RFC8273. Unique IPv6 Prefix per Host. RIPE 76 - Marseille May Jordi Palet

Transcription

1 RFC8273 Unique Prefix per Host RE 7 - Marseille May 2018 Jordi Palet (jordi.palet@theipcompany.com) -1

2 RFC8273 RFC8273: Unique Prefix per Host Not a new protocol, so already widely supported Use existing protocols to allow a unique prefix (instead of a unique address from a shared prefix) to be assigned to a host interface Allows improed host isolation and enhances subscriber management on shared network segments, such as Wireless networks, data centres, among others Proides a ery simple mechanism for a single host or interface, to be able to run 24 irtual machines, with their own global address, not requiring to share a single one -2

3 How To First-hop router is a L3 edge router UE connects to the shared-access network and starts configuration with SLAAC RS First-hop router sends solicited RA response ONLY to the requesting UE Instead of using the link-layer multicast address (all-nodes group), using the link-layer unicast address of the requesting UE The solicited RA contains the unique prefix (4) and flags (to indicate if SLAAC andor DHCP should be used, etc.) Prefix from locallycentrally managed pool, aggregate block, Flags, best practices: 4. M-flag = 0 (address not managed with DHCP, 1 for DHCP prefix delegation) O-flag = 1 (DHCP used for other configuration information) A-flag = 1 (UE can configure itself using SLAAC) L-flag = 0 (prefix is not an on-link prefix, eerything sent to the gateway) Periodically unsolicited RAs follow same approach -3

4 Usage Scenarios We are already doing in cellular: 4 per PDP context Prefix sharing with other deices (tethering) Facilitate -only access (and 4-as-a-serice) Allows extending same concept to other scenarios: Hot-Spot WiFi Calling: Secured Voice oer WiFi oer untrusted connection 4 or sec tunnels to the epdg (eoled Packet Data Gateway) Corporate networks Data Center Allows also -only access and 4-as-a-serice Same concept as aboe for WiFi Calling VPN on demand in own network for 4 serices No need for NAT44 (lowers logging costs and fragmentation issues) -4

5 Hot-Spot Usage WiFi shared-access L2 network Proide isolation between user deices either due to legal requirements or to aoid potential abuse By using unique prefix per host, deices only can communicate thru the first-hop router Automatically aoids attacks based on link-local ICMP: DAD reply spoofing ND cache exhaustion Malicious redirects Rogue RAs Better scalability and robustness than DAD proxy, forced forwarding, ND snooping, etc. -5

6 Hot-Spot Example 4 8 Hot-Spot Proider -

7 Hot-Spot Example 4 8 AP Hot-Spot Proider AP n -7

8 Hot-Spot Example 4 8 AP Hot-Spot Proider AP n -8

9 Hot-Spot Example AP 1 8 Hot-Spot Proider AP n

10 Hot-Spot Example AP Hot-Spot Proider AP n

11 Data Centre Usage How to same as for the Hot-Spot case The UE serer may need multiple addresses from the same unique prefix (VMs, containers), so just need to configure them The first-hop router must be able to handle the presence and use of those - 11

12 Data Center Example 48 Data Center - 12

13 Data Center Example Rack Data Center 5 Rack n - 13

14 Data Center Example Rack Data Center Serer 1 Rack n - 14

15 Data Center Example 4 Rack Serer 1 48 Data Center Serer Rack n - 15

16 Data Center Example Serer n Serer 1 Serer n 5 Serer 2 Rack Serer 2 48 Data Center Serer Rack n - 1

17 Enterprise Example 48 Enterprise - 17

18 Enterprise Example 5 5 Enterprise Switch 1 48 Switch n - 18

19 Enterprise Example 5 5 Switch 1 Enterprise -o nly VL AN 4 48 Switch n - 19

20 Enterprise Example -o nly VL AN 4 Switch Enterprise VL AN -o nly N 4 A L nly V o 4 N 4 A N VL A y l L n V -o y l P I n -o 4 Switch n - 20

21 Enterprise Example Switch Enterprise Switch n -o nly N 4 A L nly V o 4 N 4 A N VL A y l L n V -o y l P I n -o 4 N 4 -only VLA 4 N A ly VL n o 4 N LA V nly o VL AN -o nly VL AN

22 Enterprise Example On-Demand VPN 4 Switch Enterprise Switch n -o nly N 4 A L nly V o 4 N 4 A N VL A y l L n V -o y l P I n -o 4 N 4 -only VLA 4 N A ly VL n o 4 N LA V nly o VL AN -o nly VL AN

23 Conclusions RFC8273 Stable and secure -only experience No performance impact Secure host-to-host communication managed by first-hop router Each unique prefix can function as a control-plane anchor point to ensure that each deice receies expected subscriber policy and serice leels Throughput QoS Security Parental control Other alue-added-serices - 23

24 Thanks! Contact: Jordi Palet: - 24