IPv6 Protocols & Standards. ISP Training Workshops

Transcription

1 IPv6 Protocols & Stadards ISP Traiig Workshops 1

2 So what has really chaged? p Expaded address space Address legth quadrupled to 16 bytes p Header Format Simplificatio Fixed legth, optioal headers are daisy-chaied IPv6 header is twice as log (40 bytes) as IPv4 header without optios (20 bytes) p No checksum at the IP etwork layer p No hop-by-hop segmetatio Path MTU discovery p 64 bits aliged p Autheticatio ad Privacy Capabilities IPsec is madated p No more broadcast 2

3 IPv4 ad IPv6 Header Compariso IPv4 Header IPv6 Header Versio IHL Type of Service Total Legth Versio Traffic Class Flow Label Idetificatio Flags Fragmet Offset Time to Live Protocol Header Checksum Payload Legth Next Header Hop Limit Source Address Destiatio Address Source Address Optios Paddig Leged Field s ame kept from IPv4 to IPv6 Fields ot kept i IPv6 Name ad positio chaged i IPv6 New field i IPv6 Destiatio Address 3

4 IPv6 Header p Versio = 4-bit value set to 6 p Traffic Class = 8-bit value Replaces IPv4 TOS field p Flow Label = 20-bit value p Payload Legth = 16-bit value The size of the rest of the IPv6 packet followig the header replaces IPv4 Total Legth p Next Header = 8-bit value Replaces IPv4 Protocol, ad idicates type of ext header p Hop Limit = 8-bit value Decreased by oe every IPv6 hop (IPv4 TTL couter) p Source address = 128-bit value p Destiatio address = 128-bit value 4

5 Header Format Simplificatio p Fixed legth Optioal headers are daisy-chaied p 64 bits aliged p IPv6 header is twice as log (40 bytes) as IPv4 header without optios (20 bytes) p IPv4 cotais 10 basic header fields p IPv6 cotais 6 basic header fields No checksum at the IP etwork layer No hop-by-hop fragmetatio 5

6 Header Format Extesio Headers IPv6 Header Next Header = TCP TCP Header + Data IPv6 Header Next Header = Routig Routig Header Next Header = TCP TCP Header + Data IPv6 Header Next Header = Routig Routig Header Next Header = Destiatio Destiatio Header Next Header = TCP Fragmet of TCP Header + Data p p p p All optioal fields go ito extesio headers These are daisy chaied behid the mai header The last 'extesio' header is usually the ICMP, TCP or UDP header Makes it simple to add ew features i IPv6 protocol without major re-egieerig of devices Number of extesio headers is ot fixed / limited 6

7 Header Format Commo Headers p Commo values of Next Header field: 0 Hop-by-hop optio (extesio) 2 ICMP (payload) 6 TCP (payload) 17 UDP (payload) 43 Source routig (extesio) 44 Fragmetatio (extesio) 50 Ecrypted security payload (extesio, IPSec) 51 Autheticatio (extesio, IPSec) 59 Null (No ext header) 60 Destiatio optio (extesio) 7

8 Header Format Orderig of Headers p Order is importat because: Hop-by-hop header has to be processed by every itermediate ode Routig header eeds to be processed by itermediate routers At the destiatio fragmetatio has to be processed before other headers p This makes header processig easier to implemet i hardware 8

9 Larger Address Space IPv4 = 32 bits IPv6 = 128 bits p p IPv4 IPv6 32 bits = 4,294,967,296 possible addressable devices 128 bits: 4 times the size i bits = 3.4 x possible addressable devices = 340,282,366,920,938,463,463,374,607,431,768,211,456 ~ 5 x addresses per perso o the plaet 9

10 How was the IPv6 Address Size Chose? p Some wated fixed-legth, 64-bit addresses Easily good for sites, odes, at.0001 allocatio efficiecy p (3 orders of magitude more tha IPv6 requiremet) Miimizes growth of per-packet header overhead Efficiet for software processig p Some wated variable-legth, up to 160 bits Compatible with OSI NSAP addressig plas Big eough for auto-cofiguratio usig IEEE 802 addresses Could start with addresses shorter tha 64 bits & grow later p Settled o fixed-legth, 128-bit addresses 10

11 IPv6 Address Represetatio (1) p 16 bit fields i case isesitive colo hexadecimal represetatio 2031:0000:130F:0000:0000:09C0:876A:130B p Leadig zeros i a field are optioal: 2031:0:130F:0:0:9C0:876A:130B p Successive fields of 0 represeted as ::, but oly oce i a address: 2031:0:130F::9C0:876A:130B is ok 2031::130F::9C0:876A:130B is NOT ok 0:0:0:0:0:0:0:1 ::1 (loopback address) 0:0:0:0:0:0:0:0 :: (uspecified address) 11

12 IPv6 Address Represetatio (2) p :: represetatio RFC5952 recommeds that the rightmost set of :0: be replaced with :: for cosistecy p 2001:db8:0:2f::5 rather tha 2001:db8::2f:0:0:0:5 p IPv4-compatible (ot used ay more) 0:0:0:0:0:0: = :: = ::C0A8:1E01 p I a URL, it is eclosed i brackets (RFC3986) Cumbersome for users, mostly for diagostic purposes Use fully qualified domai ames (FQDN) Þ The DNS has to work!! 12

13 IPv6 Address Represetatio (3) p Prefix Represetatio Represetatio of prefix is just like IPv4 CIDR I this represetatio you attach the prefix legth Like IPv4 address: p /16 IPv6 address is represeted i the same way: p 2001:db8:12::/40 13

14 IPv6 Addressig p IPv6 Addressig rules are covered by multiple RFCs Architecture defied by RFC 4291 p Address Types are : Uicast : Oe to Oe (Global, Uique Local, Lik local) Aycast : Oe to Nearest (Allocated from Uicast) Multicast : Oe to May p A sigle iterface may be assiged multiple IPv6 addresses of ay type (uicast, aycast, multicast) No Broadcast Address Use Multicast 14

15 IPv6 Addressig Type Biary Hex Uspecified ::/128 Loopback ::1/128 Global Uicast Address Lik Local Uicast Address Uique Local Uicast Address ::/ FE80::/ FC00::/7 Multicast Address FF00::/8 15

16 IPv6 Address Allocatio /12 /32 /48 / db8 Iterface ID Registry ISP prefix Site prefix LAN prefix p The allocatio process is: The IANA is allocatig out of 2000::/3 for iitial IPv6 uicast use Each registry gets a /12 prefix from the IANA Registry allocates a /32 prefix (or larger) to a IPv6 ISP Policy is that a ISP allocates a /48 prefix to each ed customer 16

17 IPv6 Addressig Scope p 64 bits reserved for the iterface ID Possibility of 2 64 hosts o oe etwork LAN I theory 18,446,744,073,709,551,616 hosts Arragemet to accommodate MAC addresses withi the IPv6 address p 16 bits reserved for the ed site Possibility of 2 16 etworks at each ed-site subets equivalet to a /12 i IPv4 (assumig a /28 or 16 hosts per IPv4 subet) 17

18 IPv6 Addressig Scope p 16 bits reserved for each service provider Possibility of 2 16 ed-sites per service provider possible customers: equivalet to each service provider receivig a /8 i IPv4 (assumig a /24 address block per customer) p 29 bits reserved for all service providers Possibility of 2 29 service providers i.e. 536,870,912 discrete service provider etworks p Although some service providers already are justifyig more tha a /32 18

19 How to get a IPv6 Address? p IPv6 address space is allocated by the 5 RIRs: AfriNIC, APNIC, ARIN, LACNIC, RIPE NCC ISPs get address space from the RIRs Eterprises get their IPv6 address space from their ISP p 6to4 tuels 2002::/16 Last resort oly ad ow mostly useless p (6Boe) Was the IPv6 experimetal etwork sice the mid 90s Now retired, ed of service was 6th Jue 2006 (RFC3701) 19

20 Aggregatio hopes Customer o :db8:1:/48 Customer o :db8:2:/48 ISP 2001:db8::/32 Oly aouces the /32 prefix IPv6 Iteret p Larger address space eables aggregatio of prefixes aouced i the global routig table p Idea was to allow efficiet ad scalable routig p But curret Iteret multihomig solutio breaks this model 20

21 Iterface IDs p Lowest order 64-bit field of uicast address may be assiged i several differet ways: Auto-cofigured from a 64-bit EUI-64, or expaded from a 48-bit MAC address (e.g., Etheret address) Auto-geerated pseudo-radom umber (to address privacy cocers) Assiged via DHCP Maually cofigured 21

22 EUI-64 Etheret MAC address (48 bits) FC 0F FC 0F FF FE 64 bits versio FF FE 17 FC 0F Scope of the EUI-64 id EUI-64 address X0 X = where X= 1 = uiversal 0 = local FF FE 17 FC 0F p EUI-64 address is formed by isertig FFFE betwee the compay-id ad the maufacturer extesio, ad settig the u bit to idicate scope Global scope: for IEEE 48-bit MAC 22 Local scope: whe o IEEE 48-bit MAC is available (eg serials, tuels)

23 IPv6 Addressig Examples LAN: 2001:db8:213:1::/64 Etheret0 iterface Etheret0 ipv6 address 2001:db8:213:1::/64 eui-64 MAC address: e router# show ipv6 iterface Etheret0 Etheret0 is up, lie protocol is up IPv6 is eabled, lik-local address is FE80::260:3EFF:FE47:1530 Global uicast address(es): 2001:db8:213:1:260:3EFF:FE47:1530, subet is 2001:db8:213:1::/64 Joied group address(es): FF02::1:FF47:1530 FF02::1 FF02::2 MTU is 1500 bytes 23

24 IPv6 Address Privacy (RFC 4941) /12 /32 /48 / db8 Iterface ID p p p p p Temporary addresses for IPv6 host cliet applicatio, e.g. Web browser Iteded to ihibit device/user trackig but is also a potetial issue More difficult to sca all IP addresses o a subet But port sca is idetical whe a address is kow Radom 64 bit iterface ID, ru DAD before usig it Rate of chage based o local policy Implemeted o Microsoft Widows XP/Vista/7 ad Apple MacOS 10.7 owards Ca be activated o FreeBSD/Liux with a system call 24

25 Host IPv6 Addressig Optios p Stateless (RFC4862) SLAAC Stateless Address AutoCofiguratio Bootig ode seds a router solicitatio to request router advertisemet to get iformatio to cofigure its iterface Bootig ode cofigures its ow Lik-Local address p Stateful DHCPv6 required by most eterprises Maual like IPv4 pre-dhcp p Useful for servers ad router ifrastructure p Does t scale for typical ed user devices 25

26 IPv6 Reumberig p Reumberig Hosts Stateless: p Hosts reumberig is doe by modifyig the RA to aouce the old prefix with a short lifetime ad the ew prefix Stateful: p DHCPv6 uses same process as DHCPv4 p Reumberig Routers Router reumberig protocol was developed (RFC 2894) to allow domai-iterior routers to lear of prefix itroductio / withdrawal No kow implemetatio! 26

27 Auto-cofiguratio Mac address: 00:2c:04:00:FE:56 Host autocofigured address is: prefix received + lik-layer address Seds etwork-type iformatio (prefix, default route, ) p PC seds router solicitatio (RS) message p Router respods with router advertisemet (RA) This icludes prefix ad default route RFC6106 adds DNS server optio p PC cofigures its IPv6 address by cocateatig prefix received with its EUI-64 address 27

28 Reumberig Mac address: 00:2c:04:00:FE:56 Host auto-cofigured address is: NEW prefix received + SAME lik-layer address p Router seds router advertisemet (RA) This icludes the ew prefix ad default route (ad remaiig lifetime of the old address) p PC cofigures a ew IPv6 address by cocateatig prefix received with its EUI-64 address Attaches lifetime to old address Seds NEW etwork-type iformatio (prefix, default route, ) 28

29 Uique-Local 128 Bits Global ID 40 Bits Iterface ID FC00::/7 Subet ID 16 Bits 7 Bits p Uique-Local Addresses Used For: Local commuicatios & iter-site VPNs Local devices such as priters, telephoes, etc Site Network Maagemet systems coectivity p Not routable o the Iteret p Reivetio of the deprecated site-local? 29

30 Lik-Local 128 Bits Remaiig 54 Bits Iterface ID FE80::/10 10 Bits p p p p Lik-Local Addresses Used For: Commuicatio betwee two IPv6 device (like ARP but at Layer 3) Next-Hop calculatio i Routig Protocols Automatically assiged by Router as soo as IPv6 is eabled Madatory Address Oly Lik Specific scope Remaiig 54 bits could be Zero or ay maual cofigured value 30

31 Multicast use p Broadcasts i IPv4 Iterrupts all devices o the LAN eve if the itet of the request was for a subset Ca completely swamp the etwork ( broadcast storm ) p Broadcasts i IPv6 Are ot used ad replaced by multicast p Multicast Eables the efficiet use of the etwork Multicast address rage is much larger 31

32 IPv6 Multicast Address p IP multicast address has a prefix FF00::/8 p The secod octet defies the lifetime ad scope of the multicast address. 8-bit 4-bit 4-bit 112-bit Lifetime Scope Group-ID Lifetime 0 If Permaet 1 If Temporary Scope 1 Node 2 Lik 5 Site 8 Orgaisatio E Global 32

33 IPv6 Multicast Address Examples p RIPg The multicast address AllRIPRouters is FF02::9 p OSPFv3 p Note that 02 meas that this is a permaet address ad has lik scope The multicast address AllSPFRouters is FF02::5 The multicast address AllDRouters is FF02::6 p EIGRP The multicast address AllEIGRPRouters is FF02::A 33

34 Solicited-Node Multicast p Solicited-Node Multicast is used for Duplicate Address Detectio Part of the Neighbour Discovery process Replaces ARP Duplicate IPv6 Addresses are rare, but still have to be tested for p For each uicast ad aycast address cofigured there is a correspodig solicited-ode multicast address This address is oly sigificat for the local lik 34

35 Solicited-Node Multicast Address p Solicited-ode multicast address cosists of FF02:0:0:0:0:1:FF::/104 prefix joied with the lower 24 bits from the uicast or aycast IPv6 address 35

36 Solicited-Node Multicast R1#sh ipv6 it e0 Etheret0 is up, lie protocol is up IPv6 is eabled, lik-local address is FE80::200:CFF:FE3A:8B18 No global uicast address is cofigured Joied group address(es): FF02::1 FF02::2 Solicited-Node Multicast Address FF02::1:FF3A:8B18 MTU is 1500 bytes ICMP error messages limited to oe every 100 millisecods ICMP redirects are eabled ND DAD is eabled, umber of DAD attempts: 1 ND reachable time is millisecods ND advertised reachable time is 0 millisecods ND advertised retrasmit iterval is 0 millisecods ND router advertisemets are set every 200 secods ND router advertisemets live for 1800 secods Hosts use stateless autocofig for addresses. R1# 36

37 IPv6 Aycast p A IPv6 aycast address is a idetifier for a set of iterfaces (typically belogig to differet odes) A packet set to a aycast address is delivered to oe of the iterfaces idetified by that address (the earest oe, accordig to the routig protocol s measure of distace). RFC4291 describes IPv6 Aycast i more detail p I reality there is o kow implemetatio of IPv6 Aycast as per the RFC Most operators have chose to use IPv4 style aycast istead 37

38 Aycast o the Iteret p A global uicast address is assiged to all odes which eed to respod to a service beig offered This address is routed as part of its paret address block p The respodig ode is the oe which is closest to the requestig ode accordig to the routig protocol Each aycast ode looks idetical to the other p Applicable withi a ASN, or globally across the Iteret p Typical (IPv4) examples today iclude: Root DNS ad cctld/gtld ameservers SMTP relays ad DNS resolvers withi ISP autoomous systems 38

39 MTU Issues p Miimum lik MTU for IPv6 is 1280 octets (versus 68 octets for IPv4) Þ o liks with MTU < 1280, lik-specific fragmetatio ad reassembly must be used p Implemetatios are expected to perform path MTU discovery to sed packets bigger tha 1280 p Miimal implemetatio ca omit PMTU discovery as log as all packets kept 1280 octets p A Hop-by-Hop Optio supports trasmissio of jumbograms with up to 2 32 octets of payload 39

40 IPv6 Neighbour Discovery p Protocol defies mechaisms for the followig problems: Router discovery Prefix discovery Parameter discovery Address autocofiguratio Address resolutio Next-hop determiatio Neighbour ureachability detectio Duplicate address detectio Redirects 40

41 IPv6 Neighbour Discovery p Defied i RFC 4861 p Protocol built o top of ICMPv6 (RFC 4443) Combiatio of IPv4 protocols (ARP, ICMP, IGMP, ) p Fully dyamic, iteractive betwee Hosts & Routers p Defies 5 ICMPv6 packet types: Router Solicitatio Router Advertisemet Neighbour Solicitatio Neighbour Advertisemet Redirect 41

42 IPv6 ad DNS p Hostame to IP address: IPv4 A IPv6 AAAA 2001:db8:c18:1::2 42

43 IPv6 ad DNS p IP address to Hostame: IPv i-addr.arpa. PTR IPv c.0.8.b.d ip6.arpa PTR 43

44 IPv6 Techology Scope IP Service IPv4 Solutio IPv6 Solutio 32-bit, Network Address Traslatio 128-bit, Multiple Scopes Autocofiguratio DHCP Serverless, Recofiguratio, DHCP Security IPSec IPSec Madated, works Ed-to-Ed Mobility Mobile IP Mobile IP with Direct Routig Addressig Rage Quality-ofService IP Multicast Differetiated Service, Itegrated Service IGMP/PIM/Multicast BGP Differetiated Service, Itegrated Service MLD/PIM/Multicast BGP, Scope Idetifier 44

45 What does IPv6 do for: p Security Nothig IPv4 does t do IPSec rus i both But IPv6 madates IPSec p QoS Nothig IPv4 does t do p Differetiated ad Itegrated Services ru i both p So far, Flow label has o real use 45

46 IPv6 Security p IPsec stadards apply to both IPv4 ad IPv6 p All implemetatios required to support autheticatio ad ecryptio headers ( IPsec ) p Autheticatio separate from ecryptio for use i situatios where ecryptio is prohibited or prohibitively expesive p Key distributio protocols are ot yet defied (idepedet of IP v4/v6) p Support for maual key cofiguratio required 46

47 IP Quality of Service Remider p Two basic approaches developed by IETF: Itegrated Service (it-serv) p Fie-grai (per-flow), quatitative promises (e.g., x bits per secod), uses RSVP sigallig Differetiated Service (diff-serv) p Coarse-grai (per-class), qualitative promises (e.g., higher priority), o explicit sigallig Sigalled diff-serv (RFC 2998) p Uses RSVP for sigallig with course-graied qualitative aggregate markigs p Allows for policy cotrol without requirig per-router state overhead 47

48 IPv6 Support for It-Serv p 20-bit Flow Label field to idetify specific flows eedig special QoS Each source chooses its ow Flow Label values; routers use Source Addr + Flow Label to idetify distict flows Flow Label value of 0 used whe o special QoS requested (the commo case today) p Origially stadardised as RFC

49 IPv6 Flow Label p Flow label has ot bee used sice IPv6 stadardised Suggestios for use i recet years were icompatible with origial specificatio (discussed i RFC6436) p Specificatio updated i RFC6437 RFC6438 describes the use of the Flow Label for equal cost multi-path ad lik aggregatio i Tuels 49

50 IPv6 Support for Diff-Serv p 8-bit Traffic Class field to idetify specific classes of packets eedig special QoS Same as ew defiitio of IPv4 Type-of- Service byte May be iitialized by source or by router eroute; may be rewritte by routers eroute Traffic Class value of 0 used whe o special QoS requested (the commo case today) 50

51 IPv6 Stadards p Core IPv6 specificatios are IETF Draft Stadards well-tested & stable IPv6 base spec, ICMPv6, Neighbor Discovery, PMTU Discovery,... p Other importat specs are further behid o the stadards track, but i good shape Mobile IPv6, header compressio,... For up-to-date status: p 3GPP UMTS Rel. 5 cellular wireless stadards madate IPv6; also beig cosidered by 3GPP2 51

52 IPv6 Status Stadardisatio p p Several key compoets o stadards track Specificatio (RFC2460) Neighbour Discovery (RFC4861) ICMPv6 (RFC4443) IPv6 Addresses (RFC4291 & 3587) RIP (RFC2080) BGP (RFC2545) IGMPv6 (RFC2710) OSPF (RFC5340) Router Alert (RFC2711) Jumbograms (RFC2675) Autocofiguratio (RFC4862) Radius (RFC3162) DHCPv6 (RFC3315 & 4361) Flow Label (RFC6436/7/8) IPv6 Mobility (RFC3775) Mobile IPv6 MIB (RFC4295) GRE Tuellig (RFC2473) Uique Local IPv6 Addresses (RFC4193) DAD for IPv6 (RFC4429) Teredo (RFC4380) ISIS for IPv6 (RFC5308) VRRP (RFC5798) IPv6 available over: PPP (RFC5072) Etheret (RFC2464) FDDI (RFC2467) Toke Rig (RFC2470) NBMA (RFC2491) ATM (RFC2492) Frame Relay (RFC2590) ARCet (RFC2497) IEEE1394 (RFC3146) FibreChael (RFC4338) Facebook (RFC5514) 52

53 Recet IPv6 Hot Topics p IPv4 depletio debate IANA IPv4 pool ra out o 3rd February 2011 p p IPv6 Trasitio assistace CGN, 6rd, NAT64, IVI, DS-Lite, 6to4, A+P p Mobile IPv6 p Multihomig SHIM6 dead, Multihomig i IPv6 same as i IPv4 p IPv6 Security Security idustry & experts takig much closer look 53

54 Coclusio p Protocol is ready to go p The core compoets have already see several years field experiece 54

55 IPv6 Protocols & Stadards ISP Traiig Workshops 55