IPv6 Technical Challenges

Transcription

1 IPv6 Technical Challenges Peter Palúch, CCIE #23527, CCIP University of Zilina, Slovakia Academy Salute, April 15 th 16 th, Bucharest

2 IPv6 technical challenges What challenges do I meet if I decide to deploy IPv6? Providing basic IPv6 connectivity Migrating existing services to IPv6 or IPv4/IPv6 operation Providing IPv6 communication over IPv4 clouds Allowing for IPv6/IPv4 intercommunication Practical experiences in configuring and operating IPv6 networks Persuading the network admins for the extra effort of deploying IPv6 in their network

3 IPv6 characteristics a short overview IPv6 a new (?) L3 protocol ultimately aiming to replace the IPv4 in the long run Key features: Larger address space with 128-bit addressing Simplified header and its processing Removal of broadcast semantics Provisions for automagic autoconfiguration Provisions for better security (well, kind of ) Provisions for better mobility and last but not least, provisions for all sorts of headaches

4 Legend IPv4 and IPv6 Header Comparison Version IHL Time to Live Identification IPv4 Header Type of Service Protocol Flags Total Length Fragment Offset Header Checksum Version Traffic Class Payload Length IPv6 Header Flow Label Next Header Hop Limit Source Address Destination Address Options Padding Source Address Fields Kept from IPv4 to IPv6 Fields Not Kept in IPv6 Name and Position Changed in IPv6 New Field in IPv6 Destination Address

5 IPv6 Address Representation x:x:x:x:x:x:x:x, where x is a 16-bit hexadecimal field Leading zeros in a field are optional: 2031:0:130F:0:0:9C0:876A:130B Successive fields of 0 can be represented as ::, but only once per address. Examples: 2031:0000:130F:0000:0000:09C0:876A:130B 2031:0:130f::9c0:876a:130b FF01:0:0:0:0:0:0:1 >>> FF01::1 0:0:0:0:0:0:0:1 >>> ::1 0:0:0:0:0:0:0:0 >>> ::

6 IPv6 Address Types Unicast One-to-one type Address assigned to a single interface only Multicast One-to-many type Address assigned to a group of listeners Anycast One-to-nearest type More devices sharing the same address because they provide the same service It depends on basic routing which node processes the packets There is no concept of broadcast address

7 IPv6 Address Categories It is normal for an interface to have lots of IPv6 addresses Very unlike IPv4 IPv6 addreses are differentiated into several categories ::/128 ::1/128 FF00::/8 FE80::/10 Unspecified address Loopback Multicast Link-Local Unicast FEC0::/10 Site local Unicast, obsoleted in RFC 3879 FC00::/7 Unique Local Unicast, RFC 4193 ::A.B.C.D IPv4-Compatible addresses (deprecated) ::FFFF:A.B.C.D IPv4-Mapped addresses All other Global Unicast

8 IPv6 Global Unicast Address Formally, a Global Unicast Address has three parts, very similar to IPv4 addressing Global Routing Prefix Subnet ID Interface ID A site is usually given a /48 global routing prefix The Interface ID is required to have 64 bits The Interface ID may be assigned manually or by different mechanisms This leaves 16 bits for the Subnet ID

9 MAC Address to EUI-64

10 Link-Local Address Remaining 54 bits Mandatory address for communication between two IPv6 devices Automatically assigned to interface as soon as IPv6 is enabled Also used for next-hop calculation in routing protocols Only link specific scope Remaining 54 bits could be zero or any manual configured value Pure transit links can nicely operate using link-local addresses only

11 Multicasting Multicast is frequently used in IPv6

12 ICMP version 6 In IPv6, the ICMP is given a crucial role Supports all important messages of its predecessor Adds new functions Router Solicitation, Advertisement (for autoconfiguration) Neighbor Solicitation, Advertisement (replaces ARP) Multicast Listener Discovery The added functions provide for Automatic gateway discovery and stateless address configuration Resolution of MAC addresses Duplicate Address Detection Multicast delivery control Blocking ICMPv6 in firewalls may cause serious trouble

13 Stateless Autoconfiguration A router sends network information to all the nodes on the local link A host can autoconfigure itself by appending its IPv6 interface identifier (64-bit format) to the local link prefix (64 bits) The result is a full 128-bit address that is usable and guaranteed to be globally unique

14 A Standard Stateless Autoconfiguration Stage 1: The PC sends a router solicitation to request a prefix for stateless autoconfiguration

15 A Standard Stateless Autoconfiguration (Cont.) Stage 2: The router replies with a router advertisement

16 Connectivity issues related to autoconfig End stations usually come preinstalled with IPv6 enabled Modern operating systems generally prefer IPv6 to IPv4 when opening connections Until there is no IPv6 router in a network, the IPv6 will not really become active on the stations With an IPv6 router on the segment, stations acquire their IPv6 settings and try to talk to the outside IPv6 world What if that router was put in unintentionally or maliciously? What if the router spreads incorrect information? What if there is an IPv6 connectivity breach a few hops further?

17 EUI-64 and resulting privacy concerns The close relation of an autoconfigured IPv6 address to the unique MAC address raised privacy concerns Therefore, many OSes today add yet another IPv6 address to their IPv6-enabled interfaces The prefix is derived from Router Advertisement messages The Interface ID is generated randomly and changes over time The randomized address is preferred for all outgoing connections This way, the privacy is rapidly increased, at a cost It becomes difficult to correlate IPv6 addresses in logs to a particular end host for monitoring and security purposes The DHCPv6 temporary address feature may solve this problem

18 IPv6 Routing Protocols IPv6 routing types: Static RIPng IS-IS for IPv6 OSPFv3 EIGRP for IPv6 MP-BGP4

19 IPv4-to-IPv6 Transition There are several methods for IPv4-to-IPv6 migration Dual stack Static tunnels Tunnels with dynamic endpoint discovery (6to4, ISATAP, 6rd, ) Protocol Translation (NAT-PT)

20 Dual Stack Dual stack is an integration method where a node has a native connectivity to both IPv4 and IPv6 network Definitely, the dual stack is the cleanest method of migrating from IPv4 to IPv6, with a small gotcha You need an IPv4 address and they are used up now

21 Tunneling Tunneling is an integration method where an IPv6 packet is encapsulated within another protocol, such as IPv4 This includes a 20-byte IPv4 header and an IPv6 header and payload There may be another tunneling protocol involved, such as GRE (mostly for passenger protocol identification to allow the transport of multiple protocols over a single tunnel)

22 Tunneling Encapsulation can be done by edge routers between hosts or between a host and a router, as it is fundamentally a software feature Today s operating systems on end hosts support several tunneling mechanisms Static, 6to4, ISATAP, TEREDO, 6rd

23 What is needed for a tunnel? Configuring static tunnels requires: Dual-stack endpoints IPv4 and IPv6 addresses configured at each end Knowing precise IPv4 addresses of the endpoints With tunneling, fragmentation issues are to be expected

24 Translation NAT-PT The tunneling does not solve issues related to a situation when the end stations only speak different IP protocols NAT-Protocol Translation (NAT-PT) is a translation mechanism that sits between an IPv6 network and an IPv4 network The job of the translator is to translate IPv6 packets into IPv4 packets and vice versa The NAT-PT itself has been deprecated but similar mechanisms are still being considered and developed

25 Conclusions IPv6 solves crucial problems with IPv4, along with introducing its own set of peculiarities It has great provisions for sustainability, plug&play, mobility, even efficiency As just about any other technology, it needs to be deployed by a skilled and knowledgeable administrator It does not solve all problems in current networking but it certainly is a step forward, and we learn by doing

26 Thank you very much! Peter Palúch RCNA Žilina