IPv6 tutorial. RedIRIS Miguel Angel Sotos

Transcription

1 IPv6 tutorial RedIRIS Miguel Angel Sotos

2 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 2

3 History 70s TCP/IP developed in 1973, part of a project of the Department of Defense (ARPA agency, USA) ARPAnet network Universities and Research centers computers networks connection 3

4 History 80s 1983, ARPAnet starts using TCP/IP 1986, NSF (National Science Foundation) begins the development of NFSnet, it will be the ARPAnet substitute, being the base of the Internet 4

5 History 90s 1993, first previsions of exhaustion of IPv4 addresses IETF (Internet Engineegin Task Force) develops IPv6 specifications Initially it was IPng What happens with IPv5? Packets were marked with the version number 5, when the packets carried an experimental protocol, called ST, real time streaming. 5

6 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 6

7 Why IPv6 The main reason, more addresses But, what happens if I don t need more addresses? IPv6 is in fashion Don t loose the oportunity Simplify end to end connections No more NATs for security Tecnically: All in one Security in network layer Autoconfiguration More efficient and jerarquical routing We start again Headers are more simple 7

8 Why IPv6 And now we have a lot of devices connected to a network, even TVs, cameras, fridges everything! 8

9 Why IPv6 Countries with lack of IPv4 addresses Increasing demand Companies adopting and introducing IPv6 IPv6 support will be necessary to not be disconnected of part of the network and internet IPv6 is robust, no patches Anyway maybe IPv4 will not disappear 9

10 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 10

11 IPv6 header It s more simple 11

12 IPv6 header CLASS is the Type of Service in IPv4 HOP LIMIT is the TTL of IPv4 FLOW LABEL is used in QoS PAYLOAD LENGTH is the data length carried by the packet NEXT HEADER If I have more info, I use more headers No checksum No fragmentation, only end to end MTU discovery 12

13 IPv6 header Types of header extensions Routing Fragmentation Hop-by-hop options Destiny options Atuthentication ICMP Completely new Including IGMP 13

14 IPv6 addresses IPv million of addresses Allocation without control Fragmentation IPv6 3.4x10^38 addresses Clean slate, we start from scratch. Control, order. 128 bits to addres the world 14

15 IPv6 addresses 4 times bigger 32 to 128 bits Sintax: aaaa:bbbb:cccc:dddd:eeee:ffff:0000:1111 Hexadecimal digits in groups of 4 You can substitute a group of 0s by :: No masks, instead we have /number_of_bits (like CIDR notation in IPv4) 15

16 IPv6 addresses Addres format: Unicast, multicast, anycast Global unicast addresses start with 001 (binary) so we have addresses starting with 2 or :: or 3ffe:: No broadcast (instead, multicast) 16

17 IPv6 addresses Interface-id Last 64 bits of the address Unique in a local network The IPv6 address is asociated with the interface, not the host MAC address is mapped 17

18 IPv6 addresses Hosts addresses When I have IPv6 configured or enabled in a host, I automatically have a link-local address Starts with fe80:: Not routeable Is unique in the local network That address is configured automatially using the interface-id Used for autoconfiguration 18

19 IPv6 addresses Multicast addresses Start with FF00 First 0 is Flags (0,1 permanent, not permanent) Second 0 is scope 1 node 2 link 5 site 8 organization E global FF02::1 all the nodes of a network FF02::2 all the routers of a network 19

20 IPv6 addresses Anycast addresses Used for a group of interfaces with the same address One packet sent to that address goes to the nearest host with that address 20

21 IPv6 addresses Example of global addresses: IPv4: IPv6: 2001:0720:0418:cafe:cccc:1111:abeb:b0b0 We can summarize: 2001:720:0000:0000:0000:0000:0000:9876 is 2001:: :720:0000:0000:0000:0000:0000:0000 is 2001:720:: What will be ::/0? 21

22 IPv6 addresses How we can distribute my prefix in my network? To each one of the centers I can assign a /48 First 48 bits are fixed A network is a /64 Interface ID I have 16 bits to distribute the addresses in my center Network ID 22

23 IPv6 addresses Example, RedIRIS have 2001:0720::/32 for all the Universities and Research centers Company/Building Department Department 23

24 IPv6 addresses Special addresses Loopback ( ) is ::1 Default( /0) is ::/0 IPv6 compatible with IPv4 (for tunnels) :: IPv6 mapped over IPv4 ::FFFF: Link-local address, starts with fe80:: 24

25 Agenda History WhyIPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 25

26 Autoconfiguration New IPv6 feature (similar to IPv6 DHCP) Network administration is easier plug and play The user connects the host to the network and is automatically configured Advantage over DHCP It s not necessary an additional server 26

27 Autoconfiguration Protocol used here is neighbor discovery Hosts and network equipment exchange multicast IPv6 packets to check the host IPv6 address Duplicate IPv6 addresses detection Two types Stateful and stateless Different mechanisms that can be used in a complementary way 27

28 Autoconfiguration Stateful Manual configuration, or using DHCP Like IPv4 Stateless Completely automatic configuration It s not necessary the manual config of hosts and servers. In some cases, we need minimal network equipment configuration (routers) 28

29 Autoconfiguration Neighbour advertisement The host send a router request message ICMP type 133 The router sends a router advertisement message ICMP type 134 Include the prefix announced by the router with the TTL 29

30 Autoconfiguration The host sends the neighbour request message to check the IPv6 address of the neighbour ICMP type 135 A neighbour advertisement message is sent A router can send a change or redirection message to find the best hop for a destiny 30

31 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 31

32 DNS Now, applications behave in a different way First, they request the IPv6 addres (timeout ) If it s coded correctly, it will ask for IPv4 You have to be very careful when putting an IPv6 service in production Good connectivity You have to be very careful when configuring an IPv6 address in the DNS Deny of service! 32

33 DNS :800:400:10::71 Access to the web server (port 80) Port 80 not reachable 33

34 DNS I have configured all the hosts in my network, Also my router DNS is a must, due to the length of the addresses Bind v9 support IPv6 addresses IPv6 requests over IPv6:» options { listen-on-v6 { any; }; } IPv6 requests over IPv4 34

35 DNS It s better not to create an special zone for IPv6 (like ipv6.my_center.com) But, it can be dangerous for production services During tests, it s better ftp.ipv6.my_center.com than ftp.my_center.com Anyway, we should go for the same direct zone Direct zone We use the same config files as with IPv4 (AAAA instead of A) 35

36 DNS Reverse zone nibble-bit notation with.arpa ip6.arpa Root servers are configured to support this format Recommended and the zone which is delegated with the Registries (like RIPE) Latests versions of glibc support this format 36

37 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 37

38 Transition We cannot switch off the Internet and then switch on with IPv6 There are several mechanisms IPv4 and IPv6 can live together BUT IPv4 and IPv6 are not compatible Three types of transition mechanisms Dual-stack Based on tunnels Based on address translation 38

39 Transition Dual-stack We depend on vendors implementations My equipment support native IPv4 and native IPv6, at the the same time, parallel. More operational effort I can plan a periodic migration, step by step Network Servers Applications and services Hosts The best one It s recommended a testing period 39

40 Transition Tunnels IPv6 traffic is encapsulated in IPv4 packets I connect two IPv6 worlds separated by an IPv4 domain Automatic tunnels The host has an IPv4 compatible IPv6 address 6to4: IPv4 address of the tunnel endpoints are identified in the IPv6 prefix» We use 2002::/16 Manual tunnels Explicit configuration IPv4 tunnel endpoints IPv6 address of the tunnel interface Tunnel brokers Automatic configuration to have basic IPv6 connectivity if my network is only IPv4 40

41 Transition 6to4 I connect two IPv6 worlds isolated (IPv4 between them) The router to the Internet creates a 6to4 tunnel to the other domain The IPv4 addresses of the tunnel endpoints are included in the IPv6 prefix Used 2002::/16 Teredo Provides IPv6 connectivity behind a NAT Encapsulates IPv6 packets into UDP IPv4 They can go through the NAT and the Internet 41

42 Transition To migrate all my network to IPv6 I ll have the following problems: My hardware doesn t support IPv6 Upgrade it Use a Linux router Use an alternate router, with a tunnel to a provider I have a firewall» Not a lot of solutions» Upgrade is important 42

43 Transition Level 2 migration, integrating an IPv6 router in the same vlan Small IPv6 router 43

44 Transition More natural migration, including dual-stack 44

45 Transition Migration using Level 3 45

46 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 46

47 Security Support for IPv6+firewalls+tunnels is not widely deployed But IPv6 has IPsec The same as with IPv4, but in that case is part of the protocol (security header), less problems Security is included, as part of the IPv6 specifications Authentication Encryption 47

48 Security With the right security policies, it s not a problem to have public addresses for everyone. It s easier the network administration NAT is not necessary Problems with multimedia applications Problems with IPsec Problems with multicast Problems with end to end, peer to peer and point to point applications 48

49 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 49

50 IPv6 & Windows You can create an IPv6 tunnel against Micrsoft Good for testing With windos 2000 you have to install SP2 With Windows XP With SP1 or higher It s part of the system To install it Form properties of my network places Using CLI Netsh interface ipv6 install Without SP1 You cannot do DNS queries using IPv6 Install it using CLI Ipv6 install 50

51 IPv6 & Windows With windows Vista Installed by default You can deactivate it *With MAC (live show) 51

52 IPv6 & Linux In the latests versions, kernel has complete IPv6 support If my host has IPv6 activated In my loopback address I ll see: ::1/128 Scope: Host In the interfaces I ll see a link-local address eth0 Link encap:ethernet HWaddr 00:60:08:3A:9E:B7 inet addr: Bcast: Mask: inet6 addr: fe80::260:8ff:fe3a:9eb7/10 Scope:Link My host will be configured using the prefix that the router announces, having complete IPv6 connectivity eth0 Link encap:ethernet HWaddr 00:60:08:3A:9E:B7 inet addr: Bcast: Mask: inet6 addr: 3ffe:3328:5:1:260:8ff:fe3a:9eb7/64 Scope:Global inet6 addr: fe80::260:8ff:fe3a:9eb7/10 Scope:Link 52

53 IPv6 & Linux How-to State of the art Testing URLs 53

54 Agenda History Why IPv6 IPv6 addresses Autoconfiguration DNS Transition mechanisms Security in IPv6 IPv6 in Windows and Linux IPv6 now 54

55 IPv6 now Only the lack of addresses promoted the born of IPv6 When IPv4 addresses are going to be exhausted? 2012? But: It seems that we still have the 35% of IPv4 address space available Internet double its size each year NAT allows sharing addresses 55

56 IPv6 now Not equal deployment Asian countries with expanding economies or high population density China/Japan Quick deployment In Europe/USA, no lack of addresses Very slow deployment 56

57 IPv6 now Academic and research networks 90% of European and American networks provide native IPv6 Very few traffic, about 5-10% A good starting point We have the base for the commercial deployment The killer application? 57

58 IPv6 now In Spain 4% of Telcos provide IPv6 services research projects or testbeds more or less, ready There is no client requirements RedIRIS We offer IPv6 services since % of the centers with native IPv6 connection 25% of the final users Few traffic, about 7% of the total 58

59 Finally Transition cost low CAPEX High OPEX When IPv4 addresses will be finished? 2020?, 2030? IPv4 probably will not disappear Very large transition period IPv6 has to be familiar, we have to start playing with it in our networks 59