IPv6 integration in operational networks. Jean-Marc Uzé Conference: Where are we with IPv6? Paris, October 29, 2002

Transcription

1 Iv6 integration in operational networks Jean-Marc Uzé Conference: Where are we with Iv6? aris, October 29, 2002

2 Motivations for Deploying Iv6 Extending the reach of Internet Iv4 limitation GEOGRAHICALLY Source: 10/9/2002 Juniper Networks, Inc. Copyright

3 Motivations for Deploying Iv6 Extending the reach of Internet Iv6 potential GEOGRAHICALLY Source: 10/9/2002 Juniper Networks, Inc. Copyright

4 Motivations for Deploying Iv6 Extending the reach of Internet MOBILITY Iv6 Iv6 Iv6 Iv6 Iv6 10/9/2002 Juniper Networks, Inc. Copyright

5 Motivations for Deploying Iv6 eer-to-peer applications model + ermanent connections Iv6 Iv6 Iv6 Iv6 10/9/2002 Juniper Networks, Inc. Copyright

6 IS general concerns Margin! Turn on new service revenues! Reduce operating costs! Optimize bandwidth! Reduce depreciation Switching Transmission Revenue Operations 10/9/2002 Juniper Networks, Inc. Copyright

7 How to start?! By profitable services? Not a short term! No D-Day! Start where it is easy and prepare the coming challenge Transit Services IS IS networks Network infrastructure Site networks Transition Tranlation End-users Iv6 stack Applications 10/9/2002 Juniper Networks, Inc. Copyright

8 Integrating Iv6 in IS networks! But what if Iv6 can be deployed in a seamless way without expensive upgrades and operational costs? Value Deliver Showcase Training and Experience rofitable Services Time! Iv6 deployment requires preservation of: " Reliability " erformance " Services 10/9/2002 Juniper Networks, Inc. Copyright

9 Iv6 integration process! Network readiness " Required upgrade? " Equipment limitations? V4! Design " Based on existing infrastructure! Migration phases! Operational procedures V4/V6 10/9/2002 Juniper Networks, Inc. Copyright

10 Iv6 routers Taxonomy R v4 Will run Iv4 only, maybe MLS Iv6 non upgradeable router R Iv6 upgradeable router Issue: how much cost the hardware and software upgrade (CAEX + OEX)??? Justification generally linked to short term revenues Ready Iv6 qualified router 10/9/2002 Juniper Networks, Inc. Copyright

11 Iv6 Qualified Router for ISs What means really Dual Stack?! Addressing & Forwarding! Routing rotocols! Service Richness! Operational Efficiency Iv4 Iv6 10/9/2002 Juniper Networks, Inc. Copyright

12 Iv6 Addressing! Dual I addressing on the same interface! Neighbor discovery! ICMv6 CE A2 CE A1 E 1 E 2 interfaces { ge-0/1/0 { unit 0 { family inet { address /24; family inet6 { address 8028:20::1/64; E 3 CE C1 C1 CE B3 10/9/2002 Juniper Networks, Inc. Copyright

13 Iv6 Qualified Router for ISs What means really Dual Stack?! Addressing & Forwarding! Routing rotocols! Service Richness! Operational Efficiency Iv4 Iv6 10/9/2002 Juniper Networks, Inc. Copyright

14 Routing rotocols! Static routing! IG " May be used with customer sites " Iv6 unicast can be routed by RIng, OSFv3, or ISIS " Current ISIS backbone don t need IG upgrade " Current OSF backbone need to:! Migrate to IS-IS! Or add/deploy OSFv3! BG-M " Just add the Iv6 routing in existing M-BG set-up " Can use same design " Can be set-up over v4 or v6! Just add v6 routing over BG/v4 sessions! Use BG over v6 in case of Iv6 deployment in Iv4 tunnels 10/9/2002 Juniper Networks, Inc. Copyright

15 Static Routing example CE A1 CE A2 E 2 routing-options { rib inet6.0 { static { route 8028:10::1/128 next-hop 8028:25::2; E 1 E 3 CE C1 C1 CE B3 10/9/2002 Juniper Networks, Inc. Copyright

16 RIng Routing example CE A1 CE A2 E 2 protocols { ripng { group igp { neighbor ge-0/1/0.0; E 1 E 3 CE C1 C1 CE B3 10/9/2002 Juniper Networks, Inc. Copyright

17 OSFv3 example interfaces { so-0/0/0 { unit 0 { family inet { address /24; family inet6 { address 9009:6::2/64; CE A1 CE A2 E 2 lo0 { unit 0 { family inet { address /32; family inet6 { address feee::10:255:71:6/128; E 1 CE C1 C1 CE B3 so-0/0/0.0 E 3 protocols { ospf3 { area { interface so-0/0/0.0; interface lo0.0 { passive; 10/9/2002 Juniper Networks, Inc. Copyright

18 External M-BG example interfaces { ge-0/1/0 { unit 0 { family inet { address /24; family inet6 { address :: /126; routing-options { autonomous-system 100; CE A1 E 1 CE C1 C1 CE B3 CE A2 E 2 E 3 ge-0/1/0 protocols { bgp { group ebgp_both { type external; local-address ; family inet { unicast; family inet6 { unicast; peer-as 1; neighbor ; 10/9/2002 Juniper Networks, Inc. Copyright

19 Multicast Routing! erformance and scaling for Iv6 multicast clearly important! IMv2 to support for Iv4 and Iv6! Multicast Listener Discovery (MLD) protocol to discover the presence of multicast listeners " Derived from IGMv2 " Uses ICMv6 message type instead of IGM message types 10/9/2002 Juniper Networks, Inc. Copyright

20 Iv6 Qualified Router for ISs What means really Dual Stack?! Addressing & Forwarding! Routing rotocols! Service Richness! Operational Efficiency Iv4 Iv6 10/9/2002 Juniper Networks, Inc. Copyright

21 I Services! Routers must be able to perform intelligent Iv6 packet handling " Filtering Selective forwarding and discarding " Monitoring - Sampling, counting, logging, etc. " QoS - olicing, shaping, queuing, profiling, etc. " Forwarding Directing packets based on any header information! All classification and packet handling must be done in hardware to truly minimize performance impact! I services and performance must not be mutually exclusive 10/9/2002 Juniper Networks, Inc. Copyright

22 Flexible bandwidth CE A1 E 1 CE C1 C1 3ffe:1411:2205::5 CE B3 CE A2 E 2 E 3 firewall { family inet6 { filter LimitCE-A2{ policer LimCE-A2 { if-exceeding { bandwidth-limit 1m; burst-size-limit 100k; then discard; term 1 { from { source-address { 3ffe:1411:2205::/48; then { policer LimCE-A2; accept; 10/9/2002 Juniper Networks, Inc. Copyright

23 Security! Security on routers is more important than ever " for customer and infrastructure protection! On-going DoS work in Iv4 to be extended to Iv6! Hardware-based packet handling, filtering optimize key security actions! SNMv3 improves router authentication 10/9/2002 Juniper Networks, Inc. Copyright

24 Source Address Verification 3ffe:1411:2205::5 CE A2 CE A1 E 2 3ffe:1411:2205::/48*[BG/170] >via so-0/0/0/0.0 E 1 so-0/0/0.0 E 3 ge-0/1/0 Attack with Source address = 3ffe:1411:2205::5 urf CE C1 C1 CE B3 3ffe:1541:2305::/48 10/9/2002 Juniper Networks, Inc. Copyright

25 CE A1 E 1 CE C1 C1 Real-time DDoS Identification term 1 { CE B3 CE A2 E 2 so-0/0/0.0 E 3 ge-0/1/0 3ffe:1541:2305::/48 policy-options { community victim members 100:100; policy-statement set-dest-class from { protocol bgp; community victim; then { destination-class dcu-victim; accept; interfaces { so-2/0/1 { unit 0 { family inet6 { address feee::10:255:73:2/128; accounting { destination-class-usage; routing-options{ forwarding-table{ export set-dest-class; 10/9/2002 Juniper Networks, Inc. Copyright

26 Real-time DDoS Identification CE A2 CE A1 E 2 E 1 so-0/0/0.0 E 3 ge-0/1/0 CE C1 C1 CE B3 3ffe:1541:2305::/48 10/9/2002 Juniper Networks, Inc. Copyright

27 Real-time DDoS Identification CE A2 CE A1 E 2 E 1 so-0/0/0.0 E 3 ge-0/1/0 BG update 3ffe:1541:2305::12/128 Community 100:100 CE C1 C1 CE B3 3ffe:1541:2305::12 10/9/2002 Juniper Networks, Inc. Copyright

28 QoS! Iv6 header includes traffic class and flow label " Traffic class function = DSC " Largely undefined flow label identifies a traffic flow that needing special handling, I.e. voice, video, etc.! Iv6 routers must be able to use traffic class and flow label without incurring performance cost 10/9/2002 Juniper Networks, Inc. Copyright

29 VNs! VNs are a valuable service! rovider managed Iv4 VN models have been succesful! Established VN technologies used for Iv4 must be carried over to Iv6! Services offered as part of a VN, I.e. QoS, will still be required for Iv6! VN management must be able to support Iv4 and Iv6 traffic 10/9/2002 Juniper Networks, Inc. Copyright

30 L3 VN over MLS VN A Site 1, Iv6 VN A Site2, Iv6 VN B Site 1, Iv4 Static Routes CE A1 E 1 CE B1 CE A2 E 3 E 2 OSF Routing CE B2 CE A3 E-BG VN B Site2, Iv4 VN A Site 3, Iv6 VN C Site 1, Iv4 CE C1 C1 VN B Site3, Iv4 CE B3 CE C2 C2 VN C Site 2, Iv4 10/9/2002 Juniper Networks, Inc. Copyright

31 Iv6 Qualified Router for ISs What means really Dual Stack?! Addressing & Forwarding! Routing rotocols! Service Richness! Operational Efficiency Iv4 Iv6 10/9/2002 Juniper Networks, Inc. Copyright

32 Network Management! Iv6 Management must be integrated in existing management systems! SNM over v6 with Iv6 MIBs! Intuitive CLI! Iv6 Accounting! AIs (e.g. XML) for OSS integration " Reduce latency between new vendor feature/service and OSS integration " Operational efficiency hinges on OSS integration! Router operations over Iv6 " telnet, ssh, ftp, ping, traceroute 10/9/2002 Juniper Networks, Inc. Copyright

33 Robustness and Reliability! Common support of features, services on every interface across all platforms! Same approach for hardware-based packet handling as Iv4 " erformance is critical " Maintaining SLA agreement for Iv4 while operating Iv6! Separation of routing and control planes! Graceful restart mechanisms " BG, OSF, IS-IS, RSV, LD! Linear software releases continuity to ensure common support and evolution 10/9/2002 Juniper Networks, Inc. Copyright

34 Integration of non Iv6 capable routers! Iv6 in Iv4 tunnels " GRE or I-I Tunnels " Only possible:! with performance (hardware tunneling)! at small scale for manageability! Connecting Iv6 Islands with Iv4 MLS " Requires MLS capable routers in the core 10/9/2002 Juniper Networks, Inc. Copyright

35 Iv6 in Iv4 tunnels CE A1 E 1 CE C1 C1 R v R v4 R v4 R v4 CE B3 CE A2 E 2 so-0/0/ E 3 interfaces { so-0/0/0 { unit 0 { family inet { address /24; gr-1/0/0 { unit 0 { tunnel { source ; destination ; family inet6 { address 9009:6::2/64; 10/9/2002 Juniper Networks, Inc. Copyright

36 CE A1 E 1 Connecting Iv6 Islands with Iv4 MLS (1) CE C1 C1 R v R v4 R v4 R v4 CE B3 CE A2 E 2 so-0/0/ E 3 ge-0/1/0 interfaces { so-0/0/0 { unit 0 { family inet { address /24; family inet6; family mpls; ge-0/1/0 unit 0 { family inet6 { address 8002::1/126; lo0 { unit 0 { family inet { address /32; family mpls; routing-options { autonomous-system 100; 10/9/2002 Juniper Networks, Inc. Copyright

37 CE A1 E 1 Connecting Iv6 Islands with Iv4 MLS (2) CE C1 C1 R v R v4 R v4 R v4 CE B3 CE A2 E 2 so-0/0/ E 3 ge-0/1/0 protocols { rsvp { interface so-0/0/0.0; mpls { ipv6-tunneling; label-switched-path to_e1 { to ; interface so-0/0/0.0; bgp { group to_e1 { type internal; local-address ; family inet6 { labeled-unicast { explicit-null; export red-export; neighbor ; ospf { traffic-engineering; area { interface so-0/0/0.0; interface lo0.0 { passive; 10/9/2002 Juniper Networks, Inc. Copyright

38 Connecting Iv6 Islands with Iv4 MLS (3) # protocols (next) CE A1 E 1 CE C1 C1 R v R v4 R v4 R v4 CE B3 CE A2 E 2 so-0/0/ E 3 ge-0/1/0.0 ripng { group to_ce-b3 { export red-import; neighbor ge-0/1/0.0; policy-options { policy-statement red-export { term 1 { from protocol ripng; then accept; term 2 { then reject; policy-statement red-import { from protocol bgp; then accept; 10/9/2002 Juniper Networks, Inc. Copyright

39 Conclusion! The transition from Iv4 to Iv6 will be gradual! ISs can integrate Iv6 at a reasonable cost by leveraging existing investment for a seamless integration " roduction-caliber Iv6 " Internet-scale " Fully-featured Iv6 " Genuinely-deployable Iv6! Iv6 qualified routers must support solutions to by-pass potential non Iv6 capable routers! Iv6 education and training will be determinant to develop a business strategy 10/9/2002 Juniper Networks, Inc. Copyright

40 Thank you!