Enterprise IPv6 Deployment Perspectives from US Government

Transcription

1 Enterprise IPv6 Deployment Perspectives from US Government PLNOG 9 22 October, 2012 Krakow, Poland Ron Broersma DREN Chief Engineer SPAWAR Network Security Manager Federal IPv6 Task Force ron@spawar.navy.mil

2 Historical Perspectives Early networking the ARPAnet Node: IMP + 56Kb modems Protocol: BBN NCP, later TCP/IP dual stack until Jan 1, 1983 (NCP removed) Apps: telnet, ftp, Routing (IP): write your own router code called gateways in those days, later called routers note the G in EGP and BGP Addressing NCP 8 bit addresses (2 bits for host, 6 for site ) written as host/site, e.g. 0/3, or just 3. IP 32 bit addresses, split as net part and local address part, in 3 flavors (Class A, B, C). written as dd.dd.dd.dd, e.g CIDR didn t come until much later 22-Oct

3 ARPANET July Oct

4 Historical Perspectives 1969 successful moon landing (July), first remote login via ARPAnet (Oct) 1976 about 100 hosts on the network January 1983 NCP removed forever strong incentive to implement TCP/IP 1983 my first breakin over the ARPAnet password guessing attack from university 1984 DNS until then, we downloaded (ftp) new host table regularly, and installed in the local host table (example: /etc/hosts in Unix) 1984 Ethernet multiple ethernets (and other nets) at site drive subnetting (taking host part of address, and further breaking it down into subnet part and host part. Early 90 s running out of Class B addresses 1993 CIDR 1994 IP next generation working group 1995 IPv6 specification (revised 1998) Today still trying to deploy IPv6 22-Oct

5 IPv6 Today While not fully matured in all areas, IPv6 is ready for prime time. Security and Performance of IPv6 is equivalent to IPv4 IPv6 deployment does not have to be costly If you start early and use an incremental approach, and use tech refresh, there is almost no cost to deployment. If you procrastinate, it will be costly. If you haven t started, you may be too late. 22-Oct

6 IPv6 Today Some of your suppliers have limited IPv6 support today. You may need to switch providers or products. But the mainstream router/switch products, and the major operating systems all have very good support. Some of the major carriers do not, and some residential (DSL, cable) networks do not. The business case for IPv6 deployment is business survival. The killer app for IPv6 is the Internet itself. 22-Oct

7 Urgency We re out of IPv4 addresses Global (IANA) pool depleted Feb 2011 Asia (2011) and Europe (2012) depleted Growth and security of the Internet is at stake Urgent need to IPv6-enable the public Internet soonest. don t make your IPv6-only customers suffer the pain of translators in the path to your site. Focus on your public facing services now worry about your Intranet later web (80), authoritative DNS (53), MX (25) This part is actually easy if your providers support IPv6 22-Oct

8 U.S. Federal Mandate Signed by U.S. CIO, Sept 28, 2010 By Sept 2012, all public content IPv6-enabled By Sept 2014, all internal systems dual-stack Previous OMB mandate everything IPv6 capable by June 2008 Success(?): Everyone did a ping6, and then turned if off. Federal IPv6 Task Force team working to make it happen transition managers assigned in every agency 22-Oct

9 Status NIST IPv6 Deployment Monitor 22-Oct

10 Observations and Questions Why did much of the change came right before the deadline? If these metrics show only 36% completion, does this indicate a failure to meet the goal? After the Sept 2012 deadline, what incentive is there to leave things turned on continue making progress on the other 64% 22-Oct

11 Success? Yes, this was a big success: A significant increase in demand signal from the U.S. Government to industry, to deliver IPv6 services much harder to ignore us, or give low priority to our requirements explodes the myth that nobody is asking for IPv6 A huge increase in IPv6 awareness in the Government agencies people holding workshops, getting training, working with their providers, etc. 22-Oct

12 Success? A lot of public Government content is becoming IPv6-enabled, as part of the World goal to IPv6-enable the entire public Internet being the solution, rather than the problem setting an example and paving the way for the rest of the public sector This hopefully incentivizes other countries to do something similar 22-Oct

13 Some Lessons Learned Gain operational IPv6 experience before putting too much effort into enterprise-wide planning Addressing Plans everyone makes the same mistakes because they are coming from an IPv4 mindset. Go native (dual stack, no tunnels, no translators) Start from outside, and work in focus now on public facing services There will be challenges (surprises) along the way It doesn t require significant resources, if you start early and leverage tech refresh 22-Oct

14 Looking forward What is the incentive to keep the pressure on after the deadline? We plan to not allow.gov domains to be renewed if that organization has not met the mandates for IPv6 (and maybe DNSSEC as well). Other Governments and organizations should consider similar incentives 22-Oct

15 Keys to success Clear simple achievable vision and mandate, with deadlines, from the top (CIO) Responsibility, accountability and authority established and managed at the executive level Public reporting of status along the way, both internally and externally Bring in experts that have IPv6 operational experience, if you don t have it organically in your organization. (there are few experts available; check with the industry to ensure who you bring in can provide what is needed) Early (and consistent) interaction with service and technology providers, to communicate requirements. and be willing to switch providers to acquire IPv6 support Dual-stack support from ISP(s) 22-Oct

16 Addressing Plans Common mistakes Doing other than /64 for subnets Didn t read RFC 4291 nor 5375 Thinking that the addressing plan has to be perfect the first time because you believe you can t afford to re-address Choosing allocations for sites based on size of site because /48 for all sites is too wasteful Justification upwards, instead of pre-allocation downwards Host-centric allocation instead of subnet-centric 22-Oct

17 Addressing Plans Without sufficient operational experience with IPv6 deployment, you WILL get it wrong at first. usually takes the 3 rd time to get it right Planners are hindered by IPv4-thinking being conservative with address space thinking hosts instead of subnets 22-Oct

18 Do s and Don t s

19 Do Get buy-in from corporate leadership, especially CIO Develop a corporate culture for IPv6 involve all parts of organization, not just the network guys have a local champion include IPv6 in every IT initiative Take baby steps go for the low hanging fruit get experience along the way Leverage tech-refresh rather than spend $$$ on fork-lift upgrades out-ofcycle. it doesn t have to be very expensive Start now if you haven t, you are already quite late to the game Start by IPv6-enabling your public facing services work from outside in, and from bottom up Go native avoid translators, tunnels, and other transition schemes Only choose suppliers that have a good IPv6 story 22-Oct

20 Don t waste time developing a complete transition plan with no operational experience base your addressing plan on conservative IPv4 practices waste time on a comprehensive addressing plan without operational experience consider the first one a throw-away waste time trying to develop a business case (ROI) for deploying IPv6. it is a matter of business survival be afraid to break some glass world ipv6 day validated that 22-Oct

21 Updates, Observations, and other News

22 World IPv6 Launch Since the SPAWAR enterprise network (AS 22) is 100% dual-stack, how would network utilization (traffic inbound from the Internet) be impacted by an event like this? Previously (5 min averages, daytime): 1% in 2009 before Google whitelisting 2.5% after Google whitelisting just under 10% when Youtube was added (late Jan 2010) around 15% after World IPv6 Day (June 2011) After World IPv6 Launch around 20% average during the day Another view: overall daily average of traffic: Before: range (workdays) : 11-14% After: 14-18% 22-Oct

23 Top Enterprise Deployment Lack of IPv6/IPv4 feature parity taking way too long to get there Vendors not eating own dogfood but this is starting to change Challenges Rogue RAs due to Windows ICS set router priority to high as workaround Privacy Addresses (RFC4941) break address stability no easy way to centrally disable Lack of DHCPv6 client support in older OS s Network Management over IPv6 not quite there Operational Complexity with dual-stack 22-Oct

24 Benefits of IPv6 today (examples) Addressing can better map subnets to reality can align with security topology, simplifying ACLs sparse addressing (harder to scan/map) never have to worry about growing a subnet to hold new machines auto-configuration, plug-n-play universal subnet size, no surprises, no operator confusion, no bitmath shorter addresses in some cases at home: multiple subnets rather than single IP that you have to NAT Link Local implemented on every interface Multicast is simpler embedded RP no MSDP Mobile IPv6 is cleaner/simpler than in IPv4 22-Oct

25 Playing with IPv6-only environments (why would you want to do this?)

26 Case study Can you do all your network management using IPv6? Can you turn off IPv4 on your management LAN? How well do various products operate in this environment? 22-Oct

27 Findings Very few products can be fully managed using IPv6 You won t learn what s missing or broken unless you try it in production remove the training wheels You can t turn off IPv4 (yet) Bugs take 6 to 12 months to get fixed Feature requests take 18 to 48 months to get fixed 22-Oct

28 Management over IPv6 in some products Previously (June 2011): Cisco Brocade Juniper SSH HTTPS DNS Syslog SNMP NTP RADIUS Unified MIB RFC4293 Flow export TFTP FTP CDP LLDP Now: SSH HTTPS DNS Syslog SNMP NTP RADIUS Unified MIB RFC4293 Flow export TFTP FTP CDP LLDP IPv6 MTU No v4 Cisco 3 6 Brocade 1 9 Juniper 5 ALU 4 A Oct Can t reboot using SNMP over IPv (2)TR R6 (Nov 2012) R1 Nov 2012 (beta in August) 6. ASR1K:3.7S (July 2012) release, 2012Q4 8. No plans 9. fix planned for Apr

29 example IPv6-only bug when disabling IPv4 one vendor s switches, they start responding to all ipsubnet-broadcasts, and start ARPing (from ), and other strange behaviors. Example: echo request to x.x.x.255/24: 22-Oct

30 Other IPv6-only tests Test environment: network with ONLY IPv6 turned on (no IPv4 configuration or routing) A bit enabled (SLAAC) M and O enabled (for DHCPv6) Many operating systems connected, to see how they behave Windows7, MacOSX, Linux (multiple distributions), FreeBSD iphone, ipad, Android Anything without a dhcpv6-client won t get DNS addresses Windows XP, MacOSX before Lion, Android 22-Oct

31 IPv6-only Observation (Lion): You can browse OK with Safari, but Chrome and Firefox hang when trying to browse to IPv6-only web sites happy-eyeballs not working tcpdump shows it ARPing for Internet addresses because there is a default-route-to-interface installed in the routing table because it assigns IPv4 link-local (RFC 3927) and implements ARP for everything (paragraph 2.6.2) so it thinks it has full IPv4-internet reachability (unlike IPv6 behavior) Most other OS s exhibit similar behavior Need to fix happy-eyeballs workaround: actually assign IPv4 addresses (like maybe from /10 space) with default IPv4 route, but have router respond to everything as net/host-unreachable. or just disable IPv4 on the OS (Lion has a knob to do this). 22-Oct

32 END Contact me: