NAT64 – Choosing the Right Prefix

Alright, let's reply by parts

1) Private addresses

ipv6 has different "scopes" so you can have a local scope and a global scope, ipv6 is smart enough to know who's what and to regulate traffic accordingly so you can have a local non-routable network on ipv6 without any problem at all, actually it comes by default as that

2) Dump ipv4 and run only ipv6

All ipv6 implementations so far are dual stack so you can comfortably run both, and I would definitely recommend you to run both, there's no damage in doing that and ipv4 is not going away for a long time, although ipv6 is very cool completely dropping ipv4 is not something I would do.

3) Short questions

a) No technical disadvantages, on the contrary! Lots of cool stuff, automatic assignation of addresses, anycast, native ipsec, it's quite cool b) Firewalls should be good, but there's some specific firewall rules that you should pay attention to like allowing local-link scope traffic, allow multicast on ipv6 and disable processing of RH0 packets, also have in mind that icmpv6 is a completely new protocol and ipv6 is a lot more dependant on it than icmp on ipv4 so filtering it is not a good idea c) As far as I know most of linux services support ipv6 without any problem, dual stack ftw!

Also it's not bad to get yourself familiar with all the ipv6 new specs, have a look at http://en.wikipedia.org/wiki/IPv6 for starters

At layer 2, what you're looking for is network isolation between apartments - effectively each port on your switches should be able to communicate with the upstream router, but not directly with any other ports. This is exactly the case that private vlans were designed for. (Warning: The link is Cisco-tailored content but the general concept is applicable to ProCurve gear) Effectively, you put every access port in a single VLAN, and mark it as an isolated private VLAN. The upstream port is then marked as as a primary/promiscuous port, and you've established what you're looking for at layer 2.

This gets more complicated when you move up the stack, however. It sounds like you're considering using the access switches as layer 4 devices acting as the default router. I'm not familiar with the L3/L4 capabilities of these devices enough to speak towards how this will work, and more specifically how having the access switch act as a router will interact with the PVLAN implementation above. It'll probably be simpler to use the 5412 as the L4 router, and keep the 2910's as pure L2 devices for simplicity.