The IPv6 Protocol & IPv6 Standards

Transcription

1 The IPv6 Protocol & IPv6 Stadards ISP Workshops These materials are licesed uder the Creative Commos Attributio-NoCommercial 4.0 Iteratioal licese ( Last updated 7 th September

2 Ackowledgemets p This material origiated from the Cisco ISP/IXP Workshop Programme developed by Philip Smith & Barry Greee p Use of these materials is ecouraged as log as the source is fully ackowledged ad this otice remais i place p Bug fixes ad improvemets are welcomed Please workshop (at) bgp4all.com Philip Smith 2

3 IPv6 p December 1995 First Specificatio published as Proposed Stadard i RFC1883 p December 1998 Updated Specificatio published as Draft Stadard i RFC2460 Virtually all implemetatios today adhere to RFC2460 p July 2017 RFC8200 declares IPv6 as Iteret Stadard 3

4 So what has really chaged? p IPv6 does ot iteroperate with IPv4 Separate protocol workig idepedetly of IPv4 Deliberate desig itetio Simplify IP headers to remove uused or uecessary fields Fixed legth headers to make it easier for chip desigers ad software egieers 4

5 What else has chaged? p Expaded address space Address legth quadrupled to 16 bytes p Header Format Simplificatio Fixed legth, optioal headers are daisy-chaied IPv6 header is twice as log (40 bytes) as IPv4 header without optios (20 bytes) p No checksum at the IP etwork layer p No hop-by-hop fragmetatio Path MTU discovery p 64 bits aliged p Autheticatio ad Privacy Capabilities IPsec is itegrated p No more broadcast 5

6 IPv4 ad IPv6 Header Compariso Versio IHL Idetificatio Time to Live IPv4 Header Type of Service Protocol Total Legth Flags Source Address Fragmet Offset Header Checksum Versio Traffic Class Payload Legth IPv6 Header Next Header Source Address Flow Label Hop Limit Destiatio Address Optios Paddig Leged Name retaied from IPv4 to IPv6 Field ot kept i IPv6 Name ad positio chaged i IPv6 New field i IPv6 Destiatio Address 6

7 IPv6 Header p Versio = 4-bit value set to 6 p Traffic Class = 8-bit value Replaces IPv4 TOS field p Flow Label = 20-bit value p Payload Legth = 16-bit value The size of the rest of the IPv6 packet followig the header replaces IPv4 Total Legth p Next Header = 8-bit value Replaces IPv4 Protocol, ad idicates type of ext header p Hop Limit = 8-bit value Decreased by oe every IPv6 hop (IPv4 TTL couter) p Source address = 128-bit value p Destiatio address = 128-bit value 7

8 Header Format Simplificatio p Fixed legth Optioal headers are daisy-chaied p 64 bits aliged p IPv6 header is twice as log (40 bytes) as IPv4 header without optios (20 bytes) p IPv4 cotais 10 basic header fields p IPv6 cotais 6 basic header fields No checksum at the IP etwork layer No hop-by-hop fragmetatio 8

9 Header Format Extesio Headers IPv6 Header Next Header = TCP TCP Header + Data IPv6 Header Next Header = Routig Routig Header Next Header = TCP TCP Header + Data IPv6 Header Next Header = Routig Routig Header Next Header = Destiatio Destiatio Header Next Header = TCP Fragmet of TCP Header + Data p p p p All optioal fields go ito extesio headers These are daisy chaied behid the mai header The last 'extesio' header is usually the ICMP, TCP or UDP header Makes it simple to add ew features i IPv6 protocol without major re-egieerig of devices Number of extesio headers is ot fixed / limited 9

10 Header Format Commo Headers p Commo values of Next Header field: 0 Hop-by-hop optio (extesio) 2 ICMP (payload) 6 TCP (payload) 17 UDP (payload) 43 Source routig (extesio) 44 Fragmetatio (extesio) 50 Ecrypted security payload (extesio, IPSec) 51 Autheticatio (extesio, IPSec) 59 Null (No ext header) 60 Destiatio optio (extesio) 10

11 Header Format Orderig of Headers p Order is importat because: Hop-by-hop header has to be processed by every itermediate ode Routig header eeds to be processed by itermediate routers At the destiatio fragmetatio has to be processed before other headers p This makes header processig easier to implemet i hardware 11

12 Larger Address Space IPv4 = 32 bits IPv6 = 128 bits p p IPv4 32 bits = 4,294,967,296 possible addressable devices IPv6 128 bits: 4 times the size i bits = 3.4 x possible addressable devices = 340,282,366,920,938,463,463,374,607,431,768,211,456 = 4.6 x addresses per perso o the plaet 12

13 How was the IPv6 Address Size Chose? p Some wated fixed-legth, 64-bit addresses Easily good for sites, odes, at.0001 allocatio efficiecy p (3 orders of magitude more tha IPv6 requiremet) Miimizes growth of per-packet header overhead Efficiet for software processig p Some wated variable-legth, up to 160 bits Compatible with OSI NSAP addressig plas Big eough for auto-cofiguratio usig IEEE 802 addresses Could start with addresses shorter tha 64 bits & grow later p Settled o fixed-legth, 128-bit addresses 13

14 IPv6 Address Represetatio (1) p 16 bit fields i case isesitive colo hexadecimal represetatio 2031:0000:130F:0000:0000:09C0:876A:130B p Leadig zeros i a field are optioal: 2031:0:130F:0:0:9C0:876A:130B p Successive fields of 0 represeted as ::, but oly oce i a address: 2031:0:130F::9C0:876A:130B is ok 2031::130F::9C0:876A:130B is NOT ok 0:0:0:0:0:0:0:1 ::1 (loopback address) 0:0:0:0:0:0:0:0 :: (uspecified address) 14

15 IPv6 Address Represetatio (2) p :: represetatio RFC5952 recommeds that the rightmost set of :0: be replaced with :: for cosistecy p 2001:db8:0:2f::5 rather tha 2001:db8::2f:0:0:0:5 p IPv4-compatible (ot used ay more) 0:0:0:0:0:0: = :: = ::C0A8:1E01 p I a URL, it is eclosed i brackets (RFC3986) Cumbersome for users, mostly for diagostic purposes Use fully qualified domai ames (FQDN) Þ The DNS has to work!! 15

16 IPv6 Address Represetatio (3) p Prefix Represetatio Represetatio of prefix is just like IPv4 CIDR I this represetatio you attach the prefix legth Like IPv4 address: p /16 IPv6 address is represeted i the same way: p 2001:db8:12::/40 16

17 IPv6 Addressig p IPv6 Addressig rules are covered by multiple RFCs Architecture defied by RFC4291 p Address Types are : Uicast : Oe to Oe (Global, Uique Local, Lik local) Aycast : Oe to Nearest (Allocated from Uicast) Multicast : Oe to May p A sigle iterface may be assiged multiple IPv6 addresses of ay type (uicast, aycast, multicast) No Broadcast Address Use Multicast 17

18 IPv6 Addressig Type Biary Hex Uspecified ::/128 Loopback ::1/128 Global Uicast Address Uique Local Uicast Address Lik Local Uicast Address ::/ FC00::/ FE80::/10 Multicast Address FF00::/8 18

19 Global Uicast Addresses 128 Bits SPs 29 bits SP Site 64-bit Iterface ID Bits 16 Bits 2000::/3 3 Bits p Address block delegated by IETF to IANA p For distributio to the RIRs ad o to the users of the public Iteret p Global Uicast Address block is 2000::/3 This is 1/8 th of the etire available IPv6 address space 19

20 Uique-Local Addresses 128 Bits Global ID 40 Bits 64-bit Iterface ID FC00::/7 7 Bits L-bit Subet ID 16 Bits p p Uique-Local Addresses (ULAs) are NOT routable o the Iteret L-bit set to 1 which meas the address is locally assiged ULAs are used for: Isolated etworks Local commuicatios & iter-site VPNs (see 20

21 Uique-Local Typical Scearios p Isolated IPv6 etworks: Never eed public Iteret coectivity Do t eed assigmet from RIR or ISP p Local devices such as priters, telephoes, etc Coected to etworks usig Public Iteret But the devices themselves do ot commuicate outside the local etwork p Site Network Maagemet systems coectivity p Ifrastructure addressig Usig dual Global ad Uique-Local addressig p Public etworks experimetig with NPTv6 (RFC6296) Oe to oe IPv6 to IPv6 address mappig 21

22 Lik-Local Addresses 128 Bits Remaiig 54 Bits 64-bit Iterface ID FE80::/10 10 Bits p p p Lik-Local Addresses Used For: Commuicatio betwee two IPv6 device (like ARP but at Layer 3) Next-Hop calculatio i Routig Protocols Automatically assiged by Router as soo as IPv6 is eabled Madatory Address Oly Lik Specific scope p Remaiig 54 bits could be Zero or ay maual cofigured value 22

23 Multicast Addresses 128 Bits 8-bit Lifetime/Scope 112-bit Group ID FF00::/8 8 Bits p Multicast Addresses Used For: Oe to may commuicatio p 2 d octet reserved for Lifetime ad Scope p Remaider of address represets the Group ID p (Substatially larger rage tha for IPv4 which oly had /4 for Multicast) 23

24 Global Uicast IPv6 Address Allocatio /12 /32 /48 / bit Iterface ID Registry ISP prefix Site prefix LAN prefix p The allocatio process is: The IANA is allocatig out of 2000::/3 for iitial IPv6 uicast use Each registry gets a /12 prefix from the IANA Registry allocates a /32 prefix (or larger) to a IPv6 ISP Policy is that a ISP allocates a /48 prefix to each ed customer 24

25 IPv6 Addressig Scope p 64 bits reserved for the iterface ID Possibility of 2 64 hosts o oe etwork LAN I theory 18,446,744,073,709,551,616 hosts Arragemet to accommodate MAC addresses withi the IPv6 address p 16 bits reserved for the ed site Possibility of 2 16 etworks at each ed-site subets equivalet to a /12 i IPv4 (assumig a /28 or 16 hosts per IPv4 subet) 25

26 IPv6 Addressig Scope p 16 bits reserved for each service provider Possibility of 2 16 ed-sites per service provider possible customers: equivalet to each service provider receivig a /8 i IPv4 (assumig a /24 address block per customer) p 29 bits reserved for all service providers Possibility of 2 29 service providers i.e. 536,870,912 discrete service provider etworks p Although some service providers already are justifyig more tha a /32 26

27 How to get a IPv6 Address? p IPv6 address space is allocated by the 5 RIRs: AfriNIC, APNIC, ARIN, LACNIC, RIPE NCC Network Operators get address space from the RIRs Ed Users get IPv6 address space from their ISP p I the past, there were also: 6to4 tuels 2002::/16 p Iteded to give isolated IPv6 odes access to the IPv6 Iteret p Obsoleted i May 2015 (BCP196) because it was very ureliable ad totally isecure 6Boe p The experimetal IPv6 etwork lauched i the mid 1990s p Was retired o 6th Jue 2006 (RFC3701) 27

28 Aggregatio hopes Customer 2001:db8:1::/48 Customer 2001:db8:2::/48 ISP 2001:db8::/32 Oly aouces the /32 prefix IPv6 Iteret p Larger address space eables aggregatio of prefixes aouced i the global routig table p Idea was to allow efficiet ad scalable routig p But curret Iteret multihomig solutio breaks this model 28

29 Iterface IDs p Lowest order 64-bit field of uicast address may be assiged i several differet ways: Auto-cofigured from a 64-bit EUI-64, or expaded from a 48- bit MAC address (e.g., Etheret address) Auto-geerated pseudo-radom umber (to address privacy cocers) Assiged via DHCP Maually cofigured 29

30 EUI-64 Etheret MAC address (48 bits) FC 0F FC 0F FF FE 64 bits versio FF FE 17 FC 0F Scope of the EUI-64 id EUI-64 address X0 X = where X= 1 = uiversal 0 = local FF FE 17 FC 0F p EUI-64 address is formed by isertig FFFE betwee the compay-id ad the maufacturer extesio, ad settig the u bit to idicate scope Global scope: for IEEE 48-bit MAC Local scope: whe o IEEE 48-bit MAC is available (eg serials, tuels) 30

31 EUI-64 p Device MAC address is used to create: Fial 64 bits of global uicast address e.g. p 2001:db8:0:1:290:27ff:fe17:fc0f Fial 64 bits of lik local address e.g. p fe80::290:27ff:fe17:fc0f Fial 24 bits of solicited ode multicast address e.g. p ff02::1:ff17:fc0f p Note that both global uicast ad lik local addresses ca also be cofigured maually 31

32 IPv6 Addressig Examples LAN: 2001:db8:213:1::/64 Etheret0 iterface Etheret0 ipv6 address 2001:db8:213:1::/64 eui-64 MAC address: e router# show ipv6 iterface Etheret0 Etheret0 is up, lie protocol is up IPv6 is eabled, lik-local address is FE80::260:3EFF:FE47:1530 Global uicast address(es): 2001:db8:213:1:260:3EFF:FE47:1530, subet is 2001:db8:213:1::/64 Joied group address(es): FF02::1:FF47:1530 FF02::1 FF02::2 MTU is 1500 bytes 32

33 IPv6 Address Privacy (RFC4941) /16 /32 /48 / DB8 64-bit Iterface ID p p p p Temporary addresses for IPv6 host cliet applicatio, e.g. Web browser Iteded to ihibit device/user trackig but is also a potetial issue More difficult to sca all IP addresses o a subet But port sca is idetical whe a address is kow Radom 64-bit iterface ID, ru DAD before usig it Rate of chage based o local policy p Implemeted o Microsoft Widows Vista owards ad o Apple MacOS 10.7 owards Ca be activated o FreeBSD/Liux with a system call 33

34 Host IPv6 Addressig Optios p Stateless (RFC4862) SLAAC Stateless Address AutoCofiguratio Bootig ode seds a router solicitatio to request router advertisemet to get iformatio to cofigure its iterface Bootig ode cofigures its ow Lik-Local address p Stateful DHCPv6 required by most eterprises Maual like IPv4 pre-dhcp p Useful for servers ad router ifrastructure p Does t scale for typical ed user devices 34

35 IPv6 Reumberig p Reumberig Hosts Stateless: p Hosts reumberig is doe by modifyig the RA to aouce the old prefix with a short lifetime ad the ew prefix Stateful: p DHCPv6 uses same process as DHCPv4 p Reumberig Routers Router reumberig protocol was developed (RFC2894) to allow domai-iterior routers to lear of prefix itroductio / withdrawal No kow implemetatio! 35

36 Auto-cofiguratio Mac address: 00:2c:04:00:FE:56 Host autocofigured address is: prefix received + lik-layer address Seds etwork-type iformatio (prefix, default route, ) p PC seds router solicitatio (RS) message p Router respods with router advertisemet (RA) This icludes prefix ad default route RFC8106 adds DNS server optio p PC cofigures its IPv6 address by cocateatig prefix received with its EUI-64 address 36

37 Reumberig p Router seds router advertisemet (RA) This icludes the ew prefix ad default route (ad remaiig lifetime of the old address) p PC cofigures a ew IPv6 address by cocateatig prefix received with its EUI-64 address Mac address: 00:2c:04:00:FE:56 Host auto-cofigured address is: NEW prefix received + SAME lik-layer address Attaches lifetime to old address Seds NEW etwork-type iformatio (prefix, default route, ) 37

38 Multicast use p Broadcasts i IPv4 Iterrupts all devices o the LAN eve if the itet of the request was for a subset Ca completely swamp the etwork ( broadcast storm ) p Broadcasts i IPv6 Are ot used ad replaced by multicast p Multicast Eables the efficiet use of the etwork Multicast address rage is much larger 38

39 IPv6 Multicast Address p IP multicast address has a prefix FF00::/8 p The secod octet defies the lifetime ad scope of the multicast address. 8-bit 4-bit 4-bit 112-bit Lifetime Scope Group-ID Lifetime 0 If Permaet 1 If Temporary Scope 1 Node 2 Lik 5 Site 8 Orgaisatio E Global 39

40 IPv6 Multicast Address Examples p RIPg The multicast address AllRIPRouters is FF02::9 p OSPFv3 p Note that 02 meas that this is a permaet address ad has lik scope The multicast address AllSPFRouters is FF02::5 The multicast address AllDRouters is FF02::6 p EIGRP The multicast address AllEIGRPRouters is FF02::A 40

41 Solicited-Node Multicast p Solicited-Node Multicast is used for Duplicate Address Detectio Part of the Neighbour Discovery process Replaces ARP Duplicate IPv6 Addresses are rare, but still have to be tested for p For each uicast ad aycast address cofigured there is a correspodig solicited-ode multicast address This address is oly sigificat for the local lik 41

42 Solicited-Node Multicast IPv6 address Prefix Iterface ID Solicited-ode Multicast Address FF FF Lower 24 bits Lower 24 bits p Solicited-ode multicast address cosists of FF02:0:0:0:0:1:FF::/104 prefix joied with the lower 24 bits from the uicast or aycast IPv6 address 42

43 Solicited-Node Multicast R1#sh ipv6 it e0 Etheret0 is up, lie protocol is up IPv6 is eabled, lik-local address is FE80::200:CFF:FE3A:8B18 No global uicast address is cofigured Joied group address(es): FF02::1 FF02::2 Solicited-Node Multicast Address FF02::1:FF3A:8B18 MTU is 1500 bytes ICMP error messages limited to oe every 100 millisecods ICMP redirects are eabled ND DAD is eabled, umber of DAD attempts: 1 ND reachable time is millisecods ND advertised reachable time is 0 millisecods ND advertised retrasmit iterval is 0 millisecods ND router advertisemets are set every 200 secods ND router advertisemets live for 1800 secods Hosts use stateless autocofig for addresses. R1# 43

44 IPv6 Aycast p A IPv6 aycast address is a idetifier for a set of iterfaces (typically belogig to differet odes) A packet set to a aycast address is delivered to oe of the iterfaces idetified by that address (the earest oe, accordig to the routig protocol s measure of distace). RFC4291 describes IPv6 Aycast i more detail p I reality there is o kow implemetatio of IPv6 Aycast as per the RFC Most operators have chose to use IPv4 style aycast istead 44

45 Aycast o the Iteret p A global uicast address is assiged to all odes which eed to respod to a service beig offered This address is routed as part of its paret address block p The respodig ode is the oe which is closest to the requestig ode accordig to the routig protocol Each aycast ode looks idetical to the other p Applicable withi a ASN, or globally across the Iteret p Typical (IPv4) examples today iclude: Root DNS ad cctld/gtld ameservers SMTP relays ad DNS resolvers withi ISP autoomous systems 45

46 MTU Issues p Miimum lik MTU for IPv6 is 1280 octets (versus 68 octets for IPv4) Þ o liks with MTU < 1280, lik-specific fragmetatio ad reassembly must be used p Implemetatios are expected to perform path MTU discovery to sed packets bigger tha 1280 p Miimal implemetatio ca omit PMTU discovery as log as all packets kept 1280 octets p A Hop-by-Hop Optio supports trasmissio of jumbograms with up to 2 32 octets of payload 46

47 IPv6 Neighbour Discovery p Protocol defies mechaisms for the followig problems: Router discovery Prefix discovery Parameter discovery Address autocofiguratio Address resolutio Next-hop determiatio Neighbour ureachability detectio Duplicate address detectio Redirects 47

48 IPv6 Neighbour Discovery p Defied i RFC4861 p Protocol built o top of ICMPv6 (RFC 4443) Combiatio of IPv4 protocols (ARP, ICMP, IGMP, ) p Fully dyamic, iteractive betwee Hosts & Routers p Defies 5 ICMPv6 packet types: Router Solicitatio Router Advertisemet Neighbour Solicitatio Neighbour Advertisemet Redirect 48

49 IPv6 ad DNS p Hostame to IP address: IPv4 A IPv6 AAAA 2001:db8:c18:1::2 49

50 IPv6 ad DNS p IP address to Hostame: IPv i-addr.arpa. PTR IPv c.0.8.b.d ip6.arpa PTR 50

51 IPv6 Techology Scope IP Service IPv4 Solutio IPv6 Solutio Addressig Rage 32-bit, Network Address Traslatio 128-bit, Multiple Scopes Autocofiguratio DHCP DHCP, Serverless, Recofiguratio Security IPsec IPsec works Ed-to-Ed Mobility Mobile IP Mobile IP with Direct Routig Quality of Service Differetiated Service, Itegrated Service Differetiated Service, Itegrated Service Multicast IGMP, PIM, Multicast BGP MLD, PIM, Multicast BGP, Scope Idetifier 51

52 What does IPv6 do for: p Security Nothig IPv4 does t already support IPSec rus i both p QoS Nothig IPv4 does t already support Differetiated ad Itegrated Services ru i both So far, Flow label has o real use 52

53 IPv6 Security p IPsec stadards apply to both IPv4 ad IPv6 p All implemetatios required to support autheticatio ad ecryptio headers ( IPsec ) p Autheticatio separate from ecryptio for use i situatios where ecryptio is prohibited or prohibitively expesive p Key distributio protocols are ot yet defied (idepedet of IP v4/v6) p Support for maual key cofiguratio required 53

54 IP Quality of Service Remider p Two basic approaches developed by IETF: Itegrated Service (it-serv) p Fie-grai (per-flow), quatitative promises (e.g., x bits per secod), uses RSVP sigallig Differetiated Service (diff-serv) p Coarse-grai (per-class), qualitative promises (e.g., higher priority), o explicit sigallig Sigalled diff-serv (RFC2998) p Uses RSVP for sigallig with course-graied qualitative aggregate markigs p Allows for policy cotrol without requirig per-router state overhead 54

55 IPv6 Support for It-Serv p 20-bit Flow Label field to idetify specific flows eedig special QoS Each source chooses its ow Flow Label values; routers use Source Addr + Flow Label to idetify distict flows Flow Label value of 0 used whe o special QoS requested (the commo case today) p Origially stadardised as RFC

56 IPv6 Flow Label p Flow label has ot bee used sice IPv6 stadardised Suggestios for use i recet years were icompatible with origial specificatio (discussed i RFC6436) p Specificatio updated i RFC6437 RFC6438 describes the use of the Flow Label for equal cost multi-path ad lik aggregatio i Tuels 56

57 IPv6 Support for Diff-Serv p 8-bit Traffic Class field to idetify specific classes of packets eedig special QoS Same as ew defiitio of IPv4 Type-of-Service byte May be iitialized by source or by router eroute; may be rewritte by routers eroute Traffic Class value of 0 used whe o special QoS requested (the commo case today) 57

58 IPv6 Status Stadardisatio p p p Core IPv6 Specificatios are IETF Stadards Well tested & stable Years of deploymet experiece 3GPP UMTS Rel 5 cellular wireless stadards (2002) madated IPv6 Several key compoets o stadards track Specificatio (STD86) Neighbour Discovery (RFC4861) ICMPv6 (STD89) IPv6 Addresses (RFC4291 & 3587) RIP (RFC2080) BGP (RFC2545) IGMPv6 (RFC2710) OSPF (RFC5340) Router Alert (RFC2711) Jumbograms (RFC2675) Autocofiguratio (RFC4862) Radius (RFC3162) DHCPv6 (RFC3315 & 4361) Flow Label (RFC6436/7/8) IPv6 Mobility (RFC6275) Mobile IPv6 MIB (RFC4295) GRE Tuellig (RFC2473) Uique Local IPv6 Addresses (RFC4193) DAD for IPv6 (RFC4429) Teredo (RFC4380) ISIS for IPv6 (RFC5308) VRRP (RFC5798) 58

59 IPv6 Status Stadardisatio p IPv6 available over: PPP (RFC5072) FDDI (RFC2467) NBMA (RFC2491) Frame Relay (RFC2590) IEEE1394 (RFC3146) Facebook (RFC5514) LoWPAN (RFC8138) Cellular Networks (RFC6459) Etheret (RFC2464) Toke Rig (RFC2470) ATM (RFC2492) ARCet (RFC2497) FibreChael (RFC4338) MS/TP (RFC8163) DECT ULE (RFC8105) 59

60 Recet IPv6 Hot Topics p IPv6 o Mobile Networks The ed of NAT ad NAT offload p IPv4 depletio debate IANA IPv4 pool ra out o 3rd February 2011 p p IPv6 Trasitio assistace CGN, 6rd, NAT64, DS-Lite, 464XLAT p IPv6 Security Security idustry & experts takig much closer look p Multihomig Multihomig i IPv6 same as i IPv4 60

61 Coclusio p Protocol is ready to go p The core compoets have already see several years field experiece 61

62 The IPv6 Protocol & IPv6 Stadards ISP Workshops 62