IPv6 Addressing. ISP Workshops

Transcription

1 IPv6 Addressig ISP Workshops These materials are licesed uder the Creative Commos Attributio-NoCommercial 4.0 Iteratioal licese ( Last updated 21 st October

2 Ackowledgemets p This material origiated from the Cisco ISP/IXP Workshop Programme developed by Philip Smith & Barry Greee p Use of these materials is ecouraged as log as the source is fully ackowledged ad this otice remais i place p Bug fixes ad improvemets are welcomed Please workshop (at) bgp4all.com Philip Smith 2

3 Ageda p Recap: how it worked with IPv4 p Gettig IPv6 address space p Costructig a scalable IPv6 address pla p IPv6 addressig o LANs p IPv6 address pla example 3

4 How it used to be Lookig back at IPv4 4

5 How did it work for IPv4? p Up util 1994: Operators applied to IterNIC for address space p 1993 owards: icluded RIPE NCC ad APNIC Class A: Big orgaisatios Class B: Medium orgaisatios p From 1992 owards, multiple class Cs ofte haded out istead of sigle class Bs Class C: Small orgaisatios p From 1994 owards (classless Iteret) Address space distributed by IterNIC (replaced by ARIN i 1998) ad the other RIRs Distributio accordig to demostrated eed (ot wat) 5

6 IPv4 address plas (pre 1994)? p Prior to 1994, doig a address pla i IPv4 was very simple p Class C was used for oe LAN If etity had more tha oe LAN, they d ormally get a class B p A orgaisatio with a class B had 256 possible LANs Ad that was more tha most etworks had i those days p Orgaisatios with more tha 256 LANs teded to be Uiversities, big IT compaies, etc They either had multiple class Bs, or eve a class A 6

7 Typical early 90s address pla p Orgaisatio was ot coected to the Iteret as such But used TCP/IP iterally p Would geerally use /8 Or ay other class A that IterNIC had ot haded out p 10.X.Y.Z was a typical layout, where: X = buildig umber Y = floor umber Z = host address Where each subet was a /24 (like a class C) p Whe these orgaisatios coected to the Iteret, they had to reumber Ofte ito a /19 (the miimum allocatio the) 7

8 IPv4 address plas (post 1994)? p I the classful Iteret days, IP address plaig did t really exist The address space was big eough for most eeds, as the umber of devices ad LANs were small p With the arrival of classless Iteret, ad IPv4 ru out i the early 90s IP address plaig was eeded Orgaisatios got address space accordig to demostrated eed p A previous class B might ow oly get a /19 p LANs o loger were automatically /24s p etc 8

9 IPv4 address plas (post 1994)? p Advet of NAT assisted with delayig IPv4 ruout Ed-user got sigle public address, ad NATed o to that address p (Ed-users could get lazy agai) p Operators became more careful: RIR policy required demostrated eed p Further allocatios made oly whe existig allocatios were prove to be mostly used up Started assigig address space across backboe accordig to the eeds of the ifrastucture p No gaps, but still o real pla p /30s for poit-to-poit liks etc p Although the plas ofte separated ifrastructure address space from what wet to customers 9

10 IPv4 address plas (today) p Chaotic? p Ustructured? p Udocumeted? p With IPv4 address space almost all depleted Operators becomig ever more creative Operators extractig the last drops from their address space holdigs It is a scramble just to keep etwork ifrastructure addressed with public IPv4 Some operators eve use NAT withi their backboes Some operators are reclaimig IPv4 address space loaed to their customers This hotch potch caot ad does ot lead to good plaig 10

11 IPv4 address plas (today) p More serious issues because of the lack of structure, lack of plaig: Ifrastructure security filters become very hard to maage p Addig yet aother small block of IPv4 addresses to perimeter ad cotrol plae filters Traffic egieerig is more challegig p Lots of small blocks of address space to maage ad maipulate p With impacts o size of the global routig table too! Ifrastructure addressig is difficult to maage p Loopbacks ad backboe poit-to-poit liks o loger out of oe cotiguous block Access address pool resizig p Broadbad access pools reumberig, reassigig, etc 11

12 IPv6 p IPv6 chages all this p Address space delegatios are geerous Remiders of the old days of classful IPv4 p No NAT p Address plaig is very possible p Address plaig is very ecessary p Documetatio is very ecessary p Operators accustomed to hadlig IPv4 i the 1980s ad early 1990s might be able to use those old skills for IPv6! 12

13 IPv6 Address Plaig 13

14 Where to get IPv6 addresses p Your upstream ISP p Africa AfriNIC p Asia ad the Pacific APNIC p North America ARIN p Lati America ad the Caribbea LACNIC p Europe ad Middle East RIPE NCC 14

15 Iteret Registry Regios 15

16 Gettig IPv6 address space (1) p From your Regioal Iteret Registry Become a member of your Regioal Iteret Registry ad get your ow allocatio p Membership ope to all orgaisatios who are operatig a etwork Address allocatio policies listed o the idividual RIR website Miimum allocatio is a /32 (or larger if you will have more tha 65k /48 assigmets) 16

17 Gettig IPv6 address space (2) p From your upstream ISP Receive a /48 from upstream ISP s IPv6 address block Receive more tha oe /48 if you have more tha 65k subets p If you eed to multihome: Apply for a /48 assigmet from your RIR Multihomig with the provider s /48 will be operatioally challegig p Provider policies, filters, etc 17

18 Do NOT use 6to4 p Some etities still use 6to4 Deprecated i May 2015 due to serious operatioal ad security issues Read (BCP196) for the reasoig why p FYI: 6to4 operatio: Take a sigle public IPv4 /32 address 2002:<ipv4 /32 address>::/48 becomes your IPv6 address block, givig 65k subets Requires a 6to4 gateway 6to4 is a meas of coectig IPv6 islads across the IPv4 Iteret 18

19 Nibble Boudaries p IPv6 offers etwork operators more flexibility with addressig plas Network addressig ca ow be doe o ibble boudaries p For ease of operatio Rather tha makig maximum use of a very scarce resource p With the resultig operatioal complexity p A ibble boudary meas subettig address space based o the address umberig Each umber i IPv6 represets 4 bits = 1 ibble Which meas that IPv6 addressig ca be doe o 4-bit boudaries 19

20 Nibble Boudaries example p Cosider the address block 2001:db8:0:10::/61 The rage of addresses i this block are: 2001:0db8:0000:0010:0000:0000:0000:0000 to 2001:0db8:0000:0017:ffff:ffff:ffff:ffff Note that this subet oly rus from 0010 to The adjacet block is 2001:db8:0:18::/ :0db8:0000:0018:0000:0000:0000:0000 to 2001:0db8:0000:001f:ffff:ffff:ffff:ffff The address blocks do t use the etire ibble rage 20

21 Nibble Boudaries example p Now cosider the address block 2001:db8:0:10::/60 The rage of addresses i this block are: 2001:0db8:0000:0010:0000:0000:0000:0000 to 2001:0db8:0000:001f:ffff:ffff:ffff:ffff Note that this subet uses the etire ibble rage, 0 to f Which makes the umberig pla for IPv6 simpler p This rage ca have a particular meaig withi the ISP block (for example, ifrastructure addressig for a particular PoP) 21

22 Addressig Plas Ifrastructure p All Network Operators should obtai a /32 from their RIR p Address block for router loop-back iterfaces Number all loopbacks out of oe /64 /128 per loopback p Address block for ifrastructure (backboe) /48 allows 65k subets /48 per regio (for the largest multi-atioal etworks) /48 for whole backboe (for the majority of etworks) Ifrastructure/backboe usually does NOT require regioal/geographical addressig Summarise betwee sites if it makes sese 22

23 Addressig Plas Ifrastructure p What about LANs? /64 per LAN p What about Poit-to-Poit liks? Protocol desig expectatio is that /64 is used /127 ow recommeded/stadardised p p (reserve /64 for the lik, but address it as a /127) Other optios: p /126s are beig used (mimics IPv4 /30) p /112s are beig used Leaves fial 16 bits free for ode IDs p Some discussio about /80s, /96s ad /120s too p Some equipmet does t support /127s L 23

24 Addressig Plas Ifrastructure p NOC: ISP NOC is trusted etwork ad usually cosidered part of ifrastructure /48 p Cotais maagemet ad moitorig systems p Hosts the etwork operatios staff p take the last /60 (allows eough subets) p Critical Services: Network Operator s critical services are part of the trusted etwork ad should be cosidered part of the ifrastructure /48 For example, Aycast DNS, SMTP, POP3/IMAP, etc p Take the secod /64 p (some operators use the first /64 istead) 24

25 Addressig Plas ISP to Customer p Optio Oe: Use ipv6 uumbered Which meas o global uicast ipv6 address o the poit-to-poit lik Router adopts the specified iterface s IPv6 address p Router does t actually eed a global uicast IPv6 address to forward packets iterface loopback 0 ipv6 address 2001:db8::1/128 iterface serial 1/0 ipv6 address uumbered loopback 0 25

26 Addressig Plas ISP to Customer p Optio Two: Use the secod /48 for poit-to-poit liks Divide this /48 up betwee PoPs Example: p For 10 PoPs, dividig ito 16, gives /52 per PoP p Each /52 gives 4096 poit-to-poit liks p Adjust to suit! Useful if ISP moitors poit-to-poit lik state for customers p Lik addresses are utrusted, so do ot wat them i the first /48 used for the backboe &c Aggregate per router or per PoP ad carry i ibgp (ot ISIS/OSPF) 26

27 Addressig Plas Customer p Customers get oe /48 p p Uless they have more tha 65k subets i which case they get a secod /48 (ad so o) I typical deploymets today: Several ISPs are givig small customers a /56 ad sigle LAN ed-sites a /64, e.g.: p /64 if ed-site will oly ever be a LAN (ot recommeded!!) p /56 for small ed-sites (e.g. home/office/small busiess) p /48 for large ed-sites Observatios: This is a very active discussio area Do t assume that a mobile edsite eeds oly a /64 3GPP Release 10 itroduces DHCPv6-PD for tetherig Some operators are distributig /60s to their smallest customers!! 27

28 Addressig Plas Customer p Broadbad Example: DHCPv6 pool is a /48 p DHCPv6 hads out /56 per customer p Which allows for 256 customers per pool If BRAS has more tha 256 customers, icrease pool to a /47 p This allows for 512 customers at /56 per customer The whole ibble (/44) allows for 4096 delegatios I all cases, BRAS aouces etire pool as oe block by ibgp 28

29 Addressig Plas Customer p Busiess leased lie : /48 per customer Oe stop shop, o eed for customer to revisit ISP for more addresses util all 65k subets are used up p Hosted services: Oe physical server per vlan Oe /64 per vlan How may vlans per PoP? /48 reserved for etire hosted servers across backboe p Iteral sites will be subets ad carried by ibgp 29

30 Addressig Plas Customer p Geographical delegatios to Customers: Network Operator subdivides /32 address block ito geographical chuks E.g. ito /36s p Regio 1: 2001:db8:1xxx::/36 p Regio 2: 2001:db8:2xxx::/36 p Regio 3: 2001:db8:3xxx::/36 p etc Which gives 4096 /48s per regio For Operatioal ad Admiistrative ease Beefits for traffic egieerig if Network Operator multihomes i each regio 30

31 Addressig Plas Customer p Sequetial delegatios to Customers: After carvig off address space for etwork ifrastructure, Network Operator simply assigs address space sequetially Eg: p Ifrastructure: p Customer P2P: p Customer 1: p Customer 2: p etc 2001:db8:0::/ :db8:1::/ :db8:2::/ :db8:3::/48 Useful whe there is o regioal subdivisio of etwork ad o regioal multihomig eeds 31

32 Addressig Plas Routig Cosideratios p Carry Broadbad pools i ibgp across the backboe Not i OSPF/ISIS p Multiple Broadbad pools o oe BRAS should be aggregated if possible Reduce load o ibgp p Aggregatig leased lie customer address blocks per router or per PoP is udesirable: Iterferes with ISP s traffic egieerig eeds Iterferes with ISP s service quality ad service guaratees 32

33 Addressig Plas Traffic Egieerig p Smaller providers will be sigle homed The customer portio of the ISP s IPv6 address block will usually be assiged sequetially p Larger providers will be multihomed Two, three or more exteral liks from differet providers Traffic egieerig becomes importat Sequetial assigmets of customer addresses will egatively impact load balacig 33

34 Addressig Plas Traffic Egieerig p ISP Router loopbacks ad backboe poit-to-poit liks make up a small part of total address space Ad they do t attract traffic, ulike customer address space p Liks from ISP Aggregatio edge to customer router eeds oe /64 Small requiremets compared with total address space Some ISPs use IPv6 uumbered p Plaig customer assigmets is a very importat part of multihomig Traffic egieerig ivolves subdividig aggregate ito pieces util load balacig works 34

35 Uplaed IP addressig p ISP fills up customer IP addressig from oe ed of the rage: 2001:db8::/32 p Customers geerate traffic Dividig the rage ito two pieces will result i oe /33 with all the customers ad the ISP ifrastructure the addresses, ad oe /33 with othig No loadbalacig as all traffic will come i the first /33 ISP Customer Addresses Meas further subdivisio of the first /33 = harder work 35

36 Plaed IP addressig p If ISP fills up customer addressig from both eds of the rage: 2001:db8::/ ISP Customer Addresses Customer Addresses p Scheme the is: First customer from first /33, secod customer from secod /33, third from first /33, etc p This works also for residetial versus commercial customers: Residetial from first /33 Commercial from secod /33 36

37 Plaed IP Addressig p This works fie for multihomig betwee two upstream liks (same or differet providers) p Ca also subdivide address space to suit more tha two upstreams Follow a similar scheme for populatig each portio of the address space p Cosider regioal (geographical) distributio of customer delegated address space p Do t forget to always aouce a aggregate out of each lik 37

38 Addressig Plas Advice p Customer address assigmets should ot be reserved or assiged o a per PoP basis Follow same priciple as for IPv4 Subet aggregate to cater for multihomig eeds Cosider regioal delegatio ISP ibgp carries customer ets Aggregatio withi the ibgp ot required ad usually ot desirable Aggregatio i ebgp is very ecessary p Backboe ifrastructure assigmets: Number out of a sigle /48 p Operatioal simplicity ad security Aggregate to miimise size of the IGP 38

39 Addressig Plas Scheme p Lookig at Ifrastructure: 2001:db8::/32 / :db8:0::/48 / :db8:1::/48 to 2001:db8:ffff::/48 Loopbacks Backboe PtP & LANs NOC Customers p Alterative: 2001:db8::/32 / :db8:0::/48 / :db8:1::/ :db8:2::/48 to 2001:db8:ffff::/48 Loopbacks Backboe PtP & LANs NOC Customer PtP Customers 39

40 Addressig Plas Plaig p Registries will usually allocate the ext block to be cotiguous with the first allocatio (RIRs use a sparse allocatio strategy idustry goal is aggregatio) Miimum allocatio is /32 Very likely that subsequet allocatio will make this up to a /31 or larger (/28) So pla accordigly 40

41 Addressig Plas (cotd) p Documet ifrastructure allocatio Eases operatio, debuggig ad maagemet p Documet customer allocatio Customers get /48 each Prefix cotaied i ibgp Eases operatio, debuggig ad maagemet Submit etwork object to RIR Database 41

42 Addressig Idustry Best Practices p Idustry has documeted best practices for IPv6 address delegatio from operators to ed-users p It is what the majority of etwork operators are doig today: p Recommedatio: Follow RIPE-690 guidelies this will esure log term scalability of your IPv6 deploymet 42

43 Addressig Tools p Examples of IP address plaig tools: NetDot etdot.uorego.edu OpeNetAdmi opeetadmi.com HaCi sourceforge.et/projects/haci Racktables racktables.org IPAT ethead.de/idex.php/ipat freeipdb home.globalcrossig.et/~freeipdb/ p Examples of IPv6 subet calculators: ipv6ge code.google.com/p/ipv6ge/ sipcalc 43

44 IPv6 Addressig o LANs 44

45 IPv6 Addressig o LANs p Two optios: Stateless Autocofiguratio (SLAAC) p Cliet lears IPv6 address from the router o the subet DHCPv6 p Cliet lears IPv6 address from a DHCP server (as for IPv4) 45

46 SLAAC p IPv6 cliet lears address from the LAN Seds out router solicit Router respods with router advertisemet cotaiig subet ad default gateway Iitial cliet state: Cliet: e3: flags=8863<up,broadcast,smart,running,simplex,multicast> mtu 1500 ether 68:5b:35:7d:3b:bd iet6 fe80::6a5b:35ff:fe7d:3bbd%e3 prefixle 64 scopeid 0x8 Router does ot eed ay specific cofiguratio iterface FastEtheret0/0 ipv6 address 2001:db8:100::1/64 ipv6 d router-preferece high! 46

47 SLAAC p O receivig respose from the router: e3: flags=8863<up,broadcast,smart,running,simplex,multicast> mtu 1500 ether 68:5b:35:7d:3b:bd iet6 fe80::6a5b:35ff:fe7d:3bbd%e3 prefixle 64 scopeid 0x8 iet6 2001:db8:100::6a5b:35ff:fe7d:3bbd prefixle 64 autocof iet6 2001:db8:100::18eb:2861:458e:862b prefixle 64 autocof temporary d6 optios=1<performnud> Iteret6: Destiatio Gateway Flags Netif Expire default fe80::219:30ff:fee UGc e3 Note the temporary address this is the oe used for all IPv6 coectivity, ad has a lifetime determied by the cliet s operatig system 47

48 DHCPv6 p Works like DHCP o IPv4 ifrastructure: DHCPv6 server distributes addresses from a pool o request from cliet DHCPv6 cliet cofigures IPv6 address Sample server cofiguratio (Cisco IOS): ipv6 dhcp pool LABNET ds-server 2001:DB8:1::1 ds-server 2001:DB8:2::2 domai-ame labet! iterface VLAN1 ipv6 address 2001:DB8::1/64 ipv6 dhcp server LABNET! 48

49 Distributig subets by DHCP p Two optios: Static assigmet (as i IPv4) p Tell the customer what subet they have DHCPv6-PD p Use DHCPv6 Prefix Delegatio feature to distribute subets automatically 49

50 DHCPv6-PD p New for IPv6, is Prefix-Delegatio (PD) Allows DHCP server to delegate subets to cliets Especially useful for Broadbad deploymets Server example o BRAS (Cisco IOS): ipv6 dhcp pool BB-CUST-1 prefix-delegatio pool BBCUST1 lifetime ! ipv6 local pool BBCUST1 2001:DB8:F00::/40 56! iterface FastEtheret0/0 ipv6 eable ipv6 dhcp server BB-CUST-1! 50

51 DHCPv6-PD p Cliet receives address delegatio from the server: iterface Dialer0 descriptio ADSL lik to MY ISP ipv6 address autocofig default ipv6 dhcp cliet pd ADSL-PD rapid-commit! iterface Vla1 descriptio Home Network ipv6 address ADSL-PD ::0:0:0:0:1/64! iterface Vla2 descriptio Home IP/TV Network ipv6 address ADSL-PD ::1:0:0:0:1/64! Vla1 IPv6 address: 2001:DB8:F00:3100::1/64 Vla2 IPv6 address: 2001:DB8:F00:3101::1/64 51

52 Example Address Pla 52

53 Example Address Pla p Geeric Network Operator Has 2001:db8::/32 address block Takes first /48 for etwork ifrastructure p First /64 for loopbacks p Last /60 for NOC Takes secod /48 for poit to poit liks to customer sites Remaider of address space for delegatio to customers, cotet hostig ad broadbad pools p Network Operator has 20 PoPs aroud the coutry 53

54 Example: Loopback addresses p 2001:db8:0::/48 is used for ifrastructure p Out of this, 2001:db8:0:0::/64 is used for loopbacks Each loopback is umbered as a /128 p Scheme adopted is: 2001:db8::XXYY/128 p Where XX is the PoP umber (01 through FF) p Where YY is the router umber (01 through FF) Scheme is good for: p 255 PoPs p 255 routers per PoP p keepig addresses small/short 54

55 Loopbacks Example PoP 1 Routers Loopbacks PoP 10 Routers Loopbacks cr1 2001:db8::101/128 cr1 2001:db8::a01/128 cr2 2001:db8::102/128 cr2 2001:db8::a02/128 br1 2001:db8::103/128 sr1 2001:db8::a05/128 br2 2001:db8::104/128 sr2 2001:db8::a06/128 sr1 2001:db8::105/128 ar1 2001:db8::a10/128 sr2 2001:db8::106/128 ar2 2001:db8::a11/128 ar1 2001:db8::110/128 gw1 2001:db8::a20/128 ar2 2001:db8::111/128 gw2 2001:db8::a21/128 gw1 2001:db8::120/128 etc gw2 2001:db8::121/128 etc 55

56 Example: Backboe Poit to Poit liks p Backboe Poit to Poit liks come out of Ifrastructure block 2001:db8:0::/48 Scheme adopted is: p 2001:db8:0:MNXY::Z/64 Where p MN is the PoP umber (01 through FF) p XY is the LAN umber (00 through 0F) p XY is the P2P lik umber (10 through FF) p Z is the iterface address (0 or 1) Scheme is good for 16 LANs ad 240 backboe PtP liks per PoP, ad for 255 PoPs 56

57 LANs ad PtP Liks Example PoP 1 Subet PoP 14 Subet LAN1 2001:db8:0:101::/64 LAN1 2001:db8:0:e01::/64 LAN2 2001:db8:0:102::/64 LAN2 2001:db8:0:e02::/64 LAN3 2001:db8:0:103::/64 LAN3 2001:db8:0:e03::/64 PtP1 2001:db8:0:111::/64 LAN4 2001:db8:0:e04::/64 PtP2 2001:db8:0:112::/64 LAN5 2001:db8:0:e05::/64 PtP3 2001:db8:0:113::/64 PtP1 2001:db8:0:e11::/64 PtP4 2001:db8:0:114::/64 PtP2 2001:db8:0:e12::/64 PtP5 2001:db8:0:115::/64 PtP3 2001:db8:0:e13::/64 PtP6 2001:db8:0:116::/64 etc PtP7 2001:db8:0:117::/64 etc Note: PtP liks have /64 reserved but are addressed as /127s 57

58 Liks to Customers p Some ISPs use ip uumbered for IPv4 iterface liks So replicate this i IPv6 by usig ipv6 uumbered to address the liks This will ot require oe /48 to be take from the ISP s /32 allocatio p Other ISPs use real routable addresses So set aside the secod /48 for this purpose Gives possible customer liks, assumig a /64 for each lik 58

59 Customer Liks Example Customer Customer 1 Customer 2 Customer 3 Customer 4 (lik oe) Customer 4 (lik two) Customer 5 Customer 6 etc Poit to poit lik address 2001:db8:1:0::/ :db8:1:1::/ :db8:1:2::/ :db8:1:3::/ :db8:1:4::/ :db8:1:5::/ :db8:1:6::/64 Note1: PtP liks are umbered out of 2001:db8:1::/48 Note2: PtP liks have /64 reserved but are addressed as /127s 59

60 Example: Allocatios from the /32 p Master allocatio documetatio would look like this: Category Sigle /64 Sigle /60 Sigle /48 Sigle /48 Sigle /40 Sigle /40 Sigle /40 Sigle /40 Etc Purpose Loopbacks NOC Backboe Poit to Poit liks (/64 each) Customer Poit to Poit liks (/64 each) Broadbad Customers i Regio 1 (/56 each) 256 Eterprise Customers i Regio 1 (/48 each) Broadbad Customers i Regio 2 (/56 each) 256 Eterprise Customers i Regio 2 (/48 each) 60

61 Example: Allocatios from the /32 p Detailed documetatio: Address Blocks 2001:db8:0::/ :db8:1::/48 Purpose Ifrastructure (Loops, NOC, PtP) Customer Poit to Poit Liks 2001:db8:0110::/48 Customer Oe i Regio :db8:0111::/48 Customer Two i Regio :db8:0112::/48 Customer Three i Regio :db8:1100::/40 Broadbad Pool 1 i Regio :db8:1200::/40 Broadbad Pool 2 i Regio :db8:8110::/48 Customer Oe i Regio :db8:8111::/48 Customer Two i Regio :db8:9100::/40 Broadbad Pool 1 i Regio :db8:9200::/40 Broadbad Pool 2 i Regio 2 61

62 Summary p First /48 for ifrastructure Out of that, first /64 for Loopbacks p PoP structure withi IPv6 addressig is very possible Greater flexibility tha with IPv4 Possible to come up with a simple memorable scheme p Documetatio vitally importat! 62

63 Presetatio Recap p How it worked with IPv4 p Gettig IPv6 address space p Costructig a scalable IPv6 address pla p IPv6 addressig o LANs p IPv6 address pla example 63

64 IPv6 Addressig ISP Workshops 64