Yasuo Kashimura Senior Manager, Japan, APAC IPCC Alcatel-lucent

Transcription

1 Yasuo Kashimura Senior Manager, Japan, APAC IPCC Alcatel-lucent

2 Agenda Current status of / internet continuity continuity over network rapid deployment Wider deployment Solution comparison 7. Appendix. Multi-ServiceProvider Issuue in Apricot 2011 transi4on

3 1 Current status of / internet Apricot 2011 transi4on

4 IANA address pool has been sold out!! address exhaustion has become REAL.. People needs go to anyway.. Apricot 2011 transi4on

5 Address Exhaust and Deployment transition (dual-stack) Internet growth Original Expectation deployment Pool Size transition t Pool Size Internet growth Rapid migration to deployment t Transition (dual-stack, NAT, tunneling) Pool Size Internet growth deployment continuity until migration 2010 t Geoff Huston Apricot 2011 transi4on

6 Transition to : Two Approaches we need to consider.. 1. continuity/address sharing Extend the life of until all the internet become Global address sharing between the users, with using NAPT connectivity can be provided by dual-stack, some tunneling technologies, or protocol translation. 2. migration focus Rapid/Gradual introduction of capabilities (CPE, Access, BNG) Progressive steps to native service connectivity through dual-stack or protocol translation or tunneling Apricot 2011 transi4on

7 Transition to : applicable technologies Translation <-> Translation <-> Translation LSN NAT64 IVI DS-Lite, A+P 6to4 6RD SAM,4RD -over- Tunneling -over- Tunneling Tunneling Apricot 2011 transi4on

8 Methods Home device Access network Destination Solutions Internet Large Scale NAT Internet Internet Internet Dual-Stack Lite SAM, 4RD NAT64 Stateful NAT64 Stateless IVI 6to4 6RD Internet Dual-Stack Apricot 2011 transi4on

9 2 continuity Apricot 2011 transi4on

10 Large Scale NAT(LSN) Continuity Continuity Migration Private network Private network Private network 1/2stack BNG 7750-SR Private Network Network 1/2stack BNG 7750-SR Border Router LSN 7750-SR Internet Internet Priv. Priv. Public NAT44 NAT44 ROUTED ROUTED 2stack Router Route ROUTED ROUTED Server LSN Dual-Stack CGN (aka. large scale NAT or NAT444) is the most traditional approach to continuity Use of RFC1918 may collide with the addresses used within the subscriber LAN services can be offered in parallel to the NATed service through dual-stack BNGs. No new feature required on CPE. Apricot 2011 transi4on

11 L2-aware NAT Continuity Private Network IPoE Private Network PPPoE L2TP BNG+ NAT SR Internet Server Private Network Continuity Priv. NAT44 Shared Priv. NAT44 Public ROUTED L2-aware NAT L2-aware NAT offers subscriber-aware NAT by using L2 delimiter information (S-/C-VLAN, PPPoE, MAC, DHCP Option82, etc.) Based on the Radius user record, subscriber traffic is subject to NAT on the BNG Unique subscriber-id is used to create NAT mapping to allow duplicate inside-ip addresses No new feature required on CPE Apricot 2011 transi4on

12 L2-aware NAT (cont d) Session1 BNG Customer Gateway NAT Internet Customer Gateway Any Subscriber s private address can be allowed. Session2 Private Demux on Service/MAC Public Public NAT Function UDP TCP TCP UDP IP Ethernet Ethernet RFC 2684 ATM DSL Subscriber is identified by Session. IPoE PPP L2TP UDP 802.1ad NAT Function TCP Ethernet PHY TCP IP UDP Minor change in BNG Apricot 2011 transi4on

13 3 continuity over Network Apricot 2011 transi4on

14 DS-Lite ( Dual stack Lite) Continuity Migration draft-ietf-softwire-dual-stack-lite Dual-Stack Lite Broadband Deployments Following Exhaustion Carry packet over tunnel(-in-), on ONLY Access Network => Reduce Management/Operational cost Provide -to- NAPT on AFTR(Concentrator) => Global address saving by sharing the address in multiple users. CPE needs update for feature adding Continuity Migration private Dual Stack Network Dual Stack Network Dual Stack Network -in- -only BNG only Access DS-Lite Concentrator (AFTR) NAT44 Dual-stack Core global Internet Internet Apricot 2011 transi4on

15 DS-Lite Control plane sequence example /64 pd prefixes from 2010:cafe:cafe/48 pool AFTR CG-NAT B4 PE1 DHCPv6 SERVER PE2 2000::460::0:0:0:1 2000:1::1 2000:1::40 RS RA (default-gw only / No SLAAC) SOLICIT IA-PD DNS ADVERTISE IA-PD /64 DNS 2000:1::40 / OPTION-99 REQUEST REPLY IA-PD /64 DNS 2000:1::40 / OPTION-99 DHCPv6 Relay Relay-forw SOLICIT IA-PD DNS Relay-reply ADVERTISE IA-PD/64 DNS 2000:1::40 OPTION-99 Relay-forw REQUEST Relay-reply REPLY Option-99 contains Tunnel-End-Point 2001:688:1f94:a::1 Configured Tunnel-End-Point 2001:688:1f94:a::1 Apricot 2011 transi4on

16 DS-Lite Packet Flow Priv. RFC1918, /29 Tunnel Routing -in- tunneled Tunnel NAT44 IPV4 Global DS-Lite AFTR Dst-= Src-= Dst-port=80 Src-port=10000 Dst-=2001:db8:20::2 Src-=2001:db8:10::2 Dst-= Src-= Dst-port=80 Src-port=10000 Decap v4napt Softwire-ID Inside IP Prot Inside Src Port Dst-= Src-= Dst-port=80 Src-port=20000 Outside IP Prot Outside SrcPort 2001:db8:10:: TCP TCP Server Apricot 2011 transi4on

17 DS-Lite + A+P Continuity Migration draft-ietf-softwire-dual-stack-lite draft-ymbk-aplusp The A+P Approach to the Address Shortage Carry packet over tunnel(-in-), on ONLY Access Network CPE learns Global address/port-range, and CPE perform - NAPT. NAPT function can be distributed to CPE side, more scalable than DS-Lite. Minimal state core. More Flexible, more close to End-to-End transparency (but still limited) Continuity private Dual Stack Dual Stack A+P NAT A+P NAT -in- -only BNG AFTR/ A+P router global Internet Migration Dual Stack A+P NAT only Access Dual-stack Core Internet Apricot 2011 transi4on

18 DS-Lite + A+P Packet Flow Priv. RFC1918, /29 Tunnel NAT44 Tunnel -in- IPV4 Global tunneled Routing DS-Lite A+P Assigned port-range IP= Port= Server Decap Dst-= Src-= Dst-port=80 Src-port=8000 Dst-= a::1 Src-= a::2 Dst-= Src-= Dst-port=80 Src-port=10000 Dst-= Src-= Dst-port=80 Src-port=10000 Inside IP Prot Inside Src Port Apricot 2011 transi4on Outside IP Prot Outside SrcPort TCP TCP 10000

19 Stateless Address Mapping (SAM) - Mesh Softwires without e-bgp Residual Deployment across -Service networks (4rd) Migration Continuity draft-despres-softwire-mesh-sam-01 draft-despres-softwire-4rd Dual Stack SAM CE network over SAM Border Relay Internet Internet Server Private 4 NAT44 Tunnel Route Public 4 Addresses continuity and deployment in stateless tunneling by using address sharing model. Use Stateless address to address/port mapping to reduce complexity. address/port-range is embedded into address. CPE can know allocated Global Address and port-range from allocated address, and other SAM related parameters. CPE can perform NAPT based on leaned GA/port-range, and also perform over tunneling. 4RD extends applicability to IPvX o/ IPvY, and NAT less solution. Apricot 2011 transi4on

20 SAM Address mapping format common prefix Subnet ID(s) s may be 0 SAM tag Format ID f may be 0 host ID C s 8 F h C XXXXX 0 0xFF F 0 XXXXXX Parameters: F, C, s, h SAM interior ID F XXXXX XXXXXX C F XXXXX 0 XXXXXX constant prefix 32 Apricot 2011 transi4on

21 SAM Address mapping format example 2001:a:5000:0:ff00:0:0: :a::/32 s=4, h= /20 4 C s 8 F h :a: 5 0 0x22 C XXXXX 0 0xFF F 0 XXXXXX Parameters: F, C, s, h SAM interior ID 0 F 5 0x22 XXXXX XXXXXX x22 C F XXXXX 0 XXXXXX (0x22) Apricot 2011 transi4on

22 RFC over6 Transit Solution Using IP Encapsulation and MP-BGP Extensions Public Network 4o6 CE BGP SAFI - prefix - address network over 4over6 GW Internet Internet Server Public 4 Route Tunnel Route Public 4 Not Addressing continuity. Just for deployment in stateless tunnelling User s prefix and address(tunnel destination address for that prefix) information are advertised via BGP as newly defined SAFI. 4over6 GW router must cache -prefix=-address mapping, and traffic is encapsulated by header. : mapping advertiser(bgp speaker) can be another BGP router/server, not CPE. Apricot 2011 transi4on

23 4 Rapid deployment Apricot 2011 transi4on

24 RFC Rapid Deployment on Infrastructures (6rd) Network 6rd CE Network Network 6rd Border Relay Internet Server Network 6 6to4 tunnel 6 Route CGN Route Private 4 NAT Priv 4 NAT44 Public 4 6RD address format: SP s prefix GA SubnetID InterfaceID Addresses operators who want to quickly offer an service over a non- capable network Use 6to4 tunnel technique with specifying ISP s prefix. Stateless Tunneling 6rd border relay decapsulates packet and routes in natively towards Internet 6rd prefix and BR address can be obtained by DHCP option address required for 6to4 tunnel, CGN is optional. Apricot 2011 transi4on

25 6RD Packet Flow example Tunnel Routing -in- tunneled Tunnel Routing IPV6 Global DHCP option:6rd 6RD prefix: 2001:db8::/32 6RD Border: RD Border Server Decap Dst-=v6Globalx Src-= 2001:db8:c000:0201::xxxx Dst-= Src-= Dst-=v6Global Src-= 2001:db8:c000:0201::xxxx Dst-=v6Globalx Src-= 2001:db8:c000:0201::xxxx 6RD Border can know destination address for the packet from internet to user, by destination address of the packet because user s address is embedded into it. Apricot 2011 transi4on

26 5 Wider deployment Apricot 2011 transi4on

27 NAT64 (+ DNS64) (draft-ietf-behave-v6v4-xlate-stateful/rfc6146) Migration DNS response AAAA Pref64: DNS64 DNS response A network network network Large Scale NAT Internet Server network Internet 6 Route 6 NAT64 4 Addresses -only hosts communicating with -only servers Does not support -only hosts (e.g., Windows 98/XP, or non-enabled hosts) Requires a complementary DNS function (DNS64); see draft-ietf-behave-dns64(rfc6147) Not suited for continuity (connections must be v6-initiated to create state in NAT64) Will be required to provide interworking between -only hosts and -only servers Apricot 2011 transi4on

28 NAT64 (+ DNS64) (draft-ietf-behave-v6v4-xlate-stateful) host DNS64 Auth.DNS NAT64 server DNS Query AAAA example.com DNS Query AAAA example.com DNS Response Pref64=2001:db8:8000::/64 DNS Response NXDOMAIN DNS Query A example.com DNS Response A AAAA 2001:db8:8000:: Dest.: [2001:db8:8000:: ]:80 Src.: [2001:db8::xyz]:abc Allocate NAT-binding Dest.: :80 Src.: :6853 Apricot 2011 transi4on

29 IVI Translation draft-xli-behave-ivi-07 IVI DNS network network IVI Xlate v4 Xlate v6 IVI address format: SP s prefix FF IPV4 address Suffix More focusing on single-stack network, with keeping connectivity to existing network. IVI translator provides to / to translation to interconnect v4/v6 network. address is embedded into address. Working with IVI DNS, and stateless translation on IVI translator, it provides more seamless translation between and. Apricot 2011 transi4on

30 5 Solution Comparison Apricot 2011 transi4on

31 Summary of continuation/ transition technologies LSN DS-Lite DS-Lite SAM, 4RD 4over6 6RD NAT64 IVI L2-NAT + A+P CPE No CPE CPE CPE CPE change CPE CPE Only - change change change required change change required required required required hosts Address LSN - - continuity Sharing Optional can Still requires Still transition be address. requires deployed in parallel address. Access NW /v6 Stateful / Stateless Stateful Stateful Stateful Stateless Stateless Stateless Stateful Stateless transparency Limited Limited Limited Not Not Not Limited Not Limited in Limited Limited Limited Apricot 2011 transi4on 1:1 map

32 Consideration for technology implementation What is your focus? Rapid deployment, or address exhaustion? Access network is only or only, or can be dual-stack? Does it requires CPE change/feature adding? How can you define NAT policy? How can you define port-range allocation policy? Max # of ports per user Allocation algorithm: Fixed, Random Port-block allocation, or session based allocation How can you define logging policy for abuse traceability? Session based logging(large amout of log), or port-block based logging Apricot 2011 transi4on

33 Consideration for technology implementation How can you perform per-sub control? How much you provide end-end transparency? UpNP treatment draft-bpw-softwire-upnp-pcp-interworking Where you put GW/Concentrator/NAT function? Distributed to edge? Or Centralized to core? Stateless or Stateful mapping/translation? How you can define scalability parameters? # of tunnels, # of NAT session, performance, etc How much you need HA function? ( vs Cost ) Apricot 2011 transi4on

34 Appendix: Multi-ServiceProvider Issue in Apricot 2011 transi4on

35 Multi-SP Issues xsp1 s dns server BNG Prefix from DHCPv6-PD via xsp1/tunnel 2001:ac00:1234:1234::/64 Gateway xsp1 Session xsp1 s prefix xsp1 LAN switch Router WAN1 WAN2 2001:db8:0:1234::/64 xsp2 s prefix Prefix from DHCPv6-PD via xsp2/tunnel What mechanism should be used for route updates? xsp2 Session x Should the RG request delegated prefixes from all connections? How should DNS servers be configured? What about host source address selection? BNG xsp2 s dns server xsp2 Apricot 2011 transi4on

36 Problem: Source Address Selection Multiple prefixes on one physical interface Wrong ISP 2001:db8:1000::/ :db8:1000:1:: :db8:8000:1::100 ISP-A ISP-B Internet 2001:db8:8000::/36 Dropped by ingress filter (RFC2827) Apricot 2011 transi4on

37 Problem: Source Address Selection Multiple prefixes on one physical interface Disconnected network 2001:db8:1000:1:: :db8:1000::/36 ISP-A 2001:db8:a000::1 Internet 2001:db8:8000:1::100 ASP-B 2001:db8:8000::/36 Apricot 2011 transi4on

38 Problem: Next-Hop Route Selection Internet Corporate network Partner network Provide host with routing information of Partner network so that Address Selection (RFC3484) can choose correct source address. RFC4191 does that (but there is a problem..) Apricot 2011 transi4on

39 Problem: DNS Server Selection Different Answers Public DNS returns empty answer Private DNS returns IP address Solution: host queries proper DNS server long-existing industry practice Query: cnn.com Query: myasp.com Internet NSP (Interne t) ASP / VPN (myasp.com) Apricot 2011 transi4on

40 IETF Related I-Ds <IETF> - Source address selection policy - draft-ietf-6man-addr-select-opt Distributing Address Selection Policy using DHCPv6 - Route selection policy - draft-ietf-mif-dhcpv6-route-option DHCPv6 Route Option - DNS selection policy - draft-ietf-mif-dns-server-selection - DNS Server Selection on Multi-Homed Hosts - Multi-NSP solution draft including above I-Ds - draft-troan-ipv6-multihoming-without-ipv6nat - Multi-homing without Network Address Translation Apricot 2011 transi4on

41 Source address selection/route information/dns selection distribution RG/Host Behaviour Host RG xsp1 DHCPv6 SOLICIT IA_PD, OPTION_ROUTE, DNS_SERVER_SELECT, OPTION_DASP xsp2 DHCPv6 ADVERTISE IA_PD: 2001:1:0:1::/64 OPTION_ROUTE: 2001:1::/32 -> xsp1 DNS_SERVER_SELECT: 2001:1::10 xsp1.com OPTION_DASP: 2001:1::/32, Label 1, Prec 30 DHCPv6 SOLICIT IA_PD, OPTION_ROUTE, DNS_SERVER_SELECT, OPTION_DASP OPTION_ROUTE: 2001:1::/32 -> xsp1 2001:2::/32 -> xsp2 DNS_SERVER_SELECT: 2001:1::10 xsp1.com 2001:2::10 xsp2.com DHCPv6 ADVERTISE IA_PD: 2001:2:0:1::/64 OPTION_ROUTE: 2001:2::/32 -> xsp2 DNS_SERVER_SELECT: 2001:2::10 xsp2.com OPTION_DASP: 2001:2::/32, Label 2, Prec 10 OPTION_DASP: 2001:1::/32, Label 1, Prec :2::/32, Label 2, Prec 10 Apricot 2011 transi4on

42 Source address selection/route information/dns selection distribution RG/Host Behaviour Host RG xsp1 xsp2 Construct IP address RA PIO: 2001:1:0:1::/64 Autonomous 2001:2:0:1::/64 Autonomous DHCPv6 SOLICIT OPTION_DASP DHCPv6 ADVERTISE OPTION_DASP: 2001:1::/32, Label 1, Prec 30 OPTION_DASP: 2001:2::/32, Label 2, Prec 10 DHCPv6 SOLICIT OPTION_DASP DHCPv6 ADVERTISE OPTION_DASP: 2001:1::/32, Label 1, Prec 30 OPTION_DASP: 2001:2::/32, Label 2, Prec 10 OPTION_DASP: 2001:1::/32, Label 1, Prec :2::/32, Label 2, Prec 10 Apricot 2011 transi4on

43 THANK YOU