IPv6 Deployment Planning

Transcription

1 IPv6 Deploymet Plaig ISP Workshops These materials are licesed uder the Creative Commos Attributio-NoCommercial 4.0 Iteratioal licese ( Last updated 8 th April

2 Ackowledgemets p This material origiated from the Cisco ISP/IXP Workshop Programme developed by Philip Smith & Barry Greee p Use of these materials is ecouraged as log as the source is fully ackowledged ad this otice remais i place p Bug fixes ad improvemets are welcomed Please workshop (at) bgp4all.com Philip Smith 2

3 Itroductio p Presetatio itroduces the high level plaig cosideratios which ay etwork operator eeds to be aware of prior to deployig IPv6 p Cotet applicable for: Busiess decisio makers Network maagers Network egieers p Will also require implemetatio detail 3

4 Ageda 1. Goals 2. Network Assessmet 3. Network Optimisatio 4. Procurig IPv6 Address Space 5. IPv6 Address pla 6. Deploymet 7. Seekig IPv6 Trasit 8. Customers 4

5 Goals What do we wat to achieve? 5

6 Goals p Ultimate aim is to provide IPv6 to our customers: Customers = ed users Customers = cotet providers p Strategy depeds o etwork trasport: Native IP backboe p Dual Stack is the solutio MPLS backboe (tuels) p 6PE or 6VPE is the solutio p The core ifrastructure will remai IPv4 oly 6

7 Native IP Backboe p Routers are the ifrastructure Customer coectios coect to the ative backboe VPN services provided usig GRE, IPSEC, IPiIP etc Providig IPv6 for customers meas upgradig the ative ifrastructure to dual-stack IPv4 IPv4 IPv4 IPv4 IPv4 IPv6 IPv6 IPv6 IPv6 IPv6 7

8 MPLS Backboe p Routers are the ifrastructure Public ad Private etwork access provided withi the MPLS cloud The core etwork does NOT eed to be IPv6 aware IPv6 access provided by 6PE or 6VPE Provider Edge routers eed dual stack capability IPv4 IPv6 PE IPv4 MPLS IPv4 MPLS IPv4 MPLS P P PE IPv4 IPv6 8

9 Network Assessmet What ca ru IPv6 today, ad what eeds to be upgraded? 9

10 Assessmet p First step i ay deploymet: Review existig etwork ifrastructure p Primarily routers across backboe Perhaps also critical servers ad services (but ot essetial as iitial focus is o routig ifrastructure) 10

11 Process p Aalyse each locatio/pop p Documet Router or ay other L3 device RAM (istalled ad used) No-Volatile Cofiguratio memory Software release versios Most etwork operators already keep track of this ifo p If ot, RANCID ( makes this very easy p Saity check Check existig coectivity Remove uused cofiguratio Shutdow ad clea up uused iterfaces 11

12 Software Issues (1) p Does the existig software have IPv6 support? Yes: deploymet is straightforward No: ivestigate cost of upgrade p Is a software upgrade available? Yes: is hardware suitably specified? No: hardware replacemet p Implemet software upgrade Budget, purchase & schedule istallatio 12

13 Software Issues (2) p If existig software supports IPv6: Are deployed software versios cosistet across ifrastructure? p Recommed maximum of two variatios (easier troubleshootig, bug tolerace, etc) p If existig software does ot support IPv6: Cost of upgrade to a versio which does? Testig for existig feature compatibility: p A software image with IPv6 may have lost features required for the existig operatioal etwork 13

14 Hardware Issues p Ca hardware specificatio be upgraded (eg RAM, NVRAM, etc)? Yes: budget, purchase, istallatio No: hardware replacemet p Hardware replacemet: Assess suitable replacemet product Aalyse impact o operatig etwork, existig services ad customer 14

15 Result p Oce the previous steps are completed, etire etwork is ruig IPv6 capable software p Deploymet of IPv6 ca ow begi 15

16 Network Optimisatio Is the IPv4 etwork the best it ca be? 16

17 Optimisatio p IPv4 etworks have bee deployed ad operatioal for may years Your etwork may fall ito this category p Optimisatio meas: Does the iterior routig protocol make sese? Do all routig protocols have the latest best practices implemeted? Are the IGP metrics set so that primary ad backup paths operate as expected? 17

18 Motivatio for Optimisatio p IPv6 deploymet (apart from MPLS cores) will be dual stack Which meas sittig alogside existig IPv4 cofiguratios p Aim is to avoid replicatig IPv4 shortcuts or mistakes whe deployig IPv6 IPv6 cofiguratio will replicate existig IPv4 cofiguratio p Improvemets i routig protocol BCPs should be deployed ad tested for IPv4 Take the opportuity to moderise the etwork 18

19 Procurig IPv6 address space Now we eed addresses 19

20 Gettig IPv6 address space (1) p From your Regioal Iteret Registry Become a member of your Regioal Iteret Registry ad get your ow allocatio p Membership usually ope to all etwork operators p RIR specific details for IPv6 allocatios are listed o the idividual RIR website Ope to all orgaisatios who are operatig a etwork Receive a /32 (or larger if you will have more tha 65k /48 assigmets) 20

21 Gettig IPv6 address space (2) p From your upstream ISP Receive a /48 from upstream ISP s IPv6 address block Receive more tha oe /48 if you have more tha 65k subets p If you eed to multihome: Apply for a /48 assigmet from your RIR Tryig to multihome with provider s /48 will be operatioally challegig p Provider policies, filters, etc 21

22 Address Plaig p IPv6 address space available to each etwork operator is large compared with IPv4 Desig a scalable pla Be aware of idustry curret practices Separatio of ifrastructure ad customer addressig Distributio of address space accordig to fuctio 22

23 Addressig Plas Ifrastructure p Network Operators should procure a /32 from their RIR p Address block for ifrastructure /48 allows 65k subets i the backboe p Address block for router loop-back iterfaces Number all loopbacks out of oe ifrastructure /64 /128 per loopback p Poit-to-poit liks /64 reserved for each, address as a /127 p LANs /64 for each LAN 23

24 Addressig Plas Customer p Customers get oe /48 Uless they have more tha 65k subets i which case they get a secod /48 (ad so o) p Idustry stadard for customer assigmets today: /64 for just oe LAN (hosted server) /60 for mobile hadset tetherig (3GPP Release 10 owards) /56 for a small etwork (home user / small busiess) /48 for a large etwork (eterprise) 24

25 Deployig IPv6 Now we put it oto the etwork 25

26 Deployig addressig ad IGP p Strategy eeded: Start at core ad work out? Start at edges ad work i? Does it matter? p Oly strategy eeded: Do t miss out ay PoPs Coectivity is by IPv4, so sequece should t matter Startig at core meas addressig of poit-to-poit liks is doe from core to edge (may ISPs use strategy of low umber towards core, high umber towards edge) But it really does t matter where you start 26

27 IPv6 Deploymet p Number all the ifrastructure iterfaces accordig to the established addressig pla No customers yet p Care eeded o LANs p Secure routers ad L3 devices for IPv6 access Oce a device is eabled for IPv6, it must have all the same security policies applied as for IPv4 27

28 Deployig o PoP LANs p LANs eed special treatmet Eve those that are oly poit-to-poit liks p Issues: ISPs do t wat to have Router Advertisemets active o etwork ifrastructure LANs Activatig IPv6 o a LAN which is ot adequately protected may have security cosequeces p Servers may auto cofigure IPv6 p No firewall filterig meas o security Þ compromise 28

29 IPv6 Iterior Routig Protocols p Make a decisio about which IGP to use (cotiue with OSPF vs replace with IS-IS?) p Eable chose IPv6 IGP Care eeded ot to break IPv4 coectivity Adjacecies i IPv6 should match existig adjacecies i IPv4 IGP v6 routig table should match v4 routig table p Check that the IPv6 etwork s operatio compares with IPv4 operatio Fix ay problems I a dual stack etwork the protocols must fuctio the same way 29

30 IPv6 Routig Protocol Deploymet p Eable IPv6 BGP ibgp should replicate IPv4 ibgp p Same umber of active eighbours p IPv6 versio of the IPv4 cofiguratio p Modify existig templates ebgp comes ext p Check that the IPv6 etwork s operatio compares with IPv4 operatio Fix ay problems I a dual stack etwork the protocols must fuctio the same way 30

31 Seekig IPv6 Trasit Hello World, I d like to talk to you 31

32 Seekig Trasit p Most trasit ISPs ow offer ative IPv6 trasit p Next step is to decide: To give trasit busiess to those who will accept a dual stack coectio or To stay with existig IPv4 provider ad seek a tuelled IPv6 trasit from a IPv6 provider 32

33 Dual Stack Trasit Provider p Fall ito two categories: A. Those who sell you a pipe over which you sed packets B. Those who sell you a IPv4 coectio ad charge extra to carry IPv6 p ISPs i category A are much preferred to those i category B p Chargig extra for ative IPv6 is absurd, give that this ca be easily bypassed by tuellig IPv6 IPv6 is simply protocol 41 i the rage of IP protocol umbers 33

34 Dual Stack Trasit Provider p Advatages: Ca alig BGP policies for IPv4 ad IPv6 perhaps makig them more maageable Saves moey they charge you for bits o the wire, ot their colour p Disadvatages: Not aware of ay 34

35 Separate IPv4 ad IPv6 trasit p Retai trasit from resolute IPv4-oly provider You pay for your pipe at whatever $ per Mbps p Buy trasit from a IPv6 provider You pay for your pipe at whatever $ per Mbps p Luck may ucover a IPv6 provider who provides trasit for free Gettig more ad more rare as more ISPs adopt IPv6 35

36 Separate IPv4 ad IPv6 trasit p Advatages: Not aware of ay But perhaps situatio is uavoidable as log as mai IPv4 trasit provider ca t provide IPv6 Ad could be a tool to leverage IPv4 trasit provider to deploy IPv6 or lose busiess p Disadvatages: Do the $$ umbers add up for this optio? Separate policies for IPv4 ad IPv6 more to maage 36

37 Customer Coectios Network is doe, ow let s coect payig customers 37

38 Customer Coectios p Givig coectivity to customers is the biggest challege facig all ISPs p Needs special care ad attetio, eve updatig of ifrastructure ad equipmet Mobile Cable/ADSL Dial Leased lies Wireless Broadbad 38

39 IPv6 to Mobile Customers p Access techologies are predomiatly 3G ad LTE p Ed-sites could rage from hadsets to major corporatios p Strategy depeds o ifrastructure ad device capability: Dual-stack usig 464XLAT Adroid IPv6-oly with NAT64 Apple ios Mobile operators eed to support both popular cosumer devices 39

40 IPv6 to Mobile Customers (1) p Dual-stack: Native IPv6 ad IPv4-NAT p IPv6 ative from hadset to cotet p IPv4 is carried withi IPv6 Ifrastructure is IPv6 oly Hadsets support 464XLAT (CLAT) p Most Adroid phoes (4.4.4 ad 5.1 owards) Operator eeds CGNAT to hadle PLAT fuctio for hadset access to IPv4 legacy sites p Tetherig Available i 3GPP Release 10 (DHCP-PD support) 40

41 IPv6 to Mobile Customers (2) p IPv6-oly with NAT64: Native IPv6 oly Ifrastructure is IPv6 oly Hadsets are IPv6-oly p Apple iphoe (ios 9 owards, iphoe6s owards) Operator eeds CGNAT to hadle NAT64 fuctio for hadset access to IPv4 legacy sites p Tetherig Available i 3GPP Release 10 (DHCP-PD support) 41

42 IPv6 to Broadbad Customers p Method 1: Use existig techology ad CPE This is the simplest optio it looks ad feels like existig IPv4 service IPv4: PPPoE (IPCP) IPv6: PPPoE (IPv6CP) + DHCPv6 PD Used by ISPs such as Iterode (AU) ad XS4ALL (NL) p Issues: IPv6 CPE i some markets are geerally more expesive p Customised coutry versios ofte delete IPv6 support Cheapest CPE have o IPv6 eed to be replaced/upgraded p p Solutio: Customers are very cost coscious $1 ca sway a purchasig decisio Operator publishes recommeded list of CPE (which support dual-stack)! p Ad sample cofiguratios 42

43 IPv6 to Broadbad Customers p Method 2: use 6rd This is for whe Broadbad ifrastructure caot be upgraded to support IPv6 Used by ISPs such as FREE (FR) Example: p Issues: p 2001:db8:6000::/48 assiged to 6rd p Customer gets /32 by IPCP for ative IPv4 lik p IPv6 address is 2001:db8:6000:0405::/64 for their LAN (takig last 16 bits of IPv4 address) p DHCPv6 PD ca be used here too (eg to give /56s to customers) All CPE eed to be replaced/upgraded to support 6rd p Solutio: Operator publishes recommeded list of CPE (which support 6rd)! 43

44 IPv6 to Dialup Customers p Use existig techology: Most dialup access routers are easily upgradable to support IPv6 Service looks ad feels like the IPv4 service PPP with IPv6CP (or with DHCPv6 PD (??)) CPE is usually PC or laptop (ad most OSes have supported IPv6 for may years) Service already offered for several years by may ISPs 44

45 IPv6 to Fixed Lik Customers p Use existig techology: Most access routers (PE) ad Customer routers (CPE) are easily upgradeable or replaceable to iclude IPv6 support Service looks ad feels like existig IPv4 service p Cofiguratio optios: IPv6 uumbered o poit to poit liks (or address them) Static routes, subet size accordig to busiess size Or use BGP with private or public (multihomed) ASN Whatever is doe for IPv4 should be repeated for IPv6 p Fixed lik Customers are probably the easiest to roll IPv6 out to Customer deployig IPv6 withi their ow etworks is a separate discussio (reru of this presetatio!) 45

46 IPv6 to Customers p What about addressig? Here is a typical strategy: Mobile Device: p /64 = 1 subet p /60 = 16 subets for tetherig (DHCP-PD with 3GPP release 10) Home/Small Orgaisatio: p /56 = 256 subets p Reserve the whole /48 p There is o IPv6 address shortage! Eterprise/Large Orgaisatio: p /48 = subets 46

47 Customer Coectios p What about customer ed systems? Is IPv6 available o all their computers ad other etwork coected devices? How to migrate those which are t? How to educate customer operatios staff What about their CPE? What about the lik betwee your edge device ad their CPE? What about security? 47

48 Customer Ed-Site p Re-ru of this presetatio, but: Do all devices eed IPv6? Realistically, IPv6 eeded o: p Ed-user devices (hadset, tablet, laptop, desktop) eed IPv6 Already tured o by default, remember J p Exteral facig servers eed IPv6 iitially (website, mail relay, public DNS) p Corporate Firewalls, Routers ad IDS Other iteral systems have o urget eed to deploy: p Iteral facig servers p IP phoe systems & Priters p Maagemet access to IP eabled devices p Network ad Buildig security moitorig systems 48

49 Coclusio We are doe! 49

50 Coclusio p Whe deployig IPv6 for the first time, a strategy ad plaig are of paramout importace p Presetatio has highlighted the steps i the plaig ad deploymet process Variatios o the theme are quite likely there is o sigle correct way of proceedig 50

51 IPv6 Deploymet Plaig ISP Workshops 51