By accident I had virtual guests running where the ip6 network definition was different than the one specified in the network xml file ... and it worked! Of course I did get an "extra" network address on the interface (due I assume to radvd) but it worked. Now, this is really an isolated network and I like this as a feature. For "regular" private or isolated virtual networks, the virtualization host can still get to any guest and any network ... except the ones where I had forgot to update the virtual network xml. comments? Gene