A method in an IPv6 gateway configured for providing connectivity between a prescribed site and a wide area network, the method comprising: advertising a first IPv6 address prefix only within the prescribed site, the first address prefix not advertised outside of the prescribed site; advertising to the prescribed site and the wide area network that a second IPv6 address prefix is reachable via the gateway; establishing a secure tunnel with a first IPv6 node (12a, 12b) within the prescribed site, based on the first IPv6 node having a unique in-site IPv6 address (16a, 16b) that includes the first IPv6 address prefix; creating a binding cache entry specifying that an extra-site IPv6 address (26a, 26b) associated with the first IPv6 node is reachable via the in-site IPv6 address of the IPv6 node, the extra-site IPv6 address including the second IPv6 address prefix; receiving from the first IPv6 node, via the secure tunnel, a first packet having a source address field specifying the in-site IPv6 address, a destination address field specifying an IPv6 address of the gateway, and an encapsulated second packet; forwarding the second packet to a destination node (12a, 12b) in response to the destination address field of the first packet specifying the IPv6 address of the gateway, the forwarding including: recovering the second packet from the first packet, the second packet having a source address field specifying the extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, and outputting the second packet, without the in-site IPv6 address of the IPv6 node, the outputting comprising: if it is determined that the IPv6 address of the destination node specifies the second IPv6 address prefix, accessing a second binding cache entry corresponding to the destination address, and outputting the second packet into the prescribed site via a second secure tunnel to the destination 3node in response to the second binding cache entry identifying that the destination node is within the prescribed site. advertising a first IPv6 address prefix only within the prescribed site, the first address prefix not advertised outside of the prescribed site; advertising to the prescribed site and the wide area network that a second IPv6 address prefix is reachable via the gateway; establishing a secure tunnel with a first IPv6 node (12a, 12b) within the prescribed site, based on the first IPv6 node having a unique in-site IPv6 address (16a, 16b) that includes the first IPv6 address prefix; creating a binding cache entry specifying that an extra-site IPv6 address (26a, 26b) associated with the first IPv6 node is reachable via the in-site IPv6 address of the IPv6 node, the extra-site IPv6 address including the second IPv6 address prefix; receiving from the first IPv6 node, via the secure tunnel, a first packet having a source address field specifying the in-site IPv6 address, a destination address field specifying an IPv6 address of the gateway, and an encapsulated second packet; forwarding the second packet to a destination node (12a, 12b) in response to the destination address field of the first packet specifying the IPv6 address of the gateway, the forwarding including: recovering the second packet from the first packet, the second packet having a source address field specifying the extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, and outputting the second packet, without the in-site IPv6 address of the IPv6 node, the outputting comprising: recovering the second packet from the first packet, the second packet having a source address field specifying the extra-site IPv6 address having the second IPv6 address prefix and a destination address field specifying an IPv6 address of the destination node, and outputting the second packet, without the in-site IPv6 address of the IPv6 node, the outputting comprising: if it is determined that the IPv6 address of the destination node specifies the second IPv6 address prefix, accessing a second binding cache entry corresponding to the destination address, and outputting the second packet into the prescribed site via a second secure tunnel to the destination 3node in response to the second binding cache entry identifying that the destination node is within the prescribed site.