APRICOT 2005 T10-4 Enterprise Network: IPv6 Transition and Operation

Transcription

1 1

2 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies 5. Notes and Summary 2

3 3

4 Review Sheet Flexible Address- Design Improving Network Operation Various Solutions for End-users Un-exhaustible 4

5 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies 5. Notes and Summary 5

6 Introduction Phase Propagation Phase(1 st half) Propagation Phase(2 nd half) IETF Standardization Natural Deployment Dual-stacked for Router/ Server Starting Actual Services Now: End of Introduction Phase =Needs more energy for the Propagation Phase 6

7 7

8 Building IPv6 intranets had been starting. 8

9 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies 5. Notes and Summary 9

10 The guideline clarifies transition-process for users in each segment. Network managers S ers 2004 Version 2005 Version IPv6 equipment vendors Service provider Common issues for all segments SIers End users ISP operators SIers ISP operators SIers Reference: 10

11 APRICOT 2005 T10-4 Enterprise Network: IPv6 Transition and Operation Two Transition Scenarios Staged Replacement Scenario ISP ISP (IPv4) Enterprise Intranet (IPv4) Enterprise Intranet (IPv4) IPv4/IPv6(Dual) Sub-network ISP ISP (IPv4) Enterprise Intranet (IPv4) Reference: IPv6 Deployment Guideline (IPv4/IPv6) Currently feasible level Existing Independent Merging Scenario ISP 11 Enterprise Intranet (IPv4) ISP (IPv4/IPv6) Newly constructed (IPv4/IPv6)

12 Reference: IPv6 Deployment Guideline 12

13 Deny Limited permission Permission Limited permission Permission Limited permission Reference: IPv6 Deployment Guideline 13

14 IPv6overIPv4 tunneling Head Office intranet (IPv4) IPv4 sub-network Branch Office intranet (IPv4) IPv6 over IPv4 tunnel IPv4/IPv6 dual-stack sub-network IPv4/IPv6 dual-stack sub-network Head Office intranet (IPv4/IPv6) IPv4 sub-network Branch Office intranet (IPv4/IPv6) Reference: IPv6 Deployment Guideline 14

15 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies 5. Notes and Summary 15

16 More effective applications compared with using IPv4 16

17 A.com SIPServer PSTN GW IPv4 Private IPv4 GW B.com SIP Server NAT NAT IPv4 Private IP-phone terminal IP-phone terminal 17

18 A.com SIP Server GW IPv6 IPv6 GW B.com SIP Server NAT NAT IPv6 IP-phone terminal IP-phone terminal 18

19 Server is bottle-neck. Network is bottle-neck. Streaming 1Mbps Streaming 1 stream by server-to-client Multicast streaming 19

20 <draft-ietf-dnsext-ipv6-name-auto-reg-01.txt> (4) Check & Name Generation DNS Servers R Detector Registrar (2) Detect (3) Request (5) Register (1) Plug-in Plugged-in IPv6 Node 20

21 Reference: IPv6 Deployment Guideline 21

22 Initial cost Running cost Increase of additional functions Initial cost 22

23 FireWall IPv4 Enterprise Intranet using IPv4 Server Group company C Data communication IPv6 Real-time streaming management division Enterprise Intranet using IPv6 Remote Remote Maintenance control Secure end-to to-end communication Private Address Space Group company A Group company B 23

24 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies Deploying IPv6 in Closed Networks VoIP Deployment using IPv6 Stream Delivery using IPv6 5. Notes and Summary 24

25 25

26 ISP-independent addresses are not recommended. Site-local should not be used. 26

27 A global IPv4 address owned by the enterprise Reference: IPv6 Deployment Guideline 27

28 28

29 APRICOT 2005 T10-4 Enterprise Network: IPv6 Transition and Operation Inter-Site Connection (1/2) There are two major site connection services. Ⅰ Tunneling IPv6 packets transmission is possible on IPv4 access lines using capsulation.. IPv4 router tunneling segment IPv4 router IPv4 sub IPv4subsubnetwork network IPv4 access line Encapsulation IPv6 into IPv4 Decapsulation IPv6 from IPv4 tunneling router IPv6 sub IPv6subsubnetwork network tunneling router IPv4 and IPv6 terminals co-exist. Ⅱ Dual-stacked IPv4/IPv6 dualdual-stack router Either IPv4 and IPv6 transmission is possible. dualdual-stacked segment IPv4 sub IPv4subsubnetwork network IPv6 sub IPv6subsubnetwork network IPv4 and IPv6 terminals co-exist. IPv4/IPv6 dualdual-stack router 29

30 30

31 31

32 AAAA query A query Pc1.example.net DNS Cache Name server: of Pc1.example.net Pc1.example.net is V4 AAAA query A query Pc1.example.net DNS proxy(alg) Translator DNS2 It is 2001:db8::2 V6 update translation table 2001:db8:: Example.net DNS SOA AAAA query Pc1.example.net IPV6/IPv4 translator will be required in many cases when migration is proceeding. 2001:db8:2 Pc1.example.net 32

33 Policy At first, IPv6 is used for internal application. Internet IP-VPN IP-VPN NAT Router Gate-way Router Router Network management Div. Branch Office A Branch Office B Reference: 33 Division 1 Division 2 Head Office IPv4 segment

34 Generate IPv6 addresses from IPv4 global address, which is assigned for the organization. The address will be unique if the IPv4 is global unique. IPv6-over- IPv4 tunneling router NAT router IPv4 segment IPv4/IPv6 dual-stacked segment IPv6-over-IPv4 tunneling Multicast streaming server IP-VPN IP-VPN NAT router Gate-way Router NAT Internet 2002:6464:6464::/ :6464:6464:1003::/64 IPv4/IPv6 Dual-stack router Network management Div. Branch Office A 2002:6464:6464:2000::/52 Branch Office B 2002:6464:6464:3000::/ :6464:6464:1001::/ :6464:6464:1002::/64 Division 1 Head Office Division :6464:6464:1000::/52 Reference: 34

35 IPv4 segment IPv4/IPv6 dual-stack segment IPv6-over-IPv4 tunneling IPv6 segment Multicast streaming server IP-VPN IPv4/IPv6 dual-stacked router IPv6 Internet Gate-way Router Internet 2002:6464:6464:1000::/ :260:ff00:1000::/ :6464:6464::/ :260:ff00::/48 IPv4/IPv6 Dual-stack router 2002:6464:6464:1003::/ :260:ff00:1003::/64 Network management Div. 2002:6464::6464:2000::/ :260:ff00:2000::/52 Branch Office A 2002:6464:6464:3000::/ :260:ff00:3000::/52 Branch Office B Reference: 35 Division 1 Head Office Division 2

36 Method Uniqueness ISP- Independent for Closed Note /48 Assignment from ISP Yes. No. Possible Recommended Temporary Assignment No. Yes. Possible Not recommended 6to4 Assignment based on IPv4 Yes. No. Possible Recommended /32 Allocation as a LIR Yes. Yes. Possible Over Spec.? 36

37 Intranet(IPv4) IPv4 IPv4/IPv6 IPv6 IPv6 File server IP Router To/From IPv6 Network (IPv6 over IPv4 tunnel) IP Router Users can easily set-up file-servers, and generate dynamic groups. IPv4 servers for each division are usually prohibited. 37

38 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies Deploying IPv6 in Closed Networks VoIP Deployment using IPv6 Stream Delivery using IPv6 5. Notes and Summary 38

39 Head Office Major Plants Major Branches Domestic Group Companies Foreign Major Plants Foreign Major Branches Number of sites Number of employees Domestic total Foreign total Total sum

40 NAT Div. LAN NAT Div. LAN Div. LAN Major Plant NAT Div. LAN Div. LAN Head Office Div. LAN IP-VPN IP-VPN NAT the the Internet Div. LAN Major Branch NAT Div. LAN Div. LAN Group Company NAT Div. LAN Div. LAN Foreign Branch NAT Div. LAN Div. LAN Foreign Plant NAT Div. LAN NAT 40

41 41

42 Item Positive aspects Negative aspects Address assignment from ISP Not necessary IPv4 Address re-numbering No problem if proper design is achieved Possibility of re-numbering operations NAT Necessary for NAT equipment or NAT setting on routers -Increase of managed items -Not managable beyond NAT -Restriction of applications Address assignment from ISP Infinite address space once a global address assigned Necessary for obtaining a global address IPv6 Address re-numbering NAT Not necessary Necessary neither NAT equipment nor NAT setting on routers 42

43 Building IPv6 VoIP intranet is preparation for a next generation communication network. 43

44 44

45 Initial Cost There are little difference between IPv4 and IPv6. VoIP (*) VoIP Integration(*) Hard Phone SIP-NAT Soft Phone SIP SIP-NAT Equipment IPv6 VoIP SIP Server IPv6 Integration Network Integration (*)SIP, SIP-NAT design IPv4 IPv6 Running Cost The difference between IPv4 and IPv6 is SIP-NAT maintenance cost. Here, IPv6 initial cost difference will be recovered within a year. 45

46 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. Application Examples 4. Case Studies Deploying IPv6 in Closed Networks VoIP Deployment using IPv6 Stream Delivery using IPv6 5. Notes and Summary 46

47 Number of sites Number of employees Sum Head Office Major Plant Major Branch Group Compnay Total

48 Existing Solution Transition? Next Solution? 48

49 Satellite Item Positive aspects Negative aspects Live delivery function Flexibility Cost Be able to receive everywhere if the receiver is placed Fix number of channels based on the contract Fix number of channels, Limited source (ex. studio) Expensive, Fixed cost IP multicast Live delivery function Flexibility Cost Be able to receive everywhere if the intranet is reachable Flexible number of channels, Unlimited source (IP reachable) IP multicast version-up is required, but not expensive. Intranet is required, if there are not IP-reachable. 49

50 IPv6 multicast server SW -Hub MLD, PIM v6 over v4 IPv6 over IPv4 tunneling MLD, PIM v6 over v4 SW -Hub WindowsXP Multicast packets are filtered. 50

51 Accumulated Cost 100Myen Satellite N=300 N=200 N=100 Year N: Number of sites where tunnel terminated 51

52 Method Uniqueness ISP- Independent for VoIP or Streaming Note /48 Assignment from ISP Yes. No. Possible Recommended Temporary Assignment No. Yes. Impossible Not recommended 6to4 Assignment based on IPv4 Yes. No. Temporarily Possible Only for Intranet /32 Allocation as a LIR Yes. Yes. Possible Maybe recommended for huge enterprises 52

53 If IPv4 will be used, design and operation costs are continuously increasing. The simple and optimized networks are required, that can enable new applications such as P2P and multicast, etc. 53

54 0. Introduction 1. IPv6 Deployment Situations in Japan 2. IPv6 Deployment Guideline of IPv6 Promotion Council 3. IPv6 Introduction for Enterprise Networks 4. Case Studies IPv6 Introduction to Closed Network VoIP Deployment using IPv6 Stream Delivery using IPv6 5. Notes and Summary 54

55 IPv4 IPv4/IPv6 IPv6 Policy of core routers Not allow IPv4 transmit Except,SNMP packets Internet(IPv4) net(ipv4) Policy of servers Access control by ID & Password Virus scanning FW IPv4 servers (IPv4) WEB Mail DNS Intranet (IPv4) Router WEB File NMS Streaming User DNS PC#1 Router PC#2 PC#3 IPv6 servers (IPv4/IPv6 dual) Division LAN(IPv4/IPv6) Policy of access routers Filtering for illegal IPv6 packets ex. not allowed multicast, etc. Policy of end-terminals Access control by personal firewall Virus scanning 55

56 Server segment IPv4 attacks are eliminated because of IPv6 native operation (exception exists) Some protocols (DNS of Windows, SNMP) use IPv4 transport IPv6 over IPv4 Tunnel(port:41) DNS(UDP:53) Illegal Access HTTP(TCP:80/8080) SSL(TCP:443) SMTP(TCP:25) Worm MS Blaster(TCP:135) Router (Security Policy) IPv6 over IPv4 Tunnel(port:41) DNS(UDP:53) SNMP(UDP:161) DNS NMS IPv6 over IPv4 Tunnel(port:41) POP(UDP:110) Illegal Access HTTP(TCP:80/8080) SSL(TCP:443) SMTP(TCP:25) MS Blaster(TCP:135) Worm Router (Security Policy) IPv6 over IPv4 Tunnel(port:41) DNS(UDP:53) SMTP(TCP:25) HTTP(TCP:80) SSL(TCP:443) Windows Firewall Virus Scanning Personal Firewall 56 IPv6/IPv4 dual clients IPv4 filtering for IPv4 existing services ( ,WEB, etc.) is not changed. IPv6 access by domain-name used existing DNS server IPv6 filtering is basically not used. Each personal firewall is activated for illegal accesses or worms.

57 To solves above problems, some terminal management methods is required for enterprise propagation. 57

58 Independent from specific-purpose networks Enterprise intranet (Private IPv4 based) The next generation Enterprise net. (Global IPv6 based) 58

59 59

60 Thank you. Any questions? Please send s to 60

61 61