_host="${mysql_host%\]}" ;;
+esac
+
+jdbc_host="$mysql_host"
+case "$jdbc_host" in
+  *:*) jdbc_host="[$jdbc_host]" ;;
+esac
 
 MYSQL='mysql'
 
@@ -27,18 +37,18 @@ flyway_sql="$base/tools/flyway-3.2.1/sql/"
 # give grant option to the new management ip after `zstack-ctl change_ip`
 if command -v greatdb &> /dev/null; then
   $MYSQL --user=$user --password=$password --port=$port << EOF
-    grant all privileges on *.* to 'root'@"$host" with grant option;
+    grant all privileges on *.* to 'root'@"$mysql_host" with grant option;
     FLUSH PRIVILEGES;
 EOF
 else
   $MYSQL --user=$user --password=$password --port=$port << EOF
-  grant all privileges on *.* to 'root'@"$host" identified by "$password" with grant option;
+  grant all privileges on *.* to 'root'@"$mysql_host" identified by "$password" with grant option;
   FLUSH PRIVILEGES;
 EOF
 fi
 
 if command -v greatdb &> /dev/null; then
-  $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+  $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
     grant usage on *.* to 'root'@'localhost';
     grant usage on *.* to 'root'@'%';
     DROP DATABASE IF EXISTS zstack_ui;
@@ -50,7 +60,7 @@ if command -v greatdb &> /dev/null; then
     flush privileges;
 EOF
 else
-  $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+  $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
   grant usage on *.* to 'root'@'localhost';
   grant usage on *.* to 'root'@'%';
   DROP DATABASE IF EXISTS zstack_ui;
@@ -67,7 +77,7 @@ mkdir -p $flyway_sql
 ui_schema_path=`echo ~zstack`"/zstack-ui/tmp/WEB-INF/classes/db/migration/"
 if [ -d $ui_schema_path ]; then
     cp $ui_schema_path/* $flyway_sql
-    url="jdbc:mysql://$host:$port/zstack_ui"
+    url="jdbc:mysql://$jdbc_host:$port/zstack_ui"
     bash $flyway -user=$user -password=$password -url=$url clean
     bash $flyway -user=$user -password=$password -url=$url migrate
     eval "rm -f $flyway_sql/*"
@@ -76,7 +86,7 @@ fi
 hostname=`hostname`
 
 if command -v greatdb &> /dev/null; then
-  $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+  $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
     drop user if exists zstack_ui;
     create user 'zstack_ui' identified by "$zstack_ui_db_password";
     create user if not exists 'zstack_ui'@'localhost' identified by "$zstack_ui_db_password";
@@ -88,7 +98,7 @@ EOF
 else
   db_version=`$MYSQL --version | awk '/Distrib/{print $5}' |awk -F'.' '{print $1}'`
   if [ $db_version -ge 10 ];then
-      $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+      $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
   drop user if exists zstack_ui;
   create user 'zstack_ui' identified by "$zstack_ui_db_password";
   grant all privileges on zstack_ui.* to zstack_ui@'localhost' identified by "$zstack_ui_db_password";
@@ -96,7 +106,7 @@ else
   flush privileges;
 EOF
   else
-      $MYSQL --user=$user --password=$password --host=$host --port=$port << EOF
+      $MYSQL --user=$user --password=$password --host=$mysql_host --port=$port << EOF
   grant usage on *.* to 'zstack_ui'@'localhost';
   grant usage on *.* to 'zstack_ui'@'%';
   drop user zstack_ui;
diff --git a/conf/springConfigXml/DatabaseFacade.xml b/conf/springConfigXml/DatabaseFacade.xml
index d7afee98688..44f93eae20b 100755
--- a/conf/springConfigXml/DatabaseFacade.xml
+++ b/conf/springConfigXml/DatabaseFacade.xml
@@ -78,7 +78,7 @@
                 <prop key="hibernate.search.default.directory_provider">infinispan</prop>
                 <prop key="hibernate.search.infinispan.configuration_resourcename">searchConfig/default-infinispan.xml</prop>
                 <prop key="hibernate.search.default.exclusive_index_use">${Exclusive.indexUse:false}</prop>
-                <prop key="hibernate.search.default.worker.backend">jgroups</prop>
+                <prop key="hibernate.search.default.worker.backend">${Search.backend:jgroups}</prop>
                 <prop key="hibernate.search.services.jgroups.configurationFile">searchConfig/jgroup-backend-tcp.xml</prop>
                 <!--<prop key="hibernate.search.default.indexBase">${Search.indexBaseDir:/var/lib/zstack/search/indexes}</prop>-->
                 <!--disable automatic index update
diff --git a/conf/springConfigXml/PrimaryStorageManager.xml b/conf/springConfigXml/PrimaryStorageManager.xml
index b458d4dd29a..c536d1900cc 100755
--- a/conf/springConfigXml/PrimaryStorageManager.xml
+++ b/conf/springConfigXml/PrimaryStorageManager.xml
@@ -34,6 +34,12 @@
         </zstack:plugin>
     </bean>
 
+    <bean id="ManagementNetworkIpVersionStorageExtension" class="org.zstack.storage.ManagementNetworkIpVersionStorageExtension">
+        <zstack:plugin>
+            <zstack:extension interface="org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint"/>
+        </zstack:plugin>
+    </bean>
+
     <bean id="DefaultPrimaryStorageAllocatorFactory"
           class="org.zstack.storage.primary.DefaultPrimaryStorageAllocatorFactory">
         <property name="allocatorFlowNames">
diff --git a/conf/springConfigXml/SftpBackupStorage.xml b/conf/springConfigXml/SftpBackupStorage.xml
index 205be4c9a4c..b9a3fcaaa27 100755
--- a/conf/springConfigXml/SftpBackupStorage.xml
+++ b/conf/springConfigXml/SftpBackupStorage.xml
@@ -21,10 +21,11 @@
 
 	<bean id="SftpBackupStorageApiInterceptor" class="org.zstack.storage.backup.sftp.SftpBackupStorageApiInterceptor">
 		<zstack:plugin>
-            <zstack:extension interface="org.zstack.header.apimediator.ApiMessageInterceptor" />
-			<zstack:extension interface="org.zstack.header.apimediator.GlobalApiMessageInterceptor" />
-		</zstack:plugin>
-	</bean>
+			<zstack:extension interface="org.zstack.header.apimediator.ApiMessageInterceptor" />
+			<zstack:extension interface="org.zstack.header.apimediator.GlobalApiMessageInterceptor" />
+			<zstack:extension interface="org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint" />
+		</zstack:plugin>
+	</bean>
 
 	<bean id="SftpBackupStorageFactory"
 		class="org.zstack.storage.backup.sftp.SftpBackupStorageFactory">
diff --git a/conf/springConfigXml/ZoneManager.xml b/conf/springConfigXml/ZoneManager.xml
index c0bac092915..8aceb1a8bcb 100755
--- a/conf/springConfigXml/ZoneManager.xml
+++ b/conf/springConfigXml/ZoneManager.xml
@@ -6,9 +6,9 @@
          http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
          http://www.springframework.org/schema/aop
          http://www.springframework.org/schema/aop/spring-aop-3.0.xsd
-         http://www.springframework.org/schema/tx 
-     	 http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
-     	 http://zstack.org/schema/zstack 
+		http://www.springframework.org/schema/tx
+		http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
+		http://zstack.org/schema/zstack
          http://zstack.org/schema/zstack/plugin.xsd"
 	default-init-method="init" default-destroy-method="destroy">
 
@@ -18,10 +18,12 @@
             <zstack:extension interface="org.zstack.header.Service" />
 		</zstack:plugin>
 	</bean>
-
-	<bean id="ZoneApiInterceptor" class="org.zstack.compute.zone.ZoneApiInterceptor">
-		<zstack:plugin>
-			<zstack:extension interface="org.zstack.header.apimediator.ApiMessageInterceptor" />
+
+	<bean id="ManagementNetworkIpVersionManager" class="org.zstack.compute.zone.ManagementNetworkIpVersionManagerImpl" />
+
+	<bean id="ZoneApiInterceptor" class="org.zstack.compute.zone.ZoneApiInterceptor">
+		<zstack:plugin>
+			<zstack:extension interface="org.zstack.header.apimediator.ApiMessageInterceptor" />
 		</zstack:plugin>
 	</bean>
 
diff --git a/conf/springConfigXml/ceph.xml b/conf/springConfigXml/ceph.xml
index 9b3f658033f..d4b4cc579c7 100755
--- a/conf/springConfigXml/ceph.xml
+++ b/conf/springConfigXml/ceph.xml
@@ -57,6 +57,7 @@
         <zstack:plugin>
             <zstack:extension interface="org.zstack.header.apimediator.ApiMessageInterceptor" />
             <zstack:extension interface="org.zstack.header.apimediator.GlobalApiMessageInterceptor" />
+            <zstack:extension interface="org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint" />
         </zstack:plugin>
     </bean>
 
diff --git a/conf/zstack.properties b/conf/zstack.properties
index 880df37e6dc..df730a7b917 100755
--- a/conf/zstack.properties
+++ b/conf/zstack.properties
@@ -26,6 +26,8 @@ DbFacadeDataSource.testConnectionOnCheckout = true
 
 consoleProxyCertFile =
 consoleProxyOverriddenIp =
+consoleProxyOverriddenIpv4 =
+consoleProxyOverriddenIpv6 =
 consoleProxyPort=4900
 httpConsoleProxyPort=4901
 
@@ -65,4 +67,3 @@ InfluxDB.metadata.version=v2
 # user defined KVM Host iptables rule
 #KvmHost.iptables.rule.0 = -A INPUT -s 172.20.0.100/32 -d 10.0.0.1/32 -p tcp -m tcp --sport 4000 --dport 500 -j ACCEPT
 #KvmHost.iptables.rule.1 = -A INPUT -j REJECT --reject-with icmp-admin-prohibited
-
diff --git a/conf/zstack.xml b/conf/zstack.xml
index c0a5da2a80f..17bbdfae090 100755
--- a/conf/zstack.xml
+++ b/conf/zstack.xml
@@ -120,6 +120,5 @@
     <import resource="springConfigXml/HostNetworkManager.xml"/>
     <import resource="springConfigXml/upgrade.xml"/>
     <import resource="springConfigXml/plugin.xml"/>
-    <import resource="springConfigXml/HygonDeviceManager.xml"/>
     <import resource="springConfigXml/telemetry.xml"/>
 </beans>
diff --git a/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java b/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java
index 87677b52700..2976a94e5ca 100755
--- a/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java
+++ b/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java
@@ -14,6 +14,7 @@
 import org.zstack.header.vm.VmInstanceState;
 import org.zstack.header.vm.VmInstanceVO;
 import org.zstack.header.vm.VmInstanceVO_;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.util.Arrays;
 import java.util.List;
@@ -66,8 +67,22 @@ private void validate(APIRequestConsoleAccessMsg msg) {
 
     private void validate(APIUpdateConsoleProxyAgentMsg msg) {
         // consoleProxyOverriddenIp default value is 0.0.0.0
-        if (msg.getConsoleProxyOverriddenIp().trim().equals("")) {
+        msg.setConsoleProxyOverriddenIp(normalizeOptionalConsoleProxyHost(msg.getConsoleProxyOverriddenIp()));
+        if (msg.getConsoleProxyOverriddenIp() == null) {
             msg.setConsoleProxyOverriddenIp("0.0.0.0");
         }
+        if (msg.getConsoleProxyOverriddenIp().equals("")) {
+            msg.setConsoleProxyOverriddenIp("0.0.0.0");
+        }
+        msg.setConsoleProxyOverriddenIpv4(normalizeOptionalConsoleProxyHost(msg.getConsoleProxyOverriddenIpv4()));
+        msg.setConsoleProxyOverriddenIpv6(normalizeOptionalConsoleProxyHost(msg.getConsoleProxyOverriddenIpv6()));
+    }
+
+    private String normalizeOptionalConsoleProxyHost(String host) {
+        if (host == null) {
+            return null;
+        }
+
+        return IPv6NetworkUtils.stripHostUrlBrackets(host.trim());
     }
 }
diff --git a/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java b/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java
index 67057da171d..d7ed4344d67 100755
--- a/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java
+++ b/console/src/main/java/org/zstack/console/ConsoleManagerImpl.java
@@ -31,11 +31,17 @@
 import org.zstack.header.vm.*;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6Constants;
+import org.zstack.utils.network.IPv6NetworkUtils;
+import org.zstack.utils.network.NetworkUtils;
 
 import javax.persistence.Query;
 import java.util.HashMap;
 import java.util.Map;
 
+import static org.zstack.core.Platform.operr;
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_CONSOLE_10014;
+
 /**
  * Created with IntelliJ IDEA.
  * User: frank
@@ -44,6 +50,9 @@
  */
 public class ConsoleManagerImpl extends AbstractService implements ConsoleManager, VmInstanceMigrateExtensionPoint, ManagementNodeChangeListener,
         VmReleaseResourceExtensionPoint, SessionLogoutExtensionPoint, PostVmInstantiateResourceExtensionPoint, KvmReportVmShutdownFromGuestEventExtensionPoint {
+    static final String ANY_IPV4_ADDRESS = "0.0.0.0";
+    static final String ANY_IPV6_ADDRESS = IPv6Constants.IPV6_ANY_ADDRESS;
+    static final String UNIT_TEST_CONSOLE_PROXY_HOST = "127.0.0.1";
     private static CLogger logger = Utils.getLogger(ConsoleManagerImpl.class);
 
     @Autowired
@@ -102,11 +111,28 @@ public String getSyncSignature() {
             public void run(final SyncTaskChain chain) {
                 VmInstanceVO vmvo = dbf.findByUuid(msg.getVmInstanceUuid(), VmInstanceVO.class);
                 ConsoleBackend bkd = getBackend();
+                final String consoleProxyHostname = selectConsoleProxyHostname(
+                        msg.getClientIp(),
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP,
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4,
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6,
+                        CoreGlobalProperty.UNIT_TEST_ON,
+                        Platform.getManagementServerIp(),
+                        Platform.getManagementServerIp4(),
+                        Platform.getManagementServerIp6());
+                if (ConsoleConstants.MANAGEMENT_SERVER_CONSOLE_PROXY_BACKEND.equals(bkd.getConsoleBackendType()) && consoleProxyHostname == null) {
+                    evt.setError(operr(ORG_ZSTACK_CONSOLE_10014, "cannot select a console proxy address for client IP[%s]. Configure a console proxy address that supports the client IP version, or access from a supported IP version", msg.getClientIp()));
+                    evt.setSuccess(false);
+                    bus.publish(evt);
+                    chain.next();
+                    return;
+                }
+
                 bkd.grantConsoleAccess(msg.getSession(), VmInstanceInventory.valueOf(vmvo), new ReturnValueCompletion<ConsoleInventory>(chain) {
                     @Override
                     public void success(ConsoleInventory returnValue) {
-                        if (ConsoleConstants.HTTP_SCHEMA.equals(returnValue.getScheme())) {
-                            overriddenConsoleProxyIP(returnValue);
+                        if (ConsoleConstants.HTTP_SCHEMA.equals(returnValue.getScheme()) && consoleProxyHostname != null) {
+                            returnValue.setHostname(consoleProxyHostname);
                         }
 
                         evt.setInventory(returnValue);
@@ -124,15 +150,6 @@ public void fail(ErrorCode errorCode) {
                 });
             }
 
-            private void overriddenConsoleProxyIP(ConsoleInventory consoleInventory) {
-                if (!"0.0.0.0".equals(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP) &&
-                        !"".equals(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP)) {
-                    consoleInventory.setHostname(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP);
-                } else {
-                    consoleInventory.setHostname(CoreGlobalProperty.UNIT_TEST_ON ? "127.0.0.1" : Platform.getManagementServerIp());
-                }
-            }
-
             @Override
             public String getName() {
                 return getSyncSignature();
@@ -140,6 +157,77 @@ public String getName() {
         });
     }
 
+    static String selectConsoleProxyHostname(String overriddenIp, boolean unitTestOn, String managementServerIp) {
+        String hostname = normalizeConsoleProxyHost(overriddenIp);
+        if (hostname == null) {
+            hostname = unitTestOn ? UNIT_TEST_CONSOLE_PROXY_HOST : managementServerIp;
+        }
+        return IPv6NetworkUtils.formatHostForUrl(hostname);
+    }
+
+    static String selectConsoleProxyHostname(String clientIp, String overriddenIp, String overriddenIpv4, String overriddenIpv6,
+                                            boolean unitTestOn, String managementServerIp, String managementServerIp4,
+                                            String managementServerIp6) {
+        int clientIpVersion = getIpVersion(clientIp);
+        if (clientIpVersion == IPv6Constants.NONE) {
+            clientIpVersion = getIpVersion(managementServerIp);
+            if (clientIpVersion == IPv6Constants.NONE) {
+                return selectConsoleProxyHostname(overriddenIp, unitTestOn, managementServerIp);
+            }
+        }
+
+        String fallbackHostname = unitTestOn ? UNIT_TEST_CONSOLE_PROXY_HOST : managementServerIp;
+        String[] candidateHosts = clientIpVersion == IPv6Constants.IPv4 ?
+                new String[]{overriddenIpv4, overriddenIp, managementServerIp4, fallbackHostname} :
+                new String[]{overriddenIpv6, overriddenIp, managementServerIp6, fallbackHostname};
+
+        // Prefer family-specific override, then legacy override, then MN IP.
+        for (String host : candidateHosts) {
+            String normalizedHost = normalizeConsoleProxyHost(host);
+            if (normalizedHost == null) {
+                continue;
+            }
+
+            int hostIpVersion = getIpVersion(normalizedHost);
+            if (hostIpVersion == IPv6Constants.NONE || hostIpVersion == clientIpVersion) {
+                return IPv6NetworkUtils.formatHostForUrl(normalizedHost);
+            }
+        }
+
+        return null;
+    }
+
+    private static String normalizeConsoleProxyHost(String host) {
+        if (host == null) {
+            return null;
+        }
+
+        String normalizedHost = IPv6NetworkUtils.stripHostUrlBrackets(host.trim());
+        // Empty and any-address values mean the console proxy address is unset.
+        if (normalizedHost.isEmpty() || ANY_IPV4_ADDRESS.equals(normalizedHost) || ANY_IPV6_ADDRESS.equals(normalizedHost)) {
+            return null;
+        }
+
+        return normalizedHost;
+    }
+
+    private static int getIpVersion(String ip) {
+        if (ip == null) {
+            return IPv6Constants.NONE;
+        }
+
+        String normalizedIp = IPv6NetworkUtils.stripHostUrlBrackets(ip.trim());
+        if (NetworkUtils.isIpv4Address(normalizedIp)) {
+            return IPv6Constants.IPv4;
+        }
+
+        if (IPv6NetworkUtils.isIpv6Address(normalizedIp)) {
+            return IPv6Constants.IPv6;
+        }
+
+        return IPv6Constants.NONE;
+    }
+
     @Override
     public String getId() {
         return bus.makeLocalServiceId(ConsoleConstants.SERVICE_ID);
diff --git a/console/src/main/java/org/zstack/console/ConsoleProxyBase.java b/console/src/main/java/org/zstack/console/ConsoleProxyBase.java
index c61a211655e..2c7c69376ba 100755
--- a/console/src/main/java/org/zstack/console/ConsoleProxyBase.java
+++ b/console/src/main/java/org/zstack/console/ConsoleProxyBase.java
@@ -19,6 +19,8 @@
 import org.zstack.utils.URLBuilder;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6Constants;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.net.URI;
 import java.sql.Timestamp;
@@ -35,6 +37,8 @@
 @Configurable(preConstruction = true, autowire = Autowire.BY_TYPE)
 public class ConsoleProxyBase implements ConsoleProxy {
     private static final CLogger logger = Utils.getLogger(ConsoleProxyBase.class);
+    static final String ANY_IPV4_ADDRESS = "0.0.0.0";
+    static final String ANY_IPV6_ADDRESS = IPv6Constants.IPV6_ANY_ADDRESS;
     private ConsoleProxyInventory self;
 
     @Autowired
@@ -79,7 +83,7 @@ private void doEstablishConsoleProxyConnection(ConsoleUrl consoleUrl, final Retu
         cmd.setTargetSchema(targetSchema);
         cmd.setTargetHostname(targetHostname);
         cmd.setTargetPort(targetPort);
-        cmd.setProxyHostname("0.0.0.0");
+        cmd.setProxyHostname(selectProxyListenHostname(self.getProxyHostname()));
         if (ConsoleConstants.HTTP_SCHEMA.equals(targetSchema)) {
             cmd.setProxyPort(CoreGlobalProperty.HTTP_CONSOLE_PROXY_PORT);
         } else {
@@ -125,6 +129,10 @@ public Class<ConsoleProxyCommands.EstablishProxyRsp> getReturnClass() {
         });
     }
 
+    public static String selectProxyListenHostname(String proxyHostname) {
+        return IPv6NetworkUtils.isIpv6Address(proxyHostname) ? ANY_IPV6_ADDRESS : ANY_IPV4_ADDRESS;
+    }
+
     void doEstablishDirectConsoleConnection(ConsoleUrl consoleUrl, final ReturnValueCompletion<ConsoleProxyInventory> completion) {
         URI uri = consoleUrl.getUri();
 
diff --git a/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java b/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
index b909b98be60..07070b7756c 100755
--- a/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
+++ b/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
@@ -37,6 +37,8 @@
 import org.zstack.header.vm.VmInstanceInventory;
 import org.zstack.utils.*;
 import org.zstack.utils.function.Function;
+import org.zstack.utils.ctl.ConfigureCommand;
+import org.zstack.utils.ctl.ZStackCtlResult;
 import org.zstack.utils.logging.CLogger;
 import org.zstack.utils.path.PathUtil;
 
@@ -70,25 +72,32 @@ public class ManagementServerConsoleProxyBackend extends AbstractConsoleProxyBac
     private ConsoleProxyAgentTracker tracker;
 
     protected int setConsoleProxyOverridenIp(String newIp) {
-        if (CoreGlobalProperty.UNIT_TEST_ON) {
-            return 0;
-        }
+        return configureZStackProperty("consoleProxyOverriddenIp", formatConsoleProxyConfigureValue(newIp));
+    }
+
+    protected int setConsoleProxyOverridenIpv4(String newIp) {
+        return configureZStackProperty("consoleProxyOverriddenIpv4", formatConsoleProxyConfigureValue(newIp));
+    }
+
+    protected int setConsoleProxyOverridenIpv6(String newIp) {
+        return configureZStackProperty("consoleProxyOverriddenIpv6", formatConsoleProxyConfigureValue(newIp));
+    }
 
-        ShellResult rst = ShellUtils.runAndReturn(
-                "/usr/bin/zstack-ctl configure consoleProxyOverriddenIp=" + newIp
-        );
-        return rst.getRetCode();
+    private String formatConsoleProxyConfigureValue(String value) {
+        return value == null ? "" : value;
     }
 
     protected int setConsoleProxyPort(int Port) {
+        return configureZStackProperty("consoleProxyPort", Integer.toString(Port));
+    }
+
+    private int configureZStackProperty(String key, String value) {
         if (CoreGlobalProperty.UNIT_TEST_ON) {
             return 0;
         }
 
-        ShellResult rst = ShellUtils.runAndReturn(
-                "/usr/bin/zstack-ctl configure consoleProxyPort=" + Port
-        );
-        return rst.getRetCode();
+        ZStackCtlResult rst = new ConfigureCommand().Configure(String.format("%s=%s", key, value)).exec();
+        return rst.isSuccess() ? 0 : 1;
     }
 
     protected ConsoleProxy getConsoleProxy(VmInstanceInventory vm, ConsoleProxyVO vo) {
@@ -142,6 +151,8 @@ public void run(final SyncTaskChain chain) {
                     vo.setManagementIp(Platform.getManagementServerIp());
                     vo.setUuid(Platform.getManagementServerId());
                     vo.setConsoleProxyOverriddenIp(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP);
+                    vo.setConsoleProxyOverriddenIpv4(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4);
+                    vo.setConsoleProxyOverriddenIpv6(CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6);
                     vo.setConsoleProxyPort(CoreGlobalProperty.CONSOLE_PROXY_PORT);
                     vo.setState(ConsoleProxyAgentState.Enabled);
                     vo.setStatus(ConsoleProxyAgentStatus.Connecting);
@@ -457,6 +468,8 @@ private void handle(APIUpdateConsoleProxyAgentMsg msg) {
         UpdateConsoleProxyAgentMsg umsg = new UpdateConsoleProxyAgentMsg();
         umsg.setUuid(msg.getUuid());
         umsg.setConsoleProxyOverriddenIp(msg.getConsoleProxyOverriddenIp());
+        umsg.setConsoleProxyOverriddenIpv4(msg.getConsoleProxyOverriddenIpv4());
+        umsg.setConsoleProxyOverriddenIpv6(msg.getConsoleProxyOverriddenIpv6());
         umsg.setConsoleProxyPort(msg.getConsoleProxyPort());
         bus.makeServiceIdByManagementNodeId(umsg, ConsoleConstants.SERVICE_ID, msg.getUuid());
         bus.send(umsg, new CloudBusCallBack(msg) {
@@ -480,6 +493,10 @@ private void handle(UpdateConsoleProxyAgentMsg msg) {
         chain.then(new ShareFlow() {
             ConsoleProxyAgentVO vo;
             String oldProxyIp;
+            String oldProxyIpv4;
+            String oldProxyIpv6;
+            String newProxyIpv4;
+            String newProxyIpv6;
             int oldProxyPort;
             int newProxyPort = msg.getConsoleProxyPort() == null ? CoreGlobalProperty.CONSOLE_PROXY_PORT : msg.getConsoleProxyPort();
 
@@ -521,8 +538,14 @@ public void run(FlowTrigger trigger, Map data) {
                     public void run(FlowTrigger trigger, Map data) {
                         vo = dbf.findByUuid(msg.getUuid(), ConsoleProxyAgentVO.class);
                         oldProxyIp = vo.getConsoleProxyOverriddenIp();
+                        oldProxyIpv4 = vo.getConsoleProxyOverriddenIpv4();
+                        oldProxyIpv6 = vo.getConsoleProxyOverriddenIpv6();
                         oldProxyPort = vo.getConsoleProxyPort();
+                        newProxyIpv4 = msg.getConsoleProxyOverriddenIpv4() == null ? oldProxyIpv4 : msg.getConsoleProxyOverriddenIpv4();
+                        newProxyIpv6 = msg.getConsoleProxyOverriddenIpv6() == null ? oldProxyIpv6 : msg.getConsoleProxyOverriddenIpv6();
                         vo.setConsoleProxyOverriddenIp(msg.getConsoleProxyOverriddenIp());
+                        vo.setConsoleProxyOverriddenIpv4(newProxyIpv4);
+                        vo.setConsoleProxyOverriddenIpv6(newProxyIpv6);
                         vo.setConsoleProxyPort(newProxyPort);
                         dbf.update(vo);
                         trigger.next();
@@ -532,6 +555,8 @@ public void run(FlowTrigger trigger, Map data) {
                     public void rollback(FlowRollback trigger, Map data) {
                         vo = dbf.reload(vo);
                         vo.setConsoleProxyOverriddenIp(oldProxyIp);
+                        vo.setConsoleProxyOverriddenIpv4(oldProxyIpv4);
+                        vo.setConsoleProxyOverriddenIpv6(oldProxyIpv6);
                         vo.setConsoleProxyPort(oldProxyPort);
                         dbf.update(vo);
                         trigger.rollback();
@@ -543,8 +568,12 @@ public void rollback(FlowRollback trigger, Map data) {
                     @Override
                     public void run(FlowTrigger trigger, Map data) {
                         Platform.getGlobalProperties().put("consoleProxyOverriddenIp", msg.getConsoleProxyOverriddenIp());
+                        Platform.getGlobalProperties().put("consoleProxyOverriddenIpv4", formatConsoleProxyConfigureValue(newProxyIpv4));
+                        Platform.getGlobalProperties().put("consoleProxyOverriddenIpv6", formatConsoleProxyConfigureValue(newProxyIpv6));
                         Platform.getGlobalProperties().put("consoleProxyPort", Integer.toString(newProxyPort));
                         CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP = msg.getConsoleProxyOverriddenIp();
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4 = newProxyIpv4;
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6 = newProxyIpv6;
                         CoreGlobalProperty.CONSOLE_PROXY_PORT = newProxyPort;
                         trigger.next();
                     }
@@ -552,8 +581,12 @@ public void run(FlowTrigger trigger, Map data) {
                     @Override
                     public void rollback(FlowRollback trigger, Map data) {
                         Platform.getGlobalProperties().put("consoleProxyOverriddenIp", oldProxyIp);
+                        Platform.getGlobalProperties().put("consoleProxyOverriddenIpv4", formatConsoleProxyConfigureValue(oldProxyIpv4));
+                        Platform.getGlobalProperties().put("consoleProxyOverriddenIpv6", formatConsoleProxyConfigureValue(oldProxyIpv6));
                         Platform.getGlobalProperties().put("consoleProxyPort", Integer.toString(oldProxyPort));
                         CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP = oldProxyIp;
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4 = oldProxyIpv4;
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6 = oldProxyIpv6;
                         CoreGlobalProperty.CONSOLE_PROXY_PORT = oldProxyPort;
                         trigger.rollback();
                     }
@@ -564,17 +597,21 @@ public void rollback(FlowRollback trigger, Map data) {
                     @Override
                     public void run(FlowTrigger trigger, Map data) {
                         int rst = setConsoleProxyOverridenIp(msg.getConsoleProxyOverriddenIp());
+                        int ipv4Rst = setConsoleProxyOverridenIpv4(newProxyIpv4);
+                        int ipv6Rst = setConsoleProxyOverridenIpv6(newProxyIpv6);
                         int portRst = setConsoleProxyPort(newProxyPort);
-                        if (rst == 0) {
+                        if (rst == 0 && ipv4Rst == 0 && ipv6Rst == 0 && portRst == 0) {
                             trigger.next();
                         } else {
-                            trigger.fail(operr(ORG_ZSTACK_CONSOLE_10003, "failed to configure consoleProxyOverriddenIp[code:%d] or consoleProxyPort[code:%d]"));
+                            trigger.fail(operr(ORG_ZSTACK_CONSOLE_10003, "failed to configure consoleProxyOverriddenIp[code:%d], consoleProxyOverriddenIpv4[code:%d], consoleProxyOverriddenIpv6[code:%d], or consoleProxyPort[code:%d]", rst, ipv4Rst, ipv6Rst, portRst));
                         }
                     }
 
                     @Override
                     public void rollback(FlowRollback trigger, Map data) {
                         setConsoleProxyOverridenIp(oldProxyIp);
+                        setConsoleProxyOverridenIpv4(oldProxyIpv4);
+                        setConsoleProxyOverridenIpv6(oldProxyIpv6);
                         setConsoleProxyPort(oldProxyPort);
                         trigger.rollback();
                     }
diff --git a/core/src/main/java/org/zstack/core/CoreGlobalProperty.java b/core/src/main/java/org/zstack/core/CoreGlobalProperty.java
index 828b06b0bf2..43aa49cf918 100755
--- a/core/src/main/java/org/zstack/core/CoreGlobalProperty.java
+++ b/core/src/main/java/org/zstack/core/CoreGlobalProperty.java
@@ -32,6 +32,10 @@ public class CoreGlobalProperty {
     public static String PID_FILE_PATH;
     @GlobalProperty(name = "consoleProxyOverriddenIp", defaultValue = "0.0.0.0")
     public static String CONSOLE_PROXY_OVERRIDDEN_IP;
+    @GlobalProperty(name = "consoleProxyOverriddenIpv4", defaultValue = "")
+    public static String CONSOLE_PROXY_OVERRIDDEN_IPV4;
+    @GlobalProperty(name = "consoleProxyOverriddenIpv6", defaultValue = "")
+    public static String CONSOLE_PROXY_OVERRIDDEN_IPV6;
     @GlobalProperty(name = "exposeSimulatorType", defaultValue = "false")
     public static boolean EXPOSE_SIMULATOR_TYPE;
     @GlobalProperty(name = "exitJVMOnStop", defaultValue = "true")
diff --git a/core/src/main/java/org/zstack/core/Platform.java b/core/src/main/java/org/zstack/core/Platform.java
index 78b184d12e7..8b23739a901 100755
--- a/core/src/main/java/org/zstack/core/Platform.java
+++ b/core/src/main/java/org/zstack/core/Platform.java
@@ -1,6 +1,8 @@
 package org.zstack.core;
 
+import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang.LocaleUtils;
 import org.apache.commons.lang.RandomStringUtils;
 import org.apache.commons.lang.StringUtils;
@@ -20,6 +22,7 @@
 import org.zstack.core.errorcode.GlobalErrorCodeI18nService;
 import org.zstack.core.propertyvalidator.ValidatorTool;
 import org.zstack.core.search.SearchGlobalProperty;
+import org.zstack.core.search.SearchBackendConstant;
 import org.zstack.core.statemachine.StateMachine;
 import org.zstack.core.statemachine.StateMachineImpl;
 import org.zstack.core.thread.ThreadFacade;
@@ -36,6 +39,7 @@
 import org.zstack.utils.data.StringTemplate;
 import org.zstack.utils.logging.CLogger;
 import org.zstack.utils.logging.CLoggerImpl;
+import org.zstack.utils.network.IPv6Constants;
 import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 import org.zstack.utils.path.PathUtil;
@@ -46,6 +50,7 @@
 
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.FileOutputStream;
 import java.io.IOException;
 import java.lang.management.ManagementFactory;
 import java.lang.management.RuntimeMXBean;
@@ -58,6 +63,8 @@
 import java.net.NetworkInterface;
 import java.net.SocketException;
 import java.net.UnknownHostException;
+import java.nio.file.Files;
+import java.nio.file.StandardCopyOption;
 import java.sql.Timestamp;
 import java.util.*;
 import java.util.concurrent.TimeUnit;
@@ -78,9 +85,54 @@ public class Platform {
     private static String managementServerCidr;
     private static MessageSource messageSource;
     private static String encryptionKey = EncryptRSA.generateKeyString("ZStack open source");
+    private static final String MANAGEMENT_SERVER_IP_PROPERTY = "management.server.ip";
+    private static final String MANAGEMENT_SERVER_IP4_PROPERTY = "management.server.ip4";
+    private static final String MANAGEMENT_SERVER_IP6_PROPERTY = "management.server.ip6";
+    private static final String ZSTACK_MANAGEMENT_SERVER_IP_ENV = "ZSTACK_MANAGEMENT_SERVER_IP";
+    private static final String IPV4_ADDRESS_COMMAND = "ip -4 add";
+    private static final String IPV6_ADDRESS_COMMAND = "ip -6 addr";
+    private static final String DEFAULT_ROUTE_COMMAND = "/sbin/ip route";
+    private static final String DEFAULT_ROUTE_MARK = "default via";
+    private static final String JGROUPS_INITIAL_HOST_FORMAT = "%s[%s],%s[%s]";
+    private static final int IP_ADDRESS_COMMAND_CIDR_INDEX = 1;
+    private static final int IP_ADDRESS_COMMAND_MIN_TOKEN_COUNT = 2;
+    private static final String CIDR_SEPARATOR = "/";
+    private static final String TEMP_FILE_SUFFIX = ".tmp";
+    private static final String DATA_DIR_PROPERTY = "dataDir";
+    private static final String DEFAULT_DATA_DIR = "/var/lib/zstack/";
+    private static final String UNIT_TEST_ON_PROPERTY = "unitTestOn";
+    private static final String JAVA_TMP_DIR_PROPERTY = "java.io.tmpdir";
+    private static final String UNIT_TEST_DATA_DIR_NAME = "zstack-unit-test";
+    private static final String MANAGEMENT_SERVER_ID_STATE_FILE_NAME = "management-server-id.properties";
+    private static final String MANAGEMENT_SERVER_FINGERPRINT_VERSION = "2";
+    private static final String MANAGEMENT_SERVER_FINGERPRINT_ALGORITHM = "sha256:";
+    private static final String SUDO_COMMAND = "/usr/bin/sudo";
+    private static final String DMIDECODE_COMMAND = "/usr/sbin/dmidecode";
+    private static final int DMIDECODE_COMMAND_TIMEOUT_SECONDS = 3;
+    private static final int DMI_SOURCE_NAME_INDEX = 0;
+    private static final int DMI_SOURCE_FILE_INDEX = 1;
+    private static final int DMI_SOURCE_COMMAND_ARG_INDEX = 2;
+    private static final String[][] MANAGEMENT_SERVER_FINGERPRINT_DMI_SOURCES = {
+            {"dmi:system-uuid", "/sys/class/dmi/id/product_uuid", "system-uuid"},
+            {"dmi:system-serial-number", "/sys/class/dmi/id/product_serial", "system-serial-number"},
+            {"dmi:baseboard-serial-number", "/sys/class/dmi/id/board_serial", "baseboard-serial-number"}
+    };
+    private static final List<String> UNUSABLE_MACHINE_IDENTITIES = Arrays.asList(
+            "none",
+            "unknown",
+            "not specified",
+            "to be filled by o.e.m.",
+            "to be filled by oem",
+            "default string",
+            "system serial number"
+    );
+    private static final String ZSTACK_UUID_PATTERN = "[0-9a-fA-F]{32}";
     private static EncryptRSA rsa = new EncryptRSA();
     private static Map<String, Double> errorCounter = new HashMap<>();
 
+    public static final String MANAGEMENT_SERVER_ID_PROPERTY = "managementServerId";
+    public static final String MANAGEMENT_SERVER_FINGERPRINT_PROPERTY = "managementServerFingerprint";
+    public static final String MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY = "managementServerFingerprintVersion";
     public static final String COMPONENT_CLASSPATH_HOME = "componentsHome";
     public static final String FAKE_UUID = "THIS_IS_A_FAKE_UUID";
 
@@ -431,7 +483,9 @@ private static void prepareHibernateSearchProperties() {
             }
         }
 
-        if (ZSha2Helper.isMNHaEnvironment()) {
+        boolean mnHaEnvironment = ZSha2Helper.isMNHaEnvironment();
+        String searchBackend = SearchBackendConstant.JGROUPS_BACKEND;
+        if (mnHaEnvironment) {
             // jgroup configuration is required in multi node environment
             // if failed to get zsha2 info, this method thrown exception to stop management node from startup
             // so there is no need to handle exceptions
@@ -442,13 +496,11 @@ private static void prepareHibernateSearchProperties() {
             if (info.getPeerip() == null) {
                 throw new RuntimeException("the ip of peer node was null, please check the config of zsha2");
             }
-            SearchGlobalProperty.JGroupInfinispanInitialHosts = String.format("%s[%s],%s[%s]",
-                    info.getNodeip(), SearchGlobalProperty.JGroupInfinispanPort,
-                    info.getPeerip(), SearchGlobalProperty.JGroupInfinispanPort);
-            SearchGlobalProperty.JGroupBackendInitialHosts = String.format("%s[%s],%s[%s]",
-                    info.getNodeip(), SearchGlobalProperty.JGroupBackendPort,
-                    info.getPeerip(), SearchGlobalProperty.JGroupBackendPort);
-            if (getGlobalProperty("JGroup.TcppingInitialHosts") == null) {
+            SearchGlobalProperty.JGroupInfinispanInitialHosts = formatJGroupsInitialHosts(
+                    info.getNodeip(), info.getPeerip(), Integer.parseInt(SearchGlobalProperty.JGroupInfinispanPort));
+            SearchGlobalProperty.JGroupBackendInitialHosts = formatJGroupsInitialHosts(
+                    info.getNodeip(), info.getPeerip(), Integer.parseInt(SearchGlobalProperty.JGroupBackendPort));
+            if (getGlobalProperty("JGroup.InfinispanInitialHosts") == null) {
                 System.setProperty("JGroup.InfinispanInitialHosts", SearchGlobalProperty.JGroupInfinispanInitialHosts);
                 logger.debug(String.format("default JGroup.InfinispanInitialHosts to JGroup.InfinispanInitialHosts [%s]", SearchGlobalProperty.JGroupInfinispanInitialHosts));
             }
@@ -456,19 +508,25 @@ private static void prepareHibernateSearchProperties() {
                 System.setProperty("JGroup.BackendInitialHosts", SearchGlobalProperty.JGroupBackendInitialHosts);
                 logger.debug(String.format("default JGroup.BackendInitialHosts to JGroup.BackendInitialHosts [%s]", SearchGlobalProperty.JGroupBackendInitialHosts));
             }
+            searchBackend = selectHibernateSearchBackend(true);
         }
         if (getGlobalProperty("JGroup.Address") == null) {
             String serverIp = getCanonicalServerIp();
             System.setProperty("JGroup.Address", serverIp);
             logger.debug(String.format("default JGroup.Address to JGroup.Address [%s]", serverIp));
         }
-        if (ZSha2Helper.isMNHaEnvironment()) {
+        if (mnHaEnvironment) {
             SearchGlobalProperty.JGroupFlushBypass = "false";
             SearchGlobalProperty.JGroupJoinTimeout = "5000";
         } else {
             SearchGlobalProperty.ExclusiveIndexUse = "true";
         }
 
+        if (mnHaEnvironment || getGlobalProperty(SearchBackendConstant.SEARCH_BACKEND_PROPERTY) == null) {
+            System.setProperty(SearchBackendConstant.SEARCH_BACKEND_PROPERTY, searchBackend);
+            logger.debug(String.format("default %s to %s [%s]", SearchBackendConstant.SEARCH_BACKEND_PROPERTY,
+                    SearchBackendConstant.SEARCH_BACKEND_PROPERTY, searchBackend));
+        }
         System.setProperty("Exclusive.indexUse", SearchGlobalProperty.ExclusiveIndexUse);
         System.setProperty("JGroup.FlushBypass", SearchGlobalProperty.JGroupFlushBypass);
         System.setProperty("JGroup.JoinTimeout", SearchGlobalProperty.JGroupJoinTimeout);
@@ -477,6 +535,14 @@ private static void prepareHibernateSearchProperties() {
         logger.debug(String.format("default JGroup.JoinTimeout to JGroup.JoinTimeout [%s]", SearchGlobalProperty.JGroupJoinTimeout));
     }
 
+    public static String selectHibernateSearchBackend(boolean mnHaEnvironment) {
+        if (!mnHaEnvironment) {
+            return SearchBackendConstant.JGROUPS_BACKEND;
+        }
+
+        return SearchBackendConstant.ZSTACK_ZSHA2_JGROUPS_BACKEND;
+    }
+
     static {
         FileInputStream in = null;
         try {
@@ -495,8 +561,8 @@ private static void prepareHibernateSearchProperties() {
             in = new FileInputStream(globalPropertiesFile);
             System.getProperties().load(in);
 
-            // get ms ip should after global property setup
-            msId = UUID.nameUUIDFromBytes(getManagementServerIp().getBytes()).toString().replaceAll("-", "");
+            // get ms id should after global property setup
+            msId = loadOrCreateManagementServerId(globalPropertiesFile, Platform::getUuid);
 
             collectDynamicObjectMetadata();
             linkGlobalProperty();
@@ -703,6 +769,252 @@ public static String getManagementServerId() {
         return msId;
     }
 
+    public static synchronized String loadOrCreateManagementServerId(File propertiesFile, Supplier<String> idSupplier) {
+        return loadOrCreateManagementServerId(propertiesFile, getManagementServerIdStateFile(), idSupplier);
+    }
+
+    public static synchronized String loadOrCreateManagementServerId(File propertiesFile, File stateFile, Supplier<String> idSupplier) {
+        return loadOrCreateManagementServerId(propertiesFile, stateFile, idSupplier, Platform::getManagementServerFingerprint);
+    }
+
+    public static synchronized String loadOrCreateManagementServerId(File propertiesFile, File stateFile, Supplier<String> idSupplier, Supplier<String> fingerprintSupplier) {
+        Properties properties = loadProperties(propertiesFile);
+
+        String configuredId = properties.getProperty(MANAGEMENT_SERVER_ID_PROPERTY);
+        if (isValidManagementServerId(configuredId)) {
+            System.setProperty(MANAGEMENT_SERVER_ID_PROPERTY, configuredId);
+            return configuredId;
+        }
+
+        String currentFingerprint = fingerprintSupplier.get();
+        Properties state = loadProperties(stateFile);
+        String persistedId = state.getProperty(MANAGEMENT_SERVER_ID_PROPERTY);
+        if (isValidManagementServerId(persistedId)) {
+            if (canReusePersistedManagementServerId(state, currentFingerprint)) {
+                ensureManagementServerFingerprint(stateFile, state, currentFingerprint);
+                System.setProperty(MANAGEMENT_SERVER_ID_PROPERTY, persistedId);
+                return persistedId;
+            }
+
+            logger.warn(String.format("management server id state file[%s] fingerprint does not match current machine, regenerate management server id", stateFile.getAbsolutePath()));
+        }
+
+        String generatedId = idSupplier.get();
+        if (!isValidManagementServerId(generatedId)) {
+            throw new CloudRuntimeException(String.format("generated management server id[%s] is not a valid uuid", generatedId));
+        }
+
+        state.setProperty(MANAGEMENT_SERVER_ID_PROPERTY, generatedId);
+        setManagementServerFingerprint(state, currentFingerprint);
+        saveManagementServerId(stateFile, state);
+        System.setProperty(MANAGEMENT_SERVER_ID_PROPERTY, generatedId);
+        return generatedId;
+    }
+
+    private static Properties loadProperties(File file) {
+        Properties properties = new Properties();
+        if (file.exists()) {
+            try (FileInputStream inputStream = new FileInputStream(file)) {
+                properties.load(inputStream);
+            } catch (IOException e) {
+                throw new CloudRuntimeException(e);
+            }
+        }
+        return properties;
+    }
+
+    public static File getManagementServerIdStateFile() {
+        String dataDir = System.getProperty(DATA_DIR_PROPERTY);
+        if (dataDir == null && Boolean.parseBoolean(System.getProperty(UNIT_TEST_ON_PROPERTY))) {
+            dataDir = new File(System.getProperty(JAVA_TMP_DIR_PROPERTY), UNIT_TEST_DATA_DIR_NAME).getAbsolutePath();
+        }
+        if (dataDir == null) {
+            dataDir = DEFAULT_DATA_DIR;
+        }
+
+        return new File(dataDir, MANAGEMENT_SERVER_ID_STATE_FILE_NAME);
+    }
+
+    private static boolean canReusePersistedManagementServerId(Properties state, String currentFingerprint) {
+        if (StringUtils.isBlank(currentFingerprint)) {
+            return true;
+        }
+
+        String persistedFingerprint = state.getProperty(MANAGEMENT_SERVER_FINGERPRINT_PROPERTY);
+        String persistedFingerprintVersion = state.getProperty(MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY);
+        if (StringUtils.isBlank(persistedFingerprint) || !MANAGEMENT_SERVER_FINGERPRINT_VERSION.equals(persistedFingerprintVersion)) {
+            return true;
+        }
+
+        return currentFingerprint.equals(persistedFingerprint);
+    }
+
+    private static void ensureManagementServerFingerprint(File stateFile, Properties state, String currentFingerprint) {
+        if (StringUtils.isBlank(currentFingerprint)) {
+            return;
+        }
+
+        String persistedFingerprint = state.getProperty(MANAGEMENT_SERVER_FINGERPRINT_PROPERTY);
+        String persistedFingerprintVersion = state.getProperty(MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY);
+        if (currentFingerprint.equals(persistedFingerprint) && MANAGEMENT_SERVER_FINGERPRINT_VERSION.equals(persistedFingerprintVersion)) {
+            return;
+        }
+
+        setManagementServerFingerprint(state, currentFingerprint);
+        saveManagementServerId(stateFile, state);
+    }
+
+    private static void setManagementServerFingerprint(Properties state, String fingerprint) {
+        if (StringUtils.isBlank(fingerprint)) {
+            state.remove(MANAGEMENT_SERVER_FINGERPRINT_PROPERTY);
+            state.remove(MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY);
+            return;
+        }
+
+        state.setProperty(MANAGEMENT_SERVER_FINGERPRINT_PROPERTY, fingerprint);
+        state.setProperty(MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY, MANAGEMENT_SERVER_FINGERPRINT_VERSION);
+    }
+
+    private static String getManagementServerFingerprint() {
+        List<String> identities = new ArrayList<>();
+        for (String[] source : MANAGEMENT_SERVER_FINGERPRINT_DMI_SOURCES) {
+            String identity = readMachineIdentity(source[DMI_SOURCE_FILE_INDEX]);
+            if (identity == null) {
+                identity = readDmiMachineIdentity(source[DMI_SOURCE_COMMAND_ARG_INDEX]);
+            }
+            if (identity != null) {
+                identities.add(String.format("%s=%s", source[DMI_SOURCE_NAME_INDEX], identity));
+            }
+        }
+
+        if (identities.isEmpty()) {
+            logger.warn("cannot calculate management server fingerprint because no stable DMI identity source is available");
+            return null;
+        }
+
+        return MANAGEMENT_SERVER_FINGERPRINT_ALGORITHM + DigestUtils.sha256Hex(StringUtils.join(identities, "\n"));
+    }
+
+    private static String readMachineIdentity(String path) {
+        File file = new File(path);
+        if (!file.isFile() || !file.canRead()) {
+            return null;
+        }
+
+        try {
+            return normalizeMachineIdentity(FileUtils.readFileToString(file));
+        } catch (IOException e) {
+            logger.warn(String.format("unable to read machine identity file[%s], skip it", path), e);
+            return null;
+        }
+    }
+
+    private static String readDmiMachineIdentity(String dmiString) {
+        File dmidecode = new File(DMIDECODE_COMMAND);
+        File sudo = new File(SUDO_COMMAND);
+        if (!dmidecode.isFile() || !sudo.isFile() || !sudo.canExecute()) {
+            return null;
+        }
+
+        Process process = null;
+        try {
+            process = new ProcessBuilder(SUDO_COMMAND, "-n", DMIDECODE_COMMAND, "-s", dmiString).start();
+            if (!process.waitFor(DMIDECODE_COMMAND_TIMEOUT_SECONDS, TimeUnit.SECONDS)) {
+                process.destroyForcibly();
+                logger.warn(String.format("unable to read DMI machine identity[%s] before timeout, skip it", dmiString));
+                return null;
+            }
+
+            String output = IOUtils.toString(process.getInputStream(), "UTF-8");
+            String error = IOUtils.toString(process.getErrorStream(), "UTF-8");
+            if (process.exitValue() != 0) {
+                logger.debug(String.format("unable to read DMI machine identity[%s], exit code[%s], output[%s], error[%s], skip it",
+                        dmiString, process.exitValue(), output.trim(), error.trim()));
+                return null;
+            }
+
+            return normalizeMachineIdentity(output);
+        } catch (IOException e) {
+            logger.debug(String.format("unable to read DMI machine identity[%s], skip it", dmiString), e);
+            return null;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            logger.warn(String.format("interrupted when reading DMI machine identity[%s], skip it", dmiString), e);
+            return null;
+        } finally {
+            if (process != null && process.isAlive()) {
+                process.destroyForcibly();
+            }
+        }
+    }
+
+    private static String normalizeMachineIdentity(String output) {
+        if (StringUtils.isBlank(output)) {
+            return null;
+        }
+
+        for (String line : StringUtils.split(output, "\r\n")) {
+            String identity = line.trim().toLowerCase();
+            if (isUsableMachineIdentity(identity)) {
+                return identity;
+            }
+        }
+
+        return null;
+    }
+
+    private static boolean isUsableMachineIdentity(String identity) {
+        if (StringUtils.isBlank(identity)) {
+            return false;
+        }
+
+        if (UNUSABLE_MACHINE_IDENTITIES.contains(identity)) {
+            return false;
+        }
+
+        String normalized = StringUtils.deleteWhitespace(identity).replace("-", "").replace(":", "");
+        return !StringUtils.containsOnly(normalized, "0") && !StringUtils.containsOnly(normalized, "f");
+    }
+
+    private static boolean isValidManagementServerId(String id) {
+        if (id == null) {
+            return false;
+        }
+
+        try {
+            UUID.fromString(id);
+            return true;
+        } catch (IllegalArgumentException ignored) {
+            return id.matches(ZSTACK_UUID_PATTERN);
+        }
+    }
+
+    private static void saveManagementServerId(File propertiesFile, Properties properties) {
+        if (propertiesFile.getParentFile() != null && !propertiesFile.getParentFile().exists()) {
+            try {
+                FileUtils.forceMkdir(propertiesFile.getParentFile());
+            } catch (IOException e) {
+                throw new CloudRuntimeException(e);
+            }
+        }
+
+        File tmp = new File(propertiesFile.getAbsolutePath() + TEMP_FILE_SUFFIX);
+        try (FileOutputStream outputStream = new FileOutputStream(tmp)) {
+            properties.store(outputStream, "ZStack properties");
+            try {
+                Files.move(tmp.toPath(), propertiesFile.toPath(), StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+            } catch (IOException e) {
+                Files.move(tmp.toPath(), propertiesFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
+            }
+        } catch (IOException e) {
+            throw new CloudRuntimeException(e);
+        } finally {
+            if (tmp.exists()) {
+                tmp.delete();
+            }
+        }
+    }
+
     public static <K extends Enum<K>, T extends Enum<T>> StateMachine<K, T> createStateMachine() {
         return new StateMachineImpl<K, T>();
     }
@@ -785,21 +1097,38 @@ public static boolean isVIPNode() {
         return false;
     }
 
-    private static String getManagementServerCidrInternal() {
-        String mgtIp = getManagementServerIp();
+    private static String getManagementServerCidrInternal(String mgtIp) {
+        String command = IPv6NetworkUtils.isIpv6Address(mgtIp) ? IPV6_ADDRESS_COMMAND : IPV4_ADDRESS_COMMAND;
+        Linux.ShellResult ret = Linux.shell(command);
+        return parseManagementServerCidrFromIpAddressOutput(mgtIp, ret.getStdout());
+    }
 
-        /*# ip add | grep 10.86.4.132
-            inet 10.86.4.132/23 brd 10.86.5.255 scope global br_eth0*/
-        /* because Linux.shell can not run command with '|', pares the output of ip address in java  */
-        Linux.ShellResult ret = Linux.shell("ip -4 add");
-        for (String line : ret.getStdout().split("\\n")) {
-            if (line.contains(mgtIp)) {
-                line = line.trim();
-                try {
-                    return NetworkUtils.getNetworkAddressFromCidr(line.split(" ")[1]);
-                } catch (RuntimeException e) {
-                    return null;
-                }
+    public static String parseManagementServerCidrFromIpAddressOutput(String managementIp, String commandOutput) {
+        if (commandOutput == null) {
+            return null;
+        }
+
+        String normalizedManagementIp = normalizeManagementIp(managementIp);
+        for (String line : commandOutput.split("\\n")) {
+            String[] tokens = line.trim().split("\\s+");
+            if (tokens.length < IP_ADDRESS_COMMAND_MIN_TOKEN_COUNT) {
+                continue;
+            }
+
+            String cidr = tokens[IP_ADDRESS_COMMAND_CIDR_INDEX];
+            if (!cidr.contains(CIDR_SEPARATOR)) {
+                continue;
+            }
+
+            String ip = cidr.substring(0, cidr.indexOf(CIDR_SEPARATOR));
+            if (!normalizedManagementIp.equals(normalizeManagementIp(ip))) {
+                continue;
+            }
+
+            try {
+                return NetworkUtils.getNetworkAddressFromCidr(cidr);
+            } catch (RuntimeException e) {
+                return null;
             }
         }
 
@@ -808,29 +1137,44 @@ private static String getManagementServerCidrInternal() {
 
     public static String getManagementServerCidr() {
         if (managementServerCidr == null) {
-            managementServerCidr = getManagementServerCidrInternal();
+            managementServerCidr = getManagementServerCidrInternal(getManagementServerIp());
         }
 
         return managementServerCidr;
     }
 
+    public static String getManagementServerCidr(String managementIp) {
+        return getManagementServerCidrInternal(normalizeManagementIp(managementIp));
+    }
+
+    public static String getManagementServerCidr(int ipVersion) {
+        String currentIp = getManagementServerIp();
+        if ((ipVersion == IPv6Constants.IPv6 && IPv6NetworkUtils.isIpv6Address(currentIp)) ||
+                (ipVersion == IPv6Constants.IPv4 && NetworkUtils.isIpv4Address(currentIp))) {
+            return getManagementServerCidr(currentIp);
+        }
+
+        String ip = ipVersion == IPv6Constants.IPv6 ? getManagementServerIp6() : getManagementServerIp4();
+        return ip == null ? null : getManagementServerCidr(ip);
+    }
+
     private static String getManagementServerIpInternal() {
-        String ip = System.getProperty("management.server.ip");
+        String ip = System.getProperty(MANAGEMENT_SERVER_IP_PROPERTY);
         if (ip != null) {
-            logger.info(String.format("get management IP[%s] from Java property[management.server.ip]", ip));
-            return ip;
+            logger.info(String.format("get management IP[%s] from Java property[%s]", ip, MANAGEMENT_SERVER_IP_PROPERTY));
+            return normalizeManagementIp(ip);
         }
 
-        ip = System.getenv("ZSTACK_MANAGEMENT_SERVER_IP");
+        ip = System.getenv(ZSTACK_MANAGEMENT_SERVER_IP_ENV);
         if (ip != null) {
-            logger.info(String.format("get management IP[%s] from environment variable[ZSTACK_MANAGEMENT_SERVER_IP]", ip));
-            return ip;
+            logger.info(String.format("get management IP[%s] from environment variable[%s]", ip, ZSTACK_MANAGEMENT_SERVER_IP_ENV));
+            return normalizeManagementIp(ip);
         }
 
-        Linux.ShellResult ret = Linux.shell("/sbin/ip route");
+        Linux.ShellResult ret = Linux.shell(DEFAULT_ROUTE_COMMAND);
         String defaultLine = null;
         for (String s : ret.getStdout().split("\n")) {
-            if (s.contains("default via")) {
+            if (s.contains(DEFAULT_ROUTE_MARK)) {
                 defaultLine = s;
                 break;
             }
@@ -846,14 +1190,7 @@ private static String getManagementServerIpInternal() {
             for (NetworkInterface iface : Collections.list(nets)) {
                 String name = iface.getName();
                 if (defaultLine.contains(name)) {
-                    for (InetAddress ia : Collections.list(iface.getInetAddresses())) {
-                        ip = ia.getHostAddress();
-                        if (ia instanceof Inet4Address) {
-                            // we prefer IPv4 address
-                            ip = ia.getHostAddress();
-                            break;
-                        }
-                    }
+                    ip = selectManagementServerIp(Collections.list(iface.getInetAddresses()));
                 }
             }
         } catch (SocketException e) {
@@ -868,6 +1205,197 @@ private static String getManagementServerIpInternal() {
         return ip;
     }
 
+    public static String getManagementServerIp6() {
+        String ip = getManagementServerSecondaryIpProperty(MANAGEMENT_SERVER_IP6_PROPERTY, IPv6Constants.IPv6);
+        if (ip != null) {
+            return ip;
+        }
+        return getManagementServerIpOnManagementInterface(IPv6Constants.IPv6);
+    }
+
+    public static String getManagementServerIp4() {
+        String ip = getManagementServerSecondaryIpProperty(MANAGEMENT_SERVER_IP4_PROPERTY, IPv6Constants.IPv4);
+        if (ip != null) {
+            return ip;
+        }
+        return getManagementServerIpOnManagementInterface(IPv6Constants.IPv4);
+    }
+
+    private static String getManagementServerSecondaryIpProperty(String property, int ipVersion) {
+        String ip = System.getProperty(property);
+        if (ip == null || ip.trim().isEmpty()) {
+            return null;
+        }
+
+        String normalizedIp = normalizeManagementIp(ip);
+        if ((ipVersion == IPv6Constants.IPv6 && !IPv6NetworkUtils.isIpv6Address(normalizedIp)) ||
+                (ipVersion == IPv6Constants.IPv4 && !NetworkUtils.isIpv4Address(normalizedIp))) {
+            throw new CloudRuntimeException(String.format(
+                    "management IP[%s] from Java property[%s] is not IPv%s",
+                    ip, property, ipVersion));
+        }
+
+        logger.info(String.format("get management IP[%s] from Java property[%s]", ip, property));
+        return normalizedIp;
+    }
+
+    private static String getManagementServerIpOnManagementInterface(int ipVersion) {
+        try {
+            NetworkInterface iface = findManagementServerInterface();
+            if (iface == null || !iface.isUp()) {
+                return null;
+            }
+
+            for (InetAddress address : Collections.list(iface.getInetAddresses())) {
+                if (address.isLoopbackAddress() || address.isLinkLocalAddress()) {
+                    continue;
+                }
+                if (ipVersion == IPv6Constants.IPv6 && !(address instanceof Inet4Address)) {
+                    return normalizeManagementIp(address.getHostAddress());
+                }
+                if (ipVersion == IPv6Constants.IPv4 && address instanceof Inet4Address) {
+                    return normalizeManagementIp(address.getHostAddress());
+                }
+            }
+        } catch (SocketException e) {
+            throw new CloudRuntimeException(e);
+        }
+
+        return null;
+    }
+
+    private static NetworkInterface findManagementServerInterface() throws SocketException {
+        String currentIp = normalizeManagementIp(getManagementServerIp());
+        Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
+        for (NetworkInterface iface : Collections.list(nets)) {
+            for (InetAddress address : Collections.list(iface.getInetAddresses())) {
+                if (currentIp.equals(normalizeManagementIp(address.getHostAddress()))) {
+                    return iface;
+                }
+            }
+        }
+
+        return null;
+    }
+
+    public static String getManagementServerIp6Cidr() {
+        String ip6 = getManagementServerIp6();
+        return ip6 == null ? null : getManagementServerCidr(ip6);
+    }
+
+    public static List<String> getManagementServerIps() {
+        LinkedHashSet<String> ips = new LinkedHashSet<>();
+        ips.add(getManagementServerIp());
+        ips.add(getManagementServerIp4());
+        ips.add(getManagementServerIp6());
+        ips.remove(null);
+        return new ArrayList<>(ips);
+    }
+
+    public static List<String> getManagementServerIpsWithLocalFallback() {
+        LinkedHashSet<String> ips = new LinkedHashSet<>(getManagementServerIps());
+        ips.addAll(getLocalNonLoopbackIps());
+        ips.remove(null);
+        return new ArrayList<>(ips);
+    }
+
+    private static List<String> getLocalNonLoopbackIps() {
+        List<String> ips = new ArrayList<>();
+        try {
+            Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
+            for (NetworkInterface iface : Collections.list(nets)) {
+                if (!iface.isUp()) {
+                    continue;
+                }
+                for (InetAddress address : Collections.list(iface.getInetAddresses())) {
+                    if (address.isLoopbackAddress() || address.isLinkLocalAddress()) {
+                        continue;
+                    }
+                    ips.add(normalizeManagementIp(address.getHostAddress()));
+                }
+            }
+        } catch (SocketException e) {
+            logger.warn("failed to list local non-loopback IPs", e);
+        }
+        return ips;
+    }
+
+    public static String getRouteSourceIp(String remoteIp) {
+        if (StringUtils.isBlank(remoteIp)) {
+            return null;
+        }
+
+        remoteIp = normalizeManagementIp(remoteIp);
+        String family;
+        if (IPv6NetworkUtils.isIpv6Address(remoteIp)) {
+            family = "-6";
+        } else if (NetworkUtils.isIpv4Address(remoteIp)) {
+            family = "-4";
+        } else {
+            return null;
+        }
+
+        Linux.ShellResult ret = Linux.shell(String.format("/sbin/ip %s route get %s", family, remoteIp));
+        if (ret.getExitCode() != 0) {
+            logger.warn(String.format("failed to get route source IP for remote[%s], stdout[%s], stderr[%s]",
+                    remoteIp, ret.getStdout(), ret.getStderr()));
+            return null;
+        }
+
+        String[] tokens = ret.getStdout().trim().split("\\s+");
+        for (int i = 0; i < tokens.length - 1; i++) {
+            if (!"src".equals(tokens[i])) {
+                continue;
+            }
+            String sourceIp = normalizeManagementIp(tokens[i + 1]);
+            if (IPv6NetworkUtils.isIpv6Address(remoteIp) && IPv6NetworkUtils.isIpv6Address(sourceIp)) {
+                return sourceIp;
+            }
+            if (NetworkUtils.isIpv4Address(remoteIp) && NetworkUtils.isIpv4Address(sourceIp)) {
+                return sourceIp;
+            }
+        }
+
+        return null;
+    }
+
+    public static String selectManagementServerIp(Collection<InetAddress> addresses) {
+        String ipv4 = null;
+        String ipv6 = null;
+
+        for (InetAddress address : addresses) {
+            String hostAddress = normalizeManagementIp(address.getHostAddress());
+            if (address.isLoopbackAddress() || address.isLinkLocalAddress()) {
+                continue;
+            }
+
+            if (address instanceof Inet4Address) {
+                ipv4 = hostAddress;
+            } else {
+                ipv6 = hostAddress;
+            }
+        }
+
+        return ipv4 != null ? ipv4 : ipv6;
+    }
+
+    public static String formatJGroupsInitialHosts(String nodeIp, String peerIp, int port) {
+        return String.format(JGROUPS_INITIAL_HOST_FORMAT,
+                IPv6NetworkUtils.stripHostUrlBrackets(nodeIp), port,
+                IPv6NetworkUtils.stripHostUrlBrackets(peerIp), port);
+    }
+
+    private static String normalizeManagementIp(String ip) {
+        if (ip == null) {
+            return null;
+        }
+        int scopeIndex = ip.indexOf('%');
+        if (scopeIndex >= 0) {
+            ip = ip.substring(0, scopeIndex);
+        }
+        return IPv6NetworkUtils.isIpv6Address(ip) ? IPv6NetworkUtils.normalizeIpv6(ip) : ip;
+    }
+
     public static String toI18nString(String code, Object... args) {
         return toI18nString(code, null, args);
     }
diff --git a/core/src/main/java/org/zstack/core/agent/AgentManagerImpl.java b/core/src/main/java/org/zstack/core/agent/AgentManagerImpl.java
index 0e0482f2442..27966a5c73c 100755
--- a/core/src/main/java/org/zstack/core/agent/AgentManagerImpl.java
+++ b/core/src/main/java/org/zstack/core/agent/AgentManagerImpl.java
@@ -26,6 +26,7 @@
 import org.zstack.header.rest.RESTFacade;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
@@ -45,6 +46,11 @@
  */
 public class AgentManagerImpl extends AbstractService implements AgentManager {
     private static final CLogger logger = Utils.getLogger(AgentManagerImpl.class);
+    private static final String HTTP_URL_FORMAT = "http://%s:%s%s";
+
+    public static String buildAgentUrl(String ip, int port, String path) {
+        return String.format(HTTP_URL_FORMAT, IPv6NetworkUtils.formatHostForUrl(ip), port, path);
+    }
 
     @Autowired
     private CloudBus bus;
@@ -113,7 +119,7 @@ private void connect(final DeployAgentMsg msg, final Completion completion) {
         chain.setName(String.format("continue-connect-agent-server-%s:%s", msg.getIp(), msg.getAgentPort()));
         chain.then(new ShareFlow() {
             private String url(String path) {
-                return String.format("http://%s:%s%s", msg.getIp(), msg.getAgentPort(), path);
+                return buildAgentUrl(msg.getIp(), msg.getAgentPort(), path);
             }
 
             @Override
diff --git a/core/src/main/java/org/zstack/core/ansible/AnsibleRunner.java b/core/src/main/java/org/zstack/core/ansible/AnsibleRunner.java
index b05e66ef2ff..bd7e06ec714 100755
--- a/core/src/main/java/org/zstack/core/ansible/AnsibleRunner.java
+++ b/core/src/main/java/org/zstack/core/ansible/AnsibleRunner.java
@@ -16,6 +16,7 @@
 import org.zstack.utils.ShellUtils;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
@@ -40,6 +41,8 @@
 @Configurable(preConstruction = true, autowire = Autowire.BY_TYPE)
 public class AnsibleRunner {
     private static final CLogger logger = Utils.getLogger(AnsibleRunner.class);
+    static final String HTTP_URL_FORMAT = "http://%s:%d%s";
+    static final String PYPI_SIMPLE_PATH = "/zstack/static/pypi/simple";
 
     @Autowired
     private AnsibleFacade asf;
@@ -390,9 +393,9 @@ public void run(ReturnValueCompletion<Boolean> completion) {
                 deployArguments = new AnsibleBasicArguments();
             }
 
-            deployArguments.setPipUrl(String.format("http://%s:%d/zstack/static/pypi/simple", restf.getHostName(), port));
+            deployArguments.setPipUrl(buildPipUrl(restf.getHostName(), port));
             deployArguments.setTrustedHost(restf.getHostName());
-            deployArguments.setYumServer(String.format("%s:%d", restf.getHostName(), port));
+            deployArguments.setYumServer(IPv6NetworkUtils.formatHostPort(restf.getHostName(), port));
             deployArguments.setRemoteUser(username);
             if (password != null && !password.isEmpty()) {
                 deployArguments.setRemotePass(password);
@@ -415,6 +418,10 @@ public void run(ReturnValueCompletion<Boolean> completion) {
 
     }
 
+    public static String buildPipUrl(String hostname, int port) {
+        return String.format(HTTP_URL_FORMAT, IPv6NetworkUtils.formatHostForUrl(hostname), port, PYPI_SIMPLE_PATH);
+    }
+
 
     public void restartAgent(String agentName, Completion completion) {
         String script = String.format("sudo bash /etc/init.d/%s restart\n", agentName);
diff --git a/core/src/main/java/org/zstack/core/ansible/CallBackNetworkChecker.java b/core/src/main/java/org/zstack/core/ansible/CallBackNetworkChecker.java
index 031f624218c..5cf5665c06b 100644
--- a/core/src/main/java/org/zstack/core/ansible/CallBackNetworkChecker.java
+++ b/core/src/main/java/org/zstack/core/ansible/CallBackNetworkChecker.java
@@ -10,6 +10,7 @@
 import org.zstack.utils.ssh.SshCmdHelper;
 import org.zstack.utils.ssh.SshException;
 import org.zstack.utils.ssh.SshResult;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import static org.zstack.core.Platform.operr;
 import static org.zstack.utils.StringDSL.ln;
@@ -30,8 +31,11 @@ public class CallBackNetworkChecker implements AnsibleChecker {
     private String callbackIp = Platform.getManagementServerIp();
     private int callBackPort = Platform.getManagementNodeServicePort();
 
-    private static StringDSL.StringWrapper script = ln(
-            "cat /dev/null | nc {2} {1} || echo {0} | sudo -S nmap -sS -P0 -n -p {1} {2} 2>/dev/null | grep \"1 host up\""
+    private static final String EMPTY_COMMAND_OPTION = "";
+    private static final String IPV6_COMMAND_OPTION = "-6 ";
+    private static final String HOST_UP_PATTERN = "1 host up";
+    private static final StringDSL.StringWrapper CALLBACK_CHECK_SCRIPT = ln(
+            "cat /dev/null | nc {3}{2} {1} || echo {0} | sudo -S nmap {4}-sS -P0 -n -p {1} {2} 2>/dev/null | grep \"{5}\""
     );
 
     @Override
@@ -49,7 +53,7 @@ public void deleteDestFile() {
      * if failed, use nmap to try again.
      */
     private ErrorCode useNcatAndNmapToTestConnection(Ssh ssh) {
-        String srcScript = script.format(SshCmdHelper.shellQuote(password), callBackPort, callbackIp);
+        String srcScript = buildCallbackCheckScript(SshCmdHelper.shellQuote(password), callBackPort, callbackIp);
 
         ssh.sudoCommand(srcScript);
         SshResult ret = ssh.run();
@@ -58,6 +62,13 @@ private ErrorCode useNcatAndNmapToTestConnection(Ssh ssh) {
         return null;
     }
 
+    public static String buildCallbackCheckScript(String password, int port, String callbackIp) {
+        String callbackHost = IPv6NetworkUtils.stripHostUrlBrackets(callbackIp);
+        String ipVersionOption = IPv6NetworkUtils.isIpv6Address(callbackHost) ? IPV6_COMMAND_OPTION : EMPTY_COMMAND_OPTION;
+
+        return CALLBACK_CHECK_SCRIPT.format(password, port, callbackHost, ipVersionOption, ipVersionOption, HOST_UP_PATTERN);
+    }
+
     @Override
     public ErrorCode stopAnsible() {
         if (CoreGlobalProperty.UNIT_TEST_ON || !AnsibleGlobalConfig.CHECK_MANAGEMENT_CALLBACK.value(Boolean.class)) {
diff --git a/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java b/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java
index 93e8555b875..166e7323918 100755
--- a/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java
+++ b/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java
@@ -66,6 +66,7 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
@@ -140,8 +141,16 @@ public class CloudBusImpl3 implements CloudBus, CloudBusIN {
     private final static TimeoutRestTemplate http = RESTFacade.createRestTemplate(CoreGlobalProperty.REST_FACADE_READ_TIMEOUT, CoreGlobalProperty.REST_FACADE_CONNECT_TIMEOUT);
 
     public static final String HTTP_BASE_URL = "/cloudbus";
+    private static final String HTTP_URL_FORMAT = "http://%s:%s%s";
+    private static final String HTTP_CONTEXT_URL_FORMAT = "http://%s:%s/%s/%s";
     public static final FutureCompletion SEND_CONFIRMED = new FutureCompletion(null);
 
+    public static String buildCloudBusUrl(String ip, int port, String contextPath) {
+        String host = IPv6NetworkUtils.formatHostForUrl(ip);
+        return contextPath.isEmpty() ? String.format(HTTP_URL_FORMAT, host, port, HTTP_BASE_URL) :
+                String.format(HTTP_CONTEXT_URL_FORMAT, host, port, contextPath, HTTP_BASE_URL);
+    }
+
     private TelemetryFacade telemetryFacade;
 
     private TelemetryFacade getTelemetryFacade() {
@@ -673,9 +682,7 @@ private FutureCompletion httpSend() {
         }
 
         private void httpSend(String ip) {
-            String url = CloudBusGlobalProperty.HTTP_CONTEXT_PATH.isEmpty() ? String.format("http://%s:%s%s",
-                    ip, CloudBusGlobalProperty.HTTP_PORT, HTTP_BASE_URL) : String.format("http://%s:%s/%s/%s",
-                    ip, CloudBusGlobalProperty.HTTP_PORT, CloudBusGlobalProperty.HTTP_CONTEXT_PATH, HTTP_BASE_URL);
+            String url = CloudBusImpl3.buildCloudBusUrl(ip, CloudBusGlobalProperty.HTTP_PORT, CloudBusGlobalProperty.HTTP_CONTEXT_PATH);
 
             HttpHeaders headers = new HttpHeaders();
             HttpEntity<String> req = new HttpEntity<>(CloudBusGson.toJson(msg), headers);
diff --git a/core/src/main/java/org/zstack/core/config/GlobalConfig.java b/core/src/main/java/org/zstack/core/config/GlobalConfig.java
index 32b377c995b..fcb30c9664c 100755
--- a/core/src/main/java/org/zstack/core/config/GlobalConfig.java
+++ b/core/src/main/java/org/zstack/core/config/GlobalConfig.java
@@ -78,6 +78,11 @@ public EventFacade getEvtf() {
         return evtf;
     }
 
+    void wire(DatabaseFacade dbf, EventFacade evtf) {
+        this.dbf = dbf;
+        this.evtf = evtf;
+    }
+
     @Override
     public String toString() {
         return JSONObjectUtil.toJsonString(map(
diff --git a/core/src/main/java/org/zstack/core/config/GlobalConfigConstant.java b/core/src/main/java/org/zstack/core/config/GlobalConfigConstant.java
index 5de3292fb30..6173958b6f4 100755
--- a/core/src/main/java/org/zstack/core/config/GlobalConfigConstant.java
+++ b/core/src/main/java/org/zstack/core/config/GlobalConfigConstant.java
@@ -4,4 +4,6 @@ public interface GlobalConfigConstant {
 	public static final String SERVICE_ID = "globalConfig";
 
 	public static final String LOCK = "GlobalFacade.lock";
+
+	public static final long LOCK_TIMEOUT_SECONDS = 320;
 }
diff --git a/core/src/main/java/org/zstack/core/config/GlobalConfigFacadeImpl.java b/core/src/main/java/org/zstack/core/config/GlobalConfigFacadeImpl.java
index 2e551e9c0d7..3a0fec257cb 100755
--- a/core/src/main/java/org/zstack/core/config/GlobalConfigFacadeImpl.java
+++ b/core/src/main/java/org/zstack/core/config/GlobalConfigFacadeImpl.java
@@ -4,6 +4,7 @@
 import org.zstack.core.asyncbatch.While;
 import org.zstack.core.cloudbus.CloudBus;
 import org.zstack.core.cloudbus.CloudBusCallBack;
+import org.zstack.core.cloudbus.EventFacade;
 import org.zstack.core.cloudbus.MessageSafe;
 import org.zstack.core.componentloader.PluginRegistry;
 import org.zstack.core.db.DatabaseFacade;
@@ -55,6 +56,8 @@ public class GlobalConfigFacadeImpl extends AbstractService implements GlobalCon
     @Autowired
     private DatabaseFacade dbf;
     @Autowired
+    private EventFacade evtf;
+    @Autowired
     private ErrorFacade errf;
     @Autowired
     private PluginRegistry pluginRgty;
@@ -230,7 +233,7 @@ class GlobalConfigInitializer {
             Map<String, String> propertiesMap = new HashMap<>();
 
             void init() {
-                GLock lock = new GLock(GlobalConfigConstant.LOCK, 320);
+                GLock lock = new GLock(GlobalConfigConstant.LOCK, GlobalConfigConstant.LOCK_TIMEOUT_SECONDS, dbf);
                 lock.lock();
                 try {
                     loadSystemProperties();
@@ -336,6 +339,7 @@ private void loadConfigFromJava() {
 
             private void initAllConfig() {
                 for (GlobalConfig config : configsFromXml.values()) {
+                    config.wire(dbf, evtf);
                     config.init();
                 }
             }
diff --git a/core/src/main/java/org/zstack/core/db/DatabaseFacadeImpl.java b/core/src/main/java/org/zstack/core/db/DatabaseFacadeImpl.java
index 5a7b0c34c31..458aa6b20ba 100755
--- a/core/src/main/java/org/zstack/core/db/DatabaseFacadeImpl.java
+++ b/core/src/main/java/org/zstack/core/db/DatabaseFacadeImpl.java
@@ -522,7 +522,7 @@ public CriteriaBuilder getCriteriaBuilder() {
     public <T> SimpleQuery<T> createQuery(Class<T> entityClass) {
         assert entityClass.isAnnotationPresent(Entity.class)
                 : entityClass.getName() + " is not annotated by JPA @Entity";
-        return new SimpleQueryImpl<T>(entityClass);
+        return new SimpleQueryImpl<T>(entityClass, this);
     }
 
     public EntityManager getEntityManager() {
diff --git a/core/src/main/java/org/zstack/core/db/GLock.java b/core/src/main/java/org/zstack/core/db/GLock.java
index a1e034d2f04..95e6f68e636 100755
--- a/core/src/main/java/org/zstack/core/db/GLock.java
+++ b/core/src/main/java/org/zstack/core/db/GLock.java
@@ -53,6 +53,13 @@ public GLock(String name, long timeout) {
         dataSource = dbf.getDataSource();
     }
 
+    public GLock(String name, long timeout, DatabaseFacade dbf) {
+        this.name = name;
+        this.timeout = timeout;
+        this.dbf = dbf;
+        dataSource = dbf.getDataSource();
+    }
+
     public boolean isAlsoUseMemoryLock() {
         return alsoUseMemoryLock;
     }
diff --git a/core/src/main/java/org/zstack/core/db/Q.java b/core/src/main/java/org/zstack/core/db/Q.java
index 8dcdcdf48fa..cf7682c0e85 100755
--- a/core/src/main/java/org/zstack/core/db/Q.java
+++ b/core/src/main/java/org/zstack/core/db/Q.java
@@ -2,6 +2,7 @@
 
 import org.apache.commons.collections.CollectionUtils;
 import org.springframework.transaction.annotation.Transactional;
+import org.zstack.core.Platform;
 import org.zstack.utils.DebugUtils;
 
 import javax.persistence.Tuple;
@@ -18,7 +19,8 @@ public class Q {
 
     @SuppressWarnings("unchecked")
     private Q(Class clz) {
-        q = new SimpleQueryImpl(clz);
+        DatabaseFacade dbf = Platform.getComponentLoader().getComponent(DatabaseFacade.class);
+        q = new SimpleQueryImpl(clz, dbf);
     }
 
     public Q select(SingularAttribute... attrs) {
diff --git a/core/src/main/java/org/zstack/core/db/SimpleQueryImpl.java b/core/src/main/java/org/zstack/core/db/SimpleQueryImpl.java
index 9ba9b0ac494..f65e9eae31e 100755
--- a/core/src/main/java/org/zstack/core/db/SimpleQueryImpl.java
+++ b/core/src/main/java/org/zstack/core/db/SimpleQueryImpl.java
@@ -76,6 +76,12 @@ class AttrInfo {
         _builder = _dbf.getCriteriaBuilder();
     }
 
+    SimpleQueryImpl(Class<T> vo, DatabaseFacade dbf) {
+        _entityClass = vo;
+        _dbf = dbf;
+        _builder = _dbf.getCriteriaBuilder();
+    }
+
     @Override
     public SimpleQuery<T> select(SingularAttribute... attrs) {
         for (int i=0; i<attrs.length; i++) {
diff --git a/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java b/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java
index c803af97498..56cae096854 100755
--- a/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java
+++ b/core/src/main/java/org/zstack/core/rest/RESTFacadeImpl.java
@@ -47,6 +47,7 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -196,22 +197,10 @@ void init() {
             callbackHostName = hostname.trim();
         }
 
-        String url;
-        if ("".equals(path) || path == null) {
-            url = String.format("http://%s:%s", callbackHostName, port);
-        } else {
-            url = String.format("http://%s:%s/%s", callbackHostName, port, path);
-        }
-        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(url);
-        ub.path(RESTConstant.CALLBACK_PATH);
-        callbackUrl = ub.build().toUriString();
-
-        ub = UriComponentsBuilder.fromHttpUrl(url);
-        baseUrl = ub.build().toUriString();
-
-        ub = UriComponentsBuilder.fromHttpUrl(url);
-        ub.path(RESTConstant.COMMAND_CHANNEL_PATH);
-        sendCommandUrl = ub.build().toUriString();
+        String url = buildBaseUrl(callbackHostName, port, path);
+        callbackUrl = buildCallbackUrl(callbackHostName, port, path);
+        baseUrl = url;
+        sendCommandUrl = buildSendCommandUrl(callbackHostName, port, path);
 
         logger.debug(String.format("RESTFacade built callback url: %s", callbackUrl));
         template = RESTFacade.createRestTemplate(CoreGlobalProperty.REST_FACADE_READ_TIMEOUT, CoreGlobalProperty.REST_FACADE_CONNECT_TIMEOUT);
@@ -222,6 +211,26 @@ void init() {
                 CoreGlobalProperty.REST_FACADE_MAX_TOTAL);
     }
 
+    public static String buildBaseUrl(String hostName, int port, String path) {
+        String url = IPv6NetworkUtils.buildHttpUrl(hostName, port);
+        if (path != null && !path.isEmpty()) {
+            url = String.format("%s/%s", url, path);
+        }
+        return UriComponentsBuilder.fromHttpUrl(url).build().toUriString();
+    }
+
+    public static String buildCallbackUrl(String hostName, int port, String path) {
+        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(buildBaseUrl(hostName, port, path));
+        ub.path(RESTConstant.CALLBACK_PATH);
+        return ub.build().toUriString();
+    }
+
+    public static String buildSendCommandUrl(String hostName, int port, String path) {
+        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(buildBaseUrl(hostName, port, path));
+        ub.path(RESTConstant.COMMAND_CHANNEL_PATH);
+        return ub.build().toUriString();
+    }
+
     // timeout are in milliseconds
     private static AsyncRestTemplate createAsyncRestTemplate(int readTimeout, int connectTimeout, int maxPerRoute, int maxTotal) {
         PoolingNHttpClientConnectionManager connectionManager;
@@ -1017,6 +1026,11 @@ public String getCallbackUrl() {
         return callbackUrl;
     }
 
+    @Override
+    public String buildCallbackUrl(String hostName) {
+        return buildCallbackUrl(hostName, port, path);
+    }
+
     @Override
     public String getHostName() {
         return callbackHostName;
diff --git a/core/src/main/java/org/zstack/core/search/SearchBackendConstant.java b/core/src/main/java/org/zstack/core/search/SearchBackendConstant.java
new file mode 100644
index 00000000000..5bba5fde94d
--- /dev/null
+++ b/core/src/main/java/org/zstack/core/search/SearchBackendConstant.java
@@ -0,0 +1,7 @@
+package org.zstack.core.search;
+
+public class SearchBackendConstant {
+    public static final String SEARCH_BACKEND_PROPERTY = "Search.backend";
+    public static final String JGROUPS_BACKEND = "jgroups";
+    public static final String ZSTACK_ZSHA2_JGROUPS_BACKEND = "org.zstack.core.search.ZStackZSha2JGroupsBackend";
+}
diff --git a/core/src/main/java/org/zstack/core/search/ZStackZSha2JGroupsBackend.java b/core/src/main/java/org/zstack/core/search/ZStackZSha2JGroupsBackend.java
new file mode 100644
index 00000000000..55b7182b964
--- /dev/null
+++ b/core/src/main/java/org/zstack/core/search/ZStackZSha2JGroupsBackend.java
@@ -0,0 +1,12 @@
+package org.zstack.core.search;
+
+import org.hibernate.search.backend.jgroups.impl.JGroupsBackend;
+import org.hibernate.search.backend.jgroups.impl.NodeSelectorStrategy;
+import org.hibernate.search.indexes.spi.IndexManager;
+
+public class ZStackZSha2JGroupsBackend extends JGroupsBackend {
+    @Override
+    protected NodeSelectorStrategy createNodeSelectorStrategy(IndexManager indexManager) {
+        return new ZStackZSha2NodeSelector();
+    }
+}
diff --git a/core/src/main/java/org/zstack/core/search/ZStackZSha2NodeSelector.java b/core/src/main/java/org/zstack/core/search/ZStackZSha2NodeSelector.java
new file mode 100644
index 00000000000..726b5b6bdb7
--- /dev/null
+++ b/core/src/main/java/org/zstack/core/search/ZStackZSha2NodeSelector.java
@@ -0,0 +1,21 @@
+package org.zstack.core.search;
+
+import org.hibernate.search.backend.jgroups.impl.NodeSelectorStrategy;
+import org.jgroups.Address;
+import org.jgroups.View;
+import org.zstack.core.Platform;
+
+public class ZStackZSha2NodeSelector implements NodeSelectorStrategy {
+    @Override
+    public boolean isIndexOwnerLocal() {
+        return Platform.isVIPNode();
+    }
+
+    @Override
+    public void setLocalAddress(Address address) {
+    }
+
+    @Override
+    public void viewAccepted(View view) {
+    }
+}
diff --git a/core/src/main/java/org/zstack/core/timeout/ApiTimeoutManagerImpl.java b/core/src/main/java/org/zstack/core/timeout/ApiTimeoutManagerImpl.java
index e1a6697918f..32648038afe 100755
--- a/core/src/main/java/org/zstack/core/timeout/ApiTimeoutManagerImpl.java
+++ b/core/src/main/java/org/zstack/core/timeout/ApiTimeoutManagerImpl.java
@@ -5,7 +5,8 @@
 import org.zstack.core.cloudbus.CloudBus;
 import org.zstack.core.componentloader.PluginRegistry;
 import org.zstack.core.config.*;
-import org.zstack.core.db.Q;
+import org.zstack.core.db.DatabaseFacade;
+import org.zstack.core.db.SimpleQuery;
 import org.zstack.core.thread.ThreadFacade;
 import org.zstack.header.Component;
 import org.zstack.header.errorcode.OperationFailureException;
@@ -37,6 +38,8 @@ public class ApiTimeoutManagerImpl implements ApiTimeoutManager, Component,
     @Autowired
     private ThreadFacade thdf;
     @Autowired
+    private DatabaseFacade dbf;
+    @Autowired
     private Timer timer;
 
     // Legacy timeout which is configured in zstack.properties is prior 3.2.0
@@ -221,9 +224,9 @@ private List<GlobalConfig> prepareTimeoutGlobalConfig() {
     private String getTimeoutGlobalConfigValue(Class clz, GlobalConfigVO vo) {
         // once global config already exists, use its default value as
         // auto generated value and do not use legacy timeout
-        if (Q.New(GlobalConfigVO.class)
-                .eq(GlobalConfigVO_.category, vo.getCategory())
-                .eq(GlobalConfigVO_.name, vo.getName()).isExists()) {
+        if (dbf.createQuery(GlobalConfigVO.class)
+                .add(GlobalConfigVO_.category, SimpleQuery.Op.EQ, vo.getCategory())
+                .add(GlobalConfigVO_.name, SimpleQuery.Op.EQ, vo.getName()).isExists()) {
             return vo.getDefaultValue();
         }
 
diff --git a/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java b/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java
index b9f2792ea65..381e1b5617a 100755
--- a/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java
+++ b/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java
@@ -18,6 +18,10 @@ public class APIUpdateConsoleProxyAgentMsg extends APIMessage implements Console
     private String uuid;
     @APIParam
     private String consoleProxyOverriddenIp;
+    @APIParam(required = false)
+    private String consoleProxyOverriddenIpv4;
+    @APIParam(required = false)
+    private String consoleProxyOverriddenIpv6;
     @APIParam(required = false, numberRange={1, 65535})
     private Integer consoleProxyPort;
 
@@ -45,10 +49,28 @@ public void setConsoleProxyOverriddenIp(String consoleProxyOverriddenIp) {
         this.consoleProxyOverriddenIp = consoleProxyOverriddenIp;
     }
 
+    public String getConsoleProxyOverriddenIpv4() {
+        return consoleProxyOverriddenIpv4;
+    }
+
+    public void setConsoleProxyOverriddenIpv4(String consoleProxyOverriddenIpv4) {
+        this.consoleProxyOverriddenIpv4 = consoleProxyOverriddenIpv4;
+    }
+
+    public String getConsoleProxyOverriddenIpv6() {
+        return consoleProxyOverriddenIpv6;
+    }
+
+    public void setConsoleProxyOverriddenIpv6(String consoleProxyOverriddenIpv6) {
+        this.consoleProxyOverriddenIpv6 = consoleProxyOverriddenIpv6;
+    }
+
     public static APIUpdateConsoleProxyAgentMsg __example__() {
         APIUpdateConsoleProxyAgentMsg msg = new APIUpdateConsoleProxyAgentMsg();
         msg.setUuid(uuid());
         msg.setConsoleProxyOverriddenIp("127.0.0.1");
+        msg.setConsoleProxyOverriddenIpv4("127.0.0.1");
+        msg.setConsoleProxyOverriddenIpv6("2001:db8::100");
         msg.setConsoleProxyPort(4789);
         return msg;
     }
diff --git a/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsgDoc_zh_cn.groovy b/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsgDoc_zh_cn.groovy
index 914e5a128c3..18356acfaaf 100644
--- a/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsgDoc_zh_cn.groovy
+++ b/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsgDoc_zh_cn.groovy
@@ -66,6 +66,24 @@ doc {
 					optional true
 					since "4.1.0"
 				}
+				column {
+					name "consoleProxyOverriddenIpv4"
+					enclosedIn "updateConsoleProxyAgent"
+					desc ""
+					location "body"
+					type "String"
+					optional true
+					since "5.5.16"
+				}
+				column {
+					name "consoleProxyOverriddenIpv6"
+					enclosedIn "updateConsoleProxyAgent"
+					desc ""
+					location "body"
+					type "String"
+					optional true
+					since "5.5.16"
+				}
 			}
         }
 
diff --git a/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentInventory.java b/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentInventory.java
index db0fbd40a5c..5847b48334f 100755
--- a/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentInventory.java
+++ b/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentInventory.java
@@ -16,6 +16,8 @@ public class ConsoleProxyAgentInventory {
     private String description;
     private String managementIp;
     private String consoleProxyOverriddenIp;
+    private String consoleProxyOverriddenIpv4;
+    private String consoleProxyOverriddenIpv6;
     private Integer consoleProxyPort;
     private String type;
     private String status;
@@ -30,6 +32,8 @@ public static ConsoleProxyAgentInventory valueOf(ConsoleProxyAgentVO vo) {
         inv.setDescription(vo.getDescription());
         inv.setManagementIp(vo.getManagementIp());
         inv.setConsoleProxyOverriddenIp(vo.getConsoleProxyOverriddenIp());
+        inv.setConsoleProxyOverriddenIpv4(vo.getConsoleProxyOverriddenIpv4());
+        inv.setConsoleProxyOverriddenIpv6(vo.getConsoleProxyOverriddenIpv6());
         inv.setConsoleProxyPort(vo.getConsoleProxyPort());
         inv.setCreateDate(vo.getCreateDate());
         inv.setLastOpDate(vo.getLastOpDate());
@@ -125,4 +129,20 @@ public String getConsoleProxyOverriddenIp() {
     public void setConsoleProxyOverriddenIp(String consoleProxyOverriddenIp) {
         this.consoleProxyOverriddenIp = consoleProxyOverriddenIp;
     }
+
+    public String getConsoleProxyOverriddenIpv4() {
+        return consoleProxyOverriddenIpv4;
+    }
+
+    public void setConsoleProxyOverriddenIpv4(String consoleProxyOverriddenIpv4) {
+        this.consoleProxyOverriddenIpv4 = consoleProxyOverriddenIpv4;
+    }
+
+    public String getConsoleProxyOverriddenIpv6() {
+        return consoleProxyOverriddenIpv6;
+    }
+
+    public void setConsoleProxyOverriddenIpv6(String consoleProxyOverriddenIpv6) {
+        this.consoleProxyOverriddenIpv6 = consoleProxyOverriddenIpv6;
+    }
 }
diff --git a/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentVO.java b/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentVO.java
index e3c1489f751..8db4df9b3ec 100755
--- a/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentVO.java
+++ b/header/src/main/java/org/zstack/header/console/ConsoleProxyAgentVO.java
@@ -28,6 +28,12 @@ public class ConsoleProxyAgentVO {
     @Column
     private String consoleProxyOverriddenIp;
 
+    @Column
+    private String consoleProxyOverriddenIpv4;
+
+    @Column
+    private String consoleProxyOverriddenIpv6;
+
     @Column
     private Integer consoleProxyPort;
 
@@ -85,6 +91,22 @@ public void setConsoleProxyOverriddenIp(String consoleProxyOverriddenIp) {
         this.consoleProxyOverriddenIp = consoleProxyOverriddenIp;
     }
 
+    public String getConsoleProxyOverriddenIpv4() {
+        return consoleProxyOverriddenIpv4;
+    }
+
+    public void setConsoleProxyOverriddenIpv4(String consoleProxyOverriddenIpv4) {
+        this.consoleProxyOverriddenIpv4 = consoleProxyOverriddenIpv4;
+    }
+
+    public String getConsoleProxyOverriddenIpv6() {
+        return consoleProxyOverriddenIpv6;
+    }
+
+    public void setConsoleProxyOverriddenIpv6(String consoleProxyOverriddenIpv6) {
+        this.consoleProxyOverriddenIpv6 = consoleProxyOverriddenIpv6;
+    }
+
     public Integer getConsoleProxyPort() {
         return consoleProxyPort;
     }
diff --git a/header/src/main/java/org/zstack/header/console/UpdateConsoleProxyAgentMsg.java b/header/src/main/java/org/zstack/header/console/UpdateConsoleProxyAgentMsg.java
index a0473422db1..944a73132f8 100644
--- a/header/src/main/java/org/zstack/header/console/UpdateConsoleProxyAgentMsg.java
+++ b/header/src/main/java/org/zstack/header/console/UpdateConsoleProxyAgentMsg.java
@@ -8,6 +8,8 @@
 public class UpdateConsoleProxyAgentMsg extends NeedReplyMessage implements ConsoleProxyAgentMessage {
     private String uuid;
     private String consoleProxyOverriddenIp;
+    private String consoleProxyOverriddenIpv4;
+    private String consoleProxyOverriddenIpv6;
     private Integer consoleProxyPort;
 
     public Integer getConsoleProxyPort() {
@@ -33,4 +35,20 @@ public String getConsoleProxyOverriddenIp() {
     public void setConsoleProxyOverriddenIp(String consoleProxyOverriddenIp) {
         this.consoleProxyOverriddenIp = consoleProxyOverriddenIp;
     }
+
+    public String getConsoleProxyOverriddenIpv4() {
+        return consoleProxyOverriddenIpv4;
+    }
+
+    public void setConsoleProxyOverriddenIpv4(String consoleProxyOverriddenIpv4) {
+        this.consoleProxyOverriddenIpv4 = consoleProxyOverriddenIpv4;
+    }
+
+    public String getConsoleProxyOverriddenIpv6() {
+        return consoleProxyOverriddenIpv6;
+    }
+
+    public void setConsoleProxyOverriddenIpv6(String consoleProxyOverriddenIpv6) {
+        this.consoleProxyOverriddenIpv6 = consoleProxyOverriddenIpv6;
+    }
 }
diff --git a/header/src/main/java/org/zstack/header/host/APIAddHostMsg.java b/header/src/main/java/org/zstack/header/host/APIAddHostMsg.java
index ad7c6dc9270..421a3194023 100755
--- a/header/src/main/java/org/zstack/header/host/APIAddHostMsg.java
+++ b/header/src/main/java/org/zstack/header/host/APIAddHostMsg.java
@@ -19,7 +19,7 @@ public abstract class APIAddHostMsg extends APICreateMessage implements AddHostM
     @APIParam(required = false, maxLength = 2048)
     private String description;
     /**
-     * @desc IPv4 address or DNS name of management nic
+     * @desc IPv4 address, IPv6 address, or DNS name of management nic
      */
     @APIParam(emptyString = false)
     private String managementIp;
@@ -73,4 +73,4 @@ public Result audit(APIMessage msg, APIEvent rsp) {
 
         return new Result(uuid, HostVO.class);
     }
-}
\ No newline at end of file
+}
diff --git a/header/src/main/java/org/zstack/header/host/APIUpdateHostMsgDoc_zh_cn.groovy b/header/src/main/java/org/zstack/header/host/APIUpdateHostMsgDoc_zh_cn.groovy
index 47269edf949..2df152ab39a 100644
--- a/header/src/main/java/org/zstack/header/host/APIUpdateHostMsgDoc_zh_cn.groovy
+++ b/header/src/main/java/org/zstack/header/host/APIUpdateHostMsgDoc_zh_cn.groovy
@@ -51,7 +51,7 @@ doc {
 				column {
 					name "managementIp"
 					enclosedIn "updateHost"
-					desc ""
+					desc "物理机管理地址，支持IPv4地址、IPv6地址或DNS名称"
 					location "body"
 					type "String"
 					optional true
diff --git a/header/src/main/java/org/zstack/header/rest/RESTFacade.java b/header/src/main/java/org/zstack/header/rest/RESTFacade.java
index a70d5d7e337..23fee5208c2 100755
--- a/header/src/main/java/org/zstack/header/rest/RESTFacade.java
+++ b/header/src/main/java/org/zstack/header/rest/RESTFacade.java
@@ -91,6 +91,14 @@ public interface RESTFacade {
 
     String getCallbackUrl();
 
+    /**
+     * Builds an async REST callback URL using the specified callback host name or IP address.
+     *
+     * @param hostName callback host name or IP address
+     * @return callback URL reachable by agents
+     */
+    String buildCallbackUrl(String hostName);
+
     String getHostName();
 
     int getPort();
diff --git a/header/src/main/java/org/zstack/header/zone/APICreateZoneMsg.java b/header/src/main/java/org/zstack/header/zone/APICreateZoneMsg.java
index aa0edd62b81..23a523cd087 100755
--- a/header/src/main/java/org/zstack/header/zone/APICreateZoneMsg.java
+++ b/header/src/main/java/org/zstack/header/zone/APICreateZoneMsg.java
@@ -8,6 +8,7 @@
 import org.zstack.header.other.APIAuditor;
 import org.zstack.header.rest.APINoSee;
 import org.zstack.header.rest.RestRequest;
+import org.zstack.header.tag.TagResourceType;
 
 /**
  * @api create a new zone
@@ -36,6 +37,7 @@
  * @result see :ref:`APICreateZoneEvent`
  * @since 0.1.0
  */
+@TagResourceType(ZoneVO.class)
 @RestRequest(
         path = "/zones",
         method = HttpMethod.POST,
diff --git a/header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionManager.java b/header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionManager.java
new file mode 100644
index 00000000000..0c613eb2d92
--- /dev/null
+++ b/header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionManager.java
@@ -0,0 +1,56 @@
+package org.zstack.header.zone;
+
+public interface ManagementNetworkIpVersionManager {
+    /**
+     * Validate an endpoint against the management network IP version configured
+     * on a zone.
+     *
+     * @param zoneUuid zone UUID; validation is skipped when it is null
+     * @param endpoint address, URI, or storage URL to validate
+     * @param resourceType resource type used in the error message
+     * @param resourceIdentity resource identifier used in the error message
+     * @param errorCode global error code used when IP versions mismatch
+     * @throws org.zstack.header.apimediator.ApiMessageInterceptionException
+     *         when the endpoint uses an unsupported IPv6 link-local address or
+     *         a different IP version from the zone
+     */
+    void validateEndpointInZone(String zoneUuid, String endpoint, String resourceType, String resourceIdentity, String errorCode);
+
+    /**
+     * Validate an endpoint against a caller-provided IP version.
+     *
+     * @param zoneUuid zone UUID used in the error message; validation is skipped
+     *                 when it is null
+     * @param ipVersion expected IP version, {@code ipv4} or {@code ipv6};
+     *                  validation is skipped when it is null
+     * @param endpoint address, URI, or storage URL to validate
+     * @param resourceType resource type used in the error message
+     * @param resourceIdentity resource identifier used in the error message
+     * @param errorCode global error code used when IP versions mismatch
+     * @throws org.zstack.header.apimediator.ApiMessageInterceptionException
+     *         when the endpoint uses an unsupported IPv6 link-local address or
+     *         a different IP version from {@code ipVersion}
+     */
+    void validateEndpointMatchesIpVersion(String zoneUuid, String ipVersion, String endpoint,
+                                          String resourceType, String resourceIdentity, String errorCode);
+
+    /**
+     * Validate that existing zone resources can keep working after the zone
+     * management network IP version is changed.
+     *
+     * @param zoneUuid zone UUID
+     * @param ipVersion target IP version, {@code ipv4} or {@code ipv6}
+     * @throws org.zstack.header.apimediator.ApiMessageInterceptionException
+     *         when an existing host or extension-owned resource has an
+     *         incompatible endpoint
+     */
+    void validateZoneCompatibleWithExistingResources(String zoneUuid, String ipVersion);
+
+    /**
+     * Return the zone management network IP version.
+     *
+     * @param zoneUuid zone UUID
+     * @return configured IP version, or {@code ipv4} when no zone tag is set
+     */
+    String getZoneIpVersion(String zoneUuid);
+}
diff --git a/header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionResourceExtensionPoint.java b/header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionResourceExtensionPoint.java
new file mode 100644
index 00000000000..8615793064f
--- /dev/null
+++ b/header/src/main/java/org/zstack/header/zone/ManagementNetworkIpVersionResourceExtensionPoint.java
@@ -0,0 +1,5 @@
+package org.zstack.header.zone;
+
+public interface ManagementNetworkIpVersionResourceExtensionPoint {
+    void validateExistingResourcesInZone(String zoneUuid, String ipVersion);
+}
diff --git a/network/src/main/java/org/zstack/network/l3/L3NetworkApiInterceptor.java b/network/src/main/java/org/zstack/network/l3/L3NetworkApiInterceptor.java
index ac88e09dbf8..6a16cee1e3a 100755
--- a/network/src/main/java/org/zstack/network/l3/L3NetworkApiInterceptor.java
+++ b/network/src/main/java/org/zstack/network/l3/L3NetworkApiInterceptor.java
@@ -444,10 +444,7 @@ private void validateIpv6Range(IpRangeInventory ipr) {
         }
 
         L3NetworkVO l3Vo = Q.New(L3NetworkVO.class).eq(L3NetworkVO_.uuid, ipr.getL3NetworkUuid()).find();
-
-        if (l3Vo.getCategory().equals(L3NetworkCategory.System)) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L3_10034, "can not add ip range, because system network doesn't support ipv6 yet"));
-        }
+        validateManagementNetworkIpRangeVersion(l3Vo, IPv6Constants.IPv6);
 
         List<NormalIpRangeVO> rangeVOS = Q.New(NormalIpRangeVO.class).eq(NormalIpRangeVO_.l3NetworkUuid, ipr.getL3NetworkUuid()).eq(NormalIpRangeVO_.ipVersion, IPv6Constants.IPv6).list();
         if (rangeVOS != null && !rangeVOS.isEmpty()) {
@@ -626,6 +623,7 @@ private void validateAddressPool(IpRangeInventory ipr) {
 
     private void validate(IpRangeInventory ipr) {
         L3NetworkVO l3Vo = Q.New(L3NetworkVO.class).eq(L3NetworkVO_.uuid, ipr.getL3NetworkUuid()).find();
+        validateManagementNetworkIpRangeVersion(l3Vo, IPv6Constants.IPv4);
 
         if (ipr.getIpRangeType() == IpRangeType.AddressPool && l3Vo.getCategory() != L3NetworkCategory.Public) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L3_10049, "l3 network [uuid %s: name %s] is not a public network, address pool range can not be added", l3Vo.getUuid(), l3Vo.getName()));
@@ -773,6 +771,29 @@ private void validate(IpRangeInventory ipr) {
         }
     }
 
+    private void validateManagementNetworkIpRangeVersion(L3NetworkVO l3Vo, int newIpVersion) {
+        if (l3Vo.getCategory() != L3NetworkCategory.System) {
+            return;
+        }
+
+        int existingIpVersion = newIpVersion == IPv6Constants.IPv4 ? IPv6Constants.IPv6 : IPv6Constants.IPv4;
+        boolean hasExistingIpRange = Q.New(IpRangeVO.class)
+                .eq(IpRangeVO_.l3NetworkUuid, l3Vo.getUuid())
+                .eq(IpRangeVO_.ipVersion, existingIpVersion)
+                .isExists();
+        if (!hasExistingIpRange) {
+            return;
+        }
+
+        throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L3_10082,
+                "management network l3[uuid:%s] cannot mix IPv4 and IPv6 IP ranges; existing IP version is %s, new IP version is %s",
+                l3Vo.getUuid(), getIpVersionName(existingIpVersion), getIpVersionName(newIpVersion)));
+    }
+
+    private String getIpVersionName(int ipVersion) {
+        return ipVersion == IPv6Constants.IPv6 ? "IPv6" : "IPv4";
+    }
+
     private void validate(APIAddIpRangeMsg msg) {
         if (msg.getIpRangeType() == null) {
             msg.setIpRangeType(IpRangeType.Normal.toString());
diff --git a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmBase.java b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmBase.java
index b506da2aceb..995eda65293 100755
--- a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmBase.java
+++ b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmBase.java
@@ -39,6 +39,7 @@
 import org.zstack.utils.RangeSet;
 import org.zstack.utils.RangeSet.Range;
 import org.zstack.utils.function.Function;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.util.*;
 
@@ -47,6 +48,8 @@
 import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.*;
 
 public abstract class ApplianceVmBase extends VmInstanceBase implements ApplianceVm {
+    private static final String AGENT_BASE_URL_FORMAT = "%s://%s:%s";
+
     @Autowired
     private RESTFacade restf;
     
@@ -220,14 +223,9 @@ protected void handle(final ApplianceVmChangeStatusMsg msg) {
     }
 
     public static String buildAgentUrl(String hostname, String subPath, int port) {
-        UriComponentsBuilder ub = UriComponentsBuilder.newInstance();
-        ub.scheme(ApplianceVmGlobalProperty.AGENT_URL_SCHEME);
-        if (CoreGlobalProperty.UNIT_TEST_ON) {
-            ub.host("localhost");
-        } else {
-            ub.host(hostname);
-        }
-        ub.port(port);
+        String agentHost = CoreGlobalProperty.UNIT_TEST_ON ? "localhost" : IPv6NetworkUtils.formatHostForUrl(hostname);
+        String baseUrl = String.format(AGENT_BASE_URL_FORMAT, ApplianceVmGlobalProperty.AGENT_URL_SCHEME, agentHost, port);
+        UriComponentsBuilder ub = UriComponentsBuilder.fromUriString(baseUrl);
         if (!"".equals(ApplianceVmGlobalProperty.AGENT_URL_ROOT_PATH)) {
             ub.path(ApplianceVmGlobalProperty.AGENT_URL_ROOT_PATH);
         }
diff --git a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmConstant.java b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmConstant.java
index 094771f24bb..a2c7b8bad8c 100755
--- a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmConstant.java
+++ b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmConstant.java
@@ -33,6 +33,7 @@ public enum BootstrapParams {
         managementNodeIp,
         managementNodeVip,
         managementNodeCidr,
+        managementNodeIp6Cidr,
         additionalL3Uuids,
     }
 
diff --git a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java
index 76d98729668..f0295bf6351 100755
--- a/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java
+++ b/plugin/applianceVm/src/main/java/org/zstack/appliancevm/ApplianceVmFacadeImpl.java
@@ -1,6 +1,7 @@
 package org.zstack.appliancevm;
 
 import com.google.gson.Gson;
+import org.apache.commons.lang.StringUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.transaction.annotation.Transactional;
 import org.zstack.appliancevm.ApplianceVmConstant.BootstrapParams;
@@ -31,6 +32,7 @@
 import org.zstack.header.message.Message;
 import org.zstack.header.message.MessageReply;
 import org.zstack.header.network.l2.*;
+import org.zstack.header.network.l3.UsedIpInventory;
 import org.zstack.header.network.l3.L3NetworkVO;
 import org.zstack.header.network.l3.L3NetworkVO_;
 import org.zstack.header.rest.RESTFacade;
@@ -46,6 +48,8 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.function.Function;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6Constants;
+import org.zstack.utils.network.NetworkUtils;
 
 import javax.persistence.Query;
 import java.util.*;
@@ -59,6 +63,7 @@
  */
 public class ApplianceVmFacadeImpl extends AbstractService implements ApplianceVmFacade, Component {
     private static final CLogger logger = Utils.getLogger(ApplianceVmFacadeImpl.class);
+    private static final String NO_MATCHED_MN_IP_WARN = "no MN IP matched VR management CIDR %s, fallback to %s";
 
     @Autowired
     private CloudBus bus;
@@ -461,9 +466,13 @@ public Map<String, Object> prepareBootstrapInformation(VmInstanceSpec spec) {
         String publicKey = asf.getPublicKey();
         ret.put(ApplianceVmConstant.BootstrapParams.publicKey.toString(), publicKey);
         ret.put(BootstrapParams.uuid.toString(), spec.getVmInventory().getUuid());
-        ret.put(BootstrapParams.managementNodeIp.toString(), Platform.getManagementServerIp());
-        ret.put(BootstrapParams.managementNodeVip.toString(), Platform.getManagementServerVip());
-        ret.put(BootstrapParams.managementNodeCidr.toString(), Platform.getManagementServerCidr());
+        putManagementNodeBootstrapParams(ret,
+                Platform.getManagementServerIpsWithLocalFallback(),
+                getVrManagementCidrs(mgmtNic),
+                Platform.getManagementServerIp(),
+                Platform.getManagementServerVip(),
+                Platform.getManagementServerCidr(),
+                Platform.getManagementServerIp6Cidr());
         /* this is only used by ApplianceVmPrepareBootstrapInfoExtensionPoint extension point, will be deleted after extension point */
         ret.put(BootstrapParams.additionalL3Uuids.toString(), additionalNics.stream().map(VmNicInventory::getL3NetworkUuid).collect(Collectors.toList()));
 
@@ -475,6 +484,60 @@ public Map<String, Object> prepareBootstrapInformation(VmInstanceSpec spec) {
         return ret;
     }
 
+    public static String selectManagementNodeIpForBootstrap(Collection<String> mnIps, Collection<String> vrManagementCidrs, String fallbackIp) {
+        for (String cidr : vrManagementCidrs) {
+            if (!NetworkUtils.isCidr(cidr)) {
+                continue;
+            }
+            for (String ip : mnIps) {
+                if (StringUtils.isBlank(ip)) {
+                    continue;
+                }
+                if (NetworkUtils.isIpInCidr(ip, cidr)) {
+                    return ip;
+                }
+            }
+        }
+
+        if (!vrManagementCidrs.isEmpty()) {
+            logger.warn(String.format(NO_MATCHED_MN_IP_WARN, String.join(",", vrManagementCidrs), fallbackIp));
+        }
+        return fallbackIp;
+    }
+
+    public static void putManagementNodeBootstrapParams(Map<String, Object> ret,
+                                                        Collection<String> mnIps,
+                                                        Collection<String> vrManagementCidrs,
+                                                        String fallbackIp,
+                                                        String managementNodeVip,
+                                                        String managementNodeCidr,
+                                                        String managementNodeIp6Cidr) {
+        ret.put(BootstrapParams.managementNodeIp.toString(),
+                selectManagementNodeIpForBootstrap(mnIps, vrManagementCidrs, fallbackIp));
+        ret.put(BootstrapParams.managementNodeVip.toString(), managementNodeVip);
+        ret.put(BootstrapParams.managementNodeCidr.toString(), managementNodeCidr);
+        if (managementNodeIp6Cidr != null) {
+            ret.put(BootstrapParams.managementNodeIp6Cidr.toString(), managementNodeIp6Cidr);
+        }
+    }
+
+    private Collection<String> getVrManagementCidrs(VmNicInventory managementNic) {
+        List<String> cidrs = new ArrayList<>();
+        if (managementNic == null || managementNic.getUsedIps() == null) {
+            return cidrs;
+        }
+
+        for (UsedIpInventory ip : managementNic.getUsedIps()) {
+            if (Objects.equals(ip.getIpVersion(), IPv6Constants.IPv4) && StringUtils.isNotBlank(ip.getNetmask())) {
+                cidrs.add(NetworkUtils.getCidrFromIpMask(ip.getIp(), ip.getNetmask()));
+            } else if (Objects.equals(ip.getIpVersion(), IPv6Constants.IPv6) && ip.getPrefixLen() != null) {
+                cidrs.add(NetworkUtils.getNetworkAddressFromCidr(String.format("%s/%s", ip.getIp(), ip.getPrefixLen())));
+            }
+        }
+
+        return cidrs;
+    }
+
 
     @Override
     public Flow createBootstrapFlow(HypervisorType hvType) {
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/CephApiInterceptor.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/CephApiInterceptor.java
index 7d334680e97..d04f73137df 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/CephApiInterceptor.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/CephApiInterceptor.java
@@ -9,11 +9,18 @@
 import org.zstack.header.apimediator.ApiMessageInterceptionException;
 import org.zstack.header.apimediator.ApiMessageInterceptor;
 import org.zstack.header.apimediator.GlobalApiMessageInterceptor;
+import org.zstack.header.cluster.ClusterVO;
+import org.zstack.header.cluster.ClusterVO_;
 import org.zstack.header.errorcode.OperationFailureException;
 import org.zstack.header.message.APIMessage;
+import org.zstack.header.storage.backup.APIAttachBackupStorageToZoneMsg;
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO;
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO_;
 import org.zstack.header.storage.primary.APIAttachPrimaryStorageToClusterMsg;
-import org.zstack.header.storage.primary.PrimaryStorageClusterRefVO;
-import org.zstack.header.storage.primary.PrimaryStorageClusterRefVO_;
+import org.zstack.header.storage.primary.PrimaryStorageVO;
+import org.zstack.header.storage.primary.PrimaryStorageVO_;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
+import org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint;
 import org.zstack.storage.ceph.backup.*;
 import org.zstack.storage.ceph.primary.*;
 import org.zstack.utils.CharacterUtils;
@@ -22,7 +29,7 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.function.Function;
 import org.zstack.utils.logging.CLogger;
-import org.zstack.utils.network.NetworkUtils;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -34,13 +41,19 @@
 /**
  * Created by frank on 7/29/2015.
  */
-public class CephApiInterceptor implements ApiMessageInterceptor, GlobalApiMessageInterceptor {
+public class CephApiInterceptor implements ApiMessageInterceptor, GlobalApiMessageInterceptor,
+        ManagementNetworkIpVersionResourceExtensionPoint {
     private static final CLogger logger = Utils.getLogger(CephApiInterceptor.class);
 
+    private static final String CEPH_PRIMARY_STORAGE_RESOURCE_TYPE = "ceph primary storage";
+    private static final String CEPH_PRIMARY_STORAGE_MON_RESOURCE_TYPE = "ceph primary storage mon";
+    private static final String CEPH_BACKUP_STORAGE_MON_RESOURCE_TYPE = "ceph backup storage mon";
     @Autowired
     private ErrorFacade errf;
     @Autowired
     private DatabaseFacade dbf;
+    @Autowired
+    private ManagementNetworkIpVersionManager managementNetworkIpVersionManager;
 
     private static final String MON_URL_FORMAT = "sshUsername:sshPassword@hostname:[sshPort]/?[monPort=]";
 
@@ -64,6 +77,10 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
             validate((APIAddCephPrimaryStoragePoolMsg) msg);
         } else if (msg instanceof APIUpdateCephPrimaryStoragePoolMsg) {
             validate((APIUpdateCephPrimaryStoragePoolMsg) msg);
+        } else if (msg instanceof APIAttachPrimaryStorageToClusterMsg) {
+            validate((APIAttachPrimaryStorageToClusterMsg) msg);
+        } else if (msg instanceof APIAttachBackupStorageToZoneMsg) {
+            validate((APIAttachBackupStorageToZoneMsg) msg);
         }
         
         return msg;
@@ -140,6 +157,7 @@ private void distinctMons(List<String> mons) {
 
     private void validate(APIAddMonToCephPrimaryStorageMsg msg) {
         checkMonUrls(msg.getMonUrls());
+        validatePrimaryStorageMonUrls(msg.getPrimaryStorageUuid(), msg.getMonUrls(), ORG_ZSTACK_STORAGE_CEPH_10026);
         List<String> hostnames = msg.getMonUrls().stream()
                 .map(MonUri::new)
                 .map(MonUri::getHostname)
@@ -152,6 +170,7 @@ private void validate(APIAddMonToCephPrimaryStorageMsg msg) {
 
     private void validate(APIAddMonToCephBackupStorageMsg msg) {
         checkMonUrls(msg.getMonUrls());
+        validateBackupStorageMonUrls(msg.getBackupStorageUuid(), msg.getMonUrls(), ORG_ZSTACK_STORAGE_CEPH_10027);
 
         List<String> hostnames = msg.getMonUrls().stream()
                 .map(MonUri::new)
@@ -163,21 +182,25 @@ private void validate(APIAddMonToCephBackupStorageMsg msg) {
         }
     }
     private void validate(APIUpdateCephBackupStorageMonMsg msg) {
-        if (msg.getHostname() != null && !NetworkUtils.isIpv4Address(msg.getHostname()) && !NetworkUtils.isHostname(msg.getHostname())) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_CEPH_10013, "hostname[%s] is neither an IPv4 address nor a valid hostname", msg.getHostname()));
+        if (msg.getHostname() != null && !IPv6NetworkUtils.isValidManagementEndpoint(msg.getHostname())) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_CEPH_10035,
+                    "hostname[%s] is not a valid IPv4 address, IPv6 address, or hostname", msg.getHostname()));
         }
         SimpleQuery<CephBackupStorageMonVO> q = dbf.createQuery(CephBackupStorageMonVO.class);
         q.select(CephBackupStorageMonVO_.backupStorageUuid);
-        q.add(CephPrimaryStorageMonVO_.uuid, Op.EQ, msg.getMonUuid());
+        q.add(CephBackupStorageMonVO_.uuid, Op.EQ, msg.getMonUuid());
         String bsUuid = q.findValue();
         msg.setBackupStorageUuid(bsUuid);
+        if (msg.getHostname() != null) {
+            validateBackupStorageEndpoint(bsUuid, msg.getHostname(), CEPH_BACKUP_STORAGE_MON_RESOURCE_TYPE, msg.getMonUuid(),
+                    ORG_ZSTACK_STORAGE_CEPH_10028);
+        }
     }
 
     private void validate(APIUpdateCephPrimaryStorageMonMsg msg) {
-        if (msg.getHostname() != null && !NetworkUtils.isIpv4Address(msg.getHostname()) && !NetworkUtils.isHostname(msg.getHostname())) {
-            throw new ApiMessageInterceptionException(argerr(
-            ORG_ZSTACK_STORAGE_CEPH_10014,         String.format("hostname[%s] is neither an IPv4 address nor a valid hostname", msg.getHostname())
-            ));
+        if (msg.getHostname() != null && !IPv6NetworkUtils.isValidManagementEndpoint(msg.getHostname())) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_CEPH_10036,
+                    "hostname[%s] is not a valid IPv4 address, IPv6 address, or hostname", msg.getHostname()));
         }
 
         SimpleQuery<CephPrimaryStorageMonVO> q = dbf.createQuery(CephPrimaryStorageMonVO.class);
@@ -185,6 +208,10 @@ private void validate(APIUpdateCephPrimaryStorageMonMsg msg) {
         q.add(CephPrimaryStorageMonVO_.uuid, Op.EQ, msg.getMonUuid());
         String psUuid = q.findValue();
         msg.setPrimaryStorageUuid(psUuid);
+        if (msg.getHostname() != null) {
+            validatePrimaryStorageEndpoint(psUuid, msg.getHostname(), CEPH_PRIMARY_STORAGE_MON_RESOURCE_TYPE, msg.getMonUuid(),
+                    ORG_ZSTACK_STORAGE_CEPH_10029);
+        }
     }
 
     private void checkMonUrls(List<String> monUrls) {
@@ -221,6 +248,8 @@ private void validate(APIAddCephPrimaryStorageMsg msg) {
         }
 
         checkMonUrls(msg.getMonUrls());
+        validateMonUrlsInZone(msg.getZoneUuid(), msg.getMonUrls(), CEPH_PRIMARY_STORAGE_RESOURCE_TYPE, msg.getName(),
+                ORG_ZSTACK_STORAGE_CEPH_10030);
         checkExistingPrimaryStorage(msg.getMonUrls());
     }
 
@@ -253,9 +282,128 @@ private void validate(APIAddCephBackupStorageMsg msg) {
         checkExistingBackupStorage(msg.getMonUrls());
     }
 
+    private void validate(APIAttachPrimaryStorageToClusterMsg msg) {
+        String type = Q.New(PrimaryStorageVO.class)
+                .select(PrimaryStorageVO_.type)
+                .eq(PrimaryStorageVO_.uuid, msg.getPrimaryStorageUuid())
+                .findValue();
+        if (!CephConstants.CEPH_PRIMARY_STORAGE_TYPE.equals(type)) {
+            return;
+        }
+
+        String zoneUuid = Q.New(ClusterVO.class)
+                .select(ClusterVO_.zoneUuid)
+                .eq(ClusterVO_.uuid, msg.getClusterUuid())
+                .findValue();
+        validateCephPrimaryStorageMonsInZone(msg.getPrimaryStorageUuid(), zoneUuid, ORG_ZSTACK_STORAGE_CEPH_10031);
+    }
+
+    private void validate(APIAttachBackupStorageToZoneMsg msg) {
+        validateCephBackupStorageMonsInZone(msg.getBackupStorageUuid(), msg.getZoneUuid(), ORG_ZSTACK_STORAGE_CEPH_10032);
+    }
+
+    private void validatePrimaryStorageMonUrls(String primaryStorageUuid, List<String> monUrls, String errorCode) {
+        String zoneUuid = Q.New(PrimaryStorageVO.class)
+                .select(PrimaryStorageVO_.zoneUuid)
+                .eq(PrimaryStorageVO_.uuid, primaryStorageUuid)
+                .findValue();
+        validateMonUrlsInZone(zoneUuid, monUrls, "ceph primary storage", primaryStorageUuid, errorCode);
+    }
+
+    private void validateBackupStorageMonUrls(String backupStorageUuid, List<String> monUrls, String errorCode) {
+        List<String> zoneUuids = Q.New(BackupStorageZoneRefVO.class)
+                .select(BackupStorageZoneRefVO_.zoneUuid)
+                .eq(BackupStorageZoneRefVO_.backupStorageUuid, backupStorageUuid)
+                .listValues();
+        for (String zoneUuid : zoneUuids) {
+            validateMonUrlsInZone(zoneUuid, monUrls, "ceph backup storage", backupStorageUuid, errorCode);
+        }
+    }
+
+    private void validatePrimaryStorageEndpoint(String primaryStorageUuid, String endpoint, String resourceType,
+                                                String resourceIdentity, String errorCode) {
+        String zoneUuid = Q.New(PrimaryStorageVO.class)
+                .select(PrimaryStorageVO_.zoneUuid)
+                .eq(PrimaryStorageVO_.uuid, primaryStorageUuid)
+                .findValue();
+        managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, endpoint, resourceType, resourceIdentity, errorCode);
+    }
+
+    private void validateBackupStorageEndpoint(String backupStorageUuid, String endpoint, String resourceType,
+                                               String resourceIdentity, String errorCode) {
+        List<String> zoneUuids = Q.New(BackupStorageZoneRefVO.class)
+                .select(BackupStorageZoneRefVO_.zoneUuid)
+                .eq(BackupStorageZoneRefVO_.backupStorageUuid, backupStorageUuid)
+                .listValues();
+        for (String zoneUuid : zoneUuids) {
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, endpoint, resourceType, resourceIdentity, errorCode);
+        }
+    }
+
+    private void validateMonUrlsInZone(String zoneUuid, List<String> monUrls, String resourceType,
+                                       String resourceIdentity, String errorCode) {
+        for (String monUrl : monUrls) {
+            MonUri uri = new MonUri(monUrl);
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, uri.getHostname(),
+                    resourceType, resourceIdentity, errorCode);
+        }
+    }
+
+    private void validateCephPrimaryStorageMonsInZone(String primaryStorageUuid, String zoneUuid, String errorCode) {
+        List<CephPrimaryStorageMonVO> mons = Q.New(CephPrimaryStorageMonVO.class)
+                .eq(CephPrimaryStorageMonVO_.primaryStorageUuid, primaryStorageUuid)
+                .list();
+        for (CephPrimaryStorageMonVO mon : mons) {
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, mon.getHostname(),
+                    CEPH_PRIMARY_STORAGE_MON_RESOURCE_TYPE, mon.getUuid(), errorCode);
+        }
+    }
+
+    private void validateCephBackupStorageMonsInZone(String backupStorageUuid, String zoneUuid, String errorCode) {
+        List<CephBackupStorageMonVO> mons = Q.New(CephBackupStorageMonVO.class)
+                .eq(CephBackupStorageMonVO_.backupStorageUuid, backupStorageUuid)
+                .list();
+        for (CephBackupStorageMonVO mon : mons) {
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, mon.getHostname(),
+                    CEPH_BACKUP_STORAGE_MON_RESOURCE_TYPE, mon.getUuid(), errorCode);
+        }
+    }
+
+    @Override
+    public void validateExistingResourcesInZone(String zoneUuid, String ipVersion) {
+        List<String> primaryStorageUuids = Q.New(PrimaryStorageVO.class)
+                .select(PrimaryStorageVO_.uuid)
+                .eq(PrimaryStorageVO_.zoneUuid, zoneUuid)
+                .listValues();
+        if (!primaryStorageUuids.isEmpty()) {
+            List<CephPrimaryStorageMonVO> primaryMons = Q.New(CephPrimaryStorageMonVO.class)
+                    .in(CephPrimaryStorageMonVO_.primaryStorageUuid, primaryStorageUuids)
+                    .list();
+            for (CephPrimaryStorageMonVO mon : primaryMons) {
+                managementNetworkIpVersionManager.validateEndpointMatchesIpVersion(zoneUuid, ipVersion, mon.getHostname(),
+                        CEPH_PRIMARY_STORAGE_MON_RESOURCE_TYPE, mon.getUuid(), ORG_ZSTACK_STORAGE_CEPH_10033);
+            }
+        }
+
+        List<String> backupStorageUuids = Q.New(BackupStorageZoneRefVO.class)
+                .select(BackupStorageZoneRefVO_.backupStorageUuid)
+                .eq(BackupStorageZoneRefVO_.zoneUuid, zoneUuid)
+                .listValues();
+        if (backupStorageUuids.isEmpty()) {
+            return;
+        }
+        List<CephBackupStorageMonVO> backupMons = Q.New(CephBackupStorageMonVO.class)
+                .in(CephBackupStorageMonVO_.backupStorageUuid, backupStorageUuids)
+                .list();
+        for (CephBackupStorageMonVO mon : backupMons) {
+            managementNetworkIpVersionManager.validateEndpointMatchesIpVersion(zoneUuid, ipVersion, mon.getHostname(),
+                    CEPH_BACKUP_STORAGE_MON_RESOURCE_TYPE, mon.getUuid(), ORG_ZSTACK_STORAGE_CEPH_10034);
+        }
+    }
+
     @Override
     public List<Class> getMessageClassToIntercept() {
-        return CollectionDSL.list(APIAttachPrimaryStorageToClusterMsg.class);
+        return CollectionDSL.list(APIAttachPrimaryStorageToClusterMsg.class, APIAttachBackupStorageToZoneMsg.class);
     }
 
     @Override
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java
index 7a7fdad4d57..00b89db714a 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java
@@ -26,6 +26,8 @@ public class MonUri {
     private int sshPort = 22;
 
     private static List<String> allowedQueryParameter;
+    private static final String IPV6_URL_HOST_PREFIX = "[";
+    private static final String IPV6_URL_HOST_SUFFIX = "]";
     static {
         allowedQueryParameter = list("monPort");
     }
@@ -90,6 +92,7 @@ public MonUri(String url) {
                                 " in format of %s", url, MON_URL_FORMAT)
                 );
             }
+            hostname = stripIpv6Brackets(hostname);
 
             sshPort = uri.getPort() == -1 ? sshPort : uri.getPort();
             if (sshPort < 1 || sshPort > 65535) {
@@ -104,6 +107,14 @@ public MonUri(String url) {
         }
     }
 
+    private static String stripIpv6Brackets(String host) {
+        if (host != null && host.startsWith(IPV6_URL_HOST_PREFIX) && host.endsWith(IPV6_URL_HOST_SUFFIX)) {
+            return host.substring(IPV6_URL_HOST_PREFIX.length(), host.length() - IPV6_URL_HOST_SUFFIX.length());
+        }
+
+        return host;
+    }
+
     public int getSshPort() {
         return sshPort;
     }
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMetaDataMaker.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMetaDataMaker.java
index 2b346280ce9..572f272da98 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMetaDataMaker.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMetaDataMaker.java
@@ -30,6 +30,7 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import javax.persistence.TypedQuery;
 import java.util.*;
@@ -51,8 +52,12 @@ public class CephBackupStorageMetaDataMaker implements AddImageExtensionPoint, A
     @Autowired
     private CloudBus bus;
 
-    protected  String buildUrl( String hostName, Integer monPort,String subPath) {
-        return String.format("http://%s:%s%s", hostName, monPort, subPath);
+    public static String buildAgentUrl(String hostName, Integer monPort, String subPath) {
+        return IPv6NetworkUtils.buildHttpUrl(hostName, monPort) + subPath;
+    }
+
+    protected String buildUrl(String hostName, Integer monPort, String subPath) {
+        return buildAgentUrl(hostName, monPort, subPath);
     }
 
     @Transactional
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java
index 6bf2c810034..150c27ab41f 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/backup/CephBackupStorageMonBase.java
@@ -28,6 +28,7 @@
 import org.zstack.storage.ceph.*;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
 import org.zstack.utils.ssh.SshException;
@@ -494,7 +495,7 @@ public void doPing(final ReturnValueCompletion<PingResult> completion) {
         }
 
         PingCmd cmd = new PingCmd();
-        cmd.monAddr = String.format("%s:%s", getSelf().getMonAddr(), getSelf().getMonPort());
+        cmd.monAddr = IPv6NetworkUtils.formatHostPort(getSelf().getMonAddr(), getSelf().getMonPort());
         cmd.testImagePath = String.format("%s/zshb.bs.%s.%s", poolName, self.getUuid(), self.getMonAddr());
         cmd.monUuid = getSelf().getUuid();
         cmd.backupStorageUuid = getSelf().getBackupStorageUuid();
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageBase.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageBase.java
index 969db15411c..53816200465 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageBase.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageBase.java
@@ -87,6 +87,7 @@
 import org.zstack.utils.function.Function;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 
 import java.io.Serializable;
@@ -4822,7 +4823,7 @@ private void setupSelfFencerOnKvmHost(final SetupSelfFencerOnKvmHostMsg msg, fin
         cmd.monUrls = CollectionUtils.transformToList(getSelf().getMons(), new Function<String, CephPrimaryStorageMonVO>() {
             @Override
             public String call(CephPrimaryStorageMonVO arg) {
-                return String.format("%s:%s", arg.getMonAddr(), arg.getMonPort());
+                return IPv6NetworkUtils.formatHostPort(arg.getMonAddr(), arg.getMonPort());
             }
         });
         cmd.strategy = param.getStrategy();
@@ -4992,7 +4993,7 @@ private void checkHostStorageConnection(List<String> hostUuids, final Completion
                         .eq(CephPrimaryStoragePoolVO_.primaryStorageUuid, self.getUuid())
                         .listValues())
                 .monUrls(CollectionUtils.transformToList(getSelf().getMons(), (Function<String, CephPrimaryStorageMonVO>) arg
-                        -> String.format("%s:%s", arg.getMonAddr(), arg.getMonPort())));
+                        -> IPv6NetworkUtils.formatHostPort(arg.getMonAddr(), arg.getMonPort())));
 
         List<KVMHostAsyncHttpCallMsg> msgs = CollectionUtils.transformToList(hostUuids, (Function<KVMHostAsyncHttpCallMsg, String>) huuid -> {
             KVMHostAsyncHttpCallMsg msg = new KVMHostAsyncHttpCallMsg();
@@ -6006,7 +6007,7 @@ public MonMigrateIpInfo(String psUuid) {
                 final String extraIps = CephMonSystemTags.EXTRA_IPS
                         .getTokenByResourceUuid(mon.getUuid(), CephMonSystemTags.EXTRA_IPS_TOKEN);
                 Optional.ofNullable(extraIps).ifPresent(it -> ips.addAll(Arrays.asList(it.split(","))));
-                List<String> cidrIps = NetworkUtils.filterIpv4sInCidr(ips, migrateCidr);
+                List<String> cidrIps = NetworkUtils.filterIpsInCidr(ips, migrateCidr);
                 if (!cidrIps.isEmpty()) {
                     monMigrateIpMap.put(mon.getUuid(), cidrIps.get(0));
                 }
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java
index 7ca3e710291..e3ba7578f12 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/primary/CephPrimaryStorageMonBase.java
@@ -26,6 +26,7 @@
 import org.zstack.storage.ceph.*;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
 import org.zstack.utils.ssh.SshException;
@@ -506,7 +507,7 @@ private void doPing(final ReturnValueCompletion<PingResult> completion) {
         cmd.testImagePath = String.format("%s/zshb.ps.%s.%s", poolName, self.getUuid(), self.getMonAddr());
         cmd.monUuid = getSelf().getUuid();
         cmd.primaryStorageUuid = getSelf().getPrimaryStorageUuid();
-        cmd.monAddr = String.format("%s:%s", getSelf().getMonAddr(), getSelf().getMonPort());
+        cmd.monAddr = IPv6NetworkUtils.formatHostPort(getSelf().getMonAddr(), getSelf().getMonPort());
 
         restf.asyncJsonPost(CephAgentUrl.primaryStorageUrl(self.getHostname(), PING_PATH),
                 cmd, new JsonAsyncRESTCallback<PingRsp>(completion) {
diff --git a/plugin/flatNetworkProvider/src/main/java/org/zstack/network/service/flat/FlatDhcpBackend.java b/plugin/flatNetworkProvider/src/main/java/org/zstack/network/service/flat/FlatDhcpBackend.java
index db72febcf4d..347b6a4c080 100755
--- a/plugin/flatNetworkProvider/src/main/java/org/zstack/network/service/flat/FlatDhcpBackend.java
+++ b/plugin/flatNetworkProvider/src/main/java/org/zstack/network/service/flat/FlatDhcpBackend.java
@@ -1836,6 +1836,7 @@ public static class DhcpInfo {
         public List<HostRouteInfo> hostRoutes;
         public String nicType;
         public String vlanId;
+        public String vmUuid;
     }
 
     public static class ApplyDhcpCmd extends KVMAgentCommands.AgentCommand {
@@ -2063,6 +2064,7 @@ public DhcpInfo call(DhcpStruct arg) {
                 info.mtu = arg.getMtu();
                 info.hostRoutes = getL3NetworkHostRoute(arg.getL3Network().getUuid());
                 info.vmMultiGateway = multiGateway;
+                info.vmUuid = arg.getVmUuid();
                 if ((arg.getIpVersion() == IPv6Constants.DUAL_STACK  || arg.getIpVersion() == IPv6Constants.IPv6)
                         && !IPv6Constants.SLAAC.equals(arg.getRaMode())) {
                     info.ip6 = arg.getIp6();
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/APIAddKVMHostMsgDoc_zh_cn.groovy b/plugin/kvm/src/main/java/org/zstack/kvm/APIAddKVMHostMsgDoc_zh_cn.groovy
index fb03b3676ee..ad1222e287b 100644
--- a/plugin/kvm/src/main/java/org/zstack/kvm/APIAddKVMHostMsgDoc_zh_cn.groovy
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/APIAddKVMHostMsgDoc_zh_cn.groovy
@@ -69,7 +69,7 @@ doc {
 				column {
 					name "managementIp"
 					enclosedIn "params"
-					desc "物理机管理节点IP"
+					desc "物理机管理地址，支持IPv4地址、IPv6地址或DNS名称"
 					location "body"
 					type "String"
 					optional false
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/APIUpdateKVMHostMsgDoc_zh_cn.groovy b/plugin/kvm/src/main/java/org/zstack/kvm/APIUpdateKVMHostMsgDoc_zh_cn.groovy
index 4f5300e5b07..8c884e13589 100644
--- a/plugin/kvm/src/main/java/org/zstack/kvm/APIUpdateKVMHostMsgDoc_zh_cn.groovy
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/APIUpdateKVMHostMsgDoc_zh_cn.groovy
@@ -78,7 +78,7 @@ doc {
 				column {
 					name "managementIp"
 					enclosedIn "updateKVMHost"
-					desc "管理节点IP"
+					desc "物理机管理地址，支持IPv4地址、IPv6地址或DNS名称"
 					location "body"
 					type "String"
 					optional true
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KVMConsoleHypervisorBackend.java b/plugin/kvm/src/main/java/org/zstack/kvm/KVMConsoleHypervisorBackend.java
index 3e8ab0c26a3..80b3e3d0cef 100755
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KVMConsoleHypervisorBackend.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KVMConsoleHypervisorBackend.java
@@ -16,6 +16,7 @@
 import org.zstack.header.message.MessageReply;
 import org.zstack.header.vm.VmInstanceInventory;
 import org.zstack.kvm.KVMAgentCommands.GetVncPortResponse;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -78,7 +79,7 @@ public void run(MessageReply reply) {
                 String mgmtIp = q.findValue();
                 try {
                     // see https://tools.ietf.org/html/rfc7869#section-2.1
-                    URI uri = new URI(String.format("vnc://%s:%s/", mgmtIp, rsp.getPort()));
+                    URI uri = buildConsoleUri(mgmtIp, rsp.getPort());
                     ConsoleUrl consoleUrl = new ConsoleUrl();
                     consoleUrl.setUri(uri);
                     consoleUrl.setVersion(dbf.getDbVersion());
@@ -89,4 +90,8 @@ public void run(MessageReply reply) {
             }
         });
     }
+
+    public static URI buildConsoleUri(String host, int port) throws URISyntaxException {
+        return new URI(String.format("vnc://%s:%s/", IPv6NetworkUtils.formatHostForUrl(host), port));
+    }
 }
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java
index 7a5a0bcf99f..c82eaee2411 100755
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java
@@ -101,6 +101,7 @@
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
 import org.zstack.utils.message.OperationChecker;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
@@ -111,6 +112,8 @@
 
 import javax.persistence.TypedQuery;
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.*;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -129,6 +132,7 @@
 public class KVMHost extends HostBase implements Host {
     private static final CLogger logger = Utils.getLogger(KVMHost.class);
     private static final ZTester tester = Utils.getTester();
+    private static final String EXTRA_IP_SEPARATOR = ",";
     protected static OperationChecker allowedOperations = new OperationChecker(true);
     protected static OperationChecker skipOperations = new OperationChecker(true);
 
@@ -2251,10 +2255,27 @@ protected static String getDataNetworkAddress(String hostUuid, String cidr) {
             return null;
         }
 
-        final String[] ips = extraIps.split(",");
-        for (String ip: ips) {
-            if (NetworkUtils.isIpv4InCidr(ip, cidr)) {
-                return ip;
+        return selectIpInCidr(extraIps, cidr);
+    }
+
+    public static String selectIpInCidr(String ips, String cidr) {
+        if (ips == null) {
+            return null;
+        }
+
+        final String[] ipList = ips.split(EXTRA_IP_SEPARATOR);
+        for (String ip: ipList) {
+            String trimmedIp = ip.trim();
+            if (StringUtils.isBlank(trimmedIp)) {
+                continue;
+            }
+
+            try {
+                if (NetworkUtils.isIpInCidr(trimmedIp, cidr)) {
+                    return trimmedIp;
+                }
+            } catch (RuntimeException e) {
+                logger.warn(String.format("skip invalid host extra IP[%s] when matching CIDR[%s]: %s", trimmedIp, cidr, e.getMessage()));
             }
         }
 
@@ -2802,16 +2823,41 @@ public void run(MessageReply reply) {
         });
     }
 
-    private String buildUrl(String path) {
-        UriComponentsBuilder ub = UriComponentsBuilder.newInstance();
-        ub.scheme(KVMGlobalProperty.AGENT_URL_SCHEME);
-        ub.host(self.getManagementIp());
-        ub.port(KVMGlobalProperty.AGENT_PORT);
-        if (!"".equals(KVMGlobalProperty.AGENT_URL_ROOT_PATH)) {
-            ub.path(KVMGlobalProperty.AGENT_URL_ROOT_PATH);
+    public static String buildAgentUrl(String host, String path) {
+        try {
+            return new URI(
+                    KVMGlobalProperty.AGENT_URL_SCHEME,
+                    null,
+                    IPv6NetworkUtils.stripHostUrlBrackets(host),
+                    KVMGlobalProperty.AGENT_PORT,
+                    joinAgentPath(KVMGlobalProperty.AGENT_URL_ROOT_PATH, path),
+                    null,
+                    null).toString();
+        } catch (URISyntaxException e) {
+            throw new CloudRuntimeException(String.format("failed to build KVM agent url for host[%s], path[%s]", host, path), e);
+        }
+    }
+
+    private static String joinAgentPath(String rootPath, String path) {
+        if (rootPath == null || rootPath.isEmpty()) {
+            return path;
+        }
+        if (path == null || path.isEmpty()) {
+            return rootPath.startsWith("/") ? rootPath : "/" + rootPath;
+        }
+
+        String normalizedRootPath = rootPath.startsWith("/") ? rootPath : "/" + rootPath;
+        if (normalizedRootPath.endsWith("/") && path.startsWith("/")) {
+            return normalizedRootPath + path.substring(1);
+        }
+        if (!normalizedRootPath.endsWith("/") && !path.startsWith("/")) {
+            return normalizedRootPath + "/" + path;
         }
-        ub.path(path);
-        return ub.build().toUriString();
+        return normalizedRootPath + path;
+    }
+
+    private String buildUrl(String path) {
+        return buildAgentUrl(self.getManagementIp(), path);
     }
 
     private void executeAsyncHttpCall(final KVMHostAsyncHttpCallMsg msg, final NoErrorCompletion completion) {
@@ -3253,10 +3299,7 @@ public void run(final FlowTrigger trigger, Map data) {
                         CleanVmFirmwareFlashCmd cmd = new CleanVmFirmwareFlashCmd();
                         cmd.vmUuid = vmUuid;
 
-                        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(baseUrl);
-                        ub.host(dstHostMnIp);
-                        ub.path(KVMConstant.CLEAN_FIRMWARE_FLASH);
-                        String url = ub.build().toString();
+                        String url = buildAgentUrl(dstHostMnIp, KVMConstant.CLEAN_FIRMWARE_FLASH);
                         new Http<>(url, cmd, AgentResponse.class).call(dstHostUuid, new ReturnValueCompletion<AgentResponse>(trigger) {
                             @Override
                             public void success(AgentResponse ret) {
@@ -3326,9 +3369,9 @@ protected void scripts() {
                             cmd.setDisks(diskMigrationMap);
                         }
 
-                        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(migrateVmPath);
-                        ub.host(migrateFromDestination ? dstHostMnIp : srcHostMnIp);
-                        String migrateUrl = ub.build().toString();
+                        String migrateUrl = buildAgentUrl(
+                                migrateFromDestination ? dstHostMnIp : srcHostMnIp,
+                                KVMConstant.KVM_MIGRATE_VM_PATH);
                         new Http<>(migrateUrl, cmd, MigrateVmResponse.class).call(migrateFromDestination ? dstHostUuid : srcHostUuid, new ReturnValueCompletion<MigrateVmResponse>(trigger) {
                             @Override
                             public void success(MigrateVmResponse ret) {
@@ -3367,10 +3410,7 @@ public void run(final FlowTrigger trigger, Map data) {
                         cmd.vmUuid = vmUuid;
                         cmd.hostManagementIp = dstHostMnIp;
 
-                        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(baseUrl);
-                        ub.host(dstHostMnIp);
-                        ub.path(KVMConstant.KVM_HARDEN_CONSOLE_PATH);
-                        String url = ub.build().toString();
+                        String url = buildAgentUrl(dstHostMnIp, KVMConstant.KVM_HARDEN_CONSOLE_PATH);
                         new Http<>(url, cmd, AgentResponse.class).call(dstHostUuid, new ReturnValueCompletion<AgentResponse>(trigger) {
                             @Override
                             public void success(AgentResponse ret) {
@@ -3403,10 +3443,7 @@ public void run(final FlowTrigger trigger, Map data) {
                         cmd.vmUuid = vmUuid;
                         cmd.hostManagementIp = srcHostMnIp;
 
-                        UriComponentsBuilder ub = UriComponentsBuilder.fromHttpUrl(baseUrl);
-                        ub.host(srcHostMnIp);
-                        ub.path(KVMConstant.KVM_DELETE_CONSOLE_FIREWALL_PATH);
-                        String url = ub.build().toString();
+                        String url = buildAgentUrl(srcHostMnIp, KVMConstant.KVM_DELETE_CONSOLE_FIREWALL_PATH);
                         new Http<>(url, cmd, AgentResponse.class).call(new ReturnValueCompletion<AgentResponse>(trigger) {
                             @Override
                             public void success(AgentResponse ret) {
@@ -5906,7 +5943,9 @@ public void run(FlowTrigger trigger, Map data) {
                             // expectation matches what the host itself reports.
                             String certIpList = KVMHostUtils.collectHostIps(
                                     sshShell, self.getUuid(), managementIp);
-                            List<String> allIps = new ArrayList<>(Arrays.asList(certIpList.split(",")));
+                            String expectedCertIpList = KVMHostUtils.unionTlsCertIps(
+                                    self.getUuid(), managementIp, certIpList);
+                            List<String> allIps = new ArrayList<>(Arrays.asList(expectedCertIpList.split(",")));
                             // Save detected IPs so apply-ansible-playbook can union with
                             // EXTRA_IPS without running a second SSH.
                             data.put("TLS_DETECTED_IPS", certIpList);
@@ -6958,7 +6997,7 @@ public void handle(ErrorCode errCode, Map data) {
     }
 
     private boolean checkMigrateNetworkCidrOfHost(String cidr) {
-        if (NetworkUtils.isIpv4InCidr(self.getManagementIp(), cidr)) {
+        if (NetworkUtils.isIpInCidr(self.getManagementIp(), cidr)) {
             return true;
         }
 
@@ -6969,14 +7008,7 @@ private boolean checkMigrateNetworkCidrOfHost(String cidr) {
             return false;
         }
 
-        final String[] ips = extraIps.split(",");
-        for (String ip: ips) {
-            if (NetworkUtils.isIpv4InCidr(ip, cidr)) {
-                return true;
-            }
-        }
-
-        return false;
+        return selectIpInCidr(extraIps, cidr) != null;
     }
 
     private boolean checkQemuLibvirtVersionOfHost() {
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostFactory.java b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostFactory.java
index a38cbae68df..2ab85c784e2 100755
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostFactory.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostFactory.java
@@ -91,10 +91,12 @@
 import org.zstack.utils.function.ValidateFunction;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import javax.persistence.Tuple;
 import java.io.File;
 import java.io.IOException;
+import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.SocketAddress;
 import java.net.StandardSocketOptions;
@@ -996,7 +998,7 @@ private boolean isTimeout(Long timeInMap, long currentTime) {
     @AsyncThread
     private void startTcpServer() throws IOException {
         try (Selector selector = Selector.open(); ServerSocketChannel serverSocket = ServerSocketChannel.open()) {
-            serverSocket.bind(new InetSocketAddress("0.0.0.0", KVMGlobalProperty.TCP_SERVER_PORT));
+            serverSocket.bind(makeTcpServerBindAddress(KVMGlobalProperty.TCP_SERVER_PORT));
             serverSocket.configureBlocking(false);
             serverSocket.register(selector, SelectionKey.OP_ACCEPT);
             ByteBuffer buffer = ByteBuffer.allocate(256);
@@ -1043,7 +1045,11 @@ private void checkHostConnection(SocketChannel client) throws IOException {
         client.close();
         socketTimeoutMap.remove(client, timeHelper.getCurrentTimeMillis());
 
-        String managementIp = remoteAddress.toString().split("/")[1].split(":")[0];
+        String managementIp = extractRemoteManagementIp(remoteAddress);
+        if (managementIp == null) {
+            return;
+        }
+
         String hostUuid = Q.New(HostVO.class)
                 .select(HostVO_.uuid)
                 .eq(HostVO_.managementIp, managementIp)
@@ -1071,6 +1077,29 @@ private void register(Selector selector, ServerSocketChannel serverSocket)
         socketTimeoutMap.put(client, timeHelper.getCurrentTimeMillis());
     }
 
+    static InetSocketAddress makeTcpServerBindAddress(int port) {
+        return new InetSocketAddress(port);
+    }
+
+    static String extractRemoteManagementIp(SocketAddress remoteAddress) {
+        if (!(remoteAddress instanceof InetSocketAddress)) {
+            return null;
+        }
+
+        InetAddress address = ((InetSocketAddress) remoteAddress).getAddress();
+        if (address == null) {
+            return null;
+        }
+
+        String hostAddress = address.getHostAddress();
+        int scopeIndex = hostAddress.indexOf('%');
+        if (scopeIndex >= 0) {
+            hostAddress = hostAddress.substring(0, scopeIndex);
+        }
+
+        return IPv6NetworkUtils.isIpv6Address(hostAddress) ? IPv6NetworkUtils.normalizeIpv6(hostAddress) : hostAddress;
+    }
+
     private Map<String, String> getHostsWithDiffModel(String clusterUuid) {
         List<String> hostUuidsInCluster = Q.New(HostVO.class)
                 .select(HostVO_.uuid)
@@ -1108,7 +1137,7 @@ public List<KVMHostConnectExtensionPoint> getConnectExtensions() {
     public KVMHostContext createHostContext(KVMHostVO vo) {
         UriComponentsBuilder ub = UriComponentsBuilder.newInstance();
         ub.scheme(KVMGlobalProperty.AGENT_URL_SCHEME);
-        ub.host(vo.getManagementIp());
+        ub.host(KVMHostUtils.formatHostForUrl(vo.getManagementIp()));
         ub.port(KVMGlobalProperty.AGENT_PORT);
         if (!"".equals(KVMGlobalProperty.AGENT_URL_ROOT_PATH)) {
             ub.path(KVMGlobalProperty.AGENT_URL_ROOT_PATH);
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostUtils.java b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostUtils.java
index 1f634c3a3f9..222ea5ccc65 100644
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostUtils.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KVMHostUtils.java
@@ -19,6 +19,7 @@
 import org.zstack.utils.TagUtils;
 import org.zstack.utils.logging.CLogger;
 import org.zstack.utils.logging.CLoggerImpl;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.ssh.SshResult;
 import org.zstack.utils.ssh.SshShell;
 
@@ -147,6 +148,10 @@ public static String collectHostIps(String hostUuid, String managementIp,
         return collectHostIps(newSsh(managementIp, username, password, sshPort), hostUuid, managementIp);
     }
 
+    public static String formatHostForUrl(String host) {
+        return IPv6NetworkUtils.formatHostForUrl(host);
+    }
+
     // ZSTAC-84446: force ansible re-run + libvirtd restart only when operator opted in
     // or it's a fresh add; skip on plain reconnect to keep kvmagent PID stable.
     public static boolean shouldForceTlsRedeploy(boolean needDeployTlsCert,
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java b/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java
index 025d3913729..ab804fb8235 100644
--- a/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/KvmHostIpmiPowerExecutor.java
@@ -35,9 +35,7 @@ protected void run(Map tokens, Object data) {
                 String hostUuid = d.getInventory().getUuid();
                 String currentIpmiAddress = HostSystemTags.IPMI_ADDRESS.getTokenByResourceUuid(hostUuid, HostSystemTags.IPMI_ADDRESS_TOKEN);
                 HostPowerStatus status = HostPowerStatus.POWER_ON;
-                if (!NetworkUtils.isIpv4Address(currentIpmiAddress)) {
-                    currentIpmiAddress = null;
-                }
+                currentIpmiAddress = normalizeIpmiAddress(currentIpmiAddress);
 
                 HostVO host = dbf.findByUuid(hostUuid, HostVO.class);
                 HostIpmiVO ipmi = host.getIpmi();
@@ -71,4 +69,8 @@ public boolean start() {
     public boolean stop() {
         return true;
     }
+
+    public static String normalizeIpmiAddress(String ipmiAddress) {
+        return NetworkUtils.isValidIPAddress(ipmiAddress) ? ipmiAddress : null;
+    }
 }
diff --git a/plugin/kvm/src/main/java/org/zstack/kvm/VmCpuVendorKvmStartVmExtension.java b/plugin/kvm/src/main/java/org/zstack/kvm/VmCpuVendorKvmStartVmExtension.java
index 25e099a2940..ae951ef84c1 100644
--- a/plugin/kvm/src/main/java/org/zstack/kvm/VmCpuVendorKvmStartVmExtension.java
+++ b/plugin/kvm/src/main/java/org/zstack/kvm/VmCpuVendorKvmStartVmExtension.java
@@ -9,12 +9,12 @@
 import org.zstack.core.config.GlobalConfigVO_;
 import org.zstack.core.db.DatabaseFacade;
 import org.zstack.core.db.Q;
-import org.zstack.core.db.SQL;
 import org.zstack.header.errorcode.ErrorCode;
 import org.zstack.header.vm.VmInstanceSpec;
 import org.zstack.resourceconfig.ResourceConfig;
 import org.zstack.resourceconfig.ResourceConfigFacade;
 import org.zstack.resourceconfig.ResourceConfigVO;
+import org.zstack.resourceconfig.ResourceConfigVO_;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -76,12 +76,11 @@ private void changeHygonCustomizedForGlobalConfigAndResourceConfig() {
             KVMGlobalConfig.NESTED_VIRTUALIZATION.updateValue(CPU_MODE_HOST_PASSTHROUGH);
         }
 
-        String sql = "select rc from ResourceConfigVO rc where rc.name = :name " +
-                "and rc.category = :category and rc.value = :value";
-        List<ResourceConfigVO> rcs = SQL.New(sql).
-                param("name", "vm.cpuMode").
-                param("category", KVMGlobalConfig.CATEGORY).
-                param("value", CPU_MODE_HYGON_CUSTOMIZED).list();
+        List<ResourceConfigVO> rcs = Q.New(ResourceConfigVO.class)
+                .eq(ResourceConfigVO_.name, "vm.cpuMode")
+                .eq(ResourceConfigVO_.category, KVMGlobalConfig.CATEGORY)
+                .eq(ResourceConfigVO_.value, CPU_MODE_HYGON_CUSTOMIZED)
+                .list();
 
         if (!rcs.isEmpty()) {
             rcs.forEach(rc -> rc.setValue(CPU_MODE_HOST_PASSTHROUGH));
diff --git a/plugin/localstorage/src/main/java/org/zstack/storage/primary/local/LocalStorageConstants.java b/plugin/localstorage/src/main/java/org/zstack/storage/primary/local/LocalStorageConstants.java
index 389059b79cd..b0608cfc133 100755
--- a/plugin/localstorage/src/main/java/org/zstack/storage/primary/local/LocalStorageConstants.java
+++ b/plugin/localstorage/src/main/java/org/zstack/storage/primary/local/LocalStorageConstants.java
@@ -1,6 +1,7 @@
 package org.zstack.storage.primary.local;
 
 import org.zstack.header.configuration.PythonClass;
+import org.zstack.header.storage.primary.PrimaryStorageConstants;
 
 import java.util.Arrays;
 import java.util.List;
@@ -11,7 +12,7 @@
 @PythonClass
 public class LocalStorageConstants {
     @PythonClass
-    public static final String LOCAL_STORAGE_TYPE = "LocalStorage";
+    public static final String LOCAL_STORAGE_TYPE = PrimaryStorageConstants.LOCAL_STORAGE_TYPE;
     public static final String LOCAL_STORAGE_ALLOCATOR_STRATEGY = "LocalPrimaryStorageStrategy";
     public static final String LOCAL_STORAGE_MIGRATE_VM_ALLOCATOR_TYPE = "LocalStorageMigrateVmAllocatorStrategy";
     @PythonClass
diff --git a/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java b/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java
index 00f43fcf595..da283932bbc 100755
--- a/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java
+++ b/plugin/nfsPrimaryStorage/src/main/java/org/zstack/storage/primary/nfs/NfsApiParamChecker.java
@@ -32,6 +32,10 @@
 
 @Configurable(preConstruction = true, autowire = Autowire.BY_TYPE)
 public class NfsApiParamChecker {
+    private static final String IPV6_URL_HOST_PREFIX = "[";
+    private static final String IPV6_URL_HOST_SUFFIX = "]";
+    private static final String NFS_URL_SEPARATOR = ":";
+
     @Autowired
     private DatabaseFacade dbf;
     @Autowired
@@ -47,13 +51,13 @@ public void checkUrl(String zoneUuid, List<String> systemTags, String url) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_NFS_10006, "there has been a nfs primary storage having url as %s in zone[uuid:%s]", url, zoneUuid));
         }
 
-        String[] results = url.split(":");
-        if (results.length == 2 && (
-                results[1].startsWith("/dev") || results[1].startsWith("/proc") || results[1].startsWith("/sys"))) {
+        String path = getNfsPathFromUrl(url);
+        if (path != null && (
+                path.startsWith("/dev") || path.startsWith("/proc") || path.startsWith("/sys"))) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_NFS_10007, " the url contains an invalid folder[/dev or /proc or /sys]"));
         }
 
-        validateUrl(systemTags, results[0]);
+        validateUrl(systemTags, getNfsHostFromUrl(url));
     }
 
 
@@ -79,11 +83,38 @@ private void validateCidrTag(String sysTag, String ipAddr) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_NFS_10009, "invalid CIDR: %s", cidr));
         }
 
-        if (!NetworkUtils.isIpv4InCidr(ipAddr, cidr)) {
+        if (!NetworkUtils.isIpInCidr(ipAddr, cidr)) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_NFS_10010, "IP address[%s] is not in CIDR[%s]", ipAddr, cidr));
         }
     }
 
+    public static String getNfsHostFromUrl(String url) {
+        if (url.startsWith(IPV6_URL_HOST_PREFIX)) {
+            int end = url.indexOf(IPV6_URL_HOST_SUFFIX);
+            if (end > 0) {
+                return url.substring(IPV6_URL_HOST_PREFIX.length(), end);
+            }
+        }
+
+        return url.split(NFS_URL_SEPARATOR)[0];
+    }
+
+    public static String getNfsPathFromUrl(String url) {
+        if (url.startsWith(IPV6_URL_HOST_PREFIX)) {
+            int end = url.indexOf(IPV6_URL_HOST_SUFFIX);
+            if (end > 0 && url.length() > end + IPV6_URL_HOST_SUFFIX.length()) {
+                String suffix = url.substring(end + IPV6_URL_HOST_SUFFIX.length());
+                if (suffix.startsWith(NFS_URL_SEPARATOR)) {
+                    return suffix.substring(NFS_URL_SEPARATOR.length());
+                }
+            }
+            return null;
+        }
+
+        String[] results = url.split(NFS_URL_SEPARATOR);
+        return results.length == 2 ? results[1] : null;
+    }
+
     public void checkRunningVmForUpdateUrl(String psuuid) {
         String sql = "select vm.name, vm.uuid from VmInstanceVO vm, VolumeVO vol where vm.uuid = vol.vmInstanceUuid and" +
                 " vol.primaryStorageUuid = :psUuid and vm.state = :vmState";
diff --git a/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorage.java b/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorage.java
index f4aa59c4e41..cdc2622aa3f 100755
--- a/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorage.java
+++ b/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorage.java
@@ -31,6 +31,7 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.function.Function;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 import org.zstack.utils.ssh.Ssh;
 import org.zstack.utils.ssh.SshException;
@@ -75,7 +76,7 @@ public String buildUrl(String subPath) {
         if (CoreGlobalProperty.UNIT_TEST_ON) {
             ub.host("localhost");
         } else {
-            ub.host(getSelf().getHostname());
+            ub.host(IPv6NetworkUtils.formatHostForUrl(getSelf().getHostname()));
         }
 
         ub.port(SftpBackupStorageGlobalProperty.AGENT_PORT);
diff --git a/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageApiInterceptor.java b/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageApiInterceptor.java
index 6ca26f76a88..1ead226581a 100755
--- a/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageApiInterceptor.java
+++ b/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageApiInterceptor.java
@@ -7,22 +7,25 @@
 import org.zstack.core.db.SimpleQuery.Op;
 import org.zstack.core.errorcode.ErrorFacade;
 import org.zstack.header.apimediator.GlobalApiMessageInterceptor;
-import org.zstack.header.errorcode.SysErrors;
 import org.zstack.header.apimediator.ApiMessageInterceptionException;
 import org.zstack.header.apimediator.ApiMessageInterceptor;
 import org.zstack.header.image.APICreateRootVolumeTemplateFromRootVolumeMsg;
 import org.zstack.header.message.APIMessage;
 import org.zstack.header.query.QueryCondition;
 import org.zstack.header.query.QueryOp;
+import org.zstack.header.storage.backup.APIAttachBackupStorageToZoneMsg;
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO;
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO_;
 import org.zstack.header.storage.backup.BackupStorageVO;
 import org.zstack.header.storage.backup.BackupStorageVO_;
 import org.zstack.header.vm.VmInstanceState;
 import org.zstack.header.vm.VmInstanceVO;
 import org.zstack.header.vm.VmInstanceVO_;
-import org.zstack.utils.network.NetworkUtils;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
+import org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.List;
 
 import static java.util.Arrays.asList;
@@ -32,11 +35,16 @@
 
 /**
  */
-public class SftpBackupStorageApiInterceptor implements ApiMessageInterceptor, GlobalApiMessageInterceptor {
+public class SftpBackupStorageApiInterceptor implements ApiMessageInterceptor, GlobalApiMessageInterceptor,
+        ManagementNetworkIpVersionResourceExtensionPoint {
+    private static final String SFTP_BACKUP_STORAGE_RESOURCE_TYPE = "sftp backup storage";
+
     @Autowired
     private DatabaseFacade dbf;
     @Autowired
     private ErrorFacade errf;
+    @Autowired
+    private ManagementNetworkIpVersionManager managementNetworkIpVersionManager;
 
     @Override
     public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionException {
@@ -48,6 +56,8 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
             validate((APIUpdateSftpBackupStorageMsg) msg);
         } else if (msg instanceof APICreateRootVolumeTemplateFromRootVolumeMsg) {
             validate((APICreateRootVolumeTemplateFromRootVolumeMsg) msg);
+        } else if (msg instanceof APIAttachBackupStorageToZoneMsg) {
+            validate((APIAttachBackupStorageToZoneMsg) msg);
         }
 
         return msg;
@@ -75,8 +85,9 @@ private void validate(APICreateRootVolumeTemplateFromRootVolumeMsg msg) {
     }
 
     private void validate(APIUpdateSftpBackupStorageMsg msg) {
-        if (msg.getHostname() != null && !NetworkUtils.isIpv4Address(msg.getHostname()) && !NetworkUtils.isHostname(msg.getHostname())) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_BACKUP_SFTP_10021, "hostname[%s] is neither an IPv4 address nor a valid hostname", msg.getHostname()));
+        if (msg.getHostname() != null) {
+            validateHostname(msg.getHostname(), ORG_ZSTACK_STORAGE_BACKUP_SFTP_10028);
+            validateUpdatedHostnameWithAttachedZones(msg);
         }
     }
 
@@ -97,9 +108,7 @@ private void validate(APIQuerySftpBackupStorageMsg msg) {
     }
 
     private void validate(APIAddSftpBackupStorageMsg msg) {
-        if (!NetworkUtils.isIpv4Address(msg.getHostname()) && !NetworkUtils.isHostname(msg.getHostname())) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_BACKUP_SFTP_10022, "hostname[%s] is neither an IPv4 address nor a valid hostname", msg.getHostname()));
-        }
+        validateHostname(msg.getHostname(), ORG_ZSTACK_STORAGE_BACKUP_SFTP_10029);
 
         SimpleQuery<SftpBackupStorageVO> q = dbf.createQuery(SftpBackupStorageVO.class);
         q.add(SftpBackupStorageVO_.hostname, Op.EQ, msg.getHostname());
@@ -112,9 +121,61 @@ private void validate(APIAddSftpBackupStorageMsg msg) {
         }
     }
 
+    private void validate(APIAttachBackupStorageToZoneMsg msg) {
+        String hostname = Q.New(SftpBackupStorageVO.class)
+                .select(SftpBackupStorageVO_.hostname)
+                .eq(SftpBackupStorageVO_.uuid, msg.getBackupStorageUuid())
+                .findValue();
+        if (hostname == null) {
+            return;
+        }
+
+        managementNetworkIpVersionManager.validateEndpointInZone(msg.getZoneUuid(), hostname,
+                SFTP_BACKUP_STORAGE_RESOURCE_TYPE, msg.getBackupStorageUuid(), ORG_ZSTACK_STORAGE_BACKUP_SFTP_10025);
+    }
+
+    private void validateUpdatedHostnameWithAttachedZones(APIUpdateSftpBackupStorageMsg msg) {
+        List<String> zoneUuids = Q.New(BackupStorageZoneRefVO.class)
+                .select(BackupStorageZoneRefVO_.zoneUuid)
+                .eq(BackupStorageZoneRefVO_.backupStorageUuid, msg.getUuid())
+                .listValues();
+
+        for (String zoneUuid : zoneUuids) {
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, msg.getHostname(),
+                    SFTP_BACKUP_STORAGE_RESOURCE_TYPE, msg.getUuid(), ORG_ZSTACK_STORAGE_BACKUP_SFTP_10026);
+        }
+    }
+
+    private void validateHostname(String hostname, String errorCode) {
+        if (!IPv6NetworkUtils.isValidManagementEndpoint(hostname)) {
+            throw new ApiMessageInterceptionException(argerr(errorCode,
+                    "hostname[%s] is not a valid IPv4 address, IPv6 address, or hostname", hostname));
+        }
+    }
+
+    @Override
+    public void validateExistingResourcesInZone(String zoneUuid, String ipVersion) {
+        List<String> backupStorageUuids = Q.New(BackupStorageZoneRefVO.class)
+                .select(BackupStorageZoneRefVO_.backupStorageUuid)
+                .eq(BackupStorageZoneRefVO_.zoneUuid, zoneUuid)
+                .listValues();
+        if (backupStorageUuids.isEmpty()) {
+            return;
+        }
+
+        List<SftpBackupStorageVO> sftpBackupStorages = Q.New(SftpBackupStorageVO.class)
+                .in(SftpBackupStorageVO_.uuid, backupStorageUuids)
+                .list();
+
+        for (SftpBackupStorageVO sftp : sftpBackupStorages) {
+            managementNetworkIpVersionManager.validateEndpointMatchesIpVersion(zoneUuid, ipVersion, sftp.getHostname(),
+                    SFTP_BACKUP_STORAGE_RESOURCE_TYPE, sftp.getUuid(), ORG_ZSTACK_STORAGE_BACKUP_SFTP_10027);
+        }
+    }
+
     @Override
     public List<Class> getMessageClassToIntercept() {
-        return Collections.singletonList(APICreateRootVolumeTemplateFromRootVolumeMsg.class);
+        return asList(APICreateRootVolumeTemplateFromRootVolumeMsg.class, APIAttachBackupStorageToZoneMsg.class);
     }
 
     @Override
diff --git a/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageMetaDataMaker.java b/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageMetaDataMaker.java
index e142fe80945..fd799a86d0c 100755
--- a/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageMetaDataMaker.java
+++ b/plugin/sftpBackupStorage/src/main/java/org/zstack/storage/backup/sftp/SftpBackupStorageMetaDataMaker.java
@@ -34,6 +34,7 @@
 import org.zstack.utils.Utils;
 import org.zstack.utils.gson.JSONObjectUtil;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import javax.persistence.TypedQuery;
 import java.util.*;
@@ -66,7 +67,7 @@ private String buildUrl(String subPath, String hostName) {
         if (CoreGlobalProperty.UNIT_TEST_ON) {
             ub.host("localhost");
         } else {
-            ub.host(hostName);
+            ub.host(IPv6NetworkUtils.formatHostForUrl(hostName));
         }
 
         ub.port(SftpBackupStorageGlobalProperty.AGENT_PORT);
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouter.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouter.java
index 85a275a84e0..295e8b71925 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouter.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouter.java
@@ -197,7 +197,8 @@ protected void handleLocalMessage(Message msg) {
     void doPing(String vrUuid, ReturnValueCompletion<PingVirtualRouterVmReply> completion) {
         PingCmd cmd = new PingCmd();
         cmd.setUuid(vrUuid);
-        restf.asyncJsonPost(buildUrl(vr.getManagementNic().getIp(), VirtualRouterConstant.VR_PING), cmd, new JsonAsyncRESTCallback<PingRsp>(completion) {
+        restf.asyncJsonPost(buildUrl(vr.getManagementNic().getIp(), VirtualRouterConstant.VR_PING),
+                cmd, vrMgr.buildAgentCallbackUrlHeaders(vr.getManagementNic().getIp()), new JsonAsyncRESTCallback<PingRsp>(completion) {
             @Override
             public void fail(ErrorCode err) {
                 completion.fail(err);
@@ -701,7 +702,8 @@ public void run(final SyncTaskChain chain) {
                             self.getUuid(), msg.getPath()));
                 }
 
-                restf.asyncJsonPost(buildUrl(vr.getManagementNic().getIp(), msg.getPath()), msg.getCommand(), new JsonAsyncRESTCallback<LinkedHashMap>(msg, chain) {
+                restf.asyncJsonPost(buildUrl(vr.getManagementNic().getIp(), msg.getPath()),
+                        msg.getCommand(), vrMgr.buildAgentCallbackUrlHeaders(vr.getManagementNic().getIp()), new JsonAsyncRESTCallback<LinkedHashMap>(msg, chain) {
                     @Override
                     public void fail(ErrorCode err) {
                         reply.setError(err);
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterApiInterceptor.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterApiInterceptor.java
index ea2e5ba66bb..2713a4699cc 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterApiInterceptor.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterApiInterceptor.java
@@ -212,11 +212,6 @@ private void validate(APICreateVirtualRouterOfferingMsg msg) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_SERVICE_VIRTUALROUTER_10030, "management network[uuid:%s] is not in the same zone[uuid:%s] this offering is going to create",
                             msg.getManagementNetworkUuid(), msg.getZoneUuid()));
         }
-        /* mgt network does not support ipv6 yet, TODO, will be implemented soon */
-        if (mgtL3.getIpVersions().contains(IPv6Constants.IPv6) && !mgtL3.getIpVersions().contains(IPv6Constants.IPv4)) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_SERVICE_VIRTUALROUTER_10031, "can not create virtual router offering, because management network doesn't support ipv6 yet"));
-        }
-
         if (!CoreGlobalProperty.UNIT_TEST_ON) {
             checkIfManagementNetworkReachable(msg.getManagementNetworkUuid());
         }
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManager.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManager.java
index a7711086975..acbad6f0291 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManager.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManager.java
@@ -11,6 +11,7 @@
 import org.zstack.header.vm.VmNicInventory;
 
 import java.util.List;
+import java.util.Map;
 
 public interface VirtualRouterManager {
 
@@ -18,6 +19,14 @@ public interface VirtualRouterManager {
 	
     String buildUrl(String mgmtNicIp, String subPath);
 
+    /**
+     * Builds async REST callback headers for virtual router agent requests.
+     *
+     * @param mgmtNicIp virtual router management NIC IP address used to select the callback IP family
+     * @return HTTP headers carrying the callback URL for agent requests
+     */
+    Map<String, String> buildAgentCallbackUrlHeaders(String mgmtNicIp);
+
     List<String> selectL3NetworksNeedingSpecificNetworkService(List<String> candidate, NetworkServiceType nsType);
 
     List<String> selectGuestL3NetworksNeedingSpecificNetworkService(List<String> candidate, NetworkServiceType nsType, String publicUuid);
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java
index f5a4366c190..4f22ae67d99 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java
@@ -52,6 +52,8 @@
 import org.zstack.header.query.ExpandedQueryAliasStruct;
 import org.zstack.header.query.ExpandedQueryStruct;
 import org.zstack.header.query.QueryBelongFilter;
+import org.zstack.header.rest.RESTConstant;
+import org.zstack.header.rest.RESTFacade;
 import org.zstack.header.tag.*;
 import org.zstack.header.vm.*;
 import org.zstack.identity.Account;
@@ -120,6 +122,9 @@ public class VirtualRouterManagerImpl extends AbstractService implements Virtual
 	private final Map<String, VirtualRouterHypervisorBackend> hypervisorBackends = new HashMap<String, VirtualRouterHypervisorBackend>();
     private final Map<String, Integer> vrParallelismDegrees = new ConcurrentHashMap<String, Integer>();
 
+    @Autowired
+    private RESTFacade restf;
+
     private List<String> virtualRouterPostCreateFlows;
     private List<String> virtualRouterPostStartFlows;
     private List<String> virtualRouterPostRebootFlows;
@@ -961,7 +966,7 @@ public String buildUrl(String mgmtNicIp, String subPath) {
         if (CoreGlobalProperty.UNIT_TEST_ON) {
             ub.host("localhost");
         } else {
-            ub.host(mgmtNicIp);
+            ub.host(IPv6NetworkUtils.formatHostForUrl(mgmtNicIp));
         }
 
         ub.port(VirtualRouterGlobalProperty.AGENT_PORT);
@@ -973,6 +978,34 @@ public String buildUrl(String mgmtNicIp, String subPath) {
         return ub.build().toUriString();
     }
 
+    @Override
+    public Map<String, String> buildAgentCallbackUrlHeaders(String mgmtNicIp) {
+        return Collections.singletonMap(RESTConstant.CALLBACK_URL, restf.buildCallbackUrl(selectManagementIpForAgent(mgmtNicIp)));
+    }
+
+    private String selectManagementIpForAgent(String agentIp) {
+        String routeSourceIp = Platform.getRouteSourceIp(agentIp);
+        if (routeSourceIp != null) {
+            return routeSourceIp;
+        }
+
+        if (IPv6NetworkUtils.isIpv6Address(agentIp)) {
+            return Platform.getManagementServerIps().stream()
+                    .filter(IPv6NetworkUtils::isIpv6Address)
+                    .findFirst()
+                    .orElse(Platform.getManagementServerIp());
+        }
+
+        if (NetworkUtils.isIpv4Address(agentIp)) {
+            return Platform.getManagementServerIps().stream()
+                    .filter(NetworkUtils::isIpv4Address)
+                    .findFirst()
+                    .orElse(Platform.getManagementServerIp());
+        }
+
+        return Platform.getManagementServerIp();
+    }
+
 	private void buildWorkFlowBuilder() {
         postCreateFlowsBuilder = FlowChainBuilder.newBuilder().setFlowClassNames(virtualRouterPostCreateFlows).construct();
         postStartFlowsBuilder = FlowChainBuilder.newBuilder().setFlowClassNames(virtualRouterPostStartFlows).construct();
@@ -2868,50 +2901,6 @@ private List<VipTO> findVipsOnVirtualRouter(List<VmNicInventory> vfNics, String
 
     @Override
     public void preVmMigration(VmInstanceInventory vm, VmMigrationType type, String dstHostUuid, Completion completion) {
-        if (ApplianceVmConstant.APPLIANCE_VM_TYPE.equals(vm.getType())) {
-            VirtualRouterVmVO vrVo = Q.New(VirtualRouterVmVO.class).eq(VirtualRouterVmVO_.uuid, vm.getUuid()).find();
-            if (vrVo == null) {
-                completion.success();
-                return;
-            }
-            VirtualRouterVmInventory inv = VirtualRouterVmInventory.valueOf(vrVo);
-            List<VmNicInventory> vfNics = inv.getVmNics().stream()
-                    .filter(nic -> !Objects.equals(nic.getType(), VmInstanceConstant.VIRTUAL_NIC_TYPE))
-                    .collect(Collectors.toList());
-            if (vrVo.isHaEnabled() && !vfNics.isEmpty()) {
-                List<VirtualRouterHaGroupExtensionPoint> exps = pluginRgty.getExtensionList(VirtualRouterHaGroupExtensionPoint.class);
-                if (exps.isEmpty()) {
-                    completion.success();
-                    return;
-                }
-                String peerUuid = exps.get(0).getPeerUuid(vrVo.getUuid());
-                if (peerUuid == null) {
-                    completion.success();
-                    return;
-                }
-                if (ApplianceVmHaStatus.Master.equals(vrVo.getHaStatus()) &&
-                        ApplianceVmStatus.Connected.equals(vrVo.getStatus()) &&
-                        Q.New(VirtualRouterVmVO.class).eq(VirtualRouterVmVO_.status, ApplianceVmStatus.Connected)
-                                .eq(VirtualRouterVmVO_.uuid, peerUuid).isExists()) {
-                    logger.debug(String.format("demote ha master before migrate, virtual router[uuid:%s]", vrVo.getUuid()));
-                    VirtualRouterAsyncHttpCallMsg msg = new VirtualRouterAsyncHttpCallMsg();
-                    msg.setVmInstanceUuid(vrVo.getUuid());
-                    msg.setCommand(new VirtualRouterCommands.AgentCommand());
-                    msg.setCheckStatus(true);
-                    msg.setPath(VirtualRouterConstant.VR_HA_MASTER_DEMOTE);
-                    bus.makeTargetServiceIdByResourceUuid(msg, VmInstanceConstant.SERVICE_ID, vrVo.getUuid());
-                    bus.send(msg, new CloudBusCallBack(null) {
-                        @Override
-                        public void run(MessageReply reply) {
-                            if (!reply.isSuccess()) {
-                                logger.warn(reply.getError().toString());
-                            }
-                            completion.success();
-                        }
-                    });
-                }
-            }
-        }
         completion.success();
     }
 }
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/lifecycle/VirtualRouterDeployAgentFlow.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/lifecycle/VirtualRouterDeployAgentFlow.java
index 40abc08f5e8..5f44c9edb1b 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/lifecycle/VirtualRouterDeployAgentFlow.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/lifecycle/VirtualRouterDeployAgentFlow.java
@@ -106,7 +106,7 @@ public void run(final FlowTrigger trigger, Map data) {
                         cmd.setUuid(vr.getUuid());
                         cmd.setRestartDnsmasqAfterNumberOfSIGUSER1(VirtualRouterGlobalConfig.RESTART_DNSMASQ_COUNT.value(Integer.class));
                         if (timeout == null) {
-                            restf.asyncJsonPost(url, cmd, new JsonAsyncRESTCallback<InitRsp>(trigger) {
+                            restf.asyncJsonPost(url, cmd, vrMgr.buildAgentCallbackUrlHeaders(mgmtNic.getIp()), new JsonAsyncRESTCallback<InitRsp>(trigger) {
                                 @Override
                                 public void fail(ErrorCode err) {
                                     trigger.fail(err);
@@ -127,7 +127,7 @@ public Class<InitRsp> getReturnClass() {
                                 }
                             });
                         } else {
-                            restf.asyncJsonPost(url, cmd, new JsonAsyncRESTCallback<InitRsp>(trigger) {
+                            restf.asyncJsonPost(url, cmd, vrMgr.buildAgentCallbackUrlHeaders(mgmtNic.getIp()), new JsonAsyncRESTCallback<InitRsp>(trigger) {
                                 @Override
                                 public void fail(ErrorCode err) {
                                     trigger.fail(err);
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosConnectFlow.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosConnectFlow.java
index b3a7037e4cc..26f1caf8f76 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosConnectFlow.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosConnectFlow.java
@@ -188,7 +188,7 @@ public void run(final FlowTrigger trigger, Map data) {
                             cmd.setParms(parms);
 
 
-                            restf.asyncJsonPost(url, cmd, new JsonAsyncRESTCallback<InitRsp>(trigger) {
+                            restf.asyncJsonPost(url, cmd, vrMgr.buildAgentCallbackUrlHeaders(mgmtNic.getIp()), new JsonAsyncRESTCallback<InitRsp>(trigger) {
                                 @Override
                                 public void fail(ErrorCode err) {
                                     errs.add(err);
diff --git a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APICreateVxlanPoolRemoteVtepMsg.java b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APICreateVxlanPoolRemoteVtepMsg.java
index 56343f9f2c7..03ab96e1741 100644
--- a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APICreateVxlanPoolRemoteVtepMsg.java
+++ b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APICreateVxlanPoolRemoteVtepMsg.java
@@ -27,7 +27,7 @@ public class APICreateVxlanPoolRemoteVtepMsg extends APICreateMessage implements
     @APIParam
     private String clusterUuid;
     
-    @APIParam(maxLength = 15)
+    @APIParam(maxLength = VxlanNetworkPoolConstant.REMOTE_VTEP_IP_MAX_LENGTH)
     private String remoteVtepIp;
 
     @Override
diff --git a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APIDeleteVxlanPoolRemoteVtepMsg.java b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APIDeleteVxlanPoolRemoteVtepMsg.java
index 23a8c6320dd..ea353db8ecc 100644
--- a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APIDeleteVxlanPoolRemoteVtepMsg.java
+++ b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/APIDeleteVxlanPoolRemoteVtepMsg.java
@@ -26,7 +26,7 @@ public class APIDeleteVxlanPoolRemoteVtepMsg extends APIDeleteMessage implements
     @APIParam
     private String clusterUuid;
     
-    @APIParam(maxLength = 15)
+    @APIParam(maxLength = VxlanNetworkPoolConstant.REMOTE_VTEP_IP_MAX_LENGTH)
     private String remoteVtepIp;
 
     @Override
diff --git a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanNetworkPoolConstant.java b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanNetworkPoolConstant.java
index 9a3cc65656d..c4991de3096 100644
--- a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanNetworkPoolConstant.java
+++ b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanNetworkPoolConstant.java
@@ -15,6 +15,7 @@ public class VxlanNetworkPoolConstant {
     public static final Integer VXLAN_PORT = 8472;
     @PythonClass
     public static final String KVM_VXLAN_TYPE = "KVM_HOST_VXLAN";
+    public static final int REMOTE_VTEP_IP_MAX_LENGTH = 39;
 
     public static final String ACTION_CATEGORY = "vxlan";
 
diff --git a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java
index 6629d0f7def..6a37bd83526 100644
--- a/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java
+++ b/plugin/vxlan/src/main/java/org/zstack/network/l2/vxlan/vxlanNetworkPool/VxlanPoolApiInterceptor.java
@@ -17,6 +17,7 @@
 import org.zstack.network.l2.vxlan.vxlanNetwork.APICreateL2VxlanNetworkMsg;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.network.NetworkUtils;
 
 import java.util.HashMap;
@@ -56,31 +57,54 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
     }
 
     private void validate(APICreateVxlanPoolRemoteVtepMsg msg) {
-        boolean isIpv4 = NetworkUtils.isIpv4Address(msg.getRemoteVtepIp());
-        if (!isIpv4) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10015, "%s:is not ipv4", msg.getRemoteVtepIp()));
+        String remoteVtepIp = normalizeVtepIp(msg.getRemoteVtepIp());
+        msg.setRemoteVtepIp(remoteVtepIp);
+        if (!isValidVtepIp(remoteVtepIp)) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10032, "%s is not a valid IP address", remoteVtepIp));
         }
 
         SimpleQuery<VtepVO> rqv = dbf.createQuery(VtepVO.class);
         rqv.add(VtepVO_.clusterUuid, SimpleQuery.Op.EQ, msg.getClusterUuid());
         rqv.add(VtepVO_.poolUuid, SimpleQuery.Op.EQ, msg.getL2NetworkUuid());
-        rqv.add(VtepVO_.vtepIp, SimpleQuery.Op.EQ, msg.getRemoteVtepIp());
+        rqv.add(VtepVO_.vtepIp, SimpleQuery.Op.EQ, remoteVtepIp);
         long count = rqv.count();
         if (count > 0) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10016, "ip[%s] l2NetworkUuid[%s] clusterUuid[%s] ip exist in local vtep", msg.getRemoteVtepIp(), msg.getL2NetworkUuid(), msg.getClusterUuid()));
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10016, "ip[%s] l2NetworkUuid[%s] clusterUuid[%s] ip exist in local vtep", remoteVtepIp, msg.getL2NetworkUuid(), msg.getClusterUuid()));
         }
 
     }
 
     private void validate(APIDeleteVxlanPoolRemoteVtepMsg msg) {
-        boolean isIpv4 = NetworkUtils.isIpv4Address(msg.getRemoteVtepIp());
-        if (!isIpv4) {
-            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10017, "%s:is not ipv4", msg.getRemoteVtepIp()));
+        String remoteVtepIp = normalizeVtepIp(msg.getRemoteVtepIp());
+        msg.setRemoteVtepIp(remoteVtepIp);
+        if (!isValidVtepIp(remoteVtepIp)) {
+            throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10033, "%s is not a valid IP address", remoteVtepIp));
         }
 
     }
 
+    public static boolean isValidVtepIp(String vtepIp) {
+        return NetworkUtils.isIpAddress(normalizeVtepIp(vtepIp));
+    }
+
+    public static String normalizeVtepIp(String vtepIp) {
+        if (vtepIp == null) {
+            return null;
+        }
+
+        String ip = vtepIp.trim();
+        return IPv6NetworkUtils.isIpv6Address(ip) ? IPv6NetworkUtils.getIpv6AddressCanonicalString(ip) : ip;
+    }
+
     private void validate(APICreateVxlanVtepMsg msg) {
+        String vtepIp = normalizeVtepIp(msg.getVtepIp());
+        msg.setVtepIp(vtepIp);
+        if (!isValidVtepIp(vtepIp)) {
+            throw new ApiMessageInterceptionException(argerr(
+                    ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10034,
+                    "%s is not a valid VTEP IP address", vtepIp));
+        }
+
         long count = Q.New(VtepVO.class).eq(VtepVO_.hostUuid, msg.getHostUuid()).eq(VtepVO_.poolUuid, msg.getPoolUuid()).count();
         if (count > 0) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10018, "vxlan vtep address for host [uuid : %s] and pool [uuid : %s] pair already existed",
diff --git a/plugin/zbs/src/main/java/org/zstack/storage/zbs/MdsUri.java b/plugin/zbs/src/main/java/org/zstack/storage/zbs/MdsUri.java
index d0c990d6826..0e46313d40a 100644
--- a/plugin/zbs/src/main/java/org/zstack/storage/zbs/MdsUri.java
+++ b/plugin/zbs/src/main/java/org/zstack/storage/zbs/MdsUri.java
@@ -5,6 +5,7 @@
 import org.zstack.header.errorcode.ErrorCode;
 import org.zstack.header.errorcode.OperationFailureException;
 import org.zstack.header.exception.CloudRuntimeException;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -26,7 +27,7 @@ public class MdsUri {
     private String username;
     private String password;
 
-    private static final String MDS_URL_FORMAT = "sshUsername:sshPassword@hostname:[sshPort]/?[mdsPort=]";
+    private static final String MDS_URL_FORMAT = "sshUsername:sshPassword@hostname[:sshPort]/?[mdsPort=], IPv6 hostname must be bracketed";
     private static final Integer DEFAULT_MDS_PORT = 6666;
     private static final Integer DEFAULT_SSH_PORT = 22;
 
@@ -80,7 +81,7 @@ public MdsUri(String url) {
             password = ssh[1];
 
             URI uri = new URI(String.format("ssh://%s", rest));
-            hostname = uri.getHost();
+            hostname = IPv6NetworkUtils.stripHostUrlBrackets(uri.getHost());
             if (hostname == null) {
                 throw new OperationFailureException(operr(ORG_ZSTACK_STORAGE_ZBS_10004, "invalid mdsUrl[%s], hostname cannot be null. A valid mdsUrl is" +
                                 " in format of %s", url, MDS_URL_FORMAT)
diff --git a/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsAgentUrl.java b/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsAgentUrl.java
index ef42cef1193..34a98f8f8ae 100644
--- a/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsAgentUrl.java
+++ b/plugin/zbs/src/main/java/org/zstack/storage/zbs/ZbsAgentUrl.java
@@ -1,21 +1,27 @@
 package org.zstack.storage.zbs;
 
-import org.springframework.web.util.UriComponentsBuilder;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 /**
  * @author Xingwei Yu
  * @date 2024/3/27 17:39
  */
 public class ZbsAgentUrl {
-    public static String primaryStorageUrl(String ip, String path) {
-        UriComponentsBuilder ub = UriComponentsBuilder.newInstance();
-        ub.scheme("http");
-        ub.host(ip);
-        ub.port(ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_PORT);
-        if (!"".equals(ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_URL_ROOT_PATH)) {
-            ub.path(ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_URL_ROOT_PATH);
+    private static void appendPath(StringBuilder sb, String path) {
+        if (path == null || path.isEmpty()) {
+            return;
+        }
+
+        if (!path.startsWith("/")) {
+            sb.append("/");
         }
-        ub.path(path);
-        return ub.build().toUriString();
+        sb.append(path);
+    }
+
+    public static String primaryStorageUrl(String ip, String path) {
+        StringBuilder sb = new StringBuilder(IPv6NetworkUtils.buildHttpUrl(ip, ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_PORT));
+        appendPath(sb, ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_URL_ROOT_PATH);
+        appendPath(sb, path);
+        return sb.toString();
     }
 }
diff --git a/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java b/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java
index 4ece718ff52..40c5cc0cce5 100755
--- a/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java
+++ b/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java
@@ -523,6 +523,14 @@ protected void scripts() {
                             String ip = Platform.getManagementServerIp();
                             String uuid = Platform.getManagementServerId();
 
+                            ManagementNodeVO existing = findByUuid(uuid, ManagementNodeVO.class);
+                            if (ManagementNodeManagerImpl.this.isDuplicatedActiveManagementServerId(existing, ip, databaseFacade.getCurrentSqlTime())) {
+                                throw new CloudRuntimeException(String.format(
+                                        "duplicated management server id[%s] detected, current management.server.ip[%s], existing management node hostName[%s]. " +
+                                                "Please remove %s on the cloned or peer management node and restart it",
+                                        uuid, ip, existing.getHostName(), Platform.getManagementServerIdStateFile().getAbsolutePath()));
+                            }
+
                             sql(ManagementNodeVO.class).eq(ManagementNodeVO_.uuid, uuid).hardDelete();
 
                             ManagementNodeVO vo = new ManagementNodeVO();
@@ -725,6 +733,17 @@ public void destroy() {
         }
     }
 
+    private boolean isDuplicatedActiveManagementServerId(ManagementNodeVO existing, String currentHostName, Timestamp currentTime) {
+        if (existing == null || StringUtils.equals(existing.getHostName(), currentHostName) || existing.getHeartBeat() == null) {
+            return false;
+        }
+
+        long heartbeatExpirationMillis = TimeUnit.SECONDS.toMillis(
+                (long) (PortalGlobalProperty.MAX_HEARTBEAT_FAILURE + 1)
+                        * ManagementNodeGlobalConfig.NODE_HEARTBEAT_INTERVAL.value(Integer.class));
+        return currentTime.getTime() - existing.getHeartBeat().getTime() <= heartbeatExpirationMillis;
+    }
+
     private ManagementNodeVO node() {
         DebugUtils.Assert(node != null, "node is set to null!!!");
         return node;
diff --git a/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfig.java b/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfig.java
index 276ca6bd35d..48edde25600 100644
--- a/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfig.java
+++ b/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfig.java
@@ -57,6 +57,11 @@ public static ResourceConfig valueOf(GlobalConfig globalConfig, BindResourceConf
         return result;
     }
 
+    void wire(DatabaseFacade dbf, EventFacade evtf) {
+        this.dbf = dbf;
+        this.evtf = evtf;
+    }
+
     public void installLocalUpdateExtension(ResourceConfigUpdateExtensionPoint ext) {
         localUpdateExtensions.add(ext);
     }
diff --git a/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfigFacadeImpl.java b/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfigFacadeImpl.java
index db3c696392c..668e96f74c4 100644
--- a/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfigFacadeImpl.java
+++ b/resourceconfig/src/main/java/org/zstack/resourceconfig/ResourceConfigFacadeImpl.java
@@ -2,6 +2,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.zstack.core.cloudbus.CloudBus;
+import org.zstack.core.cloudbus.EventFacade;
 import org.zstack.core.cloudbus.MessageSafe;
 import org.zstack.core.config.GlobalConfig;
 import org.zstack.core.config.GlobalConfigException;
@@ -30,6 +31,8 @@ public class ResourceConfigFacadeImpl extends AbstractService implements Resourc
     @Autowired
     private DatabaseFacade dbf;
     @Autowired
+    private EventFacade evtf;
+    @Autowired
     private GlobalConfigFacade gcf;
 
     protected Map<String, ResourceConfig> resourceConfigs = new HashMap<>();
@@ -240,6 +243,9 @@ protected void buildResourceConfig(Field field) throws Exception {
     }
 
     private void initResourceConfig() {
-        resourceConfigs.values().forEach(ResourceConfig::init);
+        resourceConfigs.values().forEach(config -> {
+            config.wire(dbf, evtf);
+            config.init();
+        });
     }
 }
diff --git a/sdk/src/main/java/org/zstack/sdk/ConsoleProxyAgentInventory.java b/sdk/src/main/java/org/zstack/sdk/ConsoleProxyAgentInventory.java
index 9872032258a..f612fff1c27 100644
--- a/sdk/src/main/java/org/zstack/sdk/ConsoleProxyAgentInventory.java
+++ b/sdk/src/main/java/org/zstack/sdk/ConsoleProxyAgentInventory.java
@@ -36,6 +36,22 @@ public java.lang.String getConsoleProxyOverriddenIp() {
         return this.consoleProxyOverriddenIp;
     }
 
+    public java.lang.String consoleProxyOverriddenIpv4;
+    public void setConsoleProxyOverriddenIpv4(java.lang.String consoleProxyOverriddenIpv4) {
+        this.consoleProxyOverriddenIpv4 = consoleProxyOverriddenIpv4;
+    }
+    public java.lang.String getConsoleProxyOverriddenIpv4() {
+        return this.consoleProxyOverriddenIpv4;
+    }
+
+    public java.lang.String consoleProxyOverriddenIpv6;
+    public void setConsoleProxyOverriddenIpv6(java.lang.String consoleProxyOverriddenIpv6) {
+        this.consoleProxyOverriddenIpv6 = consoleProxyOverriddenIpv6;
+    }
+    public java.lang.String getConsoleProxyOverriddenIpv6() {
+        return this.consoleProxyOverriddenIpv6;
+    }
+
     public java.lang.Integer consoleProxyPort;
     public void setConsoleProxyPort(java.lang.Integer consoleProxyPort) {
         this.consoleProxyPort = consoleProxyPort;
diff --git a/sdk/src/main/java/org/zstack/sdk/CreateVxlanPoolRemoteVtepAction.java b/sdk/src/main/java/org/zstack/sdk/CreateVxlanPoolRemoteVtepAction.java
index 1c36ba12518..654399613aa 100644
--- a/sdk/src/main/java/org/zstack/sdk/CreateVxlanPoolRemoteVtepAction.java
+++ b/sdk/src/main/java/org/zstack/sdk/CreateVxlanPoolRemoteVtepAction.java
@@ -31,7 +31,7 @@ public Result throwExceptionIfError() {
     @Param(required = true, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String clusterUuid;
 
-    @Param(required = true, maxLength = 15, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
+    @Param(required = true, maxLength = 39, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String remoteVtepIp;
 
     @Param(required = false)
diff --git a/sdk/src/main/java/org/zstack/sdk/DeleteVxlanPoolRemoteVtepAction.java b/sdk/src/main/java/org/zstack/sdk/DeleteVxlanPoolRemoteVtepAction.java
index 610726bc31b..281e0870889 100644
--- a/sdk/src/main/java/org/zstack/sdk/DeleteVxlanPoolRemoteVtepAction.java
+++ b/sdk/src/main/java/org/zstack/sdk/DeleteVxlanPoolRemoteVtepAction.java
@@ -31,7 +31,7 @@ public Result throwExceptionIfError() {
     @Param(required = true, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String clusterUuid;
 
-    @Param(required = true, maxLength = 15, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
+    @Param(required = true, maxLength = 39, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String remoteVtepIp;
 
     @Param(required = false)
diff --git a/sdk/src/main/java/org/zstack/sdk/SetIpOnHostNetworkInterfaceAction.java b/sdk/src/main/java/org/zstack/sdk/SetIpOnHostNetworkInterfaceAction.java
index 87fa11c3400..19d3cefc655 100644
--- a/sdk/src/main/java/org/zstack/sdk/SetIpOnHostNetworkInterfaceAction.java
+++ b/sdk/src/main/java/org/zstack/sdk/SetIpOnHostNetworkInterfaceAction.java
@@ -34,6 +34,9 @@ public Result throwExceptionIfError() {
     @Param(required = false, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String netmask;
 
+    @Param(required = false, nonempty = false, nullElements = false, emptyString = true, numberRange = {0L,128L}, noTrim = false)
+    public java.lang.Integer prefixLength;
+
     @Param(required = false)
     public java.util.List systemTags;
 
diff --git a/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java b/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java
index 106cc13629c..daab7e19276 100644
--- a/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java
+++ b/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java
@@ -31,6 +31,12 @@ public Result throwExceptionIfError() {
     @Param(required = true, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String consoleProxyOverriddenIp;
 
+    @Param(required = false, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
+    public java.lang.String consoleProxyOverriddenIpv4;
+
+    @Param(required = false, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
+    public java.lang.String consoleProxyOverriddenIpv6;
+
     @Param(required = false, nonempty = false, nullElements = false, emptyString = true, numberRange = {1L,65535L}, noTrim = false)
     public java.lang.Integer consoleProxyPort;
 
diff --git a/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java b/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java
new file mode 100644
index 00000000000..b0955407a2d
--- /dev/null
+++ b/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java
@@ -0,0 +1,68 @@
+package org.zstack.storage;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.zstack.core.db.Q;
+import org.zstack.header.storage.backup.BackupStorageVO;
+import org.zstack.header.storage.backup.BackupStorageVO_;
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO;
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO_;
+import org.zstack.header.storage.primary.PrimaryStorageVO;
+import org.zstack.header.storage.primary.PrimaryStorageVO_;
+import org.zstack.header.storage.primary.PrimaryStorageConstants;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
+import org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint;
+import org.zstack.utils.network.ManagementNetworkIpVersionUtils;
+
+import java.util.List;
+
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_STORAGE_BACKUP_10135;
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_STORAGE_PRIMARY_10056;
+
+public class ManagementNetworkIpVersionStorageExtension implements ManagementNetworkIpVersionResourceExtensionPoint {
+    private static final String PRIMARY_STORAGE_RESOURCE_TYPE = "primary storage";
+    private static final String BACKUP_STORAGE_RESOURCE_TYPE = "backup storage";
+
+    @Autowired
+    private ManagementNetworkIpVersionManager managementNetworkIpVersionManager;
+
+    @Override
+    public void validateExistingResourcesInZone(String zoneUuid, String ipVersion) {
+        validatePrimaryStorages(zoneUuid, ipVersion);
+        validateBackupStorages(zoneUuid, ipVersion);
+    }
+
+    private void validatePrimaryStorages(String zoneUuid, String ipVersion) {
+        List<PrimaryStorageVO> primaryStorages = Q.New(PrimaryStorageVO.class)
+                .eq(PrimaryStorageVO_.zoneUuid, zoneUuid)
+                .notEq(PrimaryStorageVO_.type, PrimaryStorageConstants.LOCAL_STORAGE_TYPE)
+                .list();
+
+        for (PrimaryStorageVO ps : primaryStorages) {
+            managementNetworkIpVersionManager.validateEndpointMatchesIpVersion(zoneUuid, ipVersion, ps.getUrl(),
+                    PRIMARY_STORAGE_RESOURCE_TYPE, ps.getUuid(), ORG_ZSTACK_STORAGE_PRIMARY_10056);
+        }
+    }
+
+    private void validateBackupStorages(String zoneUuid, String ipVersion) {
+        List<String> backupStorageUuids = Q.New(BackupStorageZoneRefVO.class)
+                .select(BackupStorageZoneRefVO_.backupStorageUuid)
+                .eq(BackupStorageZoneRefVO_.zoneUuid, zoneUuid)
+                .listValues();
+        if (backupStorageUuids.isEmpty()) {
+            return;
+        }
+
+        List<BackupStorageVO> backupStorages = Q.New(BackupStorageVO.class)
+                .in(BackupStorageVO_.uuid, backupStorageUuids)
+                .list();
+
+        for (BackupStorageVO bs : backupStorages) {
+            if (ManagementNetworkIpVersionUtils.getEndpointIpVersion(bs.getUrl()) == null) {
+                continue;
+            }
+
+            managementNetworkIpVersionManager.validateEndpointMatchesIpVersion(zoneUuid, ipVersion, bs.getUrl(),
+                    BACKUP_STORAGE_RESOURCE_TYPE, bs.getUuid(), ORG_ZSTACK_STORAGE_BACKUP_10135);
+        }
+    }
+}
diff --git a/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java b/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java
index a7f4ee4ae76..12e7559002f 100755
--- a/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java
+++ b/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java
@@ -11,6 +11,8 @@
 import org.zstack.header.apimediator.StopRoutingException;
 import org.zstack.header.message.APIMessage;
 import org.zstack.header.storage.backup.*;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
+import org.zstack.utils.network.ManagementNetworkIpVersionUtils;
 
 import java.util.List;
 
@@ -25,12 +27,16 @@
  * To change this template use File | Settings | File Templates.
  */
 public class BackupStorageApiInterceptor implements ApiMessageInterceptor {
+    private static final String BACKUP_STORAGE_RESOURCE_TYPE = "backup storage";
+
     @Autowired
     private CloudBus bus;
     @Autowired
     private ErrorFacade errf;
     @Autowired
     private DatabaseFacade dbf;
+    @Autowired
+    private ManagementNetworkIpVersionManager managementNetworkIpVersionManager;
 
     private void setServiceId(APIMessage msg) {
         if (msg instanceof BackupStorageMessage) {
@@ -127,6 +133,14 @@ private void validate(APIAttachBackupStorageToZoneMsg msg) {
         if (q.isExists()) {
             throw new ApiMessageInterceptionException(operr(ORG_ZSTACK_STORAGE_BACKUP_10006, "backup storage[uuid:%s] has been attached to zone[uuid:%s]", msg.getBackupStorageUuid(), msg.getZoneUuid()));
         }
+
+        BackupStorageVO vo = dbf.findByUuid(msg.getBackupStorageUuid(), BackupStorageVO.class);
+        if (ManagementNetworkIpVersionUtils.getEndpointIpVersion(vo.getUrl()) == null) {
+            return;
+        }
+
+        managementNetworkIpVersionManager.validateEndpointInZone(msg.getZoneUuid(), vo.getUrl(),
+                BACKUP_STORAGE_RESOURCE_TYPE, msg.getBackupStorageUuid(), ORG_ZSTACK_STORAGE_BACKUP_10134);
     }
 
     private void validate(final APIGetTrashOnBackupStorageMsg msg) {
diff --git a/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageApiInterceptor.java b/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageApiInterceptor.java
index 11c09d144cb..5d5c94f2465 100755
--- a/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageApiInterceptor.java
+++ b/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageApiInterceptor.java
@@ -25,6 +25,7 @@
 import org.zstack.header.storage.snapshot.group.APIRevertVmFromSnapshotGroupMsg;
 import org.zstack.header.volume.APICreateVolumeSnapshotGroupMsg;
 import org.zstack.header.volume.VolumeInventory;
+import org.zstack.header.zone.ManagementNetworkIpVersionManager;
 import org.zstack.header.zone.ZoneVO;
 import org.zstack.header.zone.ZoneVO_;
 import org.zstack.utils.network.NetworkUtils;
@@ -46,6 +47,8 @@
  * To change this template use File | Settings | File Templates.
  */
 public class PrimaryStorageApiInterceptor implements ApiMessageInterceptor {
+    private static final String PRIMARY_STORAGE_RESOURCE_TYPE = "primary storage";
+
     @Autowired
     private CloudBus bus;
     @Autowired
@@ -56,6 +59,8 @@ public class PrimaryStorageApiInterceptor implements ApiMessageInterceptor {
     private PluginRegistry pluginRegistry;
     @Autowired
     private PrimaryStorageManagerImpl primaryStorageManager;
+    @Autowired
+    private ManagementNetworkIpVersionManager managementNetworkIpVersionManager;
 
     private void setServiceId(APIMessage msg) {
         if (msg instanceof PrimaryStorageMessage) {
@@ -82,6 +87,10 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
             validate((APIAddStorageProtocolMsg) msg);
         } else if (msg instanceof APIAddExternalPrimaryStorageMsg) {
             validate((APIAddExternalPrimaryStorageMsg) msg);
+        } else if (msg instanceof APIAddPrimaryStorageMsg) {
+            validate((APIAddPrimaryStorageMsg) msg);
+        } else if (msg instanceof APIUpdatePrimaryStorageMsg) {
+            validate((APIUpdatePrimaryStorageMsg) msg);
         }
 
         setServiceId(msg);
@@ -91,6 +100,7 @@ public APIMessage intercept(APIMessage msg) throws ApiMessageInterceptionExcepti
     private void validate(APIAddExternalPrimaryStorageMsg msg) {
         String config = msg.getConfig();
         if (config == null || config.trim().isEmpty()) {
+            validate((APIAddPrimaryStorageMsg) msg);
             return;
         }
         try {
@@ -99,6 +109,33 @@ private void validate(APIAddExternalPrimaryStorageMsg msg) {
             throw new ApiMessageInterceptionException(argerr(ORG_ZSTACK_STORAGE_PRIMARY_10053,
                     "config is not a valid JSON object: %s", e.getMessage()));
         }
+
+        validate((APIAddPrimaryStorageMsg) msg);
+    }
+
+    private void validate(APIAddPrimaryStorageMsg msg) {
+        if (PrimaryStorageConstants.LOCAL_STORAGE_TYPE.equals(msg.getType())) {
+            return;
+        }
+
+        managementNetworkIpVersionManager.validateEndpointInZone(msg.getZoneUuid(), msg.getUrl(),
+                PRIMARY_STORAGE_RESOURCE_TYPE, msg.getName(), ORG_ZSTACK_STORAGE_PRIMARY_10055);
+    }
+
+    private void validate(APIUpdatePrimaryStorageMsg msg) {
+        if (msg.getUrl() == null) {
+            return;
+        }
+
+        PrimaryStorageVO vo = Q.New(PrimaryStorageVO.class)
+                .eq(PrimaryStorageVO_.uuid, msg.getUuid())
+                .find();
+        if (PrimaryStorageConstants.LOCAL_STORAGE_TYPE.equals(vo.getType())) {
+            return;
+        }
+
+        managementNetworkIpVersionManager.validateEndpointInZone(vo.getZoneUuid(), msg.getUrl(),
+                PRIMARY_STORAGE_RESOURCE_TYPE, msg.getUuid(), ORG_ZSTACK_STORAGE_PRIMARY_10057);
     }
 
     private void validate(APIAddStorageProtocolMsg msg) {
@@ -218,6 +255,19 @@ private void validate(APIAttachPrimaryStorageToClusterMsg msg) {
                 .select(PrimaryStorageVO_.type)
                 .findValue();
 
+        if (!PrimaryStorageConstants.LOCAL_STORAGE_TYPE.equals(primaryStorageType)) {
+            String zoneUuid = Q.New(ClusterVO.class)
+                    .eq(ClusterVO_.uuid, msg.getClusterUuid())
+                    .select(ClusterVO_.zoneUuid)
+                    .findValue();
+            String url = Q.New(PrimaryStorageVO.class)
+                    .eq(PrimaryStorageVO_.uuid, msg.getPrimaryStorageUuid())
+                    .select(PrimaryStorageVO_.url)
+                    .findValue();
+            managementNetworkIpVersionManager.validateEndpointInZone(zoneUuid, url,
+                    PRIMARY_STORAGE_RESOURCE_TYPE, msg.getPrimaryStorageUuid(), ORG_ZSTACK_STORAGE_PRIMARY_10055);
+        }
+
         List<StorageAttachClusterMetric> storageAttachClusterMetrics =
                 new ArrayList<>(pluginRegistry.getExtensionList(StorageAttachClusterMetric.class));
 
diff --git a/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageFeatureAllocatorFlow.java b/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageFeatureAllocatorFlow.java
index 226c269f9f2..6abaf247855 100644
--- a/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageFeatureAllocatorFlow.java
+++ b/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageFeatureAllocatorFlow.java
@@ -27,14 +27,12 @@ public class PrimaryStorageFeatureAllocatorFlow extends NoRollbackFlow {
     @Autowired
     private PluginRegistry pluginRgty;
 
-    protected final List<PrimaryStorageFeatureAllocatorExtensionPoint> featureExtensions = pluginRgty.getExtensionList(PrimaryStorageFeatureAllocatorExtensionPoint.class);;
-
     @Override
     public void run(FlowTrigger trigger, Map data) {
         PrimaryStorageAllocationSpec spec = (PrimaryStorageAllocationSpec) data.get(PrimaryStorageConstant.AllocatorParams.SPEC);
         List<PrimaryStorageVO> candidates = (List<PrimaryStorageVO>) data.get(PrimaryStorageConstant.AllocatorParams.CANDIDATES);
         List<PrimaryStorageVO> ret;
-        for (PrimaryStorageFeatureAllocatorExtensionPoint extp : featureExtensions) {
+        for (PrimaryStorageFeatureAllocatorExtensionPoint extp : pluginRgty.getExtensionList(PrimaryStorageFeatureAllocatorExtensionPoint.class)) {
             ret = extp.allocatePrimaryStorage(spec.getRequiredFeatures(), candidates);
             if (ret == null) {
                 continue;
diff --git a/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageTagAllocatorFlow.java b/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageTagAllocatorFlow.java
index eb65bd7e051..3444e5aa74e 100755
--- a/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageTagAllocatorFlow.java
+++ b/storage/src/main/java/org/zstack/storage/primary/PrimaryStorageTagAllocatorFlow.java
@@ -39,8 +39,9 @@ public class PrimaryStorageTagAllocatorFlow extends NoRollbackFlow {
     @Autowired
     private PluginRegistry pluginRgty;
 
-    protected final List<PrimaryStorageTagAllocatorExtensionPoint> tagExtensions = pluginRgty.getExtensionList(PrimaryStorageTagAllocatorExtensionPoint.class);;
-
+    protected List<PrimaryStorageTagAllocatorExtensionPoint> getTagExtensions() {
+        return pluginRgty.getExtensionList(PrimaryStorageTagAllocatorExtensionPoint.class);
+    }
 
     @Override
     public void run(FlowTrigger trigger, Map data) {
@@ -71,7 +72,7 @@ public void run(FlowTrigger trigger, Map data) {
 
     protected List<PrimaryStorageVO> callTagExtensions(List<SystemTagInventory> tags, List<PrimaryStorageVO> candidates) {
         List<PrimaryStorageVO> ret;
-        for (PrimaryStorageTagAllocatorExtensionPoint extp : tagExtensions) {
+        for (PrimaryStorageTagAllocatorExtensionPoint extp : getTagExtensions()) {
             ret = extp.allocatePrimaryStorage(tags, candidates);
             if (ret == null) {
                 continue;
diff --git a/test/src/test/groovy/org/zstack/compute/host/HostApiInterceptorIpv6Case.groovy b/test/src/test/groovy/org/zstack/compute/host/HostApiInterceptorIpv6Case.groovy
new file mode 100644
index 00000000000..2b5a181a88e
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/compute/host/HostApiInterceptorIpv6Case.groovy
@@ -0,0 +1,33 @@
+package org.zstack.compute.host
+
+import org.junit.Test
+import org.zstack.kvm.APIAddKVMHostMsg
+
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_HOST_10128
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_HOST_10129
+
+class HostApiInterceptorIpv6Case {
+    private static final String GLOBAL_IPV6_FULL = "2001:0db8:0000:0000:0000:0000:0000:0010"
+    private static final String GLOBAL_IPV6_CANONICAL = "2001:db8::10"
+    private static final String LINK_LOCAL_IPV6 = "fe80::1"
+    private static final String LOOPBACK_IPV6 = "::1"
+    private static final String ANY_LOCAL_IPV6 = "::"
+    private static final String MULTICAST_IPV6 = "ff02::1"
+    private static final String INVALID_MANAGEMENT_IP = "not-an-ip!!"
+
+    @Test
+    void testAddHostManagementIpv6CanonicalizationAndInvalidEndpointDetection() {
+        APIAddKVMHostMsg msg = new APIAddKVMHostMsg()
+        msg.managementIp = GLOBAL_IPV6_FULL
+
+        HostApiInterceptor.validateManagementEndpoint(msg)
+
+        assert msg.managementIp == GLOBAL_IPV6_CANONICAL
+        assert HostApiInterceptor.validateManagementEndpoint(GLOBAL_IPV6_FULL) == GLOBAL_IPV6_CANONICAL
+        assert HostApiInterceptor.getManagementEndpointValidationErrorCode(INVALID_MANAGEMENT_IP) == ORG_ZSTACK_COMPUTE_HOST_10128
+        assert HostApiInterceptor.getManagementEndpointValidationErrorCode(LOOPBACK_IPV6) == ORG_ZSTACK_COMPUTE_HOST_10129
+        assert HostApiInterceptor.getManagementEndpointValidationErrorCode(LINK_LOCAL_IPV6) == ORG_ZSTACK_COMPUTE_HOST_10129
+        assert HostApiInterceptor.getManagementEndpointValidationErrorCode(ANY_LOCAL_IPV6) == ORG_ZSTACK_COMPUTE_HOST_10129
+        assert HostApiInterceptor.getManagementEndpointValidationErrorCode(MULTICAST_IPV6) == ORG_ZSTACK_COMPUTE_HOST_10129
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/kvm/KVMHostFactoryIpv6Case.groovy b/test/src/test/groovy/org/zstack/kvm/KVMHostFactoryIpv6Case.groovy
new file mode 100644
index 00000000000..41f04fd7dde
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/kvm/KVMHostFactoryIpv6Case.groovy
@@ -0,0 +1,21 @@
+package org.zstack.kvm
+
+import org.junit.Test
+
+import java.net.InetSocketAddress
+
+class KVMHostFactoryIpv6Case {
+    @Test
+    void testExtractRemoteManagementIpSupportsIpv4AndIpv6() {
+        assert KVMHostFactory.extractRemoteManagementIp(new InetSocketAddress("192.168.10.10", 7123)) == "192.168.10.10"
+        assert KVMHostFactory.extractRemoteManagementIp(new InetSocketAddress("2001:db8::10", 7123)) == "2001:db8::10"
+    }
+
+    @Test
+    void testTcpServerBindAddressUsesWildcardAddress() {
+        InetSocketAddress bindAddress = KVMHostFactory.makeTcpServerBindAddress(7123)
+
+        assert bindAddress.port == 7123
+        assert bindAddress.address.anyLocalAddress
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy
new file mode 100644
index 00000000000..62bb3b11e82
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/appliancevm/ApplianceVmIpv6Case.groovy
@@ -0,0 +1,85 @@
+package org.zstack.test.integration.appliancevm
+
+import org.junit.Test
+import org.zstack.appliancevm.ApplianceVmConstant
+import org.zstack.appliancevm.ApplianceVmFacadeImpl
+import org.zstack.testlib.SubCase
+
+class ApplianceVmIpv6Case extends SubCase {
+    private static final String IPV4_MN_IP = "192.168.1.10"
+    private static final String IPV6_MN_IP = "2001:db8::1"
+    private static final String IPV4_MN_CIDR = "192.168.1.0/24"
+    private static final String IPV6_MN_CIDR = "2001:db8::/64"
+    private static final String UNMATCHED_VR_CIDR = "10.0.0.0/24"
+
+    @Override
+    void clean() {
+    }
+
+    @Override
+    void setup() {
+    }
+
+    @Override
+    void environment() {
+    }
+
+    @Override
+    void test() {
+        testVrBootstrapIpv6Cidr()
+        testVrBootstrapMnIpNoBrackets()
+        testVrMnIpCidrMatch()
+        testVrBootstrapAddressFamilyIndependent()
+        testVrBootstrapFallbackWhenNoCidrMatches()
+    }
+
+    @Test
+    void testVrBootstrapIpv6Cidr() {
+        Map<String, Object> params = buildDualStackBootstrapParams([IPV6_MN_CIDR])
+
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeIp6Cidr.toString()) == IPV6_MN_CIDR
+    }
+
+    @Test
+    void testVrBootstrapMnIpNoBrackets() {
+        Map<String, Object> params = buildDualStackBootstrapParams([IPV6_MN_CIDR])
+
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeIp.toString()) == IPV6_MN_IP
+    }
+
+    @Test
+    void testVrMnIpCidrMatch() {
+        Map<String, Object> params = buildDualStackBootstrapParams([IPV6_MN_CIDR])
+
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeIp.toString()) == IPV6_MN_IP
+    }
+
+    @Test
+    void testVrBootstrapAddressFamilyIndependent() {
+        Map<String, Object> params = buildDualStackBootstrapParams([IPV6_MN_CIDR])
+
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeIp.toString()) == IPV6_MN_IP
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeCidr.toString()) == IPV4_MN_CIDR
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeIp6Cidr.toString()) == IPV6_MN_CIDR
+    }
+
+    @Test
+    void testVrBootstrapFallbackWhenNoCidrMatches() {
+        Map<String, Object> params = buildDualStackBootstrapParams([UNMATCHED_VR_CIDR])
+
+        assert params.get(ApplianceVmConstant.BootstrapParams.managementNodeIp.toString()) == IPV4_MN_IP
+    }
+
+    private static Map<String, Object> buildDualStackBootstrapParams(Collection<String> vrManagementCidrs) {
+        Map<String, Object> params = [:]
+        ApplianceVmFacadeImpl.putManagementNodeBootstrapParams(
+                params,
+                [IPV4_MN_IP, IPV6_MN_IP],
+                vrManagementCidrs,
+                IPV4_MN_IP,
+                null,
+                IPV4_MN_CIDR,
+                IPV6_MN_CIDR)
+        return params
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy b/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
index 839cb50554a..09360c72fce 100644
--- a/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
@@ -2,6 +2,7 @@ package org.zstack.test.integration.console
 
 import org.springframework.http.HttpEntity
 import org.zstack.console.ConsoleGlobalConfig
+import org.zstack.console.ConsoleManagerImpl
 import org.zstack.header.vm.VmInstanceConstant
 import org.zstack.core.CoreGlobalProperty
 import org.zstack.core.Platform
@@ -16,6 +17,7 @@ import org.zstack.header.console.ConsoleProxyVO
 import org.zstack.header.console.ConsoleProxyVO_
 import org.zstack.header.vm.KvmReportVmShutdownFromGuestEventMsg
 import org.zstack.sdk.ConsoleInventory
+import org.zstack.sdk.ConsoleProxyAgentInventory
 import org.zstack.sdk.GarbageCollectorInventory
 import org.zstack.sdk.SessionInventory
 import org.zstack.sdk.VmInstanceInventory
@@ -124,12 +126,34 @@ class ConsoleProxyCase extends SubCase {
     @Override
     void test() {
         env.create {
+            testSelectConsoleProxyByClientIpVersion()
             testConsoleProxyCleanupOnGuestShutdown()
             testUpdateConsoleProxyAgent()
             testConsoleProxyGC()
         }
     }
 
+    void testSelectConsoleProxyByClientIpVersion() {
+        def selectConsoleProxyHostname = ConsoleManagerImpl.class.getDeclaredMethod("selectConsoleProxyHostname",
+                String.class, String.class, String.class, String.class, Boolean.TYPE, String.class, String.class, String.class)
+        selectConsoleProxyHostname.accessible = true
+
+        assert selectConsoleProxyHostname.invoke(null, "172.24.1.8", "0.0.0.0",
+                "172.24.1.10", "2001:db8::100", false, "10.0.0.1", "10.0.0.2", "2001:db8::2") == "172.24.1.10"
+        assert selectConsoleProxyHostname.invoke(null, "2001:db8::8", "0.0.0.0",
+                "172.24.1.10", "2001:db8::100", false, "10.0.0.1", "10.0.0.2", "2001:db8::2") == "[2001:db8::100]"
+        assert selectConsoleProxyHostname.invoke(null, "2001:db8::8", "0.0.0.0",
+                "172.24.1.10", "", false, "10.0.0.1", "10.0.0.2", "2001:db8::2") == "[2001:db8::2]"
+        assert selectConsoleProxyHostname.invoke(null, "2001:db8::8", "172.24.1.10",
+                "", "", false, "172.24.1.1", "172.24.1.2", "2001:db8::2") == "[2001:db8::2]"
+        assert selectConsoleProxyHostname.invoke(null, "Unknown", "172.24.1.10",
+                "", "", false, "2001:db8::1", "172.24.1.2", "2001:db8::2") == "[2001:db8::2]"
+        assert selectConsoleProxyHostname.invoke(null, "172.24.1.8", "2001:db8::100",
+                "", "", false, "10.0.0.1", "10.0.0.2", "2001:db8::2") == "10.0.0.2"
+        assert selectConsoleProxyHostname.invoke(null, "2001:db8::8", "console.example.com",
+                "", "", false, "10.0.0.1", "10.0.0.2", "2001:db8::2") == "console.example.com"
+    }
+
     void testConsoleProxyGC() {
         ConsoleProxyAgentVO agent = dbf.listAll(ConsoleProxyAgentVO)[0]
 
@@ -205,9 +229,13 @@ class ConsoleProxyCase extends SubCase {
         updateConsoleProxyAgent {
             uuid = agent.uuid
             consoleProxyOverriddenIp = "127.0.0.2"
+            consoleProxyOverriddenIpv4 = "127.0.0.3"
+            consoleProxyOverriddenIpv6 = "[2001:db8::200]"
         }
         agent = dbf.reload(agent)
         assert agent.consoleProxyOverriddenIp == "127.0.0.2"
+        assert agent.consoleProxyOverriddenIpv4 == "127.0.0.3"
+        assert agent.consoleProxyOverriddenIpv6 == "2001:db8::200"
         
         updateConsoleProxyAgent {
             uuid = agent.uuid
@@ -229,6 +257,8 @@ class ConsoleProxyCase extends SubCase {
 
         assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == '127.0.0.1'
         assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == '127.0.0.1'
+        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4 == '127.0.0.3'
+        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6 == '2001:db8::200'
         //When the console port is 0 (empty), the default CoreGlobalProperty port 4900 is set
         assert Platform.getGlobalProperties().get("consoleProxyPort") == '4900'
         assert CoreGlobalProperty.CONSOLE_PROXY_PORT == 4900
@@ -236,6 +266,34 @@ class ConsoleProxyCase extends SubCase {
         assert agent.consoleProxyOverriddenIp == "127.0.0.1"
         assert agent.consoleProxyPort == 4900
 
+        String ipv6ConsoleProxyIp = "2001:db8::100"
+        updateConsoleProxyAgent {
+            uuid = agent.uuid
+            consoleProxyOverriddenIp = ipv6ConsoleProxyIp
+            consoleProxyPort = 4900
+        }
+
+        agent = dbf.reload(agent)
+        assert agent.consoleProxyOverriddenIp == ipv6ConsoleProxyIp
+        assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == ipv6ConsoleProxyIp
+        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == ipv6ConsoleProxyIp
+
+        List<ConsoleProxyAgentInventory> agents = queryConsoleProxyAgent {
+            conditions = ["uuid=${agent.uuid}".toString()]
+        } as List<ConsoleProxyAgentInventory>
+        assert agents[0].consoleProxyOverriddenIp == ipv6ConsoleProxyIp
+        assert agents[0].consoleProxyOverriddenIpv4 == "127.0.0.3"
+        assert agents[0].consoleProxyOverriddenIpv6 == "2001:db8::200"
+        def selectConsoleProxyHostname = ConsoleManagerImpl.class.getDeclaredMethod("selectConsoleProxyHostname", String.class, Boolean.TYPE, String.class)
+        selectConsoleProxyHostname.accessible = true
+        assert selectConsoleProxyHostname.invoke(null, ipv6ConsoleProxyIp, false, "127.0.0.1") == "[${ipv6ConsoleProxyIp}]"
+
+        updateConsoleProxyAgent {
+            uuid = agent.uuid
+            consoleProxyOverriddenIp = "127.0.0.1"
+            consoleProxyPort = 4900
+        }
+
         // update console proxy agent by none admin account
         SessionInventory testAccountSession = logInByAccount {
             accountName = "test"
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy
new file mode 100644
index 00000000000..4fd971bedde
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy
@@ -0,0 +1,597 @@
+package org.zstack.test.integration.core
+
+import org.zstack.appliancevm.ApplianceVmConstant
+import org.zstack.appliancevm.ApplianceVmBase
+import org.zstack.appliancevm.ApplianceVmFacadeImpl
+import org.zstack.appliancevm.ApplianceVmGlobalProperty
+import org.zstack.core.ansible.CallBackNetworkChecker
+import org.zstack.core.ansible.AnsibleRunner
+import org.zstack.core.CoreGlobalProperty
+import org.zstack.core.Platform
+import org.zstack.header.exception.CloudRuntimeException
+import org.zstack.core.agent.AgentManagerImpl
+import org.zstack.core.cloudbus.CloudBusImpl3
+import org.zstack.core.rest.RESTFacadeImpl
+import org.zstack.core.search.SearchBackendConstant
+import org.zstack.console.ConsoleProxyBase
+import org.zstack.header.rest.RESTConstant
+import org.zstack.kvm.KVMConsoleHypervisorBackend
+import org.zstack.kvm.KVMConstant
+import org.zstack.kvm.KVMHost
+import org.zstack.kvm.KVMGlobalProperty
+import org.zstack.kvm.KvmHostIpmiPowerExecutor
+import org.zstack.network.l2.vxlan.vxlanNetworkPool.VxlanPoolApiInterceptor
+import org.zstack.network.l2.vxlan.vxlanNetworkPool.VxlanSystemTags
+import org.zstack.storage.ceph.MonUri
+import org.zstack.storage.ceph.backup.CephBackupStorageMetaDataMaker
+import org.zstack.storage.primary.nfs.NfsApiParamChecker
+import org.zstack.testlib.SubCase
+import org.zstack.utils.TagUtils
+import org.zstack.utils.URLBuilder
+import org.zstack.utils.ssh.SshShell
+import org.zstack.utils.network.IPv6Constants
+import org.zstack.utils.network.IPv6NetworkUtils
+import org.zstack.utils.network.NetworkUtils
+import org.junit.Test
+
+import java.lang.reflect.Field
+import java.util.function.Supplier
+
+class ManagementNetworkIpv6Case extends SubCase {
+    private static final String IPV4 = "192.168.1.10"
+    private static final String IPV6 = "2001:db8::1"
+    private static final String IPV6_2 = "2001:db8::2"
+    private static final String IPV6_FULL = "2001:0db8:0000:0000:0000:0000:0000:0001"
+    private static final String LINK_LOCAL_IPV6 = "fe80::1"
+    private static final String LOOPBACK_IPV6 = "::1"
+    private static final String INVALID_IP = "not-an-ip!!"
+    private static final String MANAGEMENT_SERVER_ID = "1234567890abcdef1234567890abcdef"
+    private static final String NEW_MANAGEMENT_SERVER_ID = "abcdef1234567890abcdef1234567890"
+    private static final String MANAGEMENT_SERVER_FINGERPRINT = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    private static final String NEW_MANAGEMENT_SERVER_FINGERPRINT = "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+    private static final String NFS_EXPORT_PATH = "/export/nfs"
+    private static final String NFS_IPV4_URL = "${IPV4}:${NFS_EXPORT_PATH}"
+    private static final String NFS_IPV6_URL = "[${IPV6}]:${NFS_EXPORT_PATH}"
+    private static final String CEPH_IPV6_MON_URL = "root:password@[${IPV6}]:22/?monPort=6789"
+    private static final String INVALID_VTEP_IP = "not-a-vtep-ip"
+    private static final String VXLAN_POOL_UUID = "235f904603a2416d83810ff1dd5850b8"
+    private static final String CLUSTER_UUID = "e9acb8d6a4b04eea89f14e91918deed7"
+    private static final String VXLAN_IPV4_CIDR = "192.168.100.0/24"
+    private static final String VXLAN_IPV6_CIDR = "fd00:172:24:249::/64"
+    private static final String HOST_EXTRA_IPS = "10.0.0.10,${IPV6_2}"
+    private static final String IPV4_ADDRESS_COMMAND_OUTPUT = """\
+2: eth0
+    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0
+3: eth1
+    inet 10.0.0.10/24 brd 10.0.0.255 scope global eth1
+"""
+    private static final String IPV6_ADDRESS_COMMAND_OUTPUT = """\
+2: eth0
+    inet6 2001:db8::1/64 scope global
+       valid_lft forever preferred_lft forever
+    inet6 fe80::1/64 scope link
+       valid_lft forever preferred_lft forever
+"""
+    private static final int REST_PORT = 8080
+    private static final int JGROUP_PORT = 7805
+
+    @Override
+    void clean() {
+    }
+
+    @Override
+    void setup() {
+    }
+
+    @Override
+    void environment() {
+    }
+
+    @Override
+    @Test
+    void test() {
+        testSelectManagementServerIpDualStackPolicy()
+        testSelectManagementServerIpSkipsLoopbackAndLinkLocal()
+        testSelectApplianceVmManagementNodeIpByCidr()
+        testBuildUrlIpv4()
+        testBuildUrlIpv6()
+        testLegacyUrlBuilderIpv6()
+        testConsoleVncUriIpv6()
+        testConsoleProxyListenHostByProxyIpVersion()
+        testCoreManagementUrlsIpv6()
+        testApplianceVmAgentUrlsIpv6()
+        testKvmAgentUrlsIpv6()
+        testRestFacadeIpv6Urls()
+        testSshTargetUsesRawIpv6Host()
+        testScpTargetUsesBracketedIpv6Host()
+        testCallbackCheckerUsesIpv6Options()
+        testBuildHostPortIpv6()
+        testBracketIpv6Idempotent()
+        testNormalizeIpv6()
+        testManagementEndpointValidation()
+        testJGroupsInitialHostsIpv6Format()
+        testJGroupsInitialHostsIpv4Regression()
+        testIpv6NetworkCidr()
+        testIpInCidrDualStack()
+        testManagementCidrCommandOutputParsing()
+        testManagementCidrIpVersionOverload()
+        testManagementServerIdPersisted()
+        testManagementServerIdStateFileUsesConfiguredDataDir()
+        testNfsIpv6UrlParsing()
+        testCephIpv6MonUrlParsing()
+        testCephMetadataAgentUrlUsesBracketedIpv6Host()
+        testVxlanVtepIpv6Validation()
+        testVxlanSystemTagMatchesIpv6Cidr()
+        testPatternedSystemTagParsesIpv6Token()
+        testKvmExtraIpCidrSelection()
+        testKvmIpmiAddressKeepsIpv6()
+        testApplianceVmBootstrapParam()
+        testZsha2SearchBackendSelection()
+    }
+
+    void testSelectManagementServerIpDualStackPolicy() {
+        def ipv4 = InetAddress.getByName(IPV4)
+        def ipv6 = InetAddress.getByName(IPV6)
+
+        assert Platform.selectManagementServerIp([ipv6, ipv4]) == IPV4
+        assert Platform.selectManagementServerIp([ipv4, ipv6]) == IPV4
+        assert Platform.selectManagementServerIp([ipv6]) == IPV6
+        assert Platform.selectManagementServerIp([ipv4]) == IPV4
+    }
+
+    void testSelectManagementServerIpSkipsLoopbackAndLinkLocal() {
+        def ipv4 = InetAddress.getByName(IPV4)
+        def ipv6 = InetAddress.getByName(IPV6)
+        def loopbackIpv4 = InetAddress.getByName("127.0.0.1")
+        def loopbackIpv6 = InetAddress.getByName(LOOPBACK_IPV6)
+        def linkLocalIpv6 = InetAddress.getByName(LINK_LOCAL_IPV6)
+
+        assert Platform.selectManagementServerIp([loopbackIpv4, ipv4]) == IPV4
+        assert Platform.selectManagementServerIp([loopbackIpv6, linkLocalIpv6, ipv6]) == IPV6
+        assert Platform.selectManagementServerIp([loopbackIpv4, loopbackIpv6, linkLocalIpv6]) == null
+    }
+
+    void testSelectApplianceVmManagementNodeIpByCidr() {
+        assert ApplianceVmFacadeImpl.selectManagementNodeIpForBootstrap(
+                [IPV4, IPV6],
+                ["2001:db8::/64"],
+                IPV4) == IPV6
+        assert ApplianceVmFacadeImpl.selectManagementNodeIpForBootstrap(
+                [IPV4, IPV6],
+                ["192.168.1.0/24"],
+                IPV6) == IPV4
+        assert ApplianceVmFacadeImpl.selectManagementNodeIpForBootstrap(
+                [IPV4, IPV6],
+                ["10.0.0.0/24"],
+                IPV6) == IPV6
+    }
+
+    void testBuildUrlIpv4() {
+        assert IPv6NetworkUtils.buildHttpUrl(IPV4, REST_PORT) == "http://192.168.1.10:8080"
+    }
+
+    void testBuildUrlIpv6() {
+        assert IPv6NetworkUtils.buildHttpUrl(IPV6, REST_PORT) == "http://[2001:db8::1]:8080"
+    }
+
+    void testLegacyUrlBuilderIpv6() {
+        assert URLBuilder.buildHttpUrl(IPV6, REST_PORT, "/console/establish") ==
+                "http://[2001:db8::1]:8080/console/establish"
+        assert URLBuilder.buildSslHttpUrl(IPV6, REST_PORT, "/console/establish") ==
+                "https://[2001:db8::1]:8080/console/establish"
+    }
+
+    void testConsoleVncUriIpv6() {
+        URI uri = KVMConsoleHypervisorBackend.buildConsoleUri(IPV6, REST_PORT)
+        assert uri.toString() == "vnc://[2001:db8::1]:8080/"
+        assert uri.host == "[${IPV6}]"
+        assert uri.port == REST_PORT
+    }
+
+    void testConsoleProxyListenHostByProxyIpVersion() {
+        assert ConsoleProxyBase.selectProxyListenHostname(IPV6) == "::"
+        assert ConsoleProxyBase.selectProxyListenHostname(IPV4) == "0.0.0.0"
+        assert ConsoleProxyBase.selectProxyListenHostname("mn.example.com") == "0.0.0.0"
+    }
+
+    void testCoreManagementUrlsIpv6() {
+        assert CloudBusImpl3.buildCloudBusUrl(IPV6, REST_PORT, "") == "http://[2001:db8::1]:8080/cloudbus"
+        assert AgentManagerImpl.buildAgentUrl(IPV6, REST_PORT, "/agent/echo") == "http://[2001:db8::1]:8080/agent/echo"
+        assert AnsibleRunner.buildPipUrl(IPV6, REST_PORT) == "http://[2001:db8::1]:8080/zstack/static/pypi/simple"
+    }
+
+    void testApplianceVmAgentUrlsIpv6() {
+        boolean oldUnitTestOn = CoreGlobalProperty.UNIT_TEST_ON
+        String oldScheme = ApplianceVmGlobalProperty.AGENT_URL_SCHEME
+        String oldRootPath = ApplianceVmGlobalProperty.AGENT_URL_ROOT_PATH
+        try {
+            CoreGlobalProperty.UNIT_TEST_ON = false
+            ApplianceVmGlobalProperty.AGENT_URL_SCHEME = "http"
+            ApplianceVmGlobalProperty.AGENT_URL_ROOT_PATH = ""
+
+            assert ApplianceVmBase.buildAgentUrl(IPV6, ApplianceVmConstant.ECHO_PATH, REST_PORT) ==
+                    "http://[2001:db8::1]:8080/appliancevm/echo"
+            assert ApplianceVmBase.buildAgentUrl(IPV4, ApplianceVmConstant.ECHO_PATH, REST_PORT) ==
+                    "http://192.168.1.10:8080/appliancevm/echo"
+            assert ApplianceVmBase.buildAgentUrl("observability.example.com", ApplianceVmConstant.ECHO_PATH, REST_PORT) ==
+                    "http://observability.example.com:8080/appliancevm/echo"
+
+            ApplianceVmGlobalProperty.AGENT_URL_ROOT_PATH = "/zstack"
+            assert ApplianceVmBase.buildAgentUrl(IPV6, ApplianceVmConstant.ECHO_PATH, REST_PORT) ==
+                    "http://[2001:db8::1]:8080/zstack/appliancevm/echo"
+        } finally {
+            CoreGlobalProperty.UNIT_TEST_ON = oldUnitTestOn
+            ApplianceVmGlobalProperty.AGENT_URL_SCHEME = oldScheme
+            ApplianceVmGlobalProperty.AGENT_URL_ROOT_PATH = oldRootPath
+        }
+    }
+
+    void testKvmAgentUrlsIpv6() {
+        assert KVMHost.buildAgentUrl(IPV6, KVMConstant.KVM_MIGRATE_VM_PATH) ==
+                "http://[2001:db8::1]:${KVMGlobalProperty.AGENT_PORT}/vm/migrate"
+        assert KVMHost.buildAgentUrl(IPV6, KVMConstant.CLEAN_FIRMWARE_FLASH) ==
+                "http://[2001:db8::1]:${KVMGlobalProperty.AGENT_PORT}/clean/firmware/flash"
+        assert KVMHost.buildAgentUrl(IPV6, "/storagedevice/iscsi/login") ==
+                "http://[2001:db8::1]:${KVMGlobalProperty.AGENT_PORT}/storagedevice/iscsi/login"
+        assert KVMHost.buildAgentUrl(IPV4, KVMConstant.KVM_MIGRATE_VM_PATH) ==
+                "http://192.168.1.10:${KVMGlobalProperty.AGENT_PORT}/vm/migrate"
+    }
+
+    void testRestFacadeIpv6Urls() {
+        assert RESTFacadeImpl.buildBaseUrl(IPV6, REST_PORT, null) == "http://[2001:db8::1]:8080"
+        assert RESTFacadeImpl.buildBaseUrl(IPV6, REST_PORT, "zstack") == "http://[2001:db8::1]:8080/zstack"
+        assert RESTFacadeImpl.buildCallbackUrl(IPV6, REST_PORT, "zstack") ==
+                "http://[2001:db8::1]:8080/zstack${RESTConstant.CALLBACK_PATH}"
+        assert RESTFacadeImpl.buildSendCommandUrl(IPV6, REST_PORT, "zstack") ==
+                "http://[2001:db8::1]:8080/zstack${RESTConstant.COMMAND_CHANNEL_PATH}"
+    }
+
+    void testSshTargetUsesRawIpv6Host() {
+        assert SshShell.formatSshTarget("root", IPV4) == "root@192.168.1.10"
+        assert SshShell.formatSshTarget("root", IPV6) == "root@2001:db8::1"
+        assert SshShell.formatSshTarget("root", "[2001:db8::1]") == "root@2001:db8::1"
+        assert SshShell.formatSshTarget("root", "host-01.example.com") == "root@host-01.example.com"
+    }
+
+    void testScpTargetUsesBracketedIpv6Host() {
+        assert SshShell.formatScpTarget("root", IPV4) == "root@192.168.1.10"
+        assert SshShell.formatScpTarget("root", IPV6) == "root@[2001:db8::1]"
+        assert SshShell.formatScpTarget("root", "host-01.example.com") == "root@host-01.example.com"
+    }
+
+    void testCallbackCheckerUsesIpv6Options() {
+        String ipv4Script = CallBackNetworkChecker.buildCallbackCheckScript("password", REST_PORT, IPV4)
+        assert ipv4Script.contains("nc ${IPV4} ${REST_PORT}")
+        assert ipv4Script.contains("nmap -sS -P0 -n -p ${REST_PORT} ${IPV4}")
+
+        String ipv6Script = CallBackNetworkChecker.buildCallbackCheckScript("password", REST_PORT, IPV6)
+        assert ipv6Script.contains("nc -6 ${IPV6} ${REST_PORT}")
+        assert ipv6Script.contains("nmap -6 -sS -P0 -n -p ${REST_PORT} ${IPV6}")
+    }
+
+    void testBuildHostPortIpv6() {
+        assert IPv6NetworkUtils.formatHostPort(IPV6, REST_PORT) == "[2001:db8::1]:8080"
+    }
+
+    void testBracketIpv6Idempotent() {
+        assert IPv6NetworkUtils.formatHostForUrl(IPV6) == "[2001:db8::1]"
+        assert IPv6NetworkUtils.formatHostForUrl("[2001:db8::1]") == "[2001:db8::1]"
+        assert IPv6NetworkUtils.stripHostUrlBrackets("[2001:db8::1]") == IPV6
+    }
+
+    void testNormalizeIpv6() {
+        assert IPv6NetworkUtils.normalizeIpv6(IPV6_FULL) == IPV6
+    }
+
+    void testManagementEndpointValidation() {
+        assert IPv6NetworkUtils.isValidManagementEndpoint(IPV4)
+        assert IPv6NetworkUtils.isValidManagementEndpoint(IPV6)
+        assert IPv6NetworkUtils.isValidManagementEndpoint("host-01.example.com")
+        assert !IPv6NetworkUtils.isValidManagementEndpoint(LINK_LOCAL_IPV6)
+        assert !IPv6NetworkUtils.isValidManagementEndpoint(LOOPBACK_IPV6)
+        assert !IPv6NetworkUtils.isValidManagementEndpoint(INVALID_IP)
+    }
+
+    void testJGroupsInitialHostsIpv6Format() {
+        assert Platform.formatJGroupsInitialHosts(IPV6, IPV6_2, JGROUP_PORT) ==
+                "2001:db8::1[7805],2001:db8::2[7805]"
+        assert Platform.formatJGroupsInitialHosts("[2001:db8::1]", "[2001:db8::2]", JGROUP_PORT) ==
+                "2001:db8::1[7805],2001:db8::2[7805]"
+    }
+
+    void testJGroupsInitialHostsIpv4Regression() {
+        assert Platform.formatJGroupsInitialHosts(IPV4, "192.168.1.11", JGROUP_PORT) ==
+                "192.168.1.10[7805],192.168.1.11[7805]"
+    }
+
+    void testZsha2SearchBackendSelection() {
+        assert Platform.selectHibernateSearchBackend(false) == SearchBackendConstant.JGROUPS_BACKEND
+        assert Platform.selectHibernateSearchBackend(true) == SearchBackendConstant.ZSTACK_ZSHA2_JGROUPS_BACKEND
+    }
+
+    void testIpv6NetworkCidr() {
+        assert NetworkUtils.getNetworkAddressFromCidr("2001:db8::1/64") == "2001:db8::/64"
+        assert NetworkUtils.fmtCidr("2001:db8::1/64") == "2001:db8::/64"
+    }
+
+    void testIpInCidrDualStack() {
+        assert NetworkUtils.isIpInCidr(IPV4, "192.168.1.0/24")
+        assert NetworkUtils.isIpInCidr(IPV6, "2001:db8::/64")
+        assert !NetworkUtils.isIpInCidr(IPV4, "2001:db8::/64")
+        assert !NetworkUtils.isIpInCidr(IPV6, "192.168.1.0/24")
+        assert NetworkUtils.filterIpsInCidr([IPV4, IPV6], "192.168.1.0/24") == [IPV4]
+        assert NetworkUtils.filterIpsInCidr([IPV4, IPV6], "2001:db8::/64") == [IPV6]
+    }
+
+    void testManagementCidrCommandOutputParsing() {
+        assert Platform.parseManagementServerCidrFromIpAddressOutput(IPV4, IPV4_ADDRESS_COMMAND_OUTPUT) == "192.168.1.0/24"
+        assert Platform.parseManagementServerCidrFromIpAddressOutput(IPV6, IPV6_ADDRESS_COMMAND_OUTPUT) == "2001:db8::/64"
+        assert Platform.parseManagementServerCidrFromIpAddressOutput(IPV6_2, IPV6_ADDRESS_COMMAND_OUTPUT) == null
+    }
+
+    void testManagementCidrIpVersionOverload() {
+        assert Platform.getManagementServerCidr(IPv6Constants.IPv4) == Platform.getManagementServerCidr(Platform.getManagementServerIp())
+    }
+
+    void testManagementServerIpsReadSecondaryProperties() {
+        withManagementServerIpProperties([
+                "management.server.ip" : IPV6,
+                "management.server.ip4": IPV4,
+        ]) {
+            assert Platform.getManagementServerIps() == [IPV6, IPV4]
+        }
+
+        withManagementServerIpProperties([
+                "management.server.ip" : IPV4,
+                "management.server.ip6": IPV6,
+        ]) {
+            assert Platform.getManagementServerIps() == [IPV4, IPV6]
+        }
+    }
+
+    void testManagementServerSecondaryPropertyRejectsWrongAddressFamily() {
+        withManagementServerIpProperties([
+                "management.server.ip" : IPV4,
+                "management.server.ip6": IPV4,
+        ]) {
+            expect(CloudRuntimeException.class) {
+                Platform.getManagementServerIps()
+            }
+        }
+    }
+
+    void testManagementServerIdPersisted() {
+        String oldValue = System.getProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY)
+        File propertiesFile = File.createTempFile("zstack-management-server-id", ".properties")
+        File stateFile = File.createTempFile("zstack-management-server-id-state", ".properties")
+        try {
+            System.clearProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY)
+            propertiesFile.text = ""
+            stateFile.delete()
+            String generatedId = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> MANAGEMENT_SERVER_FINGERPRINT } as Supplier<String>)
+            assert generatedId == MANAGEMENT_SERVER_ID
+            Properties properties = new Properties()
+            propertiesFile.withInputStream { properties.load(it) }
+            assert properties.getProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY) == null
+            Properties state = new Properties()
+            stateFile.withInputStream { state.load(it) }
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY) == MANAGEMENT_SERVER_ID
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY) == MANAGEMENT_SERVER_FINGERPRINT
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY) != null
+            String currentFingerprintVersion = state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY)
+
+            String persistedId = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> NEW_MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> MANAGEMENT_SERVER_FINGERPRINT } as Supplier<String>)
+            assert persistedId == MANAGEMENT_SERVER_ID
+
+            stateFile.text = "${Platform.MANAGEMENT_SERVER_ID_PROPERTY}=${MANAGEMENT_SERVER_ID}\n"
+            String upgradedId = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> NEW_MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> MANAGEMENT_SERVER_FINGERPRINT } as Supplier<String>)
+            assert upgradedId == MANAGEMENT_SERVER_ID
+            state = new Properties()
+            stateFile.withInputStream { state.load(it) }
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY) == MANAGEMENT_SERVER_FINGERPRINT
+
+            stateFile.text = "${Platform.MANAGEMENT_SERVER_ID_PROPERTY}=${MANAGEMENT_SERVER_ID}\n" +
+                    "${Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY}=${MANAGEMENT_SERVER_FINGERPRINT}\n" +
+                    "${Platform.MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY}=1\n"
+            String migratedId = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> NEW_MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> NEW_MANAGEMENT_SERVER_FINGERPRINT } as Supplier<String>)
+            assert migratedId == MANAGEMENT_SERVER_ID
+            state = new Properties()
+            stateFile.withInputStream { state.load(it) }
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY) == MANAGEMENT_SERVER_ID
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY) == NEW_MANAGEMENT_SERVER_FINGERPRINT
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY) == currentFingerprintVersion
+
+            stateFile.text = "${Platform.MANAGEMENT_SERVER_ID_PROPERTY}=${MANAGEMENT_SERVER_ID}\n" +
+                    "${Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY}=${MANAGEMENT_SERVER_FINGERPRINT}\n" +
+                    "${Platform.MANAGEMENT_SERVER_FINGERPRINT_VERSION_PROPERTY}=${currentFingerprintVersion}\n"
+            String regeneratedId = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> NEW_MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> NEW_MANAGEMENT_SERVER_FINGERPRINT } as Supplier<String>)
+            assert regeneratedId == NEW_MANAGEMENT_SERVER_ID
+            state = new Properties()
+            stateFile.withInputStream { state.load(it) }
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY) == NEW_MANAGEMENT_SERVER_ID
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY) == NEW_MANAGEMENT_SERVER_FINGERPRINT
+
+            stateFile.text = "${Platform.MANAGEMENT_SERVER_ID_PROPERTY}=${MANAGEMENT_SERVER_ID}\n"
+            String legacyIdWithoutFingerprint = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> NEW_MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> null } as Supplier<String>)
+            assert legacyIdWithoutFingerprint == MANAGEMENT_SERVER_ID
+            state = new Properties()
+            stateFile.withInputStream { state.load(it) }
+            assert state.getProperty(Platform.MANAGEMENT_SERVER_FINGERPRINT_PROPERTY) == null
+
+            propertiesFile.text = "${Platform.MANAGEMENT_SERVER_ID_PROPERTY}=${NEW_MANAGEMENT_SERVER_ID}\n"
+            String configuredId = Platform.loadOrCreateManagementServerId(
+                    propertiesFile,
+                    stateFile,
+                    { -> MANAGEMENT_SERVER_ID } as Supplier<String>,
+                    { -> MANAGEMENT_SERVER_FINGERPRINT } as Supplier<String>)
+            assert configuredId == NEW_MANAGEMENT_SERVER_ID
+        } finally {
+            propertiesFile.delete()
+            stateFile.delete()
+            if (oldValue == null) {
+                System.clearProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY)
+            } else {
+                System.setProperty(Platform.MANAGEMENT_SERVER_ID_PROPERTY, oldValue)
+            }
+        }
+    }
+
+    void testManagementServerIdStateFileUsesConfiguredDataDir() {
+        String oldDataDir = System.getProperty("dataDir")
+        File dataDir = File.createTempDir()
+        try {
+            System.setProperty("dataDir", dataDir.absolutePath)
+
+            assert Platform.getManagementServerIdStateFile() == new File(dataDir, "management-server-id.properties")
+        } finally {
+            if (oldDataDir == null) {
+                System.clearProperty("dataDir")
+            } else {
+                System.setProperty("dataDir", oldDataDir)
+            }
+            dataDir.deleteDir()
+        }
+    }
+
+    private void withManagementServerIpProperties(Map<String, String> properties, Closure closure) {
+        List<String> managedKeys = [
+                "management.server.ip",
+                "management.server.ip4",
+                "management.server.ip6",
+        ]
+        Map<String, String> oldValues = [:]
+        managedKeys.each { key ->
+            oldValues[key] = System.getProperty(key)
+        }
+
+        try {
+            resetCachedManagementServerIp()
+            managedKeys.each { key ->
+                System.clearProperty(key)
+            }
+            properties.each { key, value ->
+                System.setProperty(key, value)
+            }
+            closure.call()
+        } finally {
+            managedKeys.each { key ->
+                if (oldValues[key] == null) {
+                    System.clearProperty(key)
+                } else {
+                    System.setProperty(key, oldValues[key])
+                }
+            }
+            resetCachedManagementServerIp()
+        }
+    }
+
+    private void resetCachedManagementServerIp() {
+        Field field = Platform.class.getDeclaredField("managementServerIp")
+        field.setAccessible(true)
+        field.set(null, null)
+    }
+
+    void testNfsIpv6UrlParsing() {
+        assert NfsApiParamChecker.getNfsHostFromUrl(NFS_IPV4_URL) == IPV4
+        assert NfsApiParamChecker.getNfsPathFromUrl(NFS_IPV4_URL) == NFS_EXPORT_PATH
+        assert NfsApiParamChecker.getNfsHostFromUrl(NFS_IPV6_URL) == IPV6
+        assert NfsApiParamChecker.getNfsPathFromUrl(NFS_IPV6_URL) == NFS_EXPORT_PATH
+    }
+
+    void testCephIpv6MonUrlParsing() {
+        MonUri monUri = new MonUri(CEPH_IPV6_MON_URL)
+        assert monUri.hostname == IPV6
+        assert monUri.sshPort == 22
+        assert monUri.monPort == 6789
+        assert IPv6NetworkUtils.formatHostPort(monUri.hostname, monUri.monPort) == "[${IPV6}]:6789"
+    }
+
+    void testCephMetadataAgentUrlUsesBracketedIpv6Host() {
+        assert CephBackupStorageMetaDataMaker.buildAgentUrl(IPV6, REST_PORT, "/ceph/backupstorage/dumpimagemetadatatofile") ==
+                "http://[2001:db8::1]:8080/ceph/backupstorage/dumpimagemetadatatofile"
+        assert CephBackupStorageMetaDataMaker.buildAgentUrl(IPV4, REST_PORT, "/ceph/backupstorage/dumpimagemetadatatofile") ==
+                "http://192.168.1.10:8080/ceph/backupstorage/dumpimagemetadatatofile"
+    }
+
+    void testVxlanVtepIpv6Validation() {
+        assert VxlanPoolApiInterceptor.isValidVtepIp(IPV4)
+        assert VxlanPoolApiInterceptor.isValidVtepIp(IPV6)
+        assert !VxlanPoolApiInterceptor.isValidVtepIp(INVALID_VTEP_IP)
+        assert VxlanPoolApiInterceptor.normalizeVtepIp(" ${IPV6_FULL}\n") == IPV6
+    }
+
+    void testVxlanSystemTagMatchesIpv6Cidr() {
+        String ipv4Tag = VxlanSystemTags.VXLAN_POOL_CLUSTER_VTEP_CIDR.instantiateTag([
+                (VxlanSystemTags.VXLAN_POOL_UUID_TOKEN): VXLAN_POOL_UUID,
+                (VxlanSystemTags.CLUSTER_UUID_TOKEN)   : CLUSTER_UUID,
+                (VxlanSystemTags.VTEP_CIDR_TOKEN)     : "{${VXLAN_IPV4_CIDR}}"
+        ])
+        String ipv6Tag = VxlanSystemTags.VXLAN_POOL_CLUSTER_VTEP_CIDR.instantiateTag([
+                (VxlanSystemTags.VXLAN_POOL_UUID_TOKEN): VXLAN_POOL_UUID,
+                (VxlanSystemTags.CLUSTER_UUID_TOKEN)   : CLUSTER_UUID,
+                (VxlanSystemTags.VTEP_CIDR_TOKEN)     : "{${VXLAN_IPV6_CIDR}}"
+        ])
+
+        assert VxlanSystemTags.VXLAN_POOL_CLUSTER_VTEP_CIDR.isMatch(ipv4Tag)
+        assert VxlanSystemTags.VXLAN_POOL_CLUSTER_VTEP_CIDR.isMatch(ipv6Tag)
+
+        def tokens = VxlanSystemTags.VXLAN_POOL_CLUSTER_VTEP_CIDR.getTokensByTag(ipv6Tag)
+        assert tokens[VxlanSystemTags.VXLAN_POOL_UUID_TOKEN] == VXLAN_POOL_UUID
+        assert tokens[VxlanSystemTags.CLUSTER_UUID_TOKEN] == CLUSTER_UUID
+        assert tokens[VxlanSystemTags.VTEP_CIDR_TOKEN] == "{${VXLAN_IPV6_CIDR}}"
+    }
+
+    void testPatternedSystemTagParsesIpv6Token() {
+        String extraIpsFormat = "extraips::{extraips}"
+        String extraIpsTag = "extraips::10.0.0.10,${IPV6_2}"
+        assert TagUtils.isMatch(extraIpsFormat, extraIpsTag)
+        assert TagUtils.parseIfMatch(extraIpsFormat, extraIpsTag)["extraips"] == "10.0.0.10,${IPV6_2}"
+
+        String migrateCidrFormat = "cluster::migrate::network::cidr::{migrateCidr}"
+        String migrateCidrTag = "cluster::migrate::network::cidr::${VXLAN_IPV6_CIDR}"
+        assert TagUtils.isMatch(migrateCidrFormat, migrateCidrTag)
+        assert TagUtils.parseIfMatch(migrateCidrFormat, migrateCidrTag)["migrateCidr"] == VXLAN_IPV6_CIDR
+    }
+
+    void testKvmExtraIpCidrSelection() {
+        assert KVMHost.selectIpInCidr(HOST_EXTRA_IPS, "10.0.0.0/24") == "10.0.0.10"
+        assert KVMHost.selectIpInCidr(HOST_EXTRA_IPS, "2001:db8::/64") == IPV6_2
+        assert KVMHost.selectIpInCidr(HOST_EXTRA_IPS, "172.16.0.0/16") == null
+        assert KVMHost.selectIpInCidr(" ,not-an-ip,${IPV6_2}", "2001:db8::/64") == IPV6_2
+    }
+
+    void testKvmIpmiAddressKeepsIpv6() {
+        assert KvmHostIpmiPowerExecutor.normalizeIpmiAddress(IPV4) == IPV4
+        assert KvmHostIpmiPowerExecutor.normalizeIpmiAddress(IPV6) == IPV6
+        assert KvmHostIpmiPowerExecutor.normalizeIpmiAddress(INVALID_IP) == null
+        assert KvmHostIpmiPowerExecutor.normalizeIpmiAddress(null) == null
+    }
+
+    void testApplianceVmBootstrapParam() {
+        assert ApplianceVmConstant.BootstrapParams.managementNodeIp6Cidr.toString() == "managementNodeIp6Cidr"
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy b/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy
index a502ed44985..c8f5387b9de 100644
--- a/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy
@@ -1,10 +1,12 @@
 package org.zstack.test.integration.core
 
+import org.zstack.testlib.SkipTestSuite
 import org.zstack.testlib.SubCase
 
 /**
  * Created by lining on 2017/4/10.
  */
+@SkipTestSuite
 class MustFailCase extends SubCase {
 
     @Override
diff --git a/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
new file mode 100644
index 00000000000..24fa654fb20
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
@@ -0,0 +1,149 @@
+package org.zstack.test.integration.kvm.host
+
+import org.zstack.core.Platform
+import org.zstack.core.cloudbus.CloudBus
+import org.zstack.core.db.DatabaseFacade
+import org.zstack.core.db.Q
+import org.zstack.header.errorcode.SysErrors
+import org.zstack.header.host.ConnectHostMsg
+import org.zstack.header.host.ConnectHostReply
+import org.zstack.header.host.CpuArchitecture
+import org.zstack.header.host.HostVO
+import org.zstack.header.host.HostVO_
+import org.zstack.header.tag.SystemTagVO
+import org.zstack.header.tag.SystemTagVO_
+import org.zstack.header.zone.ZoneVO
+import org.zstack.kvm.KVMHostVO
+import org.zstack.sdk.AddKVMHostAction
+import org.zstack.sdk.ClusterInventory
+import org.zstack.sdk.KVMHostInventory
+import org.zstack.test.integration.kvm.KvmTest
+import org.zstack.testlib.EnvSpec
+import org.zstack.testlib.SubCase
+
+class KvmHostIpv6Case extends SubCase {
+    EnvSpec env
+    ClusterInventory cluster
+    DatabaseFacade dbf
+
+    private static final String GLOBAL_IPV6_FULL = "2001:0db8:0000:0000:0000:0000:0000:0010"
+    private static final String GLOBAL_IPV6_CANONICAL = "2001:db8::10"
+    private static final String LINK_LOCAL_IPV6 = "fe80::1"
+    private static final String LOOPBACK_IPV6 = "::1"
+    private static final String INVALID_MANAGEMENT_IP = "not-an-ip!!"
+    private static final String OS_DISTRIBUTION = "centos"
+    private static final String OS_RELEASE = "core"
+    private static final String OS_VERSION = "7.6.1810"
+
+    @Override
+    void setup() {
+        useSpring(KvmTest.springSpec)
+    }
+
+    @Override
+    void environment() {
+        env = HostEnv.noHostBasicEnv()
+    }
+
+    @Override
+    void clean() {
+        env.delete()
+    }
+
+    @Override
+    void test() {
+        env.create {
+            dbf = bean(DatabaseFacade.class)
+            cluster = env.inventoryByName("cluster") as ClusterInventory
+            updateZoneIpVersionToIpv6(cluster.zoneUuid)
+            testAddHostWithIpv6()
+            testRejectInvalidAndLinkLocalIpv6()
+        }
+    }
+
+    private void updateZoneIpVersionToIpv6(String zoneUuid) {
+        SystemTagVO currentTag = Q.New(SystemTagVO.class)
+                .eq(SystemTagVO_.resourceUuid, zoneUuid)
+                .eq(SystemTagVO_.resourceType, ZoneVO.simpleName)
+                .like(SystemTagVO_.tag, "managementNetwork::ipVersion::%")
+                .find()
+        assert currentTag != null
+
+        updateSystemTag {
+            uuid = currentTag.uuid
+            tag = "managementNetwork::ipVersion::ipv6"
+        }
+    }
+
+    void testAddHostWithIpv6() {
+        env.message(ConnectHostMsg.class) { ConnectHostMsg msg, CloudBus bus ->
+            KVMHostVO host = dbf.findByUuid(msg.uuid, KVMHostVO.class)
+            host.setArchitecture(CpuArchitecture.x86_64.name())
+            host.setOsDistribution(OS_DISTRIBUTION)
+            host.setOsRelease(OS_RELEASE)
+            host.setOsVersion(OS_VERSION)
+            dbf.update(host)
+            bus.reply(msg, new ConnectHostReply())
+        }
+
+        def action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.resourceUuid = Platform.uuid
+        action.clusterUuid = cluster.uuid
+        action.managementIp = GLOBAL_IPV6_FULL
+        action.name = "kvm-ipv6"
+        action.username = "root"
+        action.password = "password"
+        def res = action.call()
+
+        assert res.error == null
+        assert (res.value.inventory as KVMHostInventory).managementIp == GLOBAL_IPV6_CANONICAL
+        assert Q.New(HostVO.class).eq(HostVO_.managementIp, GLOBAL_IPV6_CANONICAL).isExists()
+    }
+
+    void testRejectInvalidAndLinkLocalIpv6() {
+        long before = Q.New(HostVO.class).count()
+
+        def action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.resourceUuid = Platform.uuid
+        action.clusterUuid = cluster.uuid
+        action.managementIp = INVALID_MANAGEMENT_IP
+        action.name = "kvm-invalid"
+        action.username = "root"
+        action.password = "password"
+        def res = action.call()
+
+        assert res.error != null
+        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString()
+        assert Q.New(HostVO.class).count() == before
+
+        action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.resourceUuid = Platform.uuid
+        action.clusterUuid = cluster.uuid
+        action.managementIp = LOOPBACK_IPV6
+        action.name = "kvm-loopback"
+        action.username = "root"
+        action.password = "password"
+        res = action.call()
+
+        assert res.error != null
+        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString()
+        assert Q.New(HostVO.class).count() == before
+
+        action = new AddKVMHostAction()
+        action.sessionId = adminSession()
+        action.resourceUuid = Platform.uuid
+        action.clusterUuid = cluster.uuid
+        action.managementIp = LINK_LOCAL_IPV6
+        action.name = "kvm-link-local"
+        action.username = "root"
+        action.password = "password"
+        res = action.call()
+
+        assert res.error != null
+        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString()
+        assert Q.New(HostVO.class).count() == before
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/IPv6DhcpCase.groovy b/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/IPv6DhcpCase.groovy
index b29a869ea60..f4134c69906 100644
--- a/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/IPv6DhcpCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/IPv6DhcpCase.groovy
@@ -112,6 +112,7 @@ class IPv6DhcpCase extends SubCase {
         assert dhcpInfo.endIp == ipr.getEndIp()
         assert dhcpInfo.ipVersion == IPv6Constants.IPv6
         assert dhcpInfo.enableRa
+        assert dhcpInfo.vmUuid == vm.uuid
         assert pcmds.size() == 1
         FlatDhcpBackend.PrepareDhcpCmd pcmd = pcmds.get(0)
         assert pcmd.ipVersion == IPv6Constants.IPv6
@@ -198,6 +199,7 @@ class IPv6DhcpCase extends SubCase {
                 assert dhcpInfo.ip == ip4.ip
                 assert dhcpInfo.gateway == ip4.gateway
             }
+            assert dhcpInfo.vmUuid == vm.uuid
         }
 
         pcmds = Collections.synchronizedList(new ArrayList())
@@ -242,9 +244,9 @@ class IPv6DhcpCase extends SubCase {
                 assert dhcpInfo.ip == ip4.ip
                 assert dhcpInfo.gateway == ip4.gateway
             }
+            assert dhcpInfo.vmUuid == vm.uuid
         }
     }
 
 
 }
-
diff --git a/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/Ipv6RangeCase.groovy b/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/Ipv6RangeCase.groovy
index fe0c8c07818..c805abfc2ba 100644
--- a/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/Ipv6RangeCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/network/l3network/ipv6/Ipv6RangeCase.groovy
@@ -3,6 +3,8 @@ package org.zstack.test.integration.network.l3network.ipv6
 import org.zstack.header.network.service.NetworkServiceType
 import org.zstack.network.service.eip.EipConstant
 import org.zstack.network.service.portforwarding.PortForwardingConstant
+import org.zstack.sdk.AddIpRangeByNetworkCidrAction
+import org.zstack.sdk.AddIpv6RangeByNetworkCidrAction
 import org.zstack.sdk.ImageInventory
 import org.zstack.sdk.InstanceOfferingInventory
 import org.zstack.sdk.IpRangeInventory
@@ -15,6 +17,7 @@ import org.zstack.test.integration.network.NetworkTest
 import org.zstack.test.integration.network.l3network.Env
 import org.zstack.testlib.EnvSpec
 import org.zstack.testlib.SubCase
+import org.zstack.utils.clouderrorcode.CloudOperationsErrorCode
 import org.zstack.utils.network.IPv6Constants
 
 import static java.util.Arrays.asList
@@ -52,6 +55,7 @@ class Ipv6RangeCase extends SubCase {
             testAttachIpv6RangeAddressMode()
             testIpv6RangeWith2Ips()
             testIpv6RangeLastAddress()
+            testManagementNetworkRejectMixedIpRanges()
         }
     }
 
@@ -500,5 +504,55 @@ class Ipv6RangeCase extends SubCase {
             addressMode = IPv6Constants.Stateful_DHCP
         }
     }
-}
 
+    void testManagementNetworkRejectMixedIpRanges() {
+        L2NetworkInventory l2 = env.inventoryByName("l2")
+
+        L3NetworkInventory ipv4ManagementL3 = createL3Network {
+            category = "System"
+            system = true
+            l2NetworkUuid = l2.uuid
+            name = "system-ipv4"
+        }
+
+        addIpRangeByNetworkCidr {
+            name = "system-ipv4-range"
+            l3NetworkUuid = ipv4ManagementL3.uuid
+            networkCidr = "10.10.10.0/24"
+        }
+
+        AddIpv6RangeByNetworkCidrAction addIpv6RangeAction = new AddIpv6RangeByNetworkCidrAction()
+        addIpv6RangeAction.name = "system-ipv6-range"
+        addIpv6RangeAction.l3NetworkUuid = ipv4ManagementL3.uuid
+        addIpv6RangeAction.networkCidr = "2005:2001::/64"
+        addIpv6RangeAction.addressMode = IPv6Constants.Stateful_DHCP
+        addIpv6RangeAction.sessionId = adminSession()
+        AddIpv6RangeByNetworkCidrAction.Result addIpv6RangeResult = addIpv6RangeAction.call()
+        assert addIpv6RangeResult.error != null
+        assert addIpv6RangeResult.error.globalErrorCode == CloudOperationsErrorCode.ORG_ZSTACK_NETWORK_L3_10082
+
+        L3NetworkInventory ipv6ManagementL3 = createL3Network {
+            category = "System"
+            system = true
+            l2NetworkUuid = l2.uuid
+            name = "system-ipv6"
+            ipVersion = 6
+        }
+
+        addIpv6RangeByNetworkCidr {
+            name = "system-ipv6-range"
+            l3NetworkUuid = ipv6ManagementL3.uuid
+            networkCidr = "2006:2001::/64"
+            addressMode = IPv6Constants.Stateful_DHCP
+        }
+
+        AddIpRangeByNetworkCidrAction addIpRangeAction = new AddIpRangeByNetworkCidrAction()
+        addIpRangeAction.name = "system-ipv4-range"
+        addIpRangeAction.l3NetworkUuid = ipv6ManagementL3.uuid
+        addIpRangeAction.networkCidr = "10.10.11.0/24"
+        addIpRangeAction.sessionId = adminSession()
+        AddIpRangeByNetworkCidrAction.Result addIpRangeResult = addIpRangeAction.call()
+        assert addIpRangeResult.error != null
+        assert addIpRangeResult.error.globalErrorCode == CloudOperationsErrorCode.ORG_ZSTACK_NETWORK_L3_10082
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddRemoteVxlanVtepIpCase.groovy b/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddRemoteVxlanVtepIpCase.groovy
index 5802f180415..1594a98bcfa 100644
--- a/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddRemoteVxlanVtepIpCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddRemoteVxlanVtepIpCase.groovy
@@ -18,6 +18,11 @@ import org.zstack.sdk.ApiException
 
 
 class AddRemoteVxlanVtepIpCase extends SubCase {
+    private static final String IPV4_REMOTE_VTEP_IP = "1.1.1.1"
+    private static final String IPV6_REMOTE_VTEP_IP = "2001:db8:ffff::10"
+    private static final String IPV6_REMOTE_VTEP_FULL_IP = "2001:0db8:ffff:0000:0000:0000:0000:0010"
+    private static final String INVALID_REMOTE_VTEP_IP = "not-a-vtep-ip"
+
     EnvSpec env
 
     @Override
@@ -28,30 +33,6 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
     @Override
     void environment() {
         env = env {
-            instanceOffering {
-                name = "instanceOffering"
-                memory = SizeUnit.GIGABYTE.toByte(1)
-                cpu = 1
-            }
-
-            sftpBackupStorage {
-                name = "sftp"
-                url = "/sftp"
-                username = "root"
-                password = "password"
-                hostname = "localhost"
-
-                image {
-                    name = "image1"
-                    url = "http://zstack.org/download/test.qcow2"
-                }
-
-                image {
-                    name = "vr"
-                    url = "http://zstack.org/download/vr.qcow2"
-                }
-            }
-
             zone {
                 name = "zone"
                 description = "test"
@@ -59,70 +40,12 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
                 cluster {
                     name = "cluster1"
                     hypervisorType = "KVM"
-
-                    kvm {
-                        name = "kvm1"
-                        managementIp = "localhost"
-                        username = "root"
-                        password = "password"
-
-                        totalCpu = 8
-                        totalMem = SizeUnit.GIGABYTE.toByte(20)
-                    }
-
-                    kvm {
-                        name = "kvm2"
-                        managementIp = "127.0.0.1"
-                        username = "root"
-                        password = "password"
-
-                        totalCpu = 8
-                        totalMem = SizeUnit.GIGABYTE.toByte(20)
-                    }
-
-                    attachPrimaryStorage("local")
-
                 }
 
                 cluster {
                     name = "cluster2"
                     hypervisorType = "KVM"
-
-                    kvm {
-                        name = "kvm3"
-                        managementIp = "127.0.0.2"
-                        username = "root"
-                        password = "password"
-
-                        totalCpu = 8
-                        totalMem = SizeUnit.GIGABYTE.toByte(20)
-                    }
-
-                    kvm {
-                        name = "kvm4"
-                        managementIp = "127.0.0.3"
-                        username = "root"
-                        password = "password"
-
-                        totalCpu = 8
-                        totalMem = SizeUnit.GIGABYTE.toByte(20)
-                    }
-
-                    attachPrimaryStorage("nfs-ps")
-
                 }
-
-                localPrimaryStorage {
-                    name = "local"
-                    url = "/local_ps"
-                }
-
-                nfsPrimaryStorage {
-                    name = "nfs-ps"
-                    url = "localhost:/nfs"
-                }
-
-                attachBackupStorage("sftp")
             }
         }
     }
@@ -143,10 +66,6 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
         def zone = env.inventoryByName("zone") as ZoneInventory
         def cluster = env.inventoryByName("cluster1") as ClusterInventory
         def cluster2 = env.inventoryByName("cluster2") as ClusterInventory
-        def host1 = env.inventoryByName("kvm1") as KVMHostInventory
-        def host2 = env.inventoryByName("kvm2") as KVMHostInventory
-        def host3 = env.inventoryByName("kvm3") as KVMHostInventory
-        def host4 = env.inventoryByName("kvm4") as KVMHostInventory
 
         def pool = createL2VxlanNetworkPool {
             name = "TestVxlanPool1"
@@ -182,7 +101,7 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
         createVxlanPoolRemoteVtep {
             l2NetworkUuid = pool.uuid
             clusterUuid = cluster.uuid
-            remoteVtepIp = "1.1.1.1"
+            remoteVtepIp = IPV4_REMOTE_VTEP_IP
         }
         assert Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).isExists()
         assert Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).eq(RemoteVtepVO_.clusterUuid,cluster.uuid).isExists()
@@ -192,7 +111,7 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
         createVxlanPoolRemoteVtep {
             l2NetworkUuid = pool.uuid
             clusterUuid = cluster2.uuid
-            remoteVtepIp = "1.1.1.1"
+            remoteVtepIp = IPV4_REMOTE_VTEP_IP
         }
         assert Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).isExists()
         assert Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).eq(RemoteVtepVO_.clusterUuid,cluster2.uuid).isExists()
@@ -202,14 +121,14 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
             createVxlanPoolRemoteVtep {
                 l2NetworkUuid = pool.uuid
                 clusterUuid = cluster2.uuid
-                remoteVtepIp = "1.1.1.1"
+                remoteVtepIp = IPV4_REMOTE_VTEP_IP
             }        
         }
 
         deleteVxlanPoolRemoteVtep {
             l2NetworkUuid = pool.uuid
             clusterUuid = cluster.uuid 
-            remoteVtepIp = "1.1.1.1"
+            remoteVtepIp = IPV4_REMOTE_VTEP_IP
         }
         assert !Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).eq(RemoteVtepVO_.clusterUuid,cluster.uuid).isExists()
         assert Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).count() == 1
@@ -217,9 +136,49 @@ class AddRemoteVxlanVtepIpCase extends SubCase {
         deleteVxlanPoolRemoteVtep {
             l2NetworkUuid = pool.uuid
             clusterUuid = cluster2.uuid 
-            remoteVtepIp = "1.1.1.1"
+            remoteVtepIp = IPV4_REMOTE_VTEP_IP
         }
         assert !Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).isExists()
 
+        createVxlanPoolRemoteVtep {
+            l2NetworkUuid = pool.uuid
+            clusterUuid = cluster.uuid
+            remoteVtepIp = IPV6_REMOTE_VTEP_IP
+        }
+        assert Q.New(RemoteVtepVO.class)
+                .eq(RemoteVtepVO_.poolUuid, pool.uuid)
+                .eq(RemoteVtepVO_.clusterUuid, cluster.uuid)
+                .eq(RemoteVtepVO_.vtepIp, IPV6_REMOTE_VTEP_IP)
+                .isExists()
+        assert Q.New(RemoteVtepVO.class).eq(RemoteVtepVO_.poolUuid, pool.uuid).count() == 1
+        expect(AssertionError.class) {
+            createVxlanPoolRemoteVtep {
+                l2NetworkUuid = pool.uuid
+                clusterUuid = cluster.uuid
+                remoteVtepIp = " ${IPV6_REMOTE_VTEP_FULL_IP}\n"
+            }
+        }
+        deleteVxlanPoolRemoteVtep {
+            l2NetworkUuid = pool.uuid
+            clusterUuid = cluster.uuid
+            remoteVtepIp = " ${IPV6_REMOTE_VTEP_FULL_IP}\n"
+        }
+        assert !Q.New(RemoteVtepVO.class)
+                .eq(RemoteVtepVO_.poolUuid, pool.uuid)
+                .eq(RemoteVtepVO_.clusterUuid, cluster.uuid)
+                .eq(RemoteVtepVO_.vtepIp, IPV6_REMOTE_VTEP_IP)
+                .isExists()
+
+        expect(AssertionError.class) {
+            createVxlanPoolRemoteVtep {
+                l2NetworkUuid = pool.uuid
+                clusterUuid = cluster2.uuid
+                remoteVtepIp = INVALID_REMOTE_VTEP_IP
+            }
+        }
+        assert !Q.New(RemoteVtepVO.class)
+                .eq(RemoteVtepVO_.poolUuid, pool.uuid)
+                .eq(RemoteVtepVO_.vtepIp, INVALID_REMOTE_VTEP_IP)
+                .isExists()
     }
 }
diff --git a/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddVxlanVtepIpCase.groovy b/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddVxlanVtepIpCase.groovy
index 0a483f6759b..feb4b06d232 100644
--- a/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddVxlanVtepIpCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/network/vxlanNetwork/AddVxlanVtepIpCase.groovy
@@ -4,6 +4,9 @@ import org.apache.commons.collections.list.SynchronizedList
 import org.springframework.http.HttpEntity
 import org.zstack.network.l2.vxlan.vxlanNetworkPool.VxlanKvmAgentCommands
 import org.zstack.network.l2.vxlan.vxlanNetworkPool.VxlanNetworkPoolConstant
+import org.zstack.network.l2.vxlan.vtep.VtepVO
+import org.zstack.network.l2.vxlan.vtep.VtepVO_
+import org.zstack.core.db.Q
 import org.zstack.sdk.*
 import org.zstack.test.integration.network.NetworkTest
 import org.zstack.testlib.EnvSpec
@@ -93,6 +96,7 @@ class AddVxlanVtepIpCase extends SubCase {
     @Override
     void test() {
         env.create {
+            testCreateVxlanVtepIpValidation()
             testVxlanVtepIpChanged()
             testCreateVxlanPoll()
         }
@@ -103,6 +107,79 @@ class AddVxlanVtepIpCase extends SubCase {
         env.delete()
     }
 
+    void testCreateVxlanVtepIpValidation() {
+        def zone = env.inventoryByName("zone") as ZoneInventory
+        def host1 = env.inventoryByName("kvm1") as KVMHostInventory
+        def host2 = env.inventoryByName("kvm2") as KVMHostInventory
+
+        def pool = createL2VxlanNetworkPool {
+            name = "TestVxlanPoolValidation"
+            zoneUuid = zone.uuid
+        } as L2VxlanNetworkPoolInventory
+
+        expect(AssertionError.class) {
+            createVxlanVtep {
+                hostUuid = host1.uuid
+                poolUuid = pool.uuid
+                vtepIp = "not-an-ip"
+            }
+        }
+        assert !Q.New(VtepVO.class)
+                .eq(VtepVO_.poolUuid, pool.uuid)
+                .eq(VtepVO_.vtepIp, "not-an-ip")
+                .isExists()
+
+        expect(AssertionError.class) {
+            createVxlanVtep {
+                hostUuid = host1.uuid
+                poolUuid = pool.uuid
+                vtepIp = "12345::1"
+            }
+        }
+        assert !Q.New(VtepVO.class)
+                .eq(VtepVO_.poolUuid, pool.uuid)
+                .eq(VtepVO_.vtepIp, "12345::1")
+                .isExists()
+
+        createVxlanVtep {
+            hostUuid = host1.uuid
+            poolUuid = pool.uuid
+            vtepIp = "127.1.0.10"
+        }
+        assert Q.New(VtepVO.class)
+                .eq(VtepVO_.hostUuid, host1.uuid)
+                .eq(VtepVO_.poolUuid, pool.uuid)
+                .eq(VtepVO_.vtepIp, "127.1.0.10")
+                .isExists()
+
+        createVxlanVtep {
+            hostUuid = host2.uuid
+            poolUuid = pool.uuid
+            vtepIp = " 2001:0db8:ffff:0000:0000:0000:0000:0010\n"
+        }
+        assert Q.New(VtepVO.class)
+                .eq(VtepVO_.hostUuid, host2.uuid)
+                .eq(VtepVO_.poolUuid, pool.uuid)
+                .eq(VtepVO_.vtepIp, "2001:db8:ffff::10")
+                .isExists()
+
+        def fullLengthPool = createL2VxlanNetworkPool {
+            name = "TestVxlanPoolFullLengthIpv6"
+            zoneUuid = zone.uuid
+        } as L2VxlanNetworkPoolInventory
+
+        createVxlanVtep {
+            hostUuid = host1.uuid
+            poolUuid = fullLengthPool.uuid
+            vtepIp = "fd00:1234:5678:9abc:def0:1234:5678:9abc"
+        }
+        assert Q.New(VtepVO.class)
+                .eq(VtepVO_.hostUuid, host1.uuid)
+                .eq(VtepVO_.poolUuid, fullLengthPool.uuid)
+                .eq(VtepVO_.vtepIp, "fd00:1234:5678:9abc:def0:1234:5678:9abc")
+                .isExists()
+    }
+
     void testVxlanVtepIpChanged() {
         def zone = env.inventoryByName("zone") as ZoneInventory
         def cluster = env.inventoryByName("cluster1") as ClusterInventory
diff --git a/test/src/test/groovy/org/zstack/test/integration/storage/ManagementNetworkIpVersionStorageConstraintCase.groovy b/test/src/test/groovy/org/zstack/test/integration/storage/ManagementNetworkIpVersionStorageConstraintCase.groovy
new file mode 100644
index 00000000000..ea93fcf1d5d
--- /dev/null
+++ b/test/src/test/groovy/org/zstack/test/integration/storage/ManagementNetworkIpVersionStorageConstraintCase.groovy
@@ -0,0 +1,394 @@
+package org.zstack.test.integration.storage
+
+import org.zstack.compute.zone.ManagementNetworkIpVersionManagerImpl
+import org.zstack.core.Platform
+import org.zstack.core.cloudbus.CloudBus
+import org.zstack.core.db.DatabaseFacade
+import org.zstack.core.db.Q
+import org.zstack.header.apimediator.ApiMessageInterceptionException
+import org.zstack.header.host.ConnectHostMsg
+import org.zstack.header.host.ConnectHostReply
+import org.zstack.header.host.CpuArchitecture
+import org.zstack.header.storage.backup.BackupStorageState
+import org.zstack.header.storage.backup.BackupStorageStatus
+import org.zstack.header.storage.backup.BackupStorageVO
+import org.zstack.header.storage.backup.BackupStorageZoneRefVO
+import org.zstack.header.storage.primary.PrimaryStorageState
+import org.zstack.header.storage.primary.PrimaryStorageStatus
+import org.zstack.header.storage.primary.PrimaryStorageVO
+import org.zstack.header.tag.SystemTagVO
+import org.zstack.header.tag.SystemTagVO_
+import org.zstack.header.zone.ZoneVO
+import org.zstack.kvm.KVMHostVO
+import org.zstack.sdk.ClusterInventory
+import org.zstack.sdk.SystemTagInventory
+import org.zstack.sdk.ZoneInventory
+import org.zstack.storage.backup.sftp.SftpBackupStorageCommands
+import org.zstack.storage.backup.sftp.SftpBackupStorageConstant
+import org.zstack.storage.ceph.CephConstants
+import org.zstack.storage.ceph.MonStatus
+import org.zstack.storage.ceph.backup.CephBackupStorageMonVO
+import org.zstack.storage.ceph.backup.CephBackupStorageVO
+import org.zstack.storage.ceph.primary.CephPrimaryStorageMonVO
+import org.zstack.storage.ceph.primary.CephPrimaryStorageVO
+import org.zstack.testlib.EnvSpec
+import org.zstack.testlib.SubCase
+import org.zstack.utils.data.SizeUnit
+import org.zstack.utils.network.ManagementNetworkIpVersionUtils
+
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_STORAGE_PRIMARY_10055
+
+class ManagementNetworkIpVersionStorageConstraintCase extends SubCase {
+    private static final String IPV4 = "192.168.10.10"
+    private static final String IPV6 = "2001:db8::10"
+    private static final String IPV4_NFS_URL = "${IPV4}:/export/nfs"
+    private static final String IPV6_NFS_URL = "[${IPV6}]:/export/nfs"
+    private static final String REAL_IPV6_ZONE = "real-ipv6-zone"
+    private static final String REAL_IPV6_TAG = "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV6}"
+
+    private EnvSpec env
+    private DatabaseFacade dbf
+    private ManagementNetworkIpVersionManagerImpl manager
+    private SystemTagInventory realIpv6Tag
+    private final List<List> cleanupItems = []
+
+    @Override
+    void clean() {
+        if (dbf != null) {
+            cleanupItems.reverseEach { item ->
+                dbf.removeByPrimaryKey(item[0], item[1] as Class)
+            }
+        }
+        env?.delete()
+    }
+
+    @Override
+    void setup() {
+        useSpring(StorageTest.springSpec)
+    }
+
+    @Override
+    void environment() {
+        env = env {
+            zone {
+                name = REAL_IPV6_ZONE
+                description = "real ipv6 management network cloud"
+            }
+        }
+    }
+
+    @Override
+    void test() {
+        env.create {
+            dbf = bean(DatabaseFacade.class)
+            manager = bean(ManagementNetworkIpVersionManagerImpl.class)
+            prepareRealIpv6Cloud()
+
+            testDefaultZoneIpVersion()
+            testZoneIpVersionSystemTag()
+            testDuplicateZoneIpVersionSystemTagRejected()
+            testUpdateZoneIpVersionTagAllowsReplacingCurrentTag()
+            testIpv6LinkLocalEndpointRejected()
+            testUpdateZoneIpVersionTagChecksExistingResources()
+            testRealCloudExistingIpv6ResourcesBlockZoneIpVersionChange()
+            testExistingBackupStorageBlocksZoneIpVersionChange()
+            testExistingCephMonBlocksZoneIpVersionChange()
+        }
+    }
+
+    void testDefaultZoneIpVersion() {
+        ZoneInventory zone = createTestZone()
+
+        assert manager.getZoneIpVersion(zone.uuid) == ManagementNetworkIpVersionUtils.IPV4
+        SystemTagVO tag = getOnlyZoneIpVersionTag(zone.uuid)
+        assert tag.tag == "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV4}"
+        assert !tag.inherent
+    }
+
+    void testZoneIpVersionSystemTag() {
+        String tag = "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV6}"
+        ZoneInventory zone = createZone {
+            name = "zone-${Platform.uuid}"
+            systemTags = [tag]
+        } as ZoneInventory
+        cleanupItems << [getOnlyZoneIpVersionTag(zone.uuid).uuid, SystemTagVO.class]
+        cleanupItems << [zone.uuid, ZoneVO.class]
+
+        assert manager.getZoneIpVersion(zone.uuid) == ManagementNetworkIpVersionUtils.IPV6
+        assert getZoneIpVersionTags(zone.uuid).size() == 1
+        manager.validateZoneIpVersionTagValue(zone.uuid, tag)
+        expect(ApiMessageInterceptionException.class) {
+            manager.validateZoneIpVersionTagValue(zone.uuid, "managementNetwork::ipVersion::dual")
+        }
+    }
+
+    void testDuplicateZoneIpVersionSystemTagRejected() {
+        ZoneInventory zone = createTestZone()
+
+        expect(AssertionError.class) {
+            createZoneIpVersionTag(zone.uuid, "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV6}")
+        }
+    }
+
+    void testUpdateZoneIpVersionTagAllowsReplacingCurrentTag() {
+        ZoneInventory zone = createTestZone()
+        SystemTagVO currentTag = getOnlyZoneIpVersionTag(zone.uuid)
+
+        updateSystemTag {
+            uuid = currentTag.uuid
+            tag = "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV6}"
+        }
+
+        assert manager.getZoneIpVersion(zone.uuid) == ManagementNetworkIpVersionUtils.IPV6
+    }
+
+    void testIpv6LinkLocalEndpointRejected() {
+        ZoneInventory zone = createTestZone()
+        updateSystemTag {
+            uuid = getOnlyZoneIpVersionTag(zone.uuid).uuid
+            tag = "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV6}"
+        }
+
+        expect(ApiMessageInterceptionException.class) {
+            manager.validateEndpointInZone(zone.uuid, "[fe80::10]:/data", "primary storage", "ps",
+                    ORG_ZSTACK_STORAGE_PRIMARY_10055)
+        }
+    }
+
+    void testUpdateZoneIpVersionTagChecksExistingResources() {
+        ZoneInventory zone = createTestZone()
+        createPrimaryStorage(zone.uuid, IPV4_NFS_URL)
+        SystemTagVO currentTag = getOnlyZoneIpVersionTag(zone.uuid)
+
+        expect(AssertionError.class) {
+            updateSystemTag {
+                uuid = currentTag.uuid
+                tag = "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV6}"
+            }
+        }
+    }
+
+    void testRealCloudExistingIpv6ResourcesBlockZoneIpVersionChange() {
+        ZoneInventory zone = env.inventoryByName(REAL_IPV6_ZONE) as ZoneInventory
+
+        expect(ApiMessageInterceptionException.class) {
+            manager.validateZoneCompatibleWithExistingResources(zone.uuid, ManagementNetworkIpVersionUtils.IPV4)
+        }
+
+        expect(AssertionError.class) {
+            updateSystemTag {
+                uuid = realIpv6Tag.uuid
+                tag = "managementNetwork::ipVersion::${ManagementNetworkIpVersionUtils.IPV4}"
+            }
+        }
+
+        expect(AssertionError.class) {
+            deleteTag {
+                uuid = realIpv6Tag.uuid
+            }
+        }
+    }
+
+    private void prepareRealIpv6Cloud() {
+        ZoneInventory zone = env.inventoryByName(REAL_IPV6_ZONE) as ZoneInventory
+        realIpv6Tag = updateSystemTag {
+            uuid = getOnlyZoneIpVersionTag(zone.uuid).uuid
+            tag = REAL_IPV6_TAG
+        } as SystemTagInventory
+
+        env.message(ConnectHostMsg.class) { ConnectHostMsg msg, CloudBus bus ->
+            KVMHostVO host = dbf.findByUuid(msg.uuid, KVMHostVO.class)
+            host.setArchitecture(CpuArchitecture.x86_64.name())
+            host.setOsDistribution("centos")
+            host.setOsRelease("core")
+            host.setOsVersion("7.6.1810")
+            dbf.update(host)
+            bus.reply(msg, new ConnectHostReply())
+        }
+
+        ClusterInventory cluster = createCluster {
+            name = "real-ipv6-cluster"
+            hypervisorType = "KVM"
+            zoneUuid = zone.uuid
+        } as ClusterInventory
+
+        def primaryStorage = addNfsPrimaryStorage {
+            name = "real-ipv6-nfs"
+            url = IPV6_NFS_URL
+            zoneUuid = zone.uuid
+        }
+
+        attachPrimaryStorageToCluster {
+            primaryStorageUuid = primaryStorage.uuid
+            clusterUuid = cluster.uuid
+        }
+
+        addKVMHost {
+            name = "real-ipv6-kvm"
+            managementIp = IPV6
+            username = "root"
+            password = "password"
+            clusterUuid = cluster.uuid
+        }
+
+        env.simulator(SftpBackupStorageConstant.CONNECT_PATH) {
+            def rsp = new SftpBackupStorageCommands.ConnectResponse()
+            rsp.availableCapacity = SizeUnit.GIGABYTE.toByte(1000)
+            rsp.totalCapacity = SizeUnit.GIGABYTE.toByte(1000)
+            return rsp
+        }
+
+        def backupStorage = addSftpBackupStorage {
+            name = "real-ipv6-sftp"
+            url = "/sftp"
+            username = "root"
+            password = "password"
+            hostname = IPV6
+        }
+
+        attachBackupStorageToZone {
+            backupStorageUuid = backupStorage.uuid
+            zoneUuid = zone.uuid
+        }
+    }
+
+    void testExistingBackupStorageBlocksZoneIpVersionChange() {
+        ZoneInventory zone = createTestZone()
+        createBackupStorage(zone.uuid, IPV6_NFS_URL)
+
+        expect(ApiMessageInterceptionException.class) {
+            manager.validateZoneCompatibleWithExistingResources(zone.uuid, ManagementNetworkIpVersionUtils.IPV4)
+        }
+    }
+
+    void testExistingCephMonBlocksZoneIpVersionChange() {
+        ZoneInventory zone = createTestZone()
+        createCephPrimaryStorage(zone.uuid, IPV4)
+        createCephBackupStorage(zone.uuid, IPV6)
+
+        expect(ApiMessageInterceptionException.class) {
+            manager.validateZoneCompatibleWithExistingResources(zone.uuid, ManagementNetworkIpVersionUtils.IPV6)
+        }
+        expect(ApiMessageInterceptionException.class) {
+            manager.validateZoneCompatibleWithExistingResources(zone.uuid, ManagementNetworkIpVersionUtils.IPV4)
+        }
+    }
+
+    private ZoneInventory createTestZone() {
+        ZoneInventory zone = createZone {
+            name = "zone-${Platform.uuid}"
+        } as ZoneInventory
+        cleanupItems << [getOnlyZoneIpVersionTag(zone.uuid).uuid, SystemTagVO.class]
+        cleanupItems << [zone.uuid, ZoneVO.class]
+        return zone
+    }
+
+    private SystemTagVO getOnlyZoneIpVersionTag(String zoneUuid) {
+        List<SystemTagVO> tags = getZoneIpVersionTags(zoneUuid)
+        assert tags.size() == 1
+        return tags[0]
+    }
+
+    private List<SystemTagVO> getZoneIpVersionTags(String zoneUuid) {
+        return Q.New(SystemTagVO.class)
+                .eq(SystemTagVO_.resourceUuid, zoneUuid)
+                .eq(SystemTagVO_.resourceType, ZoneVO.simpleName)
+                .like(SystemTagVO_.tag, "managementNetwork::ipVersion::%")
+                .list()
+    }
+
+    private SystemTagInventory createZoneIpVersionTag(String zoneUuid, String tagValue) {
+        SystemTagInventory inventory = createSystemTag {
+            resourceUuid = zoneUuid
+            resourceType = ZoneVO.simpleName
+            tag = tagValue
+        } as SystemTagInventory
+        cleanupItems << [inventory.uuid, SystemTagVO.class]
+        return inventory
+    }
+
+    private void createPrimaryStorage(String zoneUuid, String url) {
+        PrimaryStorageVO ps = new PrimaryStorageVO()
+        ps.uuid = Platform.uuid
+        ps.name = "ps-${ps.uuid}"
+        ps.zoneUuid = zoneUuid
+        ps.url = url
+        ps.mountPath = "/mnt/${ps.uuid}"
+        ps.type = "NFS"
+        ps.state = PrimaryStorageState.Enabled
+        ps.status = PrimaryStorageStatus.Connected
+        dbf.persist(ps)
+        cleanupItems << [ps.uuid, PrimaryStorageVO.class]
+    }
+
+    private void createBackupStorage(String zoneUuid, String url) {
+        BackupStorageVO bs = new BackupStorageVO()
+        bs.uuid = Platform.uuid
+        bs.name = "bs-${bs.uuid}"
+        bs.type = "ImageStoreBackupStorage"
+        bs.url = url
+        bs.state = BackupStorageState.Enabled
+        bs.status = BackupStorageStatus.Connected
+        dbf.persist(bs)
+        cleanupItems << [bs.uuid, BackupStorageVO.class]
+        createBackupStorageZoneRef(bs.uuid, zoneUuid)
+    }
+
+    private void createCephPrimaryStorage(String zoneUuid, String monHostname) {
+        CephPrimaryStorageVO ps = new CephPrimaryStorageVO()
+        ps.uuid = Platform.uuid
+        ps.name = "ceph-ps-${ps.uuid}"
+        ps.zoneUuid = zoneUuid
+        ps.type = CephConstants.CEPH_PRIMARY_STORAGE_TYPE
+        ps.url = "not used"
+        ps.mountPath = "/mnt/${ps.uuid}"
+        ps.state = PrimaryStorageState.Enabled
+        ps.status = PrimaryStorageStatus.Connected
+        dbf.persist(ps)
+        cleanupItems << [ps.uuid, CephPrimaryStorageVO.class]
+
+        CephPrimaryStorageMonVO mon = new CephPrimaryStorageMonVO()
+        mon.uuid = Platform.uuid
+        mon.primaryStorageUuid = ps.uuid
+        mon.hostname = monHostname
+        mon.monAddr = monHostname
+        mon.sshUsername = "root"
+        mon.sshPassword = "password"
+        mon.status = MonStatus.Connected
+        dbf.persist(mon)
+        cleanupItems << [mon.uuid, CephPrimaryStorageMonVO.class]
+    }
+
+    private void createCephBackupStorage(String zoneUuid, String monHostname) {
+        CephBackupStorageVO bs = new CephBackupStorageVO()
+        bs.uuid = Platform.uuid
+        bs.name = "ceph-bs-${bs.uuid}"
+        bs.type = CephConstants.CEPH_BACKUP_STORAGE_TYPE
+        bs.url = "not used"
+        bs.poolName = "test-pool"
+        bs.state = BackupStorageState.Enabled
+        bs.status = BackupStorageStatus.Connected
+        dbf.persist(bs)
+        cleanupItems << [bs.uuid, CephBackupStorageVO.class]
+        createBackupStorageZoneRef(bs.uuid, zoneUuid)
+
+        CephBackupStorageMonVO mon = new CephBackupStorageMonVO()
+        mon.uuid = Platform.uuid
+        mon.backupStorageUuid = bs.uuid
+        mon.hostname = monHostname
+        mon.monAddr = monHostname
+        mon.sshUsername = "root"
+        mon.sshPassword = "password"
+        mon.status = MonStatus.Connected
+        dbf.persist(mon)
+        cleanupItems << [mon.uuid, CephBackupStorageMonVO.class]
+    }
+
+    private void createBackupStorageZoneRef(String backupStorageUuid, String zoneUuid) {
+        BackupStorageZoneRefVO ref = new BackupStorageZoneRefVO()
+        ref.backupStorageUuid = backupStorageUuid
+        ref.zoneUuid = zoneUuid
+        dbf.persist(ref)
+        cleanupItems << [ref.id, BackupStorageZoneRefVO.class]
+    }
+}
diff --git a/test/src/test/groovy/org/zstack/test/integration/storage/primary/addon/zbs/ZbsPrimaryStorageCase.groovy b/test/src/test/groovy/org/zstack/test/integration/storage/primary/addon/zbs/ZbsPrimaryStorageCase.groovy
index 089a8ac2c1c..487c308eb4b 100644
--- a/test/src/test/groovy/org/zstack/test/integration/storage/primary/addon/zbs/ZbsPrimaryStorageCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/storage/primary/addon/zbs/ZbsPrimaryStorageCase.groovy
@@ -35,7 +35,9 @@ import org.zstack.header.storage.primary.PrimaryStorageHostStatus
 import org.zstack.storage.volume.VolumeGlobalConfig
 import org.zstack.storage.zbs.AddonInfo
 import org.zstack.storage.zbs.Config
+import org.zstack.storage.zbs.ZbsAgentUrl
 import org.zstack.storage.zbs.ZbsConstants
+import org.zstack.storage.zbs.ZbsGlobalProperty
 import org.zstack.storage.zbs.ZbsPrimaryStorageMdsBase
 import org.zstack.storage.zbs.ZbsStorageController
 import org.zstack.test.integration.storage.StorageTest
@@ -197,6 +199,7 @@ class ZbsPrimaryStorageCase extends SubCase {
             testAddExternalPrimaryStorageWithMalformedJsonRejectedByInterceptor()
             testDataVolumeNegativeScenario()
             testDecodeMdsUriWithSpecialPassword()
+            testZbsMdsUriAndAgentUrlSupportIpv6()
             testMdsReconnectAfterMaximumPingFailures()
             testGetBackingChainNormalizesCbdParentUri()
             testBatchStatsNormalizesCbdInstallPath()
@@ -1050,6 +1053,36 @@ class ZbsPrimaryStorageCase extends SubCase {
         assert uri.password == specialPassword
     }
 
+    void testZbsMdsUriAndAgentUrlSupportIpv6() {
+        def ipv6Uri = new MdsUri("root:password@[2001:db8::10]:2222/?mdsPort=7777")
+        assert ipv6Uri.hostname == "2001:db8::10"
+        assert ipv6Uri.sshPort == 2222
+        assert ipv6Uri.mdsPort == 7777
+        assert ZbsAgentUrl.primaryStorageUrl(ipv6Uri.hostname, ZbsPrimaryStorageMdsBase.PING_PATH) ==
+                "http://[2001:db8::10]:${ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_PORT}${ZbsPrimaryStorageMdsBase.PING_PATH}"
+
+        def ipv4Uri = new MdsUri("root:password@172.24.249.182:2222/?mdsPort=7777")
+        assert ipv4Uri.hostname == "172.24.249.182"
+        assert ZbsAgentUrl.primaryStorageUrl(ipv4Uri.hostname, ZbsPrimaryStorageMdsBase.PING_PATH) ==
+                "http://172.24.249.182:${ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_PORT}${ZbsPrimaryStorageMdsBase.PING_PATH}"
+
+        def endpoints = [
+                "http://172.24.249.182:7763${ZbsPrimaryStorageMdsBase.PING_PATH}",
+                ZbsAgentUrl.primaryStorageUrl(ipv6Uri.hostname, ZbsPrimaryStorageMdsBase.PING_PATH)
+        ]
+        String ipv6PingUrl = "http://[2001:db8::10]:${ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_PORT}${ZbsPrimaryStorageMdsBase.PING_PATH}"
+        assert endpoints.contains(ipv6PingUrl)
+
+        String oldRootPath = ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_URL_ROOT_PATH
+        try {
+            ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_URL_ROOT_PATH = "zstack"
+            assert ZbsAgentUrl.primaryStorageUrl(ipv6Uri.hostname, ZbsPrimaryStorageMdsBase.PING_PATH) ==
+                    "http://[2001:db8::10]:${ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_PORT}/zstack${ZbsPrimaryStorageMdsBase.PING_PATH}"
+        } finally {
+            ZbsGlobalProperty.PRIMARY_STORAGE_AGENT_URL_ROOT_PATH = oldRootPath
+        }
+    }
+
     void testMdsReconnectAfterMaximumPingFailures() {
         env.cleanSimulatorAndMessageHandlers()
         Integer originalPingInterval = PrimaryStorageGlobalConfig.PING_INTERVAL.value().toInteger()
diff --git a/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy b/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy
index a77d2008545..341ddc984f3 100644
--- a/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy
@@ -1,6 +1,8 @@
 package org.zstack.test.unittest.utils
 
 import org.junit.Test
+import org.zstack.storage.ceph.MonUri
+import org.zstack.utils.network.ManagementNetworkIpVersionUtils
 import org.zstack.utils.network.NetworkUtils
 /**
  * Created by mingjian.deng on 2017/7/20.
@@ -37,4 +39,29 @@ class NetworkUtilsCase {
         assert "192.168.0.0/24" == NetworkUtils.getCidrFromIpMask("192.168.0.1", "255.255.255.0")
         assert "192.168.0.128/29" == NetworkUtils.getCidrFromIpMask("192.168.0.130", "255.255.255.248")
     }
+
+    @Test
+    void testManagementEndpointIpVersion() {
+        assert ManagementNetworkIpVersionUtils.normalizeIpVersion("IPv4") == ManagementNetworkIpVersionUtils.IPV4
+        assert ManagementNetworkIpVersionUtils.normalizeIpVersion("ipv6") == ManagementNetworkIpVersionUtils.IPV6
+        assert ManagementNetworkIpVersionUtils.normalizeIpVersion("dual") == null
+        assert ManagementNetworkIpVersionUtils.getEndpointIpVersion("172.24.1.10") == ManagementNetworkIpVersionUtils.IPV4
+        assert ManagementNetworkIpVersionUtils.getEndpointIpVersion("172.24.1.10:/data") == ManagementNetworkIpVersionUtils.IPV4
+        assert ManagementNetworkIpVersionUtils.getEndpointIpVersion("[fd00:172:24::10]:/data") == ManagementNetworkIpVersionUtils.IPV6
+        assert ManagementNetworkIpVersionUtils.getEndpointIpVersion("http://[fd00:172:24::10]:8080/path") == ManagementNetworkIpVersionUtils.IPV6
+        assert ManagementNetworkIpVersionUtils.getEndpointIpVersion("storage.example.com:/data") == null
+        assert ManagementNetworkIpVersionUtils.isIpv6LinkLocalEndpoint("[fe80::10]:/data")
+        assert ManagementNetworkIpVersionUtils.isIpv6LinkLocalEndpoint("http://[fe80::10%eth0]:8080/path")
+        assert !ManagementNetworkIpVersionUtils.isIpv6LinkLocalEndpoint("[fd00:172:24::10]:/data")
+        assert !ManagementNetworkIpVersionUtils.isIpv6LinkLocalEndpoint("fe80.example.com:/data")
+    }
+
+    @Test
+    void testCephMonUriIpv6Host() {
+        MonUri uri = new MonUri("root:password@[fd00:172:24::10]:2222/?monPort=6789")
+
+        assert uri.hostname == "fd00:172:24::10"
+        assert uri.sshPort == 2222
+        assert uri.monPort == 6789
+    }
 }
diff --git a/test/src/test/java/org/zstack/test/kvm/KVMHostUtilsTest.java b/test/src/test/java/org/zstack/test/kvm/KVMHostUtilsTest.java
index 0ae331da3d5..161cb5df9c4 100644
--- a/test/src/test/java/org/zstack/test/kvm/KVMHostUtilsTest.java
+++ b/test/src/test/java/org/zstack/test/kvm/KVMHostUtilsTest.java
@@ -126,6 +126,13 @@ public void unionIps_detectedDeduplicatesExtra() {
                         "10.0.0.7,10.0.0.8", null, Collections.emptySet()));
     }
 
+    @Test
+    public void unionIps_keepsIpv6ExtraIpsForTlsCert() {
+        Assert.assertEquals("172.25.115.196,172.26.115.213,2026:3:3:1::26:7f3e",
+                KVMHostUtils.unionIps("172.25.115.196,172.26.115.213", "172.25.115.196",
+                        "172.26.115.213,2026:3:3:1::26:7f3e", null, Collections.emptySet()));
+    }
+
     @Test
     public void unionIps_noExtraTagYieldsDetectedOnly() {
         Assert.assertEquals("192.168.1.10,172.17.0.1",
diff --git a/test/src/test/resources/unitTestSuiteXml/BackupStorageManager.xml b/test/src/test/resources/unitTestSuiteXml/BackupStorageManager.xml
index 9ef5bb6a549..180d32b3b39 100755
--- a/test/src/test/resources/unitTestSuiteXml/BackupStorageManager.xml
+++ b/test/src/test/resources/unitTestSuiteXml/BackupStorageManager.xml
@@ -14,7 +14,8 @@
     <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage2"/>
     <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage3"/>
     <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage4"/>
-    <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage5"/>
-    <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage6"/>
-    <TestCase class="org.zstack.test.storage.backup.TestGetBackupStorageCapacity"/>
-</UnitTestSuiteConfig>
\ No newline at end of file
+    <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage5"/>
+    <TestCase class="org.zstack.test.storage.backup.TestAllocateBackupStorage6"/>
+    <TestCase class="org.zstack.test.storage.backup.TestGetBackupStorageCapacity"/>
+    <TestCase class="org.zstack.test.integration.storage.ManagementNetworkIpVersionStorageConstraintCase"/>
+</UnitTestSuiteConfig>
diff --git a/utils/src/main/java/org/zstack/utils/TagUtils.java b/utils/src/main/java/org/zstack/utils/TagUtils.java
index 823a7af6dc2..33e41aab68f 100755
--- a/utils/src/main/java/org/zstack/utils/TagUtils.java
+++ b/utils/src/main/java/org/zstack/utils/TagUtils.java
@@ -8,14 +8,20 @@
 /**
  */
 public class TagUtils {
-    public static Map<String, String> parse(String fmt, String tag) {
-        List<String> origins =  new ArrayList<String>();
-        Collections.addAll(origins, tag.split("::"));
+    private static final String TAG_DELIMITER = "::";
+    private static final char TOKEN_START = '{';
+    private static final char TOKEN_END = '}';
 
+    public static Map<String, String> parse(String fmt, String tag) {
         List<String> t = new ArrayList<String>();
-        Collections.addAll(t, fmt.split("::"));
+        t.addAll(splitTagFields(fmt));
 
+        List<String> origins = splitTagFieldsByFormat(t, tag);
         Map<String, String> ret = new HashMap();
+        if (origins == null) {
+            return ret;
+        }
+
         for (int i=0;i<t.size(); i++) {
             String key = t.get(i);
             if (!key.startsWith("{") || !key.endsWith("}")) {
@@ -37,17 +43,15 @@ public static boolean isMatch(String fmt, String tag) {
             return false;
         }
 
-        List<String> origins =  new ArrayList<String>();
-        Collections.addAll(origins, tag.split("::"));
-
         List<String> t = new ArrayList<String>();
-        Collections.addAll(t, fmt.split("::"));
+        t.addAll(splitTagFields(fmt));
 
-        if (fmt.indexOf("::") == -1) {
+        if (fmt.indexOf(TAG_DELIMITER) == -1) {
             return fmt.equals(tag);
         }
 
-        if (origins.size() != t.size()) {
+        List<String> origins = splitTagFieldsByFormat(t, tag);
+        if (origins == null || origins.size() != t.size()) {
             return false;
         }
 
@@ -66,6 +70,99 @@ public static boolean isMatch(String fmt, String tag) {
         return true;
     }
 
+    private static List<String> splitTagFieldsByFormat(List<String> fmtFields, String tag) {
+        List<String> fields = new ArrayList<>();
+        int offset = 0;
+
+        for (int i = 0; i < fmtFields.size(); i++) {
+            String fmtField = fmtFields.get(i);
+            boolean lastField = i == fmtFields.size() - 1;
+            if (isTokenField(fmtField)) {
+                if (lastField) {
+                    fields.add(tag.substring(offset));
+                    offset = tag.length();
+                    continue;
+                }
+
+                int end = indexOfDelimiterOutsideToken(tag, offset);
+                if (end < 0) {
+                    return null;
+                }
+                fields.add(tag.substring(offset, end));
+                offset = end + TAG_DELIMITER.length();
+                continue;
+            }
+
+            if (!tag.startsWith(fmtField, offset)) {
+                return null;
+            }
+
+            fields.add(fmtField);
+            offset += fmtField.length();
+            if (!lastField) {
+                if (!tag.startsWith(TAG_DELIMITER, offset)) {
+                    return null;
+                }
+                offset += TAG_DELIMITER.length();
+            }
+        }
+
+        return offset == tag.length() ? fields : null;
+    }
+
+    private static boolean isTokenField(String field) {
+        return field.startsWith(String.valueOf(TOKEN_START)) && field.endsWith(String.valueOf(TOKEN_END));
+    }
+
+    private static List<String> splitTagFields(String tag) {
+        List<String> fields = new ArrayList<>();
+        StringBuilder field = new StringBuilder();
+        int braceDepth = 0;
+
+        for (int i = 0; i < tag.length(); i++) {
+            char current = tag.charAt(i);
+            if (current == TOKEN_START) {
+                braceDepth++;
+            } else if (current == TOKEN_END && braceDepth > 0) {
+                braceDepth--;
+            }
+
+            if (braceDepth == 0 && tag.startsWith(TAG_DELIMITER, i)) {
+                fields.add(field.toString());
+                field.setLength(0);
+                i += TAG_DELIMITER.length() - 1;
+                continue;
+            }
+
+            field.append(current);
+        }
+
+        fields.add(field.toString());
+        while (!fields.isEmpty() && fields.get(fields.size() - 1).isEmpty()) {
+            fields.remove(fields.size() - 1);
+        }
+
+        return fields;
+    }
+
+    private static int indexOfDelimiterOutsideToken(String tag, int offset) {
+        int braceDepth = 0;
+        for (int i = offset; i < tag.length(); i++) {
+            char current = tag.charAt(i);
+            if (current == TOKEN_START) {
+                braceDepth++;
+            } else if (current == TOKEN_END && braceDepth > 0) {
+                braceDepth--;
+            }
+
+            if (braceDepth == 0 && tag.startsWith(TAG_DELIMITER, i)) {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+
     public static Map<String, String> parseIfMatch(String fmt, String tag) {
         if (!isMatch(fmt, tag)) {
             return null;
diff --git a/utils/src/main/java/org/zstack/utils/URLBuilder.java b/utils/src/main/java/org/zstack/utils/URLBuilder.java
index cc2ed0ddb4c..047323db74c 100755
--- a/utils/src/main/java/org/zstack/utils/URLBuilder.java
+++ b/utils/src/main/java/org/zstack/utils/URLBuilder.java
@@ -2,11 +2,14 @@
 
 import org.springframework.web.util.UriComponents;
 import org.springframework.web.util.UriComponentsBuilder;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 public class URLBuilder {
+    private static final String BASE_URL_FORMAT = "%s://%s:%s";
+
     public static String buildUrl(String scheme, String host, int port, String...paths) {
-        UriComponentsBuilder builder = UriComponentsBuilder.newInstance();
-        builder.scheme(scheme).host(host).port(port);
+        UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(
+                String.format(BASE_URL_FORMAT, scheme, IPv6NetworkUtils.formatHostForUrl(host), port));
         for (String p : paths) {
             builder.path(p);
         }
diff --git a/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java b/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java
index 0d464575634..cf675f420db 100644
--- a/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java
+++ b/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java
@@ -254,6 +254,12 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10083 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10083";
 
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10084 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10084";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10085 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10085";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10086 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10086";
+
     public static final String ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10000 = "ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10000";
 
     public static final String ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10001 = "ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10001";
@@ -672,6 +678,12 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10034 = "ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10034";
 
+    public static final String ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10035 = "ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10035";
+
+    public static final String ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10036 = "ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10036";
+
+    public static final String ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10037 = "ORG_ZSTACK_ALIYUN_EBS_STORAGE_PRIMARY_10037";
+
     public static final String ORG_ZSTACK_ALIYUN_CORE_IDENTITYZONE_10000 = "ORG_ZSTACK_ALIYUN_CORE_IDENTITYZONE_10000";
 
     public static final String ORG_ZSTACK_TEST_INTEGRATION_KVM_VM_10000 = "ORG_ZSTACK_TEST_INTEGRATION_KVM_VM_10000";
@@ -978,6 +990,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_NETWORK_L3_10081 = "ORG_ZSTACK_NETWORK_L3_10081";
 
+    public static final String ORG_ZSTACK_NETWORK_L3_10082 = "ORG_ZSTACK_NETWORK_L3_10082";
+
     public static final String ORG_ZSTACK_SNS_PLATFORM_UNIVERSALSMS_SUPPLIER_EMAY_10000 = "ORG_ZSTACK_SNS_PLATFORM_UNIVERSALSMS_SUPPLIER_EMAY_10000";
 
     public static final String ORG_ZSTACK_CORE_VALIDATION_10000 = "ORG_ZSTACK_CORE_VALIDATION_10000";
@@ -1054,6 +1068,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_CONSOLE_10013 = "ORG_ZSTACK_CONSOLE_10013";
 
+    public static final String ORG_ZSTACK_CONSOLE_10014 = "ORG_ZSTACK_CONSOLE_10014";
+
     public static final String ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORK_10000 = "ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORK_10000";
 
     public static final String ORG_ZSTACK_NETWORK_SERVICE_HEADER_NFVINSTGROUP_10000 = "ORG_ZSTACK_NETWORK_SERVICE_HEADER_NFVINSTGROUP_10000";
@@ -2836,6 +2852,14 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_COMPUTE_ZONE_10003 = "ORG_ZSTACK_COMPUTE_ZONE_10003";
 
+    public static final String ORG_ZSTACK_COMPUTE_ZONE_10004 = "ORG_ZSTACK_COMPUTE_ZONE_10004";
+
+    public static final String ORG_ZSTACK_COMPUTE_ZONE_10005 = "ORG_ZSTACK_COMPUTE_ZONE_10005";
+
+    public static final String ORG_ZSTACK_COMPUTE_ZONE_10006 = "ORG_ZSTACK_COMPUTE_ZONE_10006";
+
+    public static final String ORG_ZSTACK_COMPUTE_ZONE_10007 = "ORG_ZSTACK_COMPUTE_ZONE_10007";
+
     public static final String ORG_ZSTACK_CRYPTO_DATACRYPTO_INTEGRITY_10000 = "ORG_ZSTACK_CRYPTO_DATACRYPTO_INTEGRITY_10000";
 
     public static final String ORG_ZSTACK_CRYPTO_DATACRYPTO_INTEGRITY_10001 = "ORG_ZSTACK_CRYPTO_DATACRYPTO_INTEGRITY_10001";
@@ -3388,6 +3412,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_DEVICE_10048 = "ORG_ZSTACK_STORAGE_DEVICE_10048";
 
+    public static final String ORG_ZSTACK_STORAGE_DEVICE_10049 = "ORG_ZSTACK_STORAGE_DEVICE_10049";
+
     public static final String ORG_ZSTACK_CORE_GC_10000 = "ORG_ZSTACK_CORE_GC_10000";
 
     public static final String ORG_ZSTACK_CORE_GC_10001 = "ORG_ZSTACK_CORE_GC_10001";
@@ -3582,6 +3608,18 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_PRIMARY_10053 = "ORG_ZSTACK_STORAGE_PRIMARY_10053";
 
+    public static final String ORG_ZSTACK_STORAGE_PRIMARY_10055 = "ORG_ZSTACK_STORAGE_PRIMARY_10055";
+
+    public static final String ORG_ZSTACK_STORAGE_PRIMARY_10056 = "ORG_ZSTACK_STORAGE_PRIMARY_10056";
+
+    public static final String ORG_ZSTACK_STORAGE_PRIMARY_10057 = "ORG_ZSTACK_STORAGE_PRIMARY_10057";
+
+    public static final String ORG_ZSTACK_STORAGE_PRIMARY_10058 = "ORG_ZSTACK_STORAGE_PRIMARY_10058";
+
+    public static final String ORG_ZSTACK_STORAGE_PRIMARY_10059 = "ORG_ZSTACK_STORAGE_PRIMARY_10059";
+
+    public static final String ORG_ZSTACK_STORAGE_PRIMARY_10060 = "ORG_ZSTACK_STORAGE_PRIMARY_10060";
+
     public static final String ORG_ZSTACK_CORE_ENCRYPT_10000 = "ORG_ZSTACK_CORE_ENCRYPT_10000";
 
     public static final String ORG_ZSTACK_TEST_INTEGRATION_PREMIUM_NETWORKSERVICE_SLB_10000 = "ORG_ZSTACK_TEST_INTEGRATION_PREMIUM_NETWORKSERVICE_SLB_10000";
@@ -5544,6 +5582,10 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_BAREMETAL2_GATEWAY_10085 = "ORG_ZSTACK_BAREMETAL2_GATEWAY_10085";
 
+    public static final String ORG_ZSTACK_BAREMETAL2_GATEWAY_10086 = "ORG_ZSTACK_BAREMETAL2_GATEWAY_10086";
+
+    public static final String ORG_ZSTACK_BAREMETAL2_GATEWAY_10087 = "ORG_ZSTACK_BAREMETAL2_GATEWAY_10087";
+
     public static final String ORG_ZSTACK_BAREMETAL2_DPU_10000 = "ORG_ZSTACK_BAREMETAL2_DPU_10000";
 
     public static final String ORG_ZSTACK_BAREMETAL2_DPU_10001 = "ORG_ZSTACK_BAREMETAL2_DPU_10001";
@@ -6346,6 +6388,10 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_BACKUP_10133 = "ORG_ZSTACK_STORAGE_BACKUP_10133";
 
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_10134 = "ORG_ZSTACK_STORAGE_BACKUP_10134";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_10135 = "ORG_ZSTACK_STORAGE_BACKUP_10135";
+
     public static final String ORG_ZSTACK_STORAGE_BACKUP_CANCEL_TIMEOUT = "ORG_ZSTACK_STORAGE_BACKUP_CANCEL_TIMEOUT";
 
     public static final String ORG_ZSTACK_COMPUTE_10000 = "ORG_ZSTACK_COMPUTE_10000";
@@ -7868,6 +7914,12 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10031 = "ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10031";
 
+    public static final String ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10032 = "ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10032";
+
+    public static final String ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10033 = "ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10033";
+
+    public static final String ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10034 = "ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORKPOOL_10034";
+
     public static final String ORG_ZSTACK_IAM2_CONTAINER_ZAKU_10000 = "ORG_ZSTACK_IAM2_CONTAINER_ZAKU_10000";
 
     public static final String ORG_ZSTACK_IAM2_CONTAINER_ZAKU_10001 = "ORG_ZSTACK_IAM2_CONTAINER_ZAKU_10001";
@@ -11223,6 +11275,12 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_COMPUTE_HOST_10127 = "ORG_ZSTACK_COMPUTE_HOST_10127";
 
+    public static final String ORG_ZSTACK_COMPUTE_HOST_10128 = "ORG_ZSTACK_COMPUTE_HOST_10128";
+
+    public static final String ORG_ZSTACK_COMPUTE_HOST_10129 = "ORG_ZSTACK_COMPUTE_HOST_10129";
+
+    public static final String ORG_ZSTACK_COMPUTE_HOST_10130 = "ORG_ZSTACK_COMPUTE_HOST_10130";
+
     public static final String ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10000 = "ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10000";
 
     public static final String ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10001 = "ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10001";
@@ -12263,6 +12321,16 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_BACKUP_SFTP_10024 = "ORG_ZSTACK_STORAGE_BACKUP_SFTP_10024";
 
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_SFTP_10025 = "ORG_ZSTACK_STORAGE_BACKUP_SFTP_10025";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_SFTP_10026 = "ORG_ZSTACK_STORAGE_BACKUP_SFTP_10026";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_SFTP_10027 = "ORG_ZSTACK_STORAGE_BACKUP_SFTP_10027";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_SFTP_10028 = "ORG_ZSTACK_STORAGE_BACKUP_SFTP_10028";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_SFTP_10029 = "ORG_ZSTACK_STORAGE_BACKUP_SFTP_10029";
+
     public static final String ORG_ZSTACK_TEST_CORE_ERRORCODE_10000 = "ORG_ZSTACK_TEST_CORE_ERRORCODE_10000";
 
     public static final String ORG_ZSTACK_TEST_CORE_ERRORCODE_10001 = "ORG_ZSTACK_TEST_CORE_ERRORCODE_10001";
@@ -13279,6 +13347,10 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_VPC_HA_10020 = "ORG_ZSTACK_VPC_HA_10020";
 
+    public static final String ORG_ZSTACK_VPC_HA_10021 = "ORG_ZSTACK_VPC_HA_10021";
+
+    public static final String ORG_ZSTACK_VPC_HA_10022 = "ORG_ZSTACK_VPC_HA_10022";
+
     public static final String ORG_ZSTACK_SSO_CAS_FILTER_10000 = "ORG_ZSTACK_SSO_CAS_FILTER_10000";
 
     public static final String ORG_ZSTACK_SSO_CAS_FILTER_10001 = "ORG_ZSTACK_SSO_CAS_FILTER_10001";
@@ -14151,6 +14223,28 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_CEPH_10025 = "ORG_ZSTACK_STORAGE_CEPH_10025";
 
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10026 = "ORG_ZSTACK_STORAGE_CEPH_10026";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10027 = "ORG_ZSTACK_STORAGE_CEPH_10027";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10028 = "ORG_ZSTACK_STORAGE_CEPH_10028";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10029 = "ORG_ZSTACK_STORAGE_CEPH_10029";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10030 = "ORG_ZSTACK_STORAGE_CEPH_10030";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10031 = "ORG_ZSTACK_STORAGE_CEPH_10031";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10032 = "ORG_ZSTACK_STORAGE_CEPH_10032";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10033 = "ORG_ZSTACK_STORAGE_CEPH_10033";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10034 = "ORG_ZSTACK_STORAGE_CEPH_10034";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10035 = "ORG_ZSTACK_STORAGE_CEPH_10035";
+
+    public static final String ORG_ZSTACK_STORAGE_CEPH_10036 = "ORG_ZSTACK_STORAGE_CEPH_10036";
+
     public static final String ORG_ZSTACK_HYBRID_DATACENTER_10000 = "ORG_ZSTACK_HYBRID_DATACENTER_10000";
 
     public static final String ORG_ZSTACK_HYBRID_DATACENTER_10001 = "ORG_ZSTACK_HYBRID_DATACENTER_10001";
@@ -15326,6 +15420,10 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_V2V_10038 = "ORG_ZSTACK_V2V_10038";
 
+    public static final String ORG_ZSTACK_V2V_10039 = "ORG_ZSTACK_V2V_10039";
+
+    public static final String ORG_ZSTACK_V2V_10040 = "ORG_ZSTACK_V2V_10040";
+
     public static final String ORG_ZSTACK_SNS_PLATFORM_UNIVERSALSMS_10000 = "ORG_ZSTACK_SNS_PLATFORM_UNIVERSALSMS_10000";
 
     public static final String ORG_ZSTACK_SNS_PLATFORM_UNIVERSALSMS_10001 = "ORG_ZSTACK_SNS_PLATFORM_UNIVERSALSMS_10001";
diff --git a/utils/src/main/java/org/zstack/utils/network/IPv6Constants.java b/utils/src/main/java/org/zstack/utils/network/IPv6Constants.java
index 61c1e637906..31ae048bbff 100644
--- a/utils/src/main/java/org/zstack/utils/network/IPv6Constants.java
+++ b/utils/src/main/java/org/zstack/utils/network/IPv6Constants.java
@@ -11,6 +11,7 @@ public class IPv6Constants {
     public static final String SLAAC = "SLAAC";
     public static final String Stateless_DHCP = "Stateless-DHCP";
     public static final String Stateful_DHCP = "Stateful-DHCP";
+    public static final String IPV6_ANY_ADDRESS = "::";
 
     public static final int IPV6_STATELESS_PREFIX_LEN = 64;
 
diff --git a/utils/src/main/java/org/zstack/utils/network/IPv6NetworkUtils.java b/utils/src/main/java/org/zstack/utils/network/IPv6NetworkUtils.java
index 50bbe6f195b..355e43d3fe6 100644
--- a/utils/src/main/java/org/zstack/utils/network/IPv6NetworkUtils.java
+++ b/utils/src/main/java/org/zstack/utils/network/IPv6NetworkUtils.java
@@ -8,11 +8,18 @@
 import org.zstack.utils.logging.CLogger;
 
 import java.math.BigInteger;
+import java.net.Inet6Address;
+import java.net.InetAddress;
 import java.util.Arrays;
 import java.util.List;
 
 public class IPv6NetworkUtils {
     private final static CLogger logger = Utils.getLogger(IPv6NetworkUtils.class);
+    private static final String URL_IPV6_HOST_FORMAT = "[%s]";
+    private static final String HTTP_URL_FORMAT = "http://%s:%s";
+    private static final String HOST_PORT_FORMAT = "%s:%s";
+    private static final String IPV6_BRACKET_PREFIX = "[";
+    private static final String IPV6_BRACKET_SUFFIX = "]";
 
     // IPv4 地址正则表达式
     private static String ipv4Regex = "^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$";
@@ -134,6 +141,9 @@ public static String getIPv6AddresFromMac(String networkCidr, String mac) {
     }
 
     public static boolean isIpv6Address(String ip) {
+        if (ip == null) {
+            return false;
+        }
         try {
             IPv6Address.fromString(ip);
             return true;
@@ -143,6 +153,9 @@ public static boolean isIpv6Address(String ip) {
     }
 
     public static boolean isIpv6UnicastAddress(String ip) {
+        if (ip == null) {
+            return false;
+        }
         try {
             IPv6Address address = IPv6Address.fromString(ip);
             if (address.isMulticast() || address.isLinkLocal() || address.isSiteLocal()) {
@@ -500,4 +513,65 @@ public static String getIpByIpVersion(String ipVersion, List<String> ipList) {
     public static boolean isFullCidr(String cidr) {
         return cidr.equals("::/0");
     }
+
+    public static String normalizeIpv6(String ip) {
+        return getIpv6AddressCanonicalString(ip);
+    }
+
+    public static String formatHostForUrl(String host) {
+        if (host == null) {
+            return null;
+        }
+
+        if (host.startsWith(IPV6_BRACKET_PREFIX) && host.endsWith(IPV6_BRACKET_SUFFIX)) {
+            return host;
+        }
+
+        return isIpv6Address(host) ? String.format(URL_IPV6_HOST_FORMAT, host) : host;
+    }
+
+    public static String stripHostUrlBrackets(String host) {
+        if (host == null) {
+            return null;
+        }
+
+        if (host.startsWith(IPV6_BRACKET_PREFIX) && host.endsWith(IPV6_BRACKET_SUFFIX)) {
+            return host.substring(IPV6_BRACKET_PREFIX.length(), host.length() - IPV6_BRACKET_SUFFIX.length());
+        }
+
+        return host;
+    }
+
+    public static String buildHttpUrl(String host, int port) {
+        return String.format(HTTP_URL_FORMAT, formatHostForUrl(host), port);
+    }
+
+    public static String formatHostPort(String host, int port) {
+        return String.format(HOST_PORT_FORMAT, formatHostForUrl(host), port);
+    }
+
+    public static boolean isValidManagementEndpoint(String endpoint) {
+        if (NetworkUtils.isIpv4Address(endpoint) || NetworkUtils.isHostname(endpoint)) {
+            return true;
+        }
+
+        return isValidManagementIpv6Address(endpoint);
+    }
+
+    public static boolean isValidManagementIpv6Address(String endpoint) {
+        if (!isIpv6Address(endpoint)) {
+            return false;
+        }
+
+        try {
+            InetAddress address = InetAddress.getByName(endpoint);
+            return address instanceof Inet6Address &&
+                    !address.isLinkLocalAddress() &&
+                    !address.isLoopbackAddress() &&
+                    !address.isAnyLocalAddress() &&
+                    !address.isMulticastAddress();
+        } catch (Exception e) {
+            return false;
+        }
+    }
 }
diff --git a/utils/src/main/java/org/zstack/utils/network/ManagementNetworkIpVersionUtils.java b/utils/src/main/java/org/zstack/utils/network/ManagementNetworkIpVersionUtils.java
new file mode 100644
index 00000000000..f458dfb2bad
--- /dev/null
+++ b/utils/src/main/java/org/zstack/utils/network/ManagementNetworkIpVersionUtils.java
@@ -0,0 +1,105 @@
+package org.zstack.utils.network;
+
+import org.apache.commons.lang.StringUtils;
+
+public class ManagementNetworkIpVersionUtils {
+    public static final String IPV4 = "ipv4";
+    public static final String IPV6 = "ipv6";
+
+    private static final String IPV6_HOST_PREFIX = "[";
+    private static final String IPV6_HOST_SUFFIX = "]";
+    private static final String URI_SCHEME_SEPARATOR = "://";
+    private static final String NFS_URL_SEPARATOR = ":/";
+    private static final String PORT_SEPARATOR = ":";
+    private static final String PATH_SEPARATOR = "/";
+    private static final String USER_INFO_SEPARATOR = "@";
+    private static final String IPV6_SCOPE_SEPARATOR = "%";
+
+    public static boolean isValidIpVersion(String ipVersion) {
+        return normalizeIpVersion(ipVersion) != null;
+    }
+
+    public static String normalizeIpVersion(String ipVersion) {
+        if (StringUtils.isBlank(ipVersion)) {
+            return null;
+        }
+
+        String normalizedIpVersion = ipVersion.trim().toLowerCase();
+        if (IPV4.equals(normalizedIpVersion) || IPV6.equals(normalizedIpVersion)) {
+            return normalizedIpVersion;
+        }
+
+        return null;
+    }
+
+    public static String getEndpointIpVersion(String endpoint) {
+        String host = extractEndpointHost(endpoint);
+        if (NetworkUtils.isIpv4Address(host)) {
+            return IPV4;
+        }
+
+        if (IPv6NetworkUtils.isIpv6Address(host)) {
+            return IPV6;
+        }
+
+        return null;
+    }
+
+    public static boolean isIpv6LinkLocalEndpoint(String endpoint) {
+        String host = extractEndpointHost(endpoint);
+        if (StringUtils.isBlank(host) || !host.contains(PORT_SEPARATOR)) {
+            return false;
+        }
+
+        int scopeIndex = host.indexOf(IPV6_SCOPE_SEPARATOR);
+        String address = scopeIndex >= 0 ? host.substring(0, scopeIndex) : host;
+        return IPv6NetworkUtils.isLinkLocalAddress(address);
+    }
+
+    public static String extractEndpointHost(String endpoint) {
+        if (StringUtils.isBlank(endpoint)) {
+            return null;
+        }
+
+        String value = endpoint.trim();
+        int schemeIndex = value.indexOf(URI_SCHEME_SEPARATOR);
+        if (schemeIndex >= 0) {
+            value = value.substring(schemeIndex + URI_SCHEME_SEPARATOR.length());
+        }
+
+        if (value.contains(USER_INFO_SEPARATOR)) {
+            value = value.substring(value.lastIndexOf(USER_INFO_SEPARATOR) + USER_INFO_SEPARATOR.length());
+        }
+
+        if (value.startsWith(IPV6_HOST_PREFIX)) {
+            return extractBracketIpv6Host(value);
+        }
+
+        String hostBeforePath = value;
+        int pathIndex = hostBeforePath.indexOf(PATH_SEPARATOR);
+        if (pathIndex >= 0) {
+            hostBeforePath = hostBeforePath.substring(0, pathIndex);
+        }
+
+        if (IPv6NetworkUtils.isIpv6Address(hostBeforePath)) {
+            return hostBeforePath;
+        }
+
+        int nfsIndex = value.indexOf(NFS_URL_SEPARATOR);
+        if (nfsIndex >= 0) {
+            return value.substring(0, nfsIndex);
+        }
+
+        int portIndex = hostBeforePath.indexOf(PORT_SEPARATOR);
+        if (portIndex >= 0 && hostBeforePath.indexOf(PORT_SEPARATOR, portIndex + PORT_SEPARATOR.length()) < 0) {
+            return hostBeforePath.substring(0, portIndex);
+        }
+
+        return hostBeforePath;
+    }
+
+    private static String extractBracketIpv6Host(String value) {
+        int end = value.indexOf(IPV6_HOST_SUFFIX);
+        return end > 0 ? value.substring(IPV6_HOST_PREFIX.length(), end) : value;
+    }
+}
diff --git a/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java b/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java
index 3a7859fec8d..4cb6be81196 100755
--- a/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java
+++ b/utils/src/main/java/org/zstack/utils/network/NetworkUtils.java
@@ -558,6 +558,23 @@ public static boolean isIpv4InCidr(String ipv4, String cidr) {
         return isIpv4InRange(ipv4, info.getLowAddress(), info.getHighAddress());
     }
 
+    public static boolean isIpInCidr(String ip, String cidr) {
+        DebugUtils.Assert(isCidr(cidr), String.format("%s is not a cidr", cidr));
+        validateIp(ip);
+
+        if (isIpv4Address(ip)) {
+            if (!isCidr(cidr, IPv6Constants.IPv4)) {
+                return false;
+            }
+            return isIpv4InCidr(ip, cidr);
+        }
+
+        if (!isCidr(cidr, IPv6Constants.IPv6)) {
+            return false;
+        }
+        return IPv6NetworkUtils.isIpv6InCidrRange(ip, cidr);
+    }
+
     public static List<String> filterIpv4sInCidr(List<String> ipv4s, String cidr){
         DebugUtils.Assert(isCidr(cidr), String.format("%s is not a cidr", cidr));
         SubnetUtils.SubnetInfo info = getSubnetInfo(new SubnetUtils(cidr));
@@ -572,6 +589,19 @@ public static List<String> filterIpv4sInCidr(List<String> ipv4s, String cidr){
         return results;
     }
 
+    public static List<String> filterIpsInCidr(List<String> ips, String cidr){
+        DebugUtils.Assert(isCidr(cidr), String.format("%s is not a cidr", cidr));
+        List<String> results = new ArrayList<>();
+
+        for (String ip : ips) {
+            validateIp(ip);
+            if (isIpInCidr(ip, cidr)) {
+                results.add(ip);
+            }
+        }
+        return results;
+    }
+
     public static boolean isIpRoutedByDefaultGateway(String ip) {
         ShellResult res = ShellUtils.runAndReturn(String.format("ip route get %s | grep -q \"via $(ip route | awk '/default/ {print $3}')\"", ip));
         return res.isReturnCode(0);
@@ -588,6 +618,10 @@ public static boolean isSubCidr(String cidr, String subCidr) {
     
     public static String getNetworkAddressFromCidr(String cidr) {
         DebugUtils.Assert(isCidr(cidr), String.format("%s is not a cidr", cidr));
+        if (isIpv6Address(cidr.split("\\/")[0])) {
+            return IPv6NetworkUtils.getFormalCidrOfNetworkCidr(cidr);
+        }
+
         SubnetUtils n = new SubnetUtils(cidr);
         return String.format("%s/%s", n.getInfo().getNetworkAddress(), cidr.split("\\/")[1]);
     }
@@ -607,9 +641,8 @@ public static List<String> getIpRangeFromIps(List<String> ips){
     }
 
     public static String fmtCidr(final String origin) {
-        // format "*.*.1.1/16" to "*.*.0.0/16"
         DebugUtils.Assert(isCidr(origin), String.format("%s is not a cidr", origin));
-        return new SubnetUtils(origin).getInfo().getNetworkAddress() + "/" + origin.split("/")[1];
+        return getNetworkAddressFromCidr(origin);
     }
 
     public static List<String> getCidrsFromIpRange(String startIp, String endIp) {
@@ -972,4 +1005,3 @@ public static int compareIpv4Address(String ip1, String ip2) {
         return diff > 0 ? 1 : diff == 0 ? 0 : -1;
     }
 }
-
diff --git a/utils/src/main/java/org/zstack/utils/ssh/Ssh.java b/utils/src/main/java/org/zstack/utils/ssh/Ssh.java
index 69de299e258..3f61ae0b2f8 100755
--- a/utils/src/main/java/org/zstack/utils/ssh/Ssh.java
+++ b/utils/src/main/java/org/zstack/utils/ssh/Ssh.java
@@ -345,10 +345,11 @@ public SshResult run() {
 
             @Override
             public String getCommand() {
+                String target = SshShell.formatScpTarget(username, hostname);
                 if (download) {
-                    return String.format("scp -P %d %s@%s:%s %s", port, username, hostname, src, dst);
+                    return String.format("scp -P %d %s:%s %s", port, target, src, dst);
                 } else {
-                    return String.format("scp -P %d %s %s@%s:%s", port, src, username, hostname, dst);
+                    return String.format("scp -P %d %s %s:%s", port, src, target, dst);
                 }
             }
 
diff --git a/utils/src/main/java/org/zstack/utils/ssh/SshShell.java b/utils/src/main/java/org/zstack/utils/ssh/SshShell.java
index 67299048bd2..5a9196a46c0 100755
--- a/utils/src/main/java/org/zstack/utils/ssh/SshShell.java
+++ b/utils/src/main/java/org/zstack/utils/ssh/SshShell.java
@@ -6,6 +6,7 @@
 import org.zstack.utils.ShellUtils;
 import org.zstack.utils.Utils;
 import org.zstack.utils.logging.CLogger;
+import org.zstack.utils.network.IPv6NetworkUtils;
 import org.zstack.utils.path.PathUtil;
 
 import java.io.File;
@@ -22,6 +23,7 @@
  */
 public class SshShell {
     private static final CLogger logger = Utils.getLogger(SshShell.class);
+    private static final String SSH_TARGET_FORMAT = "%s@%s";
 
     private String hostname;
     private String username;
@@ -44,6 +46,14 @@ private void checkParams() {
         DebugUtils.Assert(password != null || privateKey != null, "password and privateKey must have at least one set");
     }
 
+    public static String formatSshTarget(String username, String hostname) {
+        return String.format(SSH_TARGET_FORMAT, username, IPv6NetworkUtils.stripHostUrlBrackets(hostname));
+    }
+
+    public static String formatScpTarget(String username, String hostname) {
+        return String.format(SSH_TARGET_FORMAT, username, IPv6NetworkUtils.formatHostForUrl(hostname));
+    }
+
     public SshResult runCommand(String cmd) {
         return runCommand(cmd, false);
     }
@@ -62,13 +72,13 @@ private SshResult runCommand(String cmd, boolean allocatePseudoTty) {
             if (privateKey != null) {
                 tempPasswordFile = File.createTempFile("zstack", "tmp");
                 writeSecretFile(tempPasswordFile, privateKey);
-                ssh = String.format("ssh -q %s-i %s -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o StrictHostKeyChecking=no %s -p %s %s@%s '%s'",
-                        pseudoTtyOption, tempPasswordFile.getAbsolutePath(), sshTimeoutOptions(), port, username, hostname, cmd);
+                ssh = String.format("ssh -q %s-i %s -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o StrictHostKeyChecking=no %s -p %s %s '%s'",
+                        pseudoTtyOption, tempPasswordFile.getAbsolutePath(), sshTimeoutOptions(), port, formatSshTarget(username, hostname), cmd);
             } else {
                 tempPasswordFile = File.createTempFile("zstack", "tmp");
                 writeSecretFile(tempPasswordFile, password);
-                ssh = String.format("sshpass -f%s ssh -q %s-o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o StrictHostKeyChecking=no %s -p %s %s@%s '%s'",
-                        tempPasswordFile.getAbsolutePath(), pseudoTtyOption, sshTimeoutOptions(), port, username, hostname, cmd);
+                ssh = String.format("sshpass -f%s ssh -q %s-o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o StrictHostKeyChecking=no %s -p %s %s '%s'",
+                        tempPasswordFile.getAbsolutePath(), pseudoTtyOption, sshTimeoutOptions(), port, formatSshTarget(username, hostname), cmd);
             }
 
             if (logger.isTraceEnabled()) {
@@ -106,32 +116,32 @@ public SshResult runScript(String script) {
                 tempPasswordFile = File.createTempFile("zstack", "tmp");
                 writeSecretFile(tempPasswordFile, privateKey);
                 ssh = ln(
-                        "ssh -q -i {0} -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o StrictHostKeyChecking=no {5} -p {1} -T {2}@{3} << 'EOF'",
+                        "ssh -q -i {0} -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o StrictHostKeyChecking=no {4} -p {1} -T {2} << 'EOF'",
                         "s=`mktemp`",
                         "cat << 'EOT' > $s",
-                        "{4}",
+                        "{3}",
                         "EOT",
                         "bash $s",
                         "ret=$?",
                         "rm -f $s",
                         "exit $ret",
                         "EOF"
-                ).format(tempPasswordFile.getAbsolutePath(), port, username, hostname, script, sshTimeoutOptions());
+                ).format(tempPasswordFile.getAbsolutePath(), port, formatSshTarget(username, hostname), script, sshTimeoutOptions());
             } else {
                 tempPasswordFile = File.createTempFile("zstack", "tmp");
                 writeSecretFile(tempPasswordFile, password);
                 ssh = ln(
-                        "sshpass -f{0} ssh -q -o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o StrictHostKeyChecking=no {5} -p {1} -T {2}@{3} << 'EOF'",
+                        "sshpass -f{0} ssh -q -o UserKnownHostsFile=/dev/null -o PubkeyAuthentication=no -o StrictHostKeyChecking=no {4} -p {1} -T {2} << 'EOF'",
                         "s=`mktemp`",
                         "cat << 'EOT' > $s",
-                        "{4}",
+                        "{3}",
                         "EOT",
                         "bash $s",
                         "ret=$?",
                         "rm -f $s",
                         "exit $ret",
                         "EOF"
-                ).format(tempPasswordFile.getAbsolutePath(), port, username, hostname, script, sshTimeoutOptions());
+                ).format(tempPasswordFile.getAbsolutePath(), port, formatSshTarget(username, hostname), script, sshTimeoutOptions());
             }
 
             if (logger.isTraceEnabled()) {
@@ -226,7 +236,6 @@ public Boolean getWithSudo() {
     public void setWithSudo(Boolean withSudo) {
         this.withSudo = withSudo;
     }
-
     public int getConnectTimeoutSeconds() {
         return connectTimeoutSeconds;
     }
diff --git a/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java b/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java
index 5e9d4b9a4dc..c14290d71bc 100644
--- a/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java
+++ b/utils/src/main/java/org/zstack/utils/zsha2/ZSha2Helper.java
@@ -39,7 +39,7 @@ public static ZSha2Info getInfo(boolean checkZSha2Status) {
         ZSha2Info info = JSONObjectUtil.toObject(result.getStdout(), ZSha2Info.class);
 
         info.setMaster(ShellUtils.runAndReturn(String.format(
-                "ip addr show %s | grep -q '[^0-9]%s[^0-9]'", info.getNic(), info.getDbvip())).isReturnCode(0));
+                "ip addr show %s | grep -q ' %s/'", info.getNic(), info.getDbvip())).isReturnCode(0));
         return info;
     }
 

From c392cafbed2e151c52cff00051b8ad5159803f0a Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin.ruan@zstack.io>
Date: Mon, 29 Jun 2026 11:23:41 +0800
Subject: [PATCH 2/7] <fix>[mgt-ipv6]: address review issues

Restore VR HA demote before VF migration.

Keep MustFailCase collected for DevOps sentinel checks and assign dedicated CloudOperations error codes for new messages.

Resolves: ZSTAC-79206

Change-Id: I1b70ab2c95788391649e86af5567458aee20603f
---
 .../ManagementServerConsoleProxyBackend.java  |  2 +-
 .../VirtualRouterManagerImpl.java             | 45 +++++++++++++++++++
 .../test/integration/core/MustFailCase.groovy |  2 -
 .../CloudOperationsErrorCode.java             | 16 +++++++
 4 files changed, 62 insertions(+), 3 deletions(-)

diff --git a/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java b/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
index 07070b7756c..69d4d638cc8 100755
--- a/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
+++ b/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
@@ -603,7 +603,7 @@ public void run(FlowTrigger trigger, Map data) {
                         if (rst == 0 && ipv4Rst == 0 && ipv6Rst == 0 && portRst == 0) {
                             trigger.next();
                         } else {
-                            trigger.fail(operr(ORG_ZSTACK_CONSOLE_10003, "failed to configure consoleProxyOverriddenIp[code:%d], consoleProxyOverriddenIpv4[code:%d], consoleProxyOverriddenIpv6[code:%d], or consoleProxyPort[code:%d]", rst, ipv4Rst, ipv6Rst, portRst));
+                            trigger.fail(operr(ORG_ZSTACK_CONSOLE_10015, "failed to configure consoleProxyOverriddenIp[code:%d], consoleProxyOverriddenIpv4[code:%d], consoleProxyOverriddenIpv6[code:%d], or consoleProxyPort[code:%d]", rst, ipv4Rst, ipv6Rst, portRst));
                         }
                     }
 
diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java
index 4f22ae67d99..97dc6e38213 100755
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/VirtualRouterManagerImpl.java
@@ -2901,6 +2901,51 @@ private List<VipTO> findVipsOnVirtualRouter(List<VmNicInventory> vfNics, String
 
     @Override
     public void preVmMigration(VmInstanceInventory vm, VmMigrationType type, String dstHostUuid, Completion completion) {
+        if (ApplianceVmConstant.APPLIANCE_VM_TYPE.equals(vm.getType())) {
+            VirtualRouterVmVO vrVo = Q.New(VirtualRouterVmVO.class).eq(VirtualRouterVmVO_.uuid, vm.getUuid()).find();
+            if (vrVo == null) {
+                completion.success();
+                return;
+            }
+            VirtualRouterVmInventory inv = VirtualRouterVmInventory.valueOf(vrVo);
+            List<VmNicInventory> vfNics = inv.getVmNics().stream()
+                    .filter(nic -> !Objects.equals(nic.getType(), VmInstanceConstant.VIRTUAL_NIC_TYPE))
+                    .collect(Collectors.toList());
+            if (vrVo.isHaEnabled() && !vfNics.isEmpty()) {
+                List<VirtualRouterHaGroupExtensionPoint> exps = pluginRgty.getExtensionList(VirtualRouterHaGroupExtensionPoint.class);
+                if (exps.isEmpty()) {
+                    completion.success();
+                    return;
+                }
+                String peerUuid = exps.get(0).getPeerUuid(vrVo.getUuid());
+                if (peerUuid == null) {
+                    completion.success();
+                    return;
+                }
+                if (ApplianceVmHaStatus.Master.equals(vrVo.getHaStatus()) &&
+                        ApplianceVmStatus.Connected.equals(vrVo.getStatus()) &&
+                        Q.New(VirtualRouterVmVO.class).eq(VirtualRouterVmVO_.status, ApplianceVmStatus.Connected)
+                                .eq(VirtualRouterVmVO_.uuid, peerUuid).isExists()) {
+                    logger.debug(String.format("demote ha master before migrate, virtual router[uuid:%s]", vrVo.getUuid()));
+                    VirtualRouterAsyncHttpCallMsg msg = new VirtualRouterAsyncHttpCallMsg();
+                    msg.setVmInstanceUuid(vrVo.getUuid());
+                    msg.setCommand(new VirtualRouterCommands.AgentCommand());
+                    msg.setCheckStatus(true);
+                    msg.setPath(VirtualRouterConstant.VR_HA_MASTER_DEMOTE);
+                    bus.makeTargetServiceIdByResourceUuid(msg, VmInstanceConstant.SERVICE_ID, vrVo.getUuid());
+                    bus.send(msg, new CloudBusCallBack(null) {
+                        @Override
+                        public void run(MessageReply reply) {
+                            if (!reply.isSuccess()) {
+                                logger.warn(reply.getError().toString());
+                            }
+                            completion.success();
+                        }
+                    });
+                    return;
+                }
+            }
+        }
         completion.success();
     }
 }
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy b/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy
index c8f5387b9de..a502ed44985 100644
--- a/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/core/MustFailCase.groovy
@@ -1,12 +1,10 @@
 package org.zstack.test.integration.core
 
-import org.zstack.testlib.SkipTestSuite
 import org.zstack.testlib.SubCase
 
 /**
  * Created by lining on 2017/4/10.
  */
-@SkipTestSuite
 class MustFailCase extends SubCase {
 
     @Override
diff --git a/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java b/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java
index cf675f420db..b848d811523 100644
--- a/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java
+++ b/utils/src/main/java/org/zstack/utils/clouderrorcode/CloudOperationsErrorCode.java
@@ -260,6 +260,10 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10086 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10086";
 
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10087 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10087";
+
+    public static final String ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10088 = "ORG_ZSTACK_STORAGE_BACKUP_IMAGESTORE_10088";
+
     public static final String ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10000 = "ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10000";
 
     public static final String ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10001 = "ORG_ZSTACK_MTTYDEVICE_KVMMTTYDEVICEBACKEND_10001";
@@ -1070,6 +1074,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_CONSOLE_10014 = "ORG_ZSTACK_CONSOLE_10014";
 
+    public static final String ORG_ZSTACK_CONSOLE_10015 = "ORG_ZSTACK_CONSOLE_10015";
+
     public static final String ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORK_10000 = "ORG_ZSTACK_NETWORK_L2_VXLAN_VXLANNETWORK_10000";
 
     public static final String ORG_ZSTACK_NETWORK_SERVICE_HEADER_NFVINSTGROUP_10000 = "ORG_ZSTACK_NETWORK_SERVICE_HEADER_NFVINSTGROUP_10000";
@@ -4916,6 +4922,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_V2V_VMWARE_10017 = "ORG_ZSTACK_V2V_VMWARE_10017";
 
+    public static final String ORG_ZSTACK_V2V_VMWARE_10018 = "ORG_ZSTACK_V2V_VMWARE_10018";
+
     public static final String ORG_ZSTACK_LDAP_EXTERNALSEARCH_10000 = "ORG_ZSTACK_LDAP_EXTERNALSEARCH_10000";
 
     public static final String ORG_ZSTACK_IDENTITY_10000 = "ORG_ZSTACK_IDENTITY_10000";
@@ -6770,6 +6778,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_BAREMETAL_PXESERVER_10036 = "ORG_ZSTACK_BAREMETAL_PXESERVER_10036";
 
+    public static final String ORG_ZSTACK_BAREMETAL_PXESERVER_10037 = "ORG_ZSTACK_BAREMETAL_PXESERVER_10037";
+
     public static final String ORG_ZSTACK_TEST_INTEGRATION_V2V_10000 = "ORG_ZSTACK_TEST_INTEGRATION_V2V_10000";
 
     public static final String ORG_ZSTACK_TEST_INTEGRATION_V2V_10001 = "ORG_ZSTACK_TEST_INTEGRATION_V2V_10001";
@@ -8566,6 +8576,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_V2V_KVM_10012 = "ORG_ZSTACK_V2V_KVM_10012";
 
+    public static final String ORG_ZSTACK_V2V_KVM_10013 = "ORG_ZSTACK_V2V_KVM_10013";
+
     public static final String ORG_ZSTACK_IPSEC_VYOS_10000 = "ORG_ZSTACK_IPSEC_VYOS_10000";
 
     public static final String ORG_ZSTACK_IPSEC_VYOS_10001 = "ORG_ZSTACK_IPSEC_VYOS_10001";
@@ -11281,6 +11293,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_COMPUTE_HOST_10130 = "ORG_ZSTACK_COMPUTE_HOST_10130";
 
+    public static final String ORG_ZSTACK_COMPUTE_HOST_10131 = "ORG_ZSTACK_COMPUTE_HOST_10131";
+
     public static final String ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10000 = "ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10000";
 
     public static final String ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10001 = "ORG_ZSTACK_MONITORING_TRIGGER_EXPRESSION_10001";
@@ -13351,6 +13365,8 @@ public class CloudOperationsErrorCode {
 
     public static final String ORG_ZSTACK_VPC_HA_10022 = "ORG_ZSTACK_VPC_HA_10022";
 
+    public static final String ORG_ZSTACK_VPC_HA_10023 = "ORG_ZSTACK_VPC_HA_10023";
+
     public static final String ORG_ZSTACK_SSO_CAS_FILTER_10000 = "ORG_ZSTACK_SSO_CAS_FILTER_10000";
 
     public static final String ORG_ZSTACK_SSO_CAS_FILTER_10001 = "ORG_ZSTACK_SSO_CAS_FILTER_10001";

From 8b799fb808c80b916d0f504ac71d40f42dbb6aac Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin@shixin.ruan>
Date: Mon, 29 Jun 2026 15:56:07 +0900
Subject: [PATCH 3/7] <fix>[mgt-ipv6]: fix console proxy gc race

Query the triggered GC job by uuid and tolerate cleanup after
completion.

Resolves: ZSTAC-85916

Change-Id: Ib08de905b38a26e8de1fe5877bc01c41868a9ded
---
 .../test/integration/console/ConsoleProxyCase.groovy     | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy b/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
index 09360c72fce..cb28680ca6e 100644
--- a/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
@@ -212,10 +212,11 @@ class ConsoleProxyCase extends SubCase {
         }
 
         retryInSecs {
-            gc = queryGCJob {
-                conditions = ["status=${GCStatus.Done}".toString(), "context~=%${vm.uuid}%".toString()]
-            }[0] as GarbageCollectorInventory
-            assert gc.status == GCStatus.Done.toString()
+            List<GarbageCollectorInventory> jobs = queryGCJob {
+                conditions = ["uuid=${gc.uuid}".toString()]
+            } as List<GarbageCollectorInventory>
+            assert jobs.isEmpty() || jobs[0].status == GCStatus.Done.toString()
+            assert Q.New(ConsoleProxyVO.class).eq(ConsoleProxyVO_.vmInstanceUuid, vm.uuid).count() == 0
         }
     }
 

From 90a7f4c00d91f5ab08ea65cd2c746ae769465671 Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin.ruan@zstack.io>
Date: Mon, 29 Jun 2026 20:56:26 +0800
Subject: [PATCH 4/7] <fix>[virtualrouter]: reserve management VIP ports

Detect the actual virtual router management NIC IP through UsedIpVO so both IPv4 and IPv6 management addresses reserve appliance service ports.

Test: mvn -pl plugin/virtualRouterProvider -am -DskipTests compile

Resolves: ZSTAC-86300

Change-Id: I9b9262737a57a5366d66b82ad4a43128ce901fb0
---
 .../virtualrouter/vyos/VyosVmFactory.java     | 54 ++++++++++++++++---
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosVmFactory.java b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosVmFactory.java
index 69aa5b0155e..d2c7e33fe9a 100644
--- a/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosVmFactory.java
+++ b/plugin/virtualRouterProvider/src/main/java/org/zstack/network/service/virtualrouter/vyos/VyosVmFactory.java
@@ -6,17 +6,24 @@
 import org.zstack.appliancevm.ApvmCascadeFilterExtensionPoint;
 import org.zstack.core.cascade.CascadeAction;
 import org.zstack.core.db.DatabaseFacade;
+import org.zstack.core.db.Q;
 import org.zstack.header.network.l3.IpRangeVO;
 import org.zstack.header.network.l3.L3NetworkVO;
 import org.zstack.header.network.l3.UsedIpInventory;
-import org.zstack.header.network.service.NetworkServiceType;
+import org.zstack.header.network.l3.UsedIpVO;
+import org.zstack.header.network.l3.UsedIpVO_;
 import org.zstack.header.vm.VmNicInventory;
+import org.zstack.header.vm.VmNicVO;
+import org.zstack.header.vm.VmNicVO_;
 import org.zstack.network.service.lb.LoadBalancerConstants;
 import org.zstack.network.service.vip.VipGetUsedPortRangeExtensionPoint;
 import org.zstack.network.service.vip.VipVO;
 import org.zstack.network.service.virtualrouter.VirtualRouterGlobalConfig;
 import org.zstack.network.service.virtualrouter.VirtualRouterGlobalProperty;
 import org.zstack.network.service.virtualrouter.VirtualRouterManagerImpl;
+import org.zstack.network.service.virtualrouter.VirtualRouterNicMetaData;
+import org.zstack.network.service.virtualrouter.VirtualRouterVmVO;
+import org.zstack.network.service.virtualrouter.VirtualRouterVmVO_;
 import org.zstack.utils.RangeSet;
 import org.zstack.utils.Utils;
 import org.zstack.utils.VipUseForList;
@@ -24,6 +31,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Objects;
 
 /**
  * Created by weiwang on 19/09/2017
@@ -49,15 +57,13 @@ public RangeSet getVipUsePortRange(String vipUuid, String protocol, VipUseForLis
         portRangeList.setRanges(portRanges);
 
         VipVO vipVO = dbf.findByUuid(vipUuid, VipVO.class);
-        /* system vip is the vip of public ip of vpc or vpc ha group */
-        boolean hasSnat = vipVO.getServicesTypes().contains(NetworkServiceType.SNAT.toString());
-        if (vipVO.isSystem()) {
-            if (protocol.equalsIgnoreCase(LoadBalancerConstants.LB_PROTOCOL_UDP) && hasSnat){
+        if (isVirtualRouterManagementNicIp(vipVO)) {
+            if (protocol.equalsIgnoreCase(LoadBalancerConstants.LB_PROTOCOL_UDP)){
                 portRanges.add(new RangeSet.Range(VyosConstants.DNS_PORT, VyosConstants.DNS_PORT, true));
                 portRanges.add(new RangeSet.Range(VyosConstants.NTP_PORT, VyosConstants.NTP_PORT, true));
             }
 
-            if (protocol.equalsIgnoreCase(LoadBalancerConstants.LB_PROTOCOL_TCP) && hasSnat){
+            if (!protocol.equalsIgnoreCase(LoadBalancerConstants.LB_PROTOCOL_UDP)){
                 portRanges.add(new RangeSet.Range(VyosConstants.DNS_PORT, VyosConstants.DNS_PORT, true));
 
                 int sshPort = VirtualRouterGlobalConfig.SSH_PORT.value(Integer.class);
@@ -71,6 +77,42 @@ public RangeSet getVipUsePortRange(String vipUuid, String protocol, VipUseForLis
         return portRangeList;
     }
 
+    private boolean isVirtualRouterManagementNicIp(VipVO vipVO) {
+        List<String> nicUuids = new ArrayList<>();
+        UsedIpVO vipUsedIp = vipVO.getUsedIpUuid() == null ? null :
+                Q.New(UsedIpVO.class).eq(UsedIpVO_.uuid, vipVO.getUsedIpUuid()).find();
+        if (vipUsedIp != null
+                && Objects.equals(vipUsedIp.getIp(), vipVO.getIp())
+                && Objects.equals(vipUsedIp.getL3NetworkUuid(), vipVO.getL3NetworkUuid())
+                && vipUsedIp.getVmNicUuid() != null) {
+            nicUuids.add(vipUsedIp.getVmNicUuid());
+        } else {
+            nicUuids.addAll(Q.New(UsedIpVO.class)
+                    .select(UsedIpVO_.vmNicUuid)
+                    .eq(UsedIpVO_.ip, vipVO.getIp())
+                    .eq(UsedIpVO_.l3NetworkUuid, vipVO.getL3NetworkUuid())
+                    .notNull(UsedIpVO_.vmNicUuid)
+                    .listValues());
+        }
+
+        if (nicUuids.isEmpty()) {
+            return false;
+        }
+
+        List<VmNicVO> managementNics = Q.New(VmNicVO.class)
+                .in(VmNicVO_.uuid, nicUuids)
+                .in(VmNicVO_.metaData, VirtualRouterNicMetaData.MANAGEMENT_NIC_MASK_STRING_LIST)
+                .list();
+
+        for (VmNicVO nic : managementNics) {
+            if (Q.New(VirtualRouterVmVO.class).eq(VirtualRouterVmVO_.uuid, nic.getVmInstanceUuid()).isExists()) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
     @Override
     public List<ApplianceVmVO> filterApplianceVmCascade(List<ApplianceVmVO> applianceVmVOS, CascadeAction action,
                                                         String parentIssuer,

From 9a69106f0ebb398684909a2e1a993971ea4ac0bc Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin.ruan@zstack.io>
Date: Mon, 29 Jun 2026 21:48:44 +0800
Subject: [PATCH 5/7] <fix>[mgt-ipv6]: address mr review comments

Fix review issues in management IPv6 support: preserve console proxy partial updates, correct cloudbus context URL, normalize Ceph IPv6 mon hosts, fall back to IPv6 default route discovery, fix TagUtils IPv6 token matching, and tighten upgrade/delete edge cases.

Test: git diff --check

Test: mvn -pl utils,core,header,console,plugin/ceph,plugin/sftpBackupStorage -am -DskipTests compile

Note: mvn -f test/pom.xml -Dtest=org.zstack.test.unittest.utils.NetworkUtilsCase -DfailIfNoTests=false test fails in testCompile on existing unrelated test sources.

Resolves: ZSTAC-79206

Change-Id: Ie89261e10ff2003f8e1fcf786a609860cead551e
---
 conf/db/upgrade/V5.5.28__schema.sql           |  17 ++
 .../zstack/console/ConsoleApiInterceptor.java |   6 +-
 .../ManagementServerConsoleProxyBackend.java  |  10 +-
 .../main/java/org/zstack/core/Platform.java   |  70 +++++---
 .../zstack/core/cloudbus/CloudBusImpl3.java   |   2 +-
 .../APIUpdateConsoleProxyAgentMsg.java        |   2 +-
 .../java/org/zstack/storage/ceph/MonUri.java  |   8 +-
 .../console/ConsoleProxyCase.groovy           | 158 ++++++++++--------
 .../core/ManagementNetworkIpv6Case.groovy     |  15 +-
 .../kvm/host/KvmHostIpv6Case.groovy           |  10 +-
 .../unittest/utils/NetworkUtilsCase.groovy    |   3 +
 .../main/java/org/zstack/utils/TagUtils.java  |  23 +--
 .../java/org/zstack/utils/ssh/SshShell.java   |   4 +-
 13 files changed, 204 insertions(+), 124 deletions(-)

diff --git a/conf/db/upgrade/V5.5.28__schema.sql b/conf/db/upgrade/V5.5.28__schema.sql
index 43958fc4b21..d25afe0ba7e 100644
--- a/conf/db/upgrade/V5.5.28__schema.sql
+++ b/conf/db/upgrade/V5.5.28__schema.sql
@@ -166,6 +166,23 @@ CREATE TABLE IF NOT EXISTS `zstack`.`ResourceSourceRefVO` (
     KEY `idxResourceSourceRefVOSyncType` (`syncType`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 
+DROP PROCEDURE IF EXISTS upgrade_vtep_ip_not_null;
+DELIMITER $$
+CREATE PROCEDURE upgrade_vtep_ip_not_null()
+BEGIN
+    IF EXISTS (SELECT 1 FROM `zstack`.`VtepVO` WHERE `vtepIp` IS NULL) THEN
+        SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'VtepVO.vtepIp contains NULL values';
+    END IF;
+
+    IF EXISTS (SELECT 1 FROM `zstack`.`RemoteVtepVO` WHERE `vtepIp` IS NULL) THEN
+        SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'RemoteVtepVO.vtepIp contains NULL values';
+    END IF;
+END $$
+DELIMITER ;
+
+CALL upgrade_vtep_ip_not_null();
+DROP PROCEDURE IF EXISTS upgrade_vtep_ip_not_null;
+
 ALTER TABLE `zstack`.`VtepVO` MODIFY COLUMN `vtepIp` varchar(128) NOT NULL;
 ALTER TABLE `zstack`.`RemoteVtepVO` MODIFY COLUMN `vtepIp` varchar(128) NOT NULL;
 
diff --git a/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java b/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java
index 2976a94e5ca..a90c5e1b575 100755
--- a/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java
+++ b/console/src/main/java/org/zstack/console/ConsoleApiInterceptor.java
@@ -71,9 +71,6 @@ private void validate(APIUpdateConsoleProxyAgentMsg msg) {
         if (msg.getConsoleProxyOverriddenIp() == null) {
             msg.setConsoleProxyOverriddenIp("0.0.0.0");
         }
-        if (msg.getConsoleProxyOverriddenIp().equals("")) {
-            msg.setConsoleProxyOverriddenIp("0.0.0.0");
-        }
         msg.setConsoleProxyOverriddenIpv4(normalizeOptionalConsoleProxyHost(msg.getConsoleProxyOverriddenIpv4()));
         msg.setConsoleProxyOverriddenIpv6(normalizeOptionalConsoleProxyHost(msg.getConsoleProxyOverriddenIpv6()));
     }
@@ -83,6 +80,7 @@ private String normalizeOptionalConsoleProxyHost(String host) {
             return null;
         }
 
-        return IPv6NetworkUtils.stripHostUrlBrackets(host.trim());
+        String normalized = IPv6NetworkUtils.stripHostUrlBrackets(host.trim());
+        return normalized.isEmpty() ? null : normalized;
     }
 }
diff --git a/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java b/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
index 69d4d638cc8..af9737083a5 100755
--- a/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
+++ b/console/src/main/java/org/zstack/console/ManagementServerConsoleProxyBackend.java
@@ -495,6 +495,7 @@ private void handle(UpdateConsoleProxyAgentMsg msg) {
             String oldProxyIp;
             String oldProxyIpv4;
             String oldProxyIpv6;
+            String newProxyIp;
             String newProxyIpv4;
             String newProxyIpv6;
             int oldProxyPort;
@@ -541,9 +542,10 @@ public void run(FlowTrigger trigger, Map data) {
                         oldProxyIpv4 = vo.getConsoleProxyOverriddenIpv4();
                         oldProxyIpv6 = vo.getConsoleProxyOverriddenIpv6();
                         oldProxyPort = vo.getConsoleProxyPort();
+                        newProxyIp = msg.getConsoleProxyOverriddenIp() == null ? oldProxyIp : msg.getConsoleProxyOverriddenIp();
                         newProxyIpv4 = msg.getConsoleProxyOverriddenIpv4() == null ? oldProxyIpv4 : msg.getConsoleProxyOverriddenIpv4();
                         newProxyIpv6 = msg.getConsoleProxyOverriddenIpv6() == null ? oldProxyIpv6 : msg.getConsoleProxyOverriddenIpv6();
-                        vo.setConsoleProxyOverriddenIp(msg.getConsoleProxyOverriddenIp());
+                        vo.setConsoleProxyOverriddenIp(newProxyIp);
                         vo.setConsoleProxyOverriddenIpv4(newProxyIpv4);
                         vo.setConsoleProxyOverriddenIpv6(newProxyIpv6);
                         vo.setConsoleProxyPort(newProxyPort);
@@ -567,11 +569,11 @@ public void rollback(FlowRollback trigger, Map data) {
                     String __name__ = "update-platform-global-properties";
                     @Override
                     public void run(FlowTrigger trigger, Map data) {
-                        Platform.getGlobalProperties().put("consoleProxyOverriddenIp", msg.getConsoleProxyOverriddenIp());
+                        Platform.getGlobalProperties().put("consoleProxyOverriddenIp", formatConsoleProxyConfigureValue(newProxyIp));
                         Platform.getGlobalProperties().put("consoleProxyOverriddenIpv4", formatConsoleProxyConfigureValue(newProxyIpv4));
                         Platform.getGlobalProperties().put("consoleProxyOverriddenIpv6", formatConsoleProxyConfigureValue(newProxyIpv6));
                         Platform.getGlobalProperties().put("consoleProxyPort", Integer.toString(newProxyPort));
-                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP = msg.getConsoleProxyOverriddenIp();
+                        CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP = newProxyIp;
                         CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4 = newProxyIpv4;
                         CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6 = newProxyIpv6;
                         CoreGlobalProperty.CONSOLE_PROXY_PORT = newProxyPort;
@@ -596,7 +598,7 @@ public void rollback(FlowRollback trigger, Map data) {
                     String __name__ = "zstack-ctl-configure-consoleProxyOverriddenIp";
                     @Override
                     public void run(FlowTrigger trigger, Map data) {
-                        int rst = setConsoleProxyOverridenIp(msg.getConsoleProxyOverriddenIp());
+                        int rst = setConsoleProxyOverridenIp(newProxyIp);
                         int ipv4Rst = setConsoleProxyOverridenIpv4(newProxyIpv4);
                         int ipv6Rst = setConsoleProxyOverridenIpv6(newProxyIpv6);
                         int portRst = setConsoleProxyPort(newProxyPort);
diff --git a/core/src/main/java/org/zstack/core/Platform.java b/core/src/main/java/org/zstack/core/Platform.java
index 8b23739a901..67bdbb40a34 100755
--- a/core/src/main/java/org/zstack/core/Platform.java
+++ b/core/src/main/java/org/zstack/core/Platform.java
@@ -92,7 +92,8 @@ public class Platform {
     private static final String IPV4_ADDRESS_COMMAND = "ip -4 add";
     private static final String IPV6_ADDRESS_COMMAND = "ip -6 addr";
     private static final String DEFAULT_ROUTE_COMMAND = "/sbin/ip route";
-    private static final String DEFAULT_ROUTE_MARK = "default via";
+    private static final String DEFAULT_IPV6_ROUTE_COMMAND = "/sbin/ip -6 route";
+    private static final String DEFAULT_ROUTE_MARK = "default";
     private static final String JGROUPS_INITIAL_HOST_FORMAT = "%s[%s],%s[%s]";
     private static final int IP_ADDRESS_COMMAND_CIDR_INDEX = 1;
     private static final int IP_ADDRESS_COMMAND_MIN_TOKEN_COUNT = 2;
@@ -1001,13 +1002,18 @@ private static void saveManagementServerId(File propertiesFile, Properties prope
         File tmp = new File(propertiesFile.getAbsolutePath() + TEMP_FILE_SUFFIX);
         try (FileOutputStream outputStream = new FileOutputStream(tmp)) {
             properties.store(outputStream, "ZStack properties");
+        } catch (IOException e) {
+            throw new CloudRuntimeException(e);
+        }
+
+        try {
+            Files.move(tmp.toPath(), propertiesFile.toPath(), StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException e) {
             try {
-                Files.move(tmp.toPath(), propertiesFile.toPath(), StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE);
-            } catch (IOException e) {
                 Files.move(tmp.toPath(), propertiesFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
+            } catch (IOException ex) {
+                throw new CloudRuntimeException(ex);
             }
-        } catch (IOException e) {
-            throw new CloudRuntimeException(e);
         } finally {
             if (tmp.exists()) {
                 tmp.delete();
@@ -1171,28 +1177,20 @@ private static String getManagementServerIpInternal() {
             return normalizeManagementIp(ip);
         }
 
-        Linux.ShellResult ret = Linux.shell(DEFAULT_ROUTE_COMMAND);
-        String defaultLine = null;
-        for (String s : ret.getStdout().split("\n")) {
-            if (s.contains(DEFAULT_ROUTE_MARK)) {
-                defaultLine = s;
-                break;
-            }
+        String routeCommand = DEFAULT_ROUTE_COMMAND;
+        String defaultLine = findDefaultRouteLine(routeCommand);
+        if (defaultLine == null) {
+            routeCommand = DEFAULT_IPV6_ROUTE_COMMAND;
+            defaultLine = findDefaultRouteLine(routeCommand);
         }
 
-        String err = "cannot get management server ip of this machine. there are three ways to get the ip.\n1) search for 'management.server.ip' java property\n2) search for 'ZSTACK_MANAGEMENT_SERVER_IP' environment variable\n3) search for default route printed out by '/sbin/ip route'\nhowever, all above methods failed";
+        String err = "cannot get management server ip of this machine. there are three ways to get the ip.\n1) search for 'management.server.ip' java property\n2) search for 'ZSTACK_MANAGEMENT_SERVER_IP' environment variable\n3) search for default route printed out by '/sbin/ip route' or '/sbin/ip -6 route'\nhowever, all above methods failed";
         if (defaultLine == null) {
             throw new CloudRuntimeException(err);
         }
 
         try {
-            Enumeration<NetworkInterface> nets = NetworkInterface.getNetworkInterfaces();
-            for (NetworkInterface iface : Collections.list(nets)) {
-                String name = iface.getName();
-                if (defaultLine.contains(name)) {
-                    ip = selectManagementServerIp(Collections.list(iface.getInetAddresses()));
-                }
-            }
+            ip = selectManagementServerIpFromDefaultRoute(defaultLine);
         } catch (SocketException e) {
             throw new CloudRuntimeException(e);
         }
@@ -1201,10 +1199,40 @@ private static String getManagementServerIpInternal() {
             throw new CloudRuntimeException(err);
         }
 
-        logger.info(String.format("get management IP[%s] from default route[/sbin/ip route]", ip));
+        logger.info(String.format("get management IP[%s] from default route[%s]", ip, routeCommand));
         return ip;
     }
 
+    private static String findDefaultRouteLine(String routeCommand) {
+        Linux.ShellResult ret = Linux.shell(routeCommand);
+        for (String s : ret.getStdout().split("\n")) {
+            String line = s.trim();
+            if (line.equals(DEFAULT_ROUTE_MARK) || line.startsWith(DEFAULT_ROUTE_MARK + " ")) {
+                return line;
+            }
+        }
+
+        return null;
+    }
+
+    private static String selectManagementServerIpFromDefaultRoute(String defaultLine) throws SocketException {
+        String[] tokens = defaultLine.split("\\s+");
+        String deviceName = null;
+        for (int i = 0; i < tokens.length - 1; i++) {
+            if ("dev".equals(tokens[i])) {
+                deviceName = tokens[i + 1];
+                break;
+            }
+        }
+
+        if (deviceName == null) {
+            return null;
+        }
+
+        NetworkInterface iface = NetworkInterface.getByName(deviceName);
+        return iface == null ? null : selectManagementServerIp(Collections.list(iface.getInetAddresses()));
+    }
+
     public static String getManagementServerIp6() {
         String ip = getManagementServerSecondaryIpProperty(MANAGEMENT_SERVER_IP6_PROPERTY, IPv6Constants.IPv6);
         if (ip != null) {
diff --git a/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java b/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java
index 166e7323918..5d713331fcf 100755
--- a/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java
+++ b/core/src/main/java/org/zstack/core/cloudbus/CloudBusImpl3.java
@@ -142,7 +142,7 @@ public class CloudBusImpl3 implements CloudBus, CloudBusIN {
 
     public static final String HTTP_BASE_URL = "/cloudbus";
     private static final String HTTP_URL_FORMAT = "http://%s:%s%s";
-    private static final String HTTP_CONTEXT_URL_FORMAT = "http://%s:%s/%s/%s";
+    private static final String HTTP_CONTEXT_URL_FORMAT = "http://%s:%s/%s%s";
     public static final FutureCompletion SEND_CONFIRMED = new FutureCompletion(null);
 
     public static String buildCloudBusUrl(String ip, int port, String contextPath) {
diff --git a/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java b/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java
index 381e1b5617a..a3cb04cf170 100755
--- a/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java
+++ b/header/src/main/java/org/zstack/header/console/APIUpdateConsoleProxyAgentMsg.java
@@ -16,7 +16,7 @@
 public class APIUpdateConsoleProxyAgentMsg extends APIMessage implements ConsoleProxyAgentMessage {
     @APIParam(resourceType = ConsoleProxyAgentVO.class)
     private String uuid;
-    @APIParam
+    @APIParam(required = false)
     private String consoleProxyOverriddenIp;
     @APIParam(required = false)
     private String consoleProxyOverriddenIpv4;
diff --git a/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java b/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java
index 00b89db714a..87ad1b78cbf 100755
--- a/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java
+++ b/plugin/ceph/src/main/java/org/zstack/storage/ceph/MonUri.java
@@ -5,6 +5,7 @@
 import org.zstack.header.errorcode.ErrorCode;
 import org.zstack.header.errorcode.OperationFailureException;
 import org.zstack.header.exception.CloudRuntimeException;
+import org.zstack.utils.network.IPv6NetworkUtils;
 
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -92,7 +93,7 @@ public MonUri(String url) {
                                 " in format of %s", url, MON_URL_FORMAT)
                 );
             }
-            hostname = stripIpv6Brackets(hostname);
+            hostname = normalizeHostname(hostname);
 
             sshPort = uri.getPort() == -1 ? sshPort : uri.getPort();
             if (sshPort < 1 || sshPort > 65535) {
@@ -115,6 +116,11 @@ private static String stripIpv6Brackets(String host) {
         return host;
     }
 
+    private static String normalizeHostname(String host) {
+        host = stripIpv6Brackets(host);
+        return IPv6NetworkUtils.isIpv6Address(host) ? IPv6NetworkUtils.normalizeIpv6(host) : host;
+    }
+
     public int getSshPort() {
         return sshPort;
     }
diff --git a/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy b/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
index cb28680ca6e..35c3e25d0ec 100644
--- a/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/console/ConsoleProxyCase.groovy
@@ -226,87 +226,107 @@ class ConsoleProxyCase extends SubCase {
         }
 
         ConsoleProxyAgentVO agent = dbf.listAll(ConsoleProxyAgentVO)[0]
+        String oldOverriddenIp = CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP
+        String oldOverriddenIpv4 = CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4
+        String oldOverriddenIpv6 = CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6
+        Integer oldConsoleProxyPort = CoreGlobalProperty.CONSOLE_PROXY_PORT
 
-        updateConsoleProxyAgent {
-            uuid = agent.uuid
-            consoleProxyOverriddenIp = "127.0.0.2"
-            consoleProxyOverriddenIpv4 = "127.0.0.3"
-            consoleProxyOverriddenIpv6 = "[2001:db8::200]"
-        }
-        agent = dbf.reload(agent)
-        assert agent.consoleProxyOverriddenIp == "127.0.0.2"
-        assert agent.consoleProxyOverriddenIpv4 == "127.0.0.3"
-        assert agent.consoleProxyOverriddenIpv6 == "2001:db8::200"
-        
-        updateConsoleProxyAgent {
-            uuid = agent.uuid
-            consoleProxyOverriddenIp = "127.0.0.1"
-            consoleProxyPort = 4789
-        }
+        try {
+            updateConsoleProxyAgent {
+                uuid = agent.uuid
+                consoleProxyOverriddenIp = "127.0.0.2"
+                consoleProxyOverriddenIpv4 = "127.0.0.3"
+                consoleProxyOverriddenIpv6 = "[2001:db8::200]"
+            }
+            agent = dbf.reload(agent)
+            assert agent.consoleProxyOverriddenIp == "127.0.0.2"
+            assert agent.consoleProxyOverriddenIpv4 == "127.0.0.3"
+            assert agent.consoleProxyOverriddenIpv6 == "2001:db8::200"
 
-        assert Platform.getGlobalProperties().get("consoleProxyPort") == '4789'
-        assert CoreGlobalProperty.CONSOLE_PROXY_PORT == 4789
-        agent = dbf.reload(agent)
-        assert agent.consoleProxyPort == 4789
+            updateConsoleProxyAgent {
+                uuid = agent.uuid
+                consoleProxyPort = 4789
+            }
 
-        // update console proxy agent
-        updateConsoleProxyAgent {
-            uuid = agent.uuid
-            consoleProxyOverriddenIp = "127.0.0.1"
-            consoleProxyPort = 4900
-        }
+            assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == '127.0.0.2'
+            assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == '127.0.0.2'
+            assert Platform.getGlobalProperties().get("consoleProxyPort") == '4789'
+            assert CoreGlobalProperty.CONSOLE_PROXY_PORT == 4789
+            agent = dbf.reload(agent)
+            assert agent.consoleProxyOverriddenIp == "127.0.0.2"
+            assert agent.consoleProxyPort == 4789
 
-        assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == '127.0.0.1'
-        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == '127.0.0.1'
-        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4 == '127.0.0.3'
-        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6 == '2001:db8::200'
-        //When the console port is 0 (empty), the default CoreGlobalProperty port 4900 is set
-        assert Platform.getGlobalProperties().get("consoleProxyPort") == '4900'
-        assert CoreGlobalProperty.CONSOLE_PROXY_PORT == 4900
-        agent = dbf.reload(agent)
-        assert agent.consoleProxyOverriddenIp == "127.0.0.1"
-        assert agent.consoleProxyPort == 4900
-
-        String ipv6ConsoleProxyIp = "2001:db8::100"
-        updateConsoleProxyAgent {
-            uuid = agent.uuid
-            consoleProxyOverriddenIp = ipv6ConsoleProxyIp
-            consoleProxyPort = 4900
-        }
+            // update console proxy agent
+            updateConsoleProxyAgent {
+                uuid = agent.uuid
+                consoleProxyOverriddenIp = "127.0.0.1"
+                consoleProxyOverriddenIpv4 = " "
+                consoleProxyOverriddenIpv6 = ""
+                consoleProxyPort = 4900
+            }
 
-        agent = dbf.reload(agent)
-        assert agent.consoleProxyOverriddenIp == ipv6ConsoleProxyIp
-        assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == ipv6ConsoleProxyIp
-        assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == ipv6ConsoleProxyIp
-
-        List<ConsoleProxyAgentInventory> agents = queryConsoleProxyAgent {
-            conditions = ["uuid=${agent.uuid}".toString()]
-        } as List<ConsoleProxyAgentInventory>
-        assert agents[0].consoleProxyOverriddenIp == ipv6ConsoleProxyIp
-        assert agents[0].consoleProxyOverriddenIpv4 == "127.0.0.3"
-        assert agents[0].consoleProxyOverriddenIpv6 == "2001:db8::200"
-        def selectConsoleProxyHostname = ConsoleManagerImpl.class.getDeclaredMethod("selectConsoleProxyHostname", String.class, Boolean.TYPE, String.class)
-        selectConsoleProxyHostname.accessible = true
-        assert selectConsoleProxyHostname.invoke(null, ipv6ConsoleProxyIp, false, "127.0.0.1") == "[${ipv6ConsoleProxyIp}]"
+            assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == '127.0.0.1'
+            assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == '127.0.0.1'
+            assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV4 == '127.0.0.3'
+            assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IPV6 == '2001:db8::200'
+            //When the console port is 0 (empty), the default CoreGlobalProperty port 4900 is set
+            assert Platform.getGlobalProperties().get("consoleProxyPort") == '4900'
+            assert CoreGlobalProperty.CONSOLE_PROXY_PORT == 4900
+            agent = dbf.reload(agent)
+            assert agent.consoleProxyOverriddenIp == "127.0.0.1"
+            assert agent.consoleProxyOverriddenIpv4 == "127.0.0.3"
+            assert agent.consoleProxyOverriddenIpv6 == "2001:db8::200"
+            assert agent.consoleProxyPort == 4900
+
+            String ipv6ConsoleProxyIp = "2001:db8::100"
+            updateConsoleProxyAgent {
+                uuid = agent.uuid
+                consoleProxyOverriddenIp = ipv6ConsoleProxyIp
+                consoleProxyPort = 4900
+            }
 
-        updateConsoleProxyAgent {
-            uuid = agent.uuid
-            consoleProxyOverriddenIp = "127.0.0.1"
-            consoleProxyPort = 4900
-        }
+            agent = dbf.reload(agent)
+            assert agent.consoleProxyOverriddenIp == ipv6ConsoleProxyIp
+            assert Platform.getGlobalProperties().get("consoleProxyOverriddenIp") == ipv6ConsoleProxyIp
+            assert CoreGlobalProperty.CONSOLE_PROXY_OVERRIDDEN_IP == ipv6ConsoleProxyIp
+
+            List<ConsoleProxyAgentInventory> agents = queryConsoleProxyAgent {
+                conditions = ["uuid=${agent.uuid}".toString()]
+            } as List<ConsoleProxyAgentInventory>
+            assert agents[0].consoleProxyOverriddenIp == ipv6ConsoleProxyIp
+            assert agents[0].consoleProxyOverriddenIpv4 == "127.0.0.3"
+            assert agents[0].consoleProxyOverriddenIpv6 == "2001:db8::200"
+            def selectConsoleProxyHostname = ConsoleManagerImpl.class.getDeclaredMethod("selectConsoleProxyHostname", String.class, Boolean.TYPE, String.class)
+            selectConsoleProxyHostname.accessible = true
+            assert selectConsoleProxyHostname.invoke(null, ipv6ConsoleProxyIp, false, "127.0.0.1") == "[${ipv6ConsoleProxyIp}]"
 
-        // update console proxy agent by none admin account
-        SessionInventory testAccountSession = logInByAccount {
-            accountName = "test"
-            password = "password"
-        } as SessionInventory
-        expect(AssertionError) {
             updateConsoleProxyAgent {
-                sessionId = testAccountSession.uuid
                 uuid = agent.uuid
                 consoleProxyOverriddenIp = "127.0.0.1"
                 consoleProxyPort = 4900
             }
+
+            // update console proxy agent by none admin account
+            SessionInventory testAccountSession = logInByAccount {
+                accountName = "test"
+                password = "password"
+            } as SessionInventory
+            expect(AssertionError) {
+                updateConsoleProxyAgent {
+                    sessionId = testAccountSession.uuid
+                    uuid = agent.uuid
+                    consoleProxyOverriddenIp = "127.0.0.1"
+                    consoleProxyPort = 4900
+                }
+            }
+        } finally {
+            updateConsoleProxyAgent {
+                uuid = agent.uuid
+                consoleProxyOverriddenIp = oldOverriddenIp
+                consoleProxyOverriddenIpv4 = oldOverriddenIpv4
+                consoleProxyOverriddenIpv6 = oldOverriddenIpv6
+                consoleProxyPort = oldConsoleProxyPort
+            }
         }
     }
 
diff --git a/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy
index 4fd971bedde..48cca16068a 100644
--- a/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/core/ManagementNetworkIpv6Case.groovy
@@ -196,6 +196,7 @@ class ManagementNetworkIpv6Case extends SubCase {
 
     void testCoreManagementUrlsIpv6() {
         assert CloudBusImpl3.buildCloudBusUrl(IPV6, REST_PORT, "") == "http://[2001:db8::1]:8080/cloudbus"
+        assert CloudBusImpl3.buildCloudBusUrl(IPV6, REST_PORT, "zstack") == "http://[2001:db8::1]:8080/zstack/cloudbus"
         assert AgentManagerImpl.buildAgentUrl(IPV6, REST_PORT, "/agent/echo") == "http://[2001:db8::1]:8080/agent/echo"
         assert AnsibleRunner.buildPipUrl(IPV6, REST_PORT) == "http://[2001:db8::1]:8080/zstack/static/pypi/simple"
     }
@@ -330,7 +331,12 @@ class ManagementNetworkIpv6Case extends SubCase {
     }
 
     void testManagementCidrIpVersionOverload() {
-        assert Platform.getManagementServerCidr(IPv6Constants.IPv4) == Platform.getManagementServerCidr(Platform.getManagementServerIp())
+        withManagementServerIpProperties([
+                "management.server.ip" : IPV4,
+                "management.server.ip4": IPV4,
+        ]) {
+            assert Platform.getManagementServerCidr(IPv6Constants.IPv4) == Platform.getManagementServerCidr(IPV4)
+        }
     }
 
     void testManagementServerIpsReadSecondaryProperties() {
@@ -575,6 +581,13 @@ class ManagementNetworkIpv6Case extends SubCase {
         String migrateCidrTag = "cluster::migrate::network::cidr::${VXLAN_IPV6_CIDR}"
         assert TagUtils.isMatch(migrateCidrFormat, migrateCidrTag)
         assert TagUtils.parseIfMatch(migrateCidrFormat, migrateCidrTag)["migrateCidr"] == VXLAN_IPV6_CIDR
+
+        assert TagUtils.parseIfMatch("{cidr}", VXLAN_IPV6_CIDR)["cidr"] == VXLAN_IPV6_CIDR
+
+        String middleCidrFormat = "foo::{cidr}::bar"
+        String middleCidrTag = "foo::${VXLAN_IPV6_CIDR}::bar"
+        assert TagUtils.isMatch(middleCidrFormat, middleCidrTag)
+        assert TagUtils.parseIfMatch(middleCidrFormat, middleCidrTag)["cidr"] == VXLAN_IPV6_CIDR
     }
 
     void testKvmExtraIpCidrSelection() {
diff --git a/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy b/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
index 24fa654fb20..3c3aba7d7b2 100644
--- a/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
+++ b/test/src/test/groovy/org/zstack/test/integration/kvm/host/KvmHostIpv6Case.groovy
@@ -4,7 +4,6 @@ import org.zstack.core.Platform
 import org.zstack.core.cloudbus.CloudBus
 import org.zstack.core.db.DatabaseFacade
 import org.zstack.core.db.Q
-import org.zstack.header.errorcode.SysErrors
 import org.zstack.header.host.ConnectHostMsg
 import org.zstack.header.host.ConnectHostReply
 import org.zstack.header.host.CpuArchitecture
@@ -21,6 +20,9 @@ import org.zstack.test.integration.kvm.KvmTest
 import org.zstack.testlib.EnvSpec
 import org.zstack.testlib.SubCase
 
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_HOST_10128
+import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.ORG_ZSTACK_COMPUTE_HOST_10129
+
 class KvmHostIpv6Case extends SubCase {
     EnvSpec env
     ClusterInventory cluster
@@ -115,7 +117,7 @@ class KvmHostIpv6Case extends SubCase {
         def res = action.call()
 
         assert res.error != null
-        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString()
+        assert res.error.code == ORG_ZSTACK_COMPUTE_HOST_10128
         assert Q.New(HostVO.class).count() == before
 
         action = new AddKVMHostAction()
@@ -129,7 +131,7 @@ class KvmHostIpv6Case extends SubCase {
         res = action.call()
 
         assert res.error != null
-        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString()
+        assert res.error.code == ORG_ZSTACK_COMPUTE_HOST_10129
         assert Q.New(HostVO.class).count() == before
 
         action = new AddKVMHostAction()
@@ -143,7 +145,7 @@ class KvmHostIpv6Case extends SubCase {
         res = action.call()
 
         assert res.error != null
-        assert res.error.code == SysErrors.INVALID_ARGUMENT_ERROR.toString()
+        assert res.error.code == ORG_ZSTACK_COMPUTE_HOST_10129
         assert Q.New(HostVO.class).count() == before
     }
 }
diff --git a/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy b/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy
index 341ddc984f3..fda8a2e1e75 100644
--- a/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy
+++ b/test/src/test/groovy/org/zstack/test/unittest/utils/NetworkUtilsCase.groovy
@@ -63,5 +63,8 @@ class NetworkUtilsCase {
         assert uri.hostname == "fd00:172:24::10"
         assert uri.sshPort == 2222
         assert uri.monPort == 6789
+
+        uri = new MonUri("root:password@[fd00:172:24:0:0:0:0:10]:2222/?monPort=6789")
+        assert uri.hostname == "fd00:172:24::10"
     }
 }
diff --git a/utils/src/main/java/org/zstack/utils/TagUtils.java b/utils/src/main/java/org/zstack/utils/TagUtils.java
index 33e41aab68f..8e27ab15d87 100755
--- a/utils/src/main/java/org/zstack/utils/TagUtils.java
+++ b/utils/src/main/java/org/zstack/utils/TagUtils.java
@@ -46,7 +46,7 @@ public static boolean isMatch(String fmt, String tag) {
         List<String> t = new ArrayList<String>();
         t.addAll(splitTagFields(fmt));
 
-        if (fmt.indexOf(TAG_DELIMITER) == -1) {
+        if (fmt.indexOf(TAG_DELIMITER) == -1 && !isTokenField(fmt)) {
             return fmt.equals(tag);
         }
 
@@ -84,7 +84,7 @@ private static List<String> splitTagFieldsByFormat(List<String> fmtFields, Strin
                     continue;
                 }
 
-                int end = indexOfDelimiterOutsideToken(tag, offset);
+                int end = findTokenEnd(fmtFields, tag, offset, i + 1);
                 if (end < 0) {
                     return null;
                 }
@@ -145,22 +145,13 @@ private static List<String> splitTagFields(String tag) {
         return fields;
     }
 
-    private static int indexOfDelimiterOutsideToken(String tag, int offset) {
-        int braceDepth = 0;
-        for (int i = offset; i < tag.length(); i++) {
-            char current = tag.charAt(i);
-            if (current == TOKEN_START) {
-                braceDepth++;
-            } else if (current == TOKEN_END && braceDepth > 0) {
-                braceDepth--;
-            }
-
-            if (braceDepth == 0 && tag.startsWith(TAG_DELIMITER, i)) {
-                return i;
-            }
+    private static int findTokenEnd(List<String> fmtFields, String tag, int offset, int nextFieldIndex) {
+        String nextField = fmtFields.get(nextFieldIndex);
+        if (isTokenField(nextField)) {
+            return tag.indexOf(TAG_DELIMITER, offset);
         }
 
-        return -1;
+        return tag.indexOf(TAG_DELIMITER + nextField, offset);
     }
 
     public static Map<String, String> parseIfMatch(String fmt, String tag) {
diff --git a/utils/src/main/java/org/zstack/utils/ssh/SshShell.java b/utils/src/main/java/org/zstack/utils/ssh/SshShell.java
index 5a9196a46c0..46909b7681f 100755
--- a/utils/src/main/java/org/zstack/utils/ssh/SshShell.java
+++ b/utils/src/main/java/org/zstack/utils/ssh/SshShell.java
@@ -101,7 +101,7 @@ private SshResult runCommand(String cmd, boolean allocatePseudoTty) {
         } catch (Exception e) {
             throw new RuntimeException(e);
         } finally {
-            if (tempPasswordFile != null && tempPasswordFile.delete()) {
+            if (tempPasswordFile != null && tempPasswordFile.exists() && !tempPasswordFile.delete()) {
                 logger.warn(String.format("failed to delete file[%s]", tempPasswordFile));
             }
         }
@@ -163,7 +163,7 @@ public SshResult runScript(String script) {
         } catch (Exception e) {
             throw new RuntimeException(e);
         } finally {
-            if (tempPasswordFile != null && tempPasswordFile.delete()) {
+            if (tempPasswordFile != null && tempPasswordFile.exists() && !tempPasswordFile.delete()) {
                 logger.warn(String.format("failed to delete file[%s]", tempPasswordFile));
             }
         }

From 18cb4e9564bfd457e0be1352c5c600cd0321a173 Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin.ruan@zstack.io>
Date: Mon, 29 Jun 2026 21:59:45 +0800
Subject: [PATCH 6/7] <fix>[mgt-ipv6]: handle remaining review issues

Fail closed when an existing management node with the same UUID on another host has not written heartbeat yet, and route backup storage endpoint checks through the common management network IP version validator instead of skipping unknown endpoint forms early.

Test: git diff --check

Test: mvn -pl portal,storage,plugin/sftpBackupStorage -am -DskipTests compile

Resolves: ZSTAC-79206

Change-Id: I17adec0ecec492db8fd2ce0c3c22d51c8b394cd7
---
 .../portal/managementnode/ManagementNodeManagerImpl.java     | 5 ++++-
 .../storage/ManagementNetworkIpVersionStorageExtension.java  | 5 -----
 .../zstack/storage/backup/BackupStorageApiInterceptor.java   | 5 -----
 3 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java b/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java
index 40c5cc0cce5..41d90a3675c 100755
--- a/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java
+++ b/portal/src/main/java/org/zstack/portal/managementnode/ManagementNodeManagerImpl.java
@@ -734,9 +734,12 @@ public void destroy() {
     }
 
     private boolean isDuplicatedActiveManagementServerId(ManagementNodeVO existing, String currentHostName, Timestamp currentTime) {
-        if (existing == null || StringUtils.equals(existing.getHostName(), currentHostName) || existing.getHeartBeat() == null) {
+        if (existing == null || StringUtils.equals(existing.getHostName(), currentHostName)) {
             return false;
         }
+        if (existing.getHeartBeat() == null) {
+            return true;
+        }
 
         long heartbeatExpirationMillis = TimeUnit.SECONDS.toMillis(
                 (long) (PortalGlobalProperty.MAX_HEARTBEAT_FAILURE + 1)
diff --git a/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java b/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java
index b0955407a2d..d73fbcb96c0 100644
--- a/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java
+++ b/storage/src/main/java/org/zstack/storage/ManagementNetworkIpVersionStorageExtension.java
@@ -11,7 +11,6 @@
 import org.zstack.header.storage.primary.PrimaryStorageConstants;
 import org.zstack.header.zone.ManagementNetworkIpVersionManager;
 import org.zstack.header.zone.ManagementNetworkIpVersionResourceExtensionPoint;
-import org.zstack.utils.network.ManagementNetworkIpVersionUtils;
 
 import java.util.List;
 
@@ -57,10 +56,6 @@ private void validateBackupStorages(String zoneUuid, String ipVersion) {
                 .list();
 
         for (BackupStorageVO bs : backupStorages) {
-            if (ManagementNetworkIpVersionUtils.getEndpointIpVersion(bs.getUrl()) == null) {
-                continue;
-            }
-
             managementNetworkIpVersionManager.validateEndpointMatchesIpVersion(zoneUuid, ipVersion, bs.getUrl(),
                     BACKUP_STORAGE_RESOURCE_TYPE, bs.getUuid(), ORG_ZSTACK_STORAGE_BACKUP_10135);
         }
diff --git a/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java b/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java
index 12e7559002f..14c297722ad 100755
--- a/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java
+++ b/storage/src/main/java/org/zstack/storage/backup/BackupStorageApiInterceptor.java
@@ -12,7 +12,6 @@
 import org.zstack.header.message.APIMessage;
 import org.zstack.header.storage.backup.*;
 import org.zstack.header.zone.ManagementNetworkIpVersionManager;
-import org.zstack.utils.network.ManagementNetworkIpVersionUtils;
 
 import java.util.List;
 
@@ -135,10 +134,6 @@ private void validate(APIAttachBackupStorageToZoneMsg msg) {
         }
 
         BackupStorageVO vo = dbf.findByUuid(msg.getBackupStorageUuid(), BackupStorageVO.class);
-        if (ManagementNetworkIpVersionUtils.getEndpointIpVersion(vo.getUrl()) == null) {
-            return;
-        }
-
         managementNetworkIpVersionManager.validateEndpointInZone(msg.getZoneUuid(), vo.getUrl(),
                 BACKUP_STORAGE_RESOURCE_TYPE, msg.getBackupStorageUuid(), ORG_ZSTACK_STORAGE_BACKUP_10134);
     }

From 5e1004b8c0e4bef700770e63c4c3124a03228489 Mon Sep 17 00:00:00 2001
From: "shixin.ruan" <shixin.ruan@zstack.io>
Date: Mon, 29 Jun 2026 22:02:29 +0800
Subject: [PATCH 7/7] <fix>[mgt-ipv6]: serialize system l3 ip range creation

Serialize add IP range on the L3 task chain and recheck management network IP version immediately before creating the range, so concurrent IPv4/IPv6 additions on the same system L3 cannot both pass the API interceptor check.

Test: git diff --check

Test: mvn -pl network -am -DskipTests compile

Resolves: ZSTAC-79206

Change-Id: I9bbd5724d2a8e877e443a0add7b7c939c6a10598
---
 .../org/zstack/network/l3/L3BasicNetwork.java |  52 +++++
 .../sdk/UpdateConsoleProxyAgentAction.java    |   2 +-
 .../java/org/zstack/testlib/ApiHelper.groovy  | 195 ++++++++++++------
 3 files changed, 180 insertions(+), 69 deletions(-)

diff --git a/network/src/main/java/org/zstack/network/l3/L3BasicNetwork.java b/network/src/main/java/org/zstack/network/l3/L3BasicNetwork.java
index 43849b41e34..ae0258de955 100755
--- a/network/src/main/java/org/zstack/network/l3/L3BasicNetwork.java
+++ b/network/src/main/java/org/zstack/network/l3/L3BasicNetwork.java
@@ -64,6 +64,7 @@
 import java.util.*;
 import java.util.stream.Collectors;
 
+import static org.zstack.core.Platform.argerr;
 import static org.zstack.core.Platform.err;
 import static org.zstack.utils.CollectionDSL.*;
 import static org.zstack.utils.clouderrorcode.CloudOperationsErrorCode.*;
@@ -159,8 +160,34 @@ private void setIpRangeSharedResource(String L3NetworkUuid, String IpRangeUuid)
     }
 
     private void handle(APIAddIpRangeMsg msg) {
+        thdf.chainSubmit(new ChainTask(msg) {
+            @Override
+            public void run(SyncTaskChain chain) {
+                doAddIpRange(msg, chain);
+            }
+
+            @Override
+            public String getSyncSignature() {
+                return syncThreadName;
+            }
+
+            @Override
+            public String getName() {
+                return "add-ip-range";
+            }
+        });
+    }
+
+    private void doAddIpRange(APIAddIpRangeMsg msg, SyncTaskChain chain) {
         IpRangeInventory ipr = IpRangeInventory.fromMessage(msg);
         APIAddIpRangeEvent evt = new APIAddIpRangeEvent(msg.getId());
+        ErrorCode errorCode = validateManagementNetworkIpRangeVersionBeforeCreate(ipr);
+        if (errorCode != null) {
+            evt.setError(errorCode);
+            bus.publish(evt);
+            chain.next();
+            return;
+        }
 
         IpRangeFactory factory = l3NwMgr.getIpRangeFactory(ipr.getIpRangeType());
         factory.createIpRange(Collections.singletonList(ipr), msg, new ReturnValueCompletion<List<IpRangeInventory>>(msg) {
@@ -171,16 +198,41 @@ public void success(List<IpRangeInventory> invs) {
                 setIpRangeSharedResource(msg.getL3NetworkUuid(), inv.getUuid());
                 evt.setInventory(inv);
                 bus.publish(evt);
+                chain.next();
             }
 
             @Override
             public void fail(ErrorCode errorCode) {
                 evt.setError(errorCode);
                 bus.publish(evt);
+                chain.next();
             }
         });
     }
 
+    private ErrorCode validateManagementNetworkIpRangeVersionBeforeCreate(IpRangeInventory ipr) {
+        if (self.getCategory() != L3NetworkCategory.System) {
+            return null;
+        }
+
+        int existingIpVersion = ipr.getIpVersion() == IPv6Constants.IPv4 ? IPv6Constants.IPv6 : IPv6Constants.IPv4;
+        boolean hasExistingIpRange = Q.New(IpRangeVO.class)
+                .eq(IpRangeVO_.l3NetworkUuid, self.getUuid())
+                .eq(IpRangeVO_.ipVersion, existingIpVersion)
+                .isExists();
+        if (!hasExistingIpRange) {
+            return null;
+        }
+
+        return argerr(ORG_ZSTACK_NETWORK_L3_10082,
+                "management network l3[uuid:%s] cannot mix IPv4 and IPv6 IP ranges; existing IP version is %s, new IP version is %s",
+                self.getUuid(), getIpVersionName(existingIpVersion), getIpVersionName(ipr.getIpVersion()));
+    }
+
+    private String getIpVersionName(int ipVersion) {
+        return ipVersion == IPv6Constants.IPv6 ? "IPv6" : "IPv4";
+    }
+
     private void handleLocalMessage(Message msg) {
         if (msg instanceof AllocateIpMsg) {
             handle((AllocateIpMsg)msg);
diff --git a/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java b/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java
index daab7e19276..83c6449ebac 100644
--- a/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java
+++ b/sdk/src/main/java/org/zstack/sdk/UpdateConsoleProxyAgentAction.java
@@ -28,7 +28,7 @@ public Result throwExceptionIfError() {
     @Param(required = true, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String uuid;
 
-    @Param(required = true, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
+    @Param(required = false, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
     public java.lang.String consoleProxyOverriddenIp;
 
     @Param(required = false, nonempty = false, nullElements = false, emptyString = true, noTrim = false)
diff --git a/testlib/src/main/java/org/zstack/testlib/ApiHelper.groovy b/testlib/src/main/java/org/zstack/testlib/ApiHelper.groovy
index e67c077d98a..170fe18cd98 100644
--- a/testlib/src/main/java/org/zstack/testlib/ApiHelper.groovy
+++ b/testlib/src/main/java/org/zstack/testlib/ApiHelper.groovy
@@ -21,20 +21,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -3695,20 +3695,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -5747,19 +5747,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -9823,20 +9824,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -15034,20 +15035,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -19948,19 +19949,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -20136,19 +20138,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -20264,26 +20267,26 @@ abstract class ApiHelper {
     }
 
 
-    def extendHostCacheStore(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExtendHostCacheStoreAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExtendHostCacheStoreAction()
+    def exportBuildApp(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportBuildAppAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExportBuildAppAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -20291,8 +20294,8 @@ abstract class ApiHelper {
     }
 
 
-    def exportBuildApp(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportBuildAppAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExportBuildAppAction()
+    def exportImageFromBackupStorage(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportImageFromBackupStorageAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExportImageFromBackupStorageAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20318,8 +20321,8 @@ abstract class ApiHelper {
     }
 
 
-    def exportImageFromBackupStorage(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportImageFromBackupStorageAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExportImageFromBackupStorageAction()
+    def exportNbdVolumes(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportNbdVolumesAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExportNbdVolumesAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20345,8 +20348,8 @@ abstract class ApiHelper {
     }
 
 
-    def exportNbdVolumes(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportNbdVolumesAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExportNbdVolumesAction()
+    def exportVmOvaPackage(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportVmOvaPackageAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExportVmOvaPackageAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20372,8 +20375,8 @@ abstract class ApiHelper {
     }
 
 
-    def exportVmOvaPackage(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExportVmOvaPackageAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExportVmOvaPackageAction()
+    def expungeBaremetalInstance(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeBaremetalInstanceAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExpungeBaremetalInstanceAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20399,8 +20402,8 @@ abstract class ApiHelper {
     }
 
 
-    def expungeBaremetalInstance(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeBaremetalInstanceAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExpungeBaremetalInstanceAction()
+    def expungeDataVolume(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeDataVolumeAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExpungeDataVolumeAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20426,8 +20429,8 @@ abstract class ApiHelper {
     }
 
 
-    def expungeDataVolume(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeDataVolumeAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExpungeDataVolumeAction()
+    def expungeImage(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeImageAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExpungeImageAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20453,8 +20456,8 @@ abstract class ApiHelper {
     }
 
 
-    def expungeImage(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeImageAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExpungeImageAction()
+    def expungeImageGroup(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeImageGroupAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExpungeImageGroupAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20480,8 +20483,8 @@ abstract class ApiHelper {
     }
 
 
-    def expungeImageGroup(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeImageGroupAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExpungeImageGroupAction()
+    def expungeVmInstance(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeVmInstanceAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExpungeVmInstanceAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20507,8 +20510,8 @@ abstract class ApiHelper {
     }
 
 
-    def expungeVmInstance(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeVmInstanceAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExpungeVmInstanceAction()
+    def expungeVmUserDefinedXmlHookScript(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeVmUserDefinedXmlHookScriptAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExpungeVmUserDefinedXmlHookScriptAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -20534,8 +20537,8 @@ abstract class ApiHelper {
     }
 
 
-    def expungeVmUserDefinedXmlHookScript(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExpungeVmUserDefinedXmlHookScriptAction.class) Closure c) {
-        def a = new org.zstack.sdk.ExpungeVmUserDefinedXmlHookScriptAction()
+    def extendHostCacheStore(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.ExtendHostCacheStoreAction.class) Closure c) {
+        def a = new org.zstack.sdk.ExtendHostCacheStoreAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
@@ -21458,20 +21461,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -23884,24 +23887,24 @@ abstract class ApiHelper {
 
     def getLicenseAuthorizationInfo(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.GetLicenseAuthorizationInfoAction.class) Closure c) {
         def a = new org.zstack.sdk.GetLicenseAuthorizationInfoAction()
-
+        
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -23915,20 +23918,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -32208,7 +32211,7 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
         a.conditions = a.conditions.collect { it.toString() }
 
 
@@ -32216,14 +32219,14 @@ abstract class ApiHelper {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -35131,6 +35134,35 @@ abstract class ApiHelper {
     }
 
 
+    def queryResourceSourceRef(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.QueryResourceSourceRefAction.class) Closure c) {
+        def a = new org.zstack.sdk.QueryResourceSourceRefAction()
+        a.sessionId = Test.currentEnvSpec?.session?.uuid
+        c.resolveStrategy = Closure.OWNER_FIRST
+        c.delegate = a
+        c()
+        
+        a.conditions = a.conditions.collect { it.toString() }
+
+
+        if (System.getProperty("apipath") != null) {
+            if (a.apiId == null) {
+                a.apiId = Platform.uuid
+            }
+    
+            def tracker = new ApiPathTracker(a.apiId)
+            def out = errorOut(a.call())
+            def path = tracker.getApiPath()
+            if (!path.isEmpty()) {
+                Test.apiPaths[a.class.name] = path.join(" --->\n")
+            }
+        
+            return out
+        } else {
+            return errorOut(a.call())
+        }
+    }
+
+
     def queryResourceStack(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.QueryResourceStackAction.class) Closure c) {
         def a = new org.zstack.sdk.QueryResourceStackAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid
@@ -38042,20 +38074,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -42551,20 +42583,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -45791,20 +45823,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -48410,20 +48442,20 @@ abstract class ApiHelper {
         c.resolveStrategy = Closure.OWNER_FIRST
         c.delegate = a
         c()
-
+        
 
         if (System.getProperty("apipath") != null) {
             if (a.apiId == null) {
                 a.apiId = Platform.uuid
             }
-
+    
             def tracker = new ApiPathTracker(a.apiId)
             def out = errorOut(a.call())
             def path = tracker.getApiPath()
             if (!path.isEmpty()) {
                 Test.apiPaths[a.class.name] = path.join(" --->\n")
             }
-
+        
             return out
         } else {
             return errorOut(a.call())
@@ -50466,6 +50498,33 @@ abstract class ApiHelper {
     }
 
 
+    def configureIAM2ScimReceiver(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.iam2.api.ConfigureIAM2ScimReceiverAction.class) Closure c) {
+        def a = new org.zstack.sdk.iam2.api.ConfigureIAM2ScimReceiverAction()
+        a.sessionId = Test.currentEnvSpec?.session?.uuid
+        c.resolveStrategy = Closure.OWNER_FIRST
+        c.delegate = a
+        c()
+        
+
+        if (System.getProperty("apipath") != null) {
+            if (a.apiId == null) {
+                a.apiId = Platform.uuid
+            }
+    
+            def tracker = new ApiPathTracker(a.apiId)
+            def out = errorOut(a.call())
+            def path = tracker.getApiPath()
+            if (!path.isEmpty()) {
+                Test.apiPaths[a.class.name] = path.join(" --->\n")
+            }
+        
+            return out
+        } else {
+            return errorOut(a.call())
+        }
+    }
+
+
     def createIAM2Organization(@DelegatesTo(strategy = Closure.OWNER_FIRST, value = org.zstack.sdk.iam2.api.CreateIAM2OrganizationAction.class) Closure c) {
         def a = new org.zstack.sdk.iam2.api.CreateIAM2OrganizationAction()
         a.sessionId = Test.currentEnvSpec?.session?.uuid