IPv6. IPv6 Rationale. IPv6 (Review) IPv6 (Review) IPv6 Extension Headers. IPv6 Header Chaining PROTOCOL ADDRESSING AUTOCONFIGURATION DEPLOYMENT

Transcription

1 IPv6 PROTOCOL ADDRESSING AUTOCONFIGURATION DEPLOYMENT IPv6 Rationale Larger address space Efficient address allocation Simpler processing Autoconfiguration Support for QoS Support for security IPv4 IPv4 Address AddressSpace Exhaustion Currently, about about75% of of the the total total IPv4 IPv4 address addressspace spaceis is either either assigned or or reserved. The The best best models modelspredict predictthat that IANA IANA will willrun out outof of unallocated space spacein in and and that that the the RIRs RIRswill willrun runout outthe the following year yearunless unlessnew new ways waysof of allocating or or trading tradingaddresses are are introduced. IPv6 (Review) IPv6 (Review) Changes from IPv4 No fragmentation No checksum New option mechanism Simplified ICMP Autoconfiguration IP security integrated Simplified Fixed-size Version Traffic class Flow label length Next Source address Destination address No options/fixed Faster processing Use extension s No checksum Faster processing Done at higher levels No fragmentation Faster processing Hosts use PMTU discovery Total length length Header not included Jumbo-gram extension TTL Hop limit More accurate naming Never was seconds Protocol type Next Protocol type or first extension IPv6 Header Chaining IPv6 Header Next =6 IPv6 Header Next =0 TCP Header Hop-by-hop options Next =6 TCP TCP Header TCP IPv6 Extension Headers Extension order Hop-by-hop options Destination options Routing Fragment Authentication ESP Destination options IPv6 Header Next =0 Hop-by-hop options Next =44 Fragment Header Next =6 TCP Header TCP 1

2 IPv6 Option Format Routing Header ACT Action for unrecognzed option 00 Skip 01 Discard silently 10 Discard + ICMP 11 Discard + ICMP if unicast C Change indication 0 Does not change 1 Changes en-route Hop-by-hop option examples Router alert message Jumbogram Destination option examples NSAP address option Home address option Type Zero Routing Header Loose source routing Lists addresses datagram should pass through Type Two Routing Header Used for IPv6 mobility Next Header Header Length Type = 0 Segments left Reserved Address 1 Address 2 Address 3 ACT C Type Length Value Value IPv6 Addresses IPv6 Structured Addresses Notation Colon-separated hexadecimal CIDR notation with simplifications 2001:0DB8:0000:0000:000F:60FA: AB3B 2001:DB8:0:0:F:60FA:AB3B 2001:DB8::F:60FA:AB3B 2001:DB8::/32 Current allocation 2001::/16 Global Unicast 2002::/16 6to4 3FFE::/16 6bone Address types Unspecified ::0/128 Loopback ::1/128 Multicast FF00::/8 Link-local unicast FE80::/10 Site-local unicast FEC0::/10 Anycast Global unicast Structure Global routing prefix Subnet ID Interface ID n bits m bits n - m bits Examples 001 Global routing prefix Subnet ID Interface ID 45 bits 16 bits 64 bits Subnet ID Interface ID 10 bits 54 bits 64 bits Current global unicast address space Site-local unicast Multicast addresses Prefix: ff00::/ T Scope Group ID (112 bits) T Meaning 0 Well-known address 1 Transient address Examples: FF01::101 All NTP servers on this host FF02::1 FF02::101 All NTP servers on this link FF02::2 FF05::101 All NTP servers in this company FF02::1:ffxx:xxxx FF0E::101 All NTP servers in the world Scope Meaning Prefix 1 Interface-local FF01, FF11 2 Link-local FF02, FF12 4 Admin-local FF04, FF14 5 Site-local FF05, FF15 8 Organizational-local FF08, FF18 E Global FF0E, FF1E 0, 3, F Reserved Others Unallocated All nodes on this link All routers on this link Solicited-node address Required addresses Host Link-local address Loopback address (::1) All-nodes (ff02::1) Solicited-node multicast (ff02::ffxx:xxxx) Router Link-local address Loopback address (::1) All-nodes (ff02::1) Solicited-node multicast (ff02::ffxx:xxxx) Subnet-router anycast (Prefix::0) All-routers multicast (ff0x::2) 2

3 Address allocation Same procedure as IPv4 IANA RIR LIR Current IANA policy RIRs get /23s LIRs get /32s Customers /48s Fragmentation and IPv6 Multihoming PI addresses mow available o In practice a /32 o Disliked by many Other solutions not deployed or won t be deployed IPv6 Fragmentation Path MTU Discovery IP fragmentation in hosts o Uses fragmentation extension No fragmentation in routers o Path MTU discovery required 1500 bytes Framentation needed 1000 bytes Framentation needed Fragment 800 bytes Next Reserved = 0 Fragment offset Res M Framentation needed Identification 500 bytes IPv6 Autoconfiguration PROTOCOL ADDRESSING AUTOCONFIGURATION DEPLOYMENT 3

4 Autoconfiguration IPv6 Interface ID Stateless vs Stateful Stateless autoconfiguration OUI Top 3 octets of EUI-64 (OUI) Stateless: RFC2462 Stateful: work in progress Generate and assign link-local address based on interface ID Organizationally unique identifier 24 bits, managed by the IEEE C C C C C C U G C C C C C C C C C C C C C C C C Some goals No manual config of hosts No stateful server required for link-local communication No stateful address config server Facilitate easy renumbering Configure routers (if any) Configure global and site-local unicast addresses Configure additional information using stateful autoconf EUI-64/EUI-48 Extended unique identifier OUI + manufacturer-selected bits Typical interface ID EUI-64 (or embedded EUI-48) Inverted universal/local bit EUI-48 OUI EUI-64 OUI EUI-48 embedded in EUI-64 8 bits OUI FF FE IPv6 stateless autoconfiguration: Generate link-local address 1. Append interface ID (modified EUI-64) to link-local prefix Example: MAC: 00-0d-60-fa-ab-3b EUI-64: 0-d-60-ff-fe-fa-ab-3b Modified: 0-f-60-ff-fe-fa-ab-3b Result: fe80::f:60ff:fefa:ab3b 2. Check that address is not in useusingduplicateaddress detection (DAD) 3. Assign link-local address Address example # ip addr list 1: lo: <LOOPBACK,UP> mtu qdisc noqueue link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet /8 scope host lo inet6 ::1/128 scope host 2: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000 link/ether 00:0b:cd:f2:a7:b9 brd ff:ff:ff:ff:ff:ff inet /24 brd scope global eth0 inet6 fe80::20b:cdff:fef2:a7b9/64 scope link inet6 2001:6b0:17:f023:20b:cdff:fef2:a7b9/64 scope global dynamic valid_lft sec preferred_lft sec IPv6 stateless autoconfiguration: Duplicate address detection (DAD) IPv6 stateless autoconfiguration: Configure routers and addresses RFC 2462 Process (simplified) Router advertisements Process DAD must not be performed on anycast addresses DAD should be performed on individual unicast addresses With stateless autoconfiguration it is sufficient to test the link-local address since all others are formed from the same interface ID, which is known to be unique. Send neighbor solicitation with ::0 as the source Listen for neighbor solicitations and neighbor advertisements Non-loopback NS from ::0 for the tentative address indicates duplicate NA indicates that the tentative address is in use Sent periodically by routers Maycontainaddressprefixesfor network Router solicitation Trigger sending router advert nt Sent by hosts during autoconfig Send RS and wait for RA No RA: do stateful autoconfig Check flags of RA o May indicate stateful autoconfig o May indicate stateful autoconfig for additional information For each advertised prefix, form a unicast address based on prefix and interface ID, and maybe perform DAD on the address Maybe set the router as a default router 4

5 Neighbor Discovery IPv6 Neighbor Discovery Neighbor solicitation Who has IPv6 address... Sent to solicited node multicast address Solicited node multicast address Multicast address for a particular node ff02::ffxx:xxxx where xx:xxxx are low three bytes of target address Type Code Checksum Reserved Target address IPv6 Neighbor Discovery Neighbor advertisement I have IPv6 address... Sent to IP sender of solicitation RSO Router Solicited Override Options Target link-layer address MTU Prefix information Type Code Checksum R S O Reserved Target address... Neighbor Unreachability Detection (NUD) Forward reachability Solicited neighbor advertisement Hint from upper layer Neighbor cache/table Replaces ARP cache Each entry in one of five states Neighbor cache states Incomplete: Address resolution is being performed on this entry Reachable: Forward path to the neighbor is functioning Stale: No positive confirmation for some time Delay: No positive confirmation and passively waiting for confirmation Probe: Seeking reachability confirmation Options Migration Deployment issues Dual stack Hosts use IPv4 to communicate with IPv4-only hosts Hosts use IPv6 to communicate with IPv6-capable hosts Pure IPv6 Logical topology Tunnels Encapsulate IPv6 in IPv4 for traffic between IPv6 islands Example IPv6 island Physical topology IPv4 network IPv6 island IPv6 island 5

6 Migration: 6to4 What it is Connection of IPv6 domains via IPv4 clouds IPv6 connectivity with IPv4 uplink Gives one /48 per IPv4 address IPv6-only host 6to4 router IPv4 network Dual-stack host 6to4 router IPSec 6to4 address IPv4 address: x.y.z.q IPv6 net: 2002:xxyy:zzqq::/48 Example: IPv4 address: to4 prefix: 2002:d4d6:70dd::/48 IPv6 network Public 6to4 relays (anycast ) IPv6-only host IPSec Overview ESP ESP Encapsulating Security Confidentiality AH Authentication Header Authentication Integrity IPComp IP Compression Data compression before ESP IKE Internet Key Exchange Secret key exchange Encrypted Security Parameter Index (SPI) Sequence Number Padding Pad Length Next Header Authentication data (variable) AH Next Header Length Reserved Security Parameter Index Sequence Number Authentication Data (variable) IPSec Concepts Host/Gateway Implementation Tunnel/Transport Mode Security Associations (SA) o Security Parameter Index (SPI) o Security Policy Database (SPD) o SA database (SAD) Version Internet Header Length Total Length Identification Protocol Source/Destination Address Not authenticated Type of Service (TOS) Flags Fragment Offset Time to Live (TTL) Header Checksum 6

7 IPSec modes ESP/AH Transport mode Communication between hosts Tunnel mode Communication between VPN gateways ESP Transport Mode Protects payload only IP ESP AH Transport Mode Protects IP s and payload IP AH ESP Tunnel Mode Protects original IP datagram Tunnel IP ESP Inner IP AH Tunnel Mode Protects original IP datagram and tunnel Tunnel IP ESP Inner IP IP AH/ESP New IP AH/ESP Orig. IP Authentication and Encryption Security associations Nest ESP in AH Apply ESP first, then AH IP AH ESP ESP Special format for ESP IP ESP ESP auth data Security Association (SA) One-way relationship between IPSec hosts Determines processing for sender and decoding for destination Security Parameter Index Used by destination to select correct SA for pkt SPI + destination address + protocol identifies SA SA Database (SAD) Parameters of each SA SA Bundle SAs to apply together E.g. ESP in AH Security Policy Database (SPD) IPSec Processing (out) How to process traffic Bypass no IPSec Discard don t accept IPSec processing o Outbound Process o Inbound Check processing Example SPD entry Source: Dest: Action: Require IPSec processing SA: ESP/SPI 4365 SAD entry (ESP/SPI 4365) Mode: transport Algorithm: 3DES-CBC Key: Replay protection IP datagram Destination: X Protocol: TCP TCP dport: 25 SPD DST= SRC= ICMP DST=X SRC= TCP DPORT=25 SAD ESP AES KEY= REQUIRED AH SHA1 KEY= REQUIRED IPCOMP USE ESP in AH Discard if SPD says REJECT Find appropriate SAs Process according to SA bundle 7

8 IPSec Processing (in) IKE ESP in AH SAD ESP AES KEY= REQUIRED SPD DST= SRC= ICMP Discard if wrong security Problem Static SAs are inconvenient and can be insecure Solution IKE_SA_INIT AH SHA1 KEY= REQUIRED IPCOMP USE DST=X SRC= TCP DPORT=25 IP Datagram Set up SA on demand Negotiate SA parameters Protocol IKE: Internet Key Exchange IKE_AUTH IKEv1 used now Destination: X Protocol: TCP TCP dport: 25 IKEv2 accepted in 2004 CREATE_CHILD_SA Process according to SPI Check that required security was used IPSec Summary Security at the network layer Protocol family o ESP for encryption o AH for authentication o IKE for key exchange Security policy o Determined outgoing processing o Determines incoming requirements Security associations o One way connection between peers Mobility IPv6 Mobility Support Binding Updates Important changes from IPv4 No foreign agent needed Modes Route optimization To Home Agent IPSec ESP or AH Mobile Node Home Agent Correspondent Node Route optimization Bidirectional tunneling Authentication required Home Test Init Less need for tunnels New ICMP messages To Correspondent Node Care-of Test Init Home Agent Address Discovery Mobile Prefix Solicitation Return routability test Home Test Care-of Test 8

9 Binding Updates Binding Updates Home Test Init (MN CN) HI cookie Care-of Test Init (COA CN) CoI cookie Home Test (CN HA) HI cookie, home keygen token, home nonce index Care-of Test (CN COA) CoI cookie, Care-of keygen token, care-of nonce index Home Test Init Sent to acquire home keygen token Tunneled through HA Conveys home address to correspondent node Home Test Init (MN CN) HI cookie Care-of Test Init (COA CN) CoI cookie Home Test (CN HA) HI cookie, home keygen token, home nonce index Care-of Test (CN COA) CoI cookie, Care-of keygen token, care-of nonce index Care-of Test Init Sent to acquire care-of keygen token Sent directly to CN Conveys COA to correspondent node Binding Updates Binding Updates Home Test Init (MN CN) HI cookie Care-of Test Init (COA CN) CoI cookie Home Test (CN HA) HI cookie, home keygen token, home nonce index Care-of Test (CN COA) CoI cookie, Care-of keygen token, care-of nonce index Home Test Sent to convey home keygen token Tunneled through HA to mobile node Home Test Init (MN CN) HI cookie Care-of Test Init (COA CN) CoI cookie Home Test (CN HA) HI cookie, home keygen token, home nonce index Care-of Test (CN COA) CoI cookie, Care-of keygen token, care-of nonce index Care-of Test Sent to convey care-of keygen token Direct to MN Binding Updates Route Optimization Binding Update MAC, sequence number, nonce indices, COA Binding Acknowledgement MAC, seq#, status MN Binding Update Binding Ack CN Type 2 Routing Header Packets from CN sent to care-of address with type 2 routing MN extracts home address from type 2 routing Home address option Specifies home address Carried by destination option extension CN MN Source: Destination: Routing hdr: CN COA Home address MN CN Source: Destination: Home address option: COA CN Home address 9

10 Other Mobility Issues Multicast traffic Movement detection Returning home Interaction with IPSec Multiple care-of addresses Home agent discovery Home address assignment Care-of address formation 10