Introduction & Understanding IPv6 BRKRST-1069

Transcription

1 Introduction & Understanding IPv6 BRKRST-1069

2 An IPv4 packet walks into a bar and says Give me a CIDR, I m exhausted An IPv6 packet walks into a bar and complains I can t get a drink because not many people understand me 2

3 Agenda Why IPv6 IPv6 Addressing IPv6 Packet Types IPv6 DNS and DHCP IPv6 Routing Q&A 3

4 IPv6 Cisco Live 2012 Techtorial TECRST Hands on Experience with IPv6 Routing and Services Routing & Switching BRKRST-1069 Introduction and Understanding IPv6 BRKRST-2301 Enterprise IPv6 Deployment BRKRST-2311 IPv6 Planning, Deployment and Operation Considerations Security BRKSEC-2003 IPv6 Security Threats and Mitigations Service Provider BRKSPG-2611 IP Routing in Smart Object Networks & the Internet of Things BRKSPG-1069 IPv4-Exhaustion and IPv6-Transition in Mobile Networks BRKSPG-2067 IPv6 Design and Transition Mechanisms 4

5 The Day The Earth Stood Still (OK, maybe a slight exaggeration) 3 rd February 2011 The last five remaining /8 pools were allocated amongst the five Regional Internet Registries Hey Buddy, Can you spare an IPv4 address? 15 th April 2011, APNIC pool consists of the final /8 block IPv4 allocation policy has now changed APNIC members eligible for a SINGLE /22 (1024 addresses) from the pool Source: 5

6 Why Move To IPv6? IPv6 is an enabler It is NOT a new service It allows anything to connect to everything IPv4 address pool exhausted NGN Capabilities to Defence Government Mandates Cable market address scaling Population densities in APAC 4G deployments IPv6 OS, Content & Applications Smart Grids/Sensor Networks Connected Communities IPv4 connects computers IPv6 connects people and things 6

7 General Observations Most Network Providers do not seem to consider IPv6 unless A lack of IPv4 space hinders their progress or there is consumer demand However, IPv6 underpins SP transformation - collaboration, content delivery, mobility, video, cloud Enterprises will not ask for IPv6 unless They have an application requirement to drive it Their presence on the Internet is compromised by lack of IPv6 access The price of an IPv4 address exceeds the hardware cost to route it Consumers are generally ambivalent Do not/should Not care whether IPv4 or IPv6 broadband delivery IPv4 address trading markets starting to appear Nortel sold 666,624 IP addresses to Microsoft Corp. for $7.5 million* ($11.25 each) Trading site for IPv4 addresses * Source: 23 rd March,

8 IPv6 Addressing

9 IPv6 Addresses IPv6 addresses are 128 bits long Segmented into 8 groups of four HEX characters (called HEXtets) Separated by a colon (:) Default is 50% for network ID, 50% for interface ID Network portion is allocated by Internet registries 2^64 (1.8 x 1019) Still leaves us with ~ 3 billion network prefixes for each person on earth Global Unicast Identifier Example Network Portion gggg:gggg:gggg : Interface ID ssssxxxx:xxxx:xxxx:xxxx : Global Routing Prefix n <= 48 bits Subnet ID 64 n bits Host 2001:0000:0000 : 00A10000:0000:0000:1E2A : Full Format 2001:0:0: A1: :1E2A Abbreviated Format 9

10 So How Big Is The IPv6 Address Space? 340,282,366,920,938,463,374,607,432,768,211,456 (IPv6 Address Space Trillion Trillion Trillion) vs 4,294,967,296 (IPv4 Address Space - 4 Billion). 10

11 IPv6 Address Format Details Hex numbers are not case sensitive Abbreviations are possible Leading zeros in contiguous block could be represented by (::) 2001:0db8:0000:130F:0000:0000:087C:140B 2001:0db8:0:130F::87C:140B Double colon can only appear once in the address IPv6 uses CIDR representation IPv4 address looks like /16 IPv6 address is represented the same way 2001:db8:12::/48 Notation must be represented in 16 bit blocks irrespective of the mask e.g. FE80::/10, or FF00::/8 Only leading zeros are omitted, trailing zeros cannot be omitted 2001:0db8:0012::/48 = 2001:db8:12::/ :db80:1200::/ :db8:12::/48 11

12 IPv6 Address Representation Loopback address representation 0:0:0:0:0:0:0:1 == ::1 Same as in IPv4 Identifies self Unspecified address representation 0:0:0:0:0:0:0:0 == :: Used as a placeholder when no address available (Initial DHCP request, Duplicate Address Detection DAD) NOT the default route Default Route representation ::/0 12

13 IPv6 Address Scopes Addresses are assigned to interfaces An IPv6 interface is expected to have multiple addresses and multiple scopes Addresses have scope Link Local Unique Local Global Addresses have lifetime Valid and preferred lifetime Global Unique Local Link Local 13

14 IPv6 Address Types Three types of unicast address scopes Link-Local Non routable exists on single layer 2 domain (FE80::/64) FE80:0000:0000:0000 xxxx:xxxx:xxxx:xxxx : Unique-Local Routable within administrative domain (FC00::/7) FCgg:gggg:gggg: ssssxxxx:xxxx:xxxx:xxxx : FDgg:gggg:gggg: ssssxxxx:xxxx:xxxx:xxxx : Global Routable across the Internet (2000::/3) 2ggg:gggg:gggg: ssssxxxx:xxxx:xxxx:xxxx : 3ggg:gggg:gggg: ssssxxxx:xxxx:xxxx:xxxx : Multicast addresses (FF00::/8) FFzs: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxx Flags (z) in 3 rd x nibble (4 bits) Scope (s) into 4 th nibble 14

15 IPv6 Addressing Types Represented in Binary and Hex Type Binary Hex Global Unicast Address or 3 Link Local Unicast Address Unique Local Unicast Address Multicast Address Solicited Node Multicast FE80::/10 FC00::/7 FC00::/8(registry) FD00::/8 (no registry) FF00::/16 FF02::1:FF00/104 15

16 PI and PA Allocation Process Provider Assigned Provider Independent 2000::/3 IANA 2000::/3 /12 Registries /12 /32 ISP Org /48 /48 Enterprise Level Four 16

17 Global Unicast Addresses Provider Site Host n Bits 64-n Bits 64 Bits Global Routing Prefix Subnet Interface ID 001 Addresses for generic use of IPv6 Structured as a hierarchy to try and keep the aggregation 17

18 Global Unicast Address Interface ID Interface ID unicast address may be assigned in different ways Auto-configured from a 64-bit EUI-64 or expanded from a 48-bit MAC Auto-generated pseudo-random number (to address privacy concerns) Assigned via DHCP Manually configured EUI-64 format to do stateless auto-configuration Expands the 48 bit MAC address to 64 bits by inserting FFFE into the middle To ensure chosen address is from a unique Ethernet MAC address The universal/local ( u bit) is set to 1 for global scope and 0 for local scope 64 Bits Global Routing Prefix Subnet Interface ID 18

19 IPv6 Interface Identifier (EUI-64 format) Cisco uses the EUI-64 format to do stateless auto-configuration This format expands the 48 bit MAC address to 64 bits by inserting FFFE into the middle 16 bits To make sure that the chosen address is from a unique Ethernet MAC address, the universal/local ( u bit) is set to 1 for global scope and 0 for local scope Cisco devices bit-flip the 7th bit MAC Address FC 0F FC 0F FF FE FF FE 17 FC 0F U0 U = 1 Where U= 1 = Unique 0 = Not Unique FF FE 17 FC 0F 19

20 Link-Local Address 10 Bits 54 Bits Remaining 54 bits = 0 64 Bits Interface ID FE80::/10 Mandatory for communication between two IPv6 devices Automatically assigned by device using EUI-64 Also used for next-hop calculation in routing protocols Only link specific scope Remaining 54 bits could be zero or any manually configured 20

21 Unique Local Address (RFC 4193) n Bits 16 Bits 64 Bits L FC00::/7 Global ID ULA are like RFC 1918 not routable on Internet ULA uses include Local communications Inter-site VPNs (Mergers and Acquisitions) Subnet FC00::/8 is Registry Assigned (L bit = 0), FD00::/8 is self generated (L bit = 1) Registries not yet assigning ULA space, Global ID can be generated using an algorithm Low order 40 bits result of SHA-1 Digest {EUI-64 && Time} Interface ID 21

22 IPv6 Multicast Address (RFC 4291) An IPv6 multicast address has the prefix FF00::/8 ( ) Second octet defines lifetime and scope 8Bits 4 Bits 4 Bits 112 Bits R P T Scope Variable Format Flags R = 0 R = 1 P = 0 P = 1 T = 0 T = 1 No embedded RP Embedded RP Not based on unicast Based on unicast Permanent address (IANA assigned) Temporary address (local assigned) Scope 1 Node 2 Link 3 Subnet 4 Admin 5 Site 8 Organization E Global 22

23 Well Known Multicast Addresses Address Scope Meaning FF01::1 Node-Local All Nodes FF01::2 Node-Local All Routers FF02::1 Link-Local All Nodes FF02::2 Link-Local All Routers FF02::5 Link-Local OSPFv3 Routers FF02::6 Link-Local OSPFv3 DR Routers FF02::1:FFXX:XXXX Link-Local Solicited-Node 02 means that this is a permanent address (t = 0) and has link scope (2) 23

24 Solicited-Node Multicast Address For each Unicast and Anycast address configured there is a corresponding solicited-node multicast (Layer 3 address) Used in neighbor solicitation (NS) messages Multicast address with a link-local scope Solicited-node multicast consists of FF02::1:FF & {lower 24 bits from IPv6 Unicast interface ID} 64 Bits Routing Prefix High Order 40 Bits Interface ID Low Order 24 bits FF FF Low 24 24

25 Solicited Node Multicast Address Example 64 Bits Network ID 64 Bits Interface ID FE CFF FE3A 8B18 Link-Local FF bits FF 3A8B18 32 bits Solicited Node Multicast FF 3A 8B 18 Ethernet Multicast 25

26 IPv6 Interface Example R1#show ipv6 interface e0 Ethernet0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::200:CFF:FE3A:8B18 No global unicast address is configured Joined group address(es): FF02::1 FF02::2 FF02::1:FF3A:8B18 MTU is 1500 bytes All Routers All Nodes Solicited Node Multicast Address ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. R1# Link-local address (FE80::) 26

27 IPv6 Packet Types

28 Legend IPv4 and IPv6 Header Comparison Version IHL Identification IPv4 Header Type of Service Time to Live Protocol Total Length Flags Fragment Offset Header Checksum Traffic Version Class Payload Length IPv6 Header Flow Label Next Header Hop Limit Source Address Destination Address Options Padding Source Address Field s Name Kept from IPv4 to IPv6 Fields Not Kept in IPv6 Name and Position Changed in IPv6 New Field in IPv6 Destination Address 28

29 Extension Headers V Len Class Flow 6 Hop V Len Class Flow 43 Hop V Len Class Flow 43 Hop Destination Destination Destination Source Source Source Upper Layer TCP Header 17 Routing Header 60 Routing Header Payload Upper Layer UDP Header 6 Destination Options Payload Upper Layer TCP Header Payload Extension Headers Are Daisy Chained 29

30 Extension Header Order Extension headers must be in the following sequence Order Header Type Header Code 1 Basic IPv6 Header - 2 Hop-by-Hop Options 0 3 Dest Options (with Routing options) 60 4 Routing Header 43 5 Fragment Header 44 6 Authentication Header 51 7 ESP Header 50 8 Destination Options 60 9 Mobility Header No Next Header 59 Upper Layer TCP 6 Upper Layer UDP 17 Upper Layer ICMPv

31 Fragmentation in IPv6 The original large packet consists of two parts Unfragmentable part IPv6 header plus any headers that must be processed by the nodes en-route Unfragmentable part is repeated with fragments appended to it following the fragment header Fragmentable part The headers that need to be processed only by the destination node = the end-to-end headers + upper layer header and data Fragmentable part is divided into pieces with length multiple of 8 octets RFC 2460 Section 4.5 defines the fragmentation header Minimum MTU for IPv6 is 1280 bytes All links MUST support it 31

32 Fragment Header 44 Next Header IPv6 basic header Fragment Header (44) Next Header Reserved Identification Fragment Data Fragment Offset 00 M Fragmentation is left to end devices in IPv6 Routers do not perform fragmentation Fragment header used when an end node has to send a packet larger than the path MTU 32

33 Path MTU Discovery (RFC 1981) Each Link has MTU a maximum transmission unit Path MTU minimum MTU of all the links in a path between a source and a destination Minimum link MTU for IPv6 is 1280 octets In comparison IPv4 minimum MTU is 68 octets If Link MTU < 1280 then fragmentation and reassembly must be used If IPv6 payload > 1280 fragmentation may need to be performed PMTU Discovery is expected to be performed by IPv6 end hosts It should only apply if sending packets > 1280 bytes For each destination, start by assuming MTU of first-hop link Exceeding the link MTU invokes ICMP packet too big back to source Message includes the offending link MTU value MTU is then cached by source for specific destination 33

34 Path MTU Discovery Source Destination MTU 1500 MTU 1500 MTU 1400 MTU 1300 Packet, MTU=1500 ICMPv6 Too Big, Use MTU=1400 Packet, MTU=1400 ICMPv6 Too Big, Use MTU=1300 Store PMTU per destination (if received) Age out PMTU (10 mins), reset to first link MTU Packet, MTU=

35 ICMPv6 (RFC 2463) Internet Control Message Protocol version 6 Combines several IPv4 functions ICMPv4, IGMP and ARP Message types are similar to ICMPv4 Destination unreachable (type 1) Packet too big (type 2) Time exceeded (type 3) Parameter problem (type 4) Echo request/reply (type 128 and 129) 35

36 ICMPv6 Header 58 Next Header IPv6 basic header ICMPv6 Header (58) ICMPv6 Type ICMPv6 Data ICMPv6 Code Checksum Also used for Neighbor Discovery, Path MTU discovery and Mcast listener discovery (MLD) Type - identifies the message or action needed Code is a type-specific sub-identifier. Checksum computed over the entire ICMPv6 36

37 Neighbor Discovery Messages (ND) ND uses ICMPv6 messages Originated from node on link local with a hop limit of 255 Receivers checks hop limit is still 255 (has not passed a router) Consists of IPv6 header, ICMPv6 header, neighbor discovery header, and neighbor discovery options Five neighbor discovery messages Message Purpose ICMP Code Sender Target Router Solicitation (RS) Prompt routers to send RA 133 Nodes All routers Router Advertisement (RA) Advertise default router, prefixes Operational parameters 134 Routers Sender of RS All routers Neighbor Solicitation (NS) Request link-layer of target 135 Node Solicited Node Target Node Neighbor Advertisement (NA) Response to NS (solicited) Advertise link-layer address change (Unsolicited) 136 Nodes Redirect Inform hosts of a better first hop 137 Routers 37

38 ICMPv6 Neighbor Discovery (RFC 4861) Replaces ARP, ICMP (redirects, router discovery) Uses ICMPv6 header Reachability of neighbours Hosts use it to discover routers, auto configuration of addresses (SLAAC) Duplicate Address Detection (DAD) 38

39 IPv4/IPv6 Provisioning Comparison Function IPv4 IPv6 Address Assignment Address Resolution DHCPv4 ARP RARP DHCPv6, SLAAC, Reconfiguration ICMPv6 NS, NA Not Used Router Discovery ICMP Router Discovery ICMPv6 RS, RA Name Resolution DNS DNS 39

40 Router Solicitation and Advertisement (RS & RA) RS RA Router Solicitation ICMP Type 133 IPv6 Source IPv6 Destination Query A Link Local (FE80::1) All Routers Multicast (FF02::2) Please send RA Router Advertisement ICMP Type 134 IPv6 Source IPv6 Destination Data A Link Local (FE80::2) All Nodes Multicast (FF02::1) Options, subnet prefix, lifetime, autoconfig flag Router solicitations (RS) are sent by booting nodes to request RAs for configuring the interfaces Routers send periodic Router Advertisements (RA) to the all-nodes multicast address 40

41 Neighbor Solicitation & Advertisement Neighbor Solicitation (NS) Used to discover link layer address of IPv6 node NS Function Source Destination Address resolution Unicast Solicited Node Multicast Node reachability Unicast Unicast Duplicate Address Detection ::0 Solicited Node Multicast Neighbor Advertisement (NA) Response to neighbor solicitation (NS) message A node may also send unsolicited Neighbor Advertisements to announce a link-layer address change. 41

42 Neighbor Solicitation & Advertisement (NS & NA) A NS NA B Neighbour Solicitation ICMP Type 135 IPv6 Source IPv6 Destination Data Query A Unicast B Solicited Node Multicast FE80:: address of A What is B link layer address? Neighbour Advertisment ICMP Type 136 IPv6 Source IPv6 Destination Data B Unicast A Unicast FE80:: address of B, MAC Address 42

43 Duplicate Address Detection (DAD) Neighbour Solicitation ICMP Type Ethernet DA IPv6 Source :: IPv6 Destination Hop Limit 255 Target Address 135 (Neighbour Solicitation) FF-52-F9-D8 IPv6 Header FF02::1:FF52:F9D8 NS Header FE80::260:8FF:FE52:F9D8 Destination address is itself A Tentative IP FE80::260:8FF:FE52:F9D8 MAC F9-D8 NS NS B Host B Actual IP FE80::260:8FF:FE52:F9D8 MAC F9-D8 C 43

44 Duplicate Address Detection Response Neighbour Solicitation ICMP Type 135 (Neighbour Solicitation) Ethernet DA IPv6 Source IPv6 Destination Hop Limit 255 Target Address Target L2 Address IPv6 Header FE80::260:8FF:FE52:F9D8 FF02::1 NA Header FE80::260:8FF:FE52:F9D8 Neighbour Discovery Option F9-D8 All Nodes Multicast A Tentative IP FE80::260:8FF:FE52:F9D8 NS B Actual IP FE80::260:8FF:FE52:F9D8 C Host B MAC F9-D8 44

45 ICMPv6 Redirection Redirect is used by a router to informs hosts of a better first hop A 1 B 2 IPv6 Payload Redirect R2 R1 IPv6 Payload Ethernet DA/SA IPv6 Dest / Source Router R2 / Host A 2001:db8:c18:2:: / Host A Redirect ICMP Type Ethernet DA / SA 137 (Neighbour Solicitation) Host A / Router R2 Data IPv6 Payload IPv6 Header IPv6 Dest / Source Host A / Router R2 Hop Limit :db8:c18:2::/64 Redirect Data Target Address Router R1 Redirected Prefix 2001:db8:c18:2::/64 45

46 Stateless Address Autoconfiguration (RFC4862) Autoconfiguration is used to automatically assigned an address to a host plug and play Generating a link-local address, Generating global addresses via stateless address autoconfiguration Duplicate Address Detection procedure to verify the uniqueness of the addresses on a link MAC 00:2c:04:00:fe:56 A 1 2 R1 2001:db8:face::/64 RS RA Host Autoconfigured Address comprises Prefix Received + Link-Layer Address if DAD check passes 2001:db8:face::22c:4ff:fe00:fe56 3 DAD Router Advertisement (RA) Ethernet DA/SA Prefix Information Default Router Router R2 / Host A 2001:db8:face::/64 Router R1 46

47 Link-Local Configured Interface Identifier Address (IOS) Fast0/0 ipv6 unicast-routing! interface FastEthernet0/0 ip address duplex auto speed auto ipv6 enable! Enable IPv6 routing Enable IPv6 on interface and automatically create link-local address 47

48 IPv6 Interface with Link-Local Address r1#show ipv6 interface fast0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::207:50FF:FE5E:9460 Global unicast address(es): None Joined group address(es): FF02::1 FF02::2 FF02::1:FF5E:9460 MTU is 1500 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 30 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. EUI-64 derived from MAC address e.9460 Listening for all hosts multicast Listening for all routers multicast Solicited Node multicast for link-local address r1# show interface fast0/0 FastEthernet0/0 is up, line protocol is up Hardware is AmdFE, address is e.9460 (bia e.9460) MAC address e

49 Manually Configured Interface Identifier Address Fast0/0 ipv6 unicast-routing! interface FastEthernet0/0 ip address duplex auto speed auto ipv6 address 2006:1::1/64 ipv6 nd ra-interval 30! Enables IPv6 and assigns a global prefix and manual interface ID Send RA every 30 seconds 49

50 IPv6 Interface with Manual Interface Address r1#show ipv6 interface fast0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::207:50FF:FE5E:9460 Global unicast address with manual interface ID of 1 Global unicast address(es): 2006:1::1, subnet is 2006:1::/64 Routable /64 subnet Joined group address(es): FF02::1 FF02::2 Corresponding Solicited Node multicast address for manual interface ID FF02::1:FF00:1 Corresponding Solicited Node multicast address for Link-Local interface ID FF02::1:FF5E:9460 MTU is 1500 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 30 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. r1# 50

51 EUI-64 Configured Interface Identifier Address Fast0/0 ipv6 unicast-routing! interface FastEthernet0/0 ip address duplex auto speed auto ipv6 address 2006:1::/64 eui-64 ipv6 nd ra-interval 30! Enables IPv6 and assigns a global prefix and EUI-64 interface ID 51

52 IPv6 Interface with EUI-64 Interface Address r1#show ipv6 interface fast0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::207:50FF:FE5E:9460 Link-Local address with EUI-64 interface ID Global unicast address(es): 2006:1::207:50FF:FE5E:9460, subnet is 2006:1::/64 Manually configured address with EUI-64 Interface ID Joined group address(es): FF02::1 FF02::2 Solicited Node multicast for both manual and link-local address FF02::1:FF5E:9460 MTU is 1500 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 30 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses. r1#show interface fast0/0 FastEthernet0/0 is up, line protocol is up Hardware is AmdFE, address is e.9460 (bia e.9460) MAC address e.9460 used for EUI-64 52

53 IPv6 DNS and DHCP

54 DNS Basics DNS is a database managing Resource Records (RR) Storage of RR for various types IPV4 and IPV6: Start of Authority (SoA) Name Server Address A and AAAA Pointer PTR DNS is an IP application Uses either UDP or TCP on top of IPv4 or IPv6 References RFC3596: DNS Extensions to Support IP Version 6 RFC3363: Representing Internet Protocol Version 6 Addresses in Domain Name system (DNS) RFC3364: Tradeoffs in Domain Name System (DNS) Support for Internet Protocol version 6 (IPv6) 54

55 IPv6 and DNS Entries Function IPv4 IPv6 Hostname to IP Address IP Address To Hostname IPv4 A Record IN A PTR Record A record: in-addr.arpa. IN PTR IPv6 AAAA Record (Quad A) IN AAAA 2001:db8:C18:1::2 PTR Record c.0.8.b.d ip6.arpa IN PTR IP address to hostname 55

56 Dual Stack Approach & DNS = *? DNS Server IPv4 IPv6 IPv4 www IN A www IN AAAA 2001:db8:1::1 In a dual stack case an application that: Is IPv4 and IPv6-enabled Can query the DNS for IPv4 and/or IPv6 records (A) or (AAAA) records Chooses one address and, for example, connects to the IPv6 address IPv6 2001:db8:1::1 56

57 DNS Query on Windows 7 (Dual Stack) msec s msecs between last packet sent Source Destination Prot Info Domain name with IPv6 address only Initial Query over IPv4 for IPv4 A record DNS Standard query A ipv6.google.com DNS Standard query response CNAME ipv6.l.google.com DNS response refers to an alias/canonical address Host immediately sends a request for AAAA record (original FQDN) DNS Standard query AAAA ipv6.google.com DNS Standard query response CNAME ipv6.l.google.com AAAA 2404:6800:8004::68 Domain name with both addresses IPv6 address of canonical name returned msecs Source Destination Prot Info DNS Standard query A Initial Query over IPv4 for IPv4 A record DNS Standard query response A DNS Standard query AAAA DNS Standard query response AAAA 2001:dc0:2001:11:: :420:1:fff:2 2001:dc0:2001:11::21 1 ICMPv6 Echo request (Unknown (0x00)) :dc0:2001:11:: :420:1:fff::2 ICMPv6 Echo reply (Unknown (0x00)) IPv4 address returned Host immediately sends a request for AAAA record IPv6 address of FQDN returned Hosts prefers IPv6 address (configurable) 57

58 IPv6 Host Address Assignment Methods Manual Assignment Statically configured by human operator Stateless Address Autoconfiguration (SLAAC RFC 4862) Allows auto assignment of address through Router Advertisements Stateful DHCPv6 (RFC 3315) Allows DHCPv6 to allocate IPv6 address plus other configuration parameters (DNS, NTP etc ) DHCPv6-PD (RFC 3633) Allows DHCPv6 to allocate entire subnets to a router/cpe device for further allocation Stateless DHCPv6 (RFC 3736) Combination of SLAAC for host address allocation DHCPv6 for additional parameters such as DNS Servers and NTP 58

59 DHCPv6 Updated version of DHCP for IPv4 to supports new addressing Can be used for renumbering DHCP Process is same as in IPv4, but, Client first detects the presence of routers on the link If found, then examines router advertisements (RA) to determine if DHCPv6 can be used If no router found or if DHCPv6 can be used, then DHCPv6 Solicit message is sent to the All-DHCP-Agents multicast address using link-local as source Multicast addresses used FF02::1:2 = All DHCP Agents (servers or relays, Link-local scope) FF05::1:3 = All DHCP Servers (Site-local scope) DHCP Messages: Clients listen UDP port 546; servers and relay agents listen on UDP port

60 DHCPv4/DHCPv6 Protocol Comparison DHCP Messages IPv4 IPv6 Initial Message Exchange 4-way handshake 4-way handshake Message Types Broadcast, Unicast Multicast, Unicast Client Server (1) DISCOVER SOLICIT Server Client (2) OFFER ADVERTISE Client Server (3) REQUEST REQUEST Server Client (4) ACK REPLY 60

61 Router Advertisement for Stateful DHCPv6 RA message contain flags that indicate address allocation combination (A, M and O bits) Use SLAAC only, Use DHCPv6 stateful, Use SLAAC and DHCPv6 for other options A 2 Send DHCP Solicit to FF02::1:2 (All DHCP Relays) 1 RA Router 1 (DHCPv6 Relay) 3 DHCP Server 2001:db8:face::1/64, DNS1, DNS2, NTP 2001:db8:face::/64 Router Advertisement (RA) A bit (Address config flag) M bit (Managed address configuration flag) O bit (Other configuration flag) Set to 0 - Do not use SLAAC for host config Set to 1 - Use DHCPv6 for host IPv6 address Set to 1 - Use DHCPv6 for additional info (DNS, NTP) 61

62 Router Advertisement for Stateless DHCPv6 RA message contain flags that indicate address allocation combination (A, M and O bits) 2 Use SLAAC only, Use DHCPv6 stateful, Use SLAAC and DHCPv6 for other options 2001:db8:face::22c:4ff:fe00:fe56 A 3 Send DHCP Solicit to FF02::1:2 for options only 1 RA Router 1 (DHCPv6 Relay) 2001:db8:face::/64 4 DNS1, DNS2, NTP DHCP Server Router Advertisement (RA) A bit (Address config flag) Set to 1 - Use SLAAC for host address config On-link Prefix M bit (Managed address configuration flag) O bit (Other configuration flag) 2001:db8:face::/64 Set to 0 - Do not use DHCPv6 for IPv6 address Set to 1 - Use DHCPv6 for additional info (DNS, NTP) 62

63 DHCPv6 Configuration options Setting the bits Config options on Router interface A bit (default) just use SLAAC int e0/0 ipv6 address 2001:db8:1000::1/64 M bit & O bit (Stateful DHCP) int e0/0 ipv6 address 2001:db8:1000::1/64 ipv6 nd managed-config-flag ipv6 nd other-config-flag ipv6 dhcp relay destination 2001:db8::10 A bit & O bit (Stateless DHCP) int e0/0 ipv6 address 2001:db8:1000::1/64 ipv6 nd other-config-flag ipv6 dhcp relay destination 2001:db8::10 Host gets address and other SLAAC options. Nothing else Host gets full stateful config from DHCP server (2001:db8::10) Host get address from SLAAC and other config from DHCP server (2001:db8::10) 63

64 IPv6 Routing

65 Static Routing Similar to IPv4 Next hop / interface is required Static routing CLI for IPv6 ipv6 route ipv6-prefix/prefix-length {ipv6-address interface-type interface-number [ipv6-address]} [administrative-distance] [administrative-multicast-distance unicast multicast] [tag tag]! Router(config)# ipv6 route 2001:DB8::0/ :DB8:1:1::1 10 Forward a packets via GUA NH using admin of 10! Router(config)# ipv6 route 2001:DB8::/32 Ethernet 1/0 FE80::215:C7FF:FE21:8640! Forward a packets via link-local NH 65

66 Default Routing Example IPv6 Internet Router 2 :e :a Router 1 LAN1: 2001:db8:c18:1::/64 Ethernet0 :a Ethernet1 LAN2: 2001:db8:c18:2::/64 router 1#config term ipv6 unicast-routing! interface Ethernet0 ipv6 address 2001:db8:c18:1::a/64! interface Ethernet1 ipv6 address 2001:db8:c18:2::a/64! ipv6 route ::/0 2001:db8:c18:1::e Default router to Router 2 66

67 RIP Next Generation (RIPng) Referred to as RIP Next Generation, distance vector protocol For the SP industry not recommended, limited use in Enterprise environments ISPs do not use RIP in any form unless there is absolutely no alternative RIPng was used in the early days of the IPv6 test network Superior routing protocols such as ISIS, OSPF and BGP rapidly replaced RIPng 67

68 Legend RIPng Overview Similar to RIPv2 Distance-vector, Hop limit of 15, split-horizon, All RIP routers is FF02::9, UDP port (521) Updated features for IPv6 Prefix length added, address-family and subnet mask fields removed RIPng header Special Handling for the NH One NH entry per group of prefixes Command Version Set to zero Field s Name kept from IPv4 to IPv6 Fields not kept in IPv6 Name and/or position changed in IPv6 New Field in IPv6 RIP header Command Version Set to zero IPv6 Next Hop Routing Table Entry (RTE) for next hop Address Family ID Route Tag 0 0 0xFF IPv4 Prefix Subnet Mask Next Hop Metric Route Tag Prefix Len IPv6 prefix Metric Routing Table Entry (RTE) for prefixes (1.. N) sharing same next hop 68

69 RIPng Configuration ::/0 Router 2 Router 1 Ethernet0 LAN2: 2001:db8:c18:2::/64 LAN1: 2001:db8:c18:1::/64 Ethernet0 Ethernet1 Router1#config term ipv6 router rip RT0! interface Ethernet0 ipv6 address 2001:db8:c18:1::/64 eui-64 ipv6 rip RT0 enable! interface Ethernet1 ipv6 address 2001:db8:c18:2::/64 eui-64 ipv6 rip RT0 enable 2001:db8:c18:1:260:3eff:fe47:1530 Router2#config term ipv6 router rip RT0 interface Ethernet0 ipv6 address 2001:db8:c18:1::/64 eui-64 ipv6 rip RT0 enable ipv6 rip RT0 default-information originate Enable RIP routing Default route from R2 Router2# debug ipv6 rip Show RIP update RIPng: Sending multicast update on Ethernet0 for RT0 src=fe80::260:3eff:fe47:1530 Use link-local as source dst=ff02::9 (Ethernet0) Destination is All RIPng routers sport=521, dport=521, length=32 command=2, version=1, mbz=0, #rte=1 tag=0, metric=1, prefix=::/0 69

70 EIGRP for IPv6 Features Three new TLVs: 0X Internal Prefix 0X External Prefix 0X Unused Hello messages use the link-local address as the src and dst of FF02::A (all EIGRP routers). Neighbors do not have to share the same global prefix (with the exception of explicitly specified neighbors) Automatic summarization is disabled by default for IPv6 (unlike IPv4) Support for no split-horizon in the case of NBMA links For example, multi-point GRE as found in DMVPN deployments, or ATM/Frame services RID stays at 32 bits Expected to be very popular amongst existing enterprise networks 70

71 EIGRP for IPv6 Configuration Router :db8:c18:1:260:3eff:fe47:1530 Ethernet0 LAN1: 2001:db8:c18:1::/64 Ethernet0 Router 1 Ethernet1 LAN2: 2001:db8:c18:2::/64 Router2#config term ipv6 router eigrp 100 eigrp router-id interface Ethernet0 ipv6 address 2001:db8:c18:1::/64 eui- 64 ipv6 eigrp 100 Router1# show ipv6 eigrp neighbor IPv6-EIGRP neighbors for process 100 H Address Interface Hold Uptime SRTT RTO Q Seq (sec) (ms) Cnt Num Neighbors and next hops are identified by link-local address 0 FE80::260:3eff:fe47:1530 E :01: Router1# show ipv6 eigrp topology all-links IPv6-EIGRP Topology Table for AS(100)/ID( ) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 2001:db8:c18:1::/64, 1 successors, FD is 28160, serno 1 via Connected, Ethernet0 via FE80::260:3eff:fe47:1530 (30720/28160), Ethernet0 71

72 OSPFv3 Overview OSPFv3 is OSPF for IPv6 (RFC 5340) Based on OSPFv2 with enhancements Distributes IPv6 prefixes only Runs directly over IPv6 Ships-in-the-night with OSPFv2 72

73 OSPFv3 Differences from OSPFv2 Legend OSPFv3 has same 5 packet types some fields have been changed OSPFv3 packets have a 16 byte header verses the 24 byte header in OSPFv2 Packet Type Description 1 Hello 2 Database description 3 Link state request 4 Link state update OSPFv2 5 Link state acknowledgement Version Type Packet Length Router ID OSPFv3 Field s Name kept from IPv4 to IPv6 Fields not kept in IPv6 Name and/or position changed in IPv6 New Field in IPv6 Version Type Packet Length Router ID Area ID Area ID Checksum Authtype Authentication Checksum Instance ID 0 Authentication 73

74 OSPFv3 Differences from OSPFv2 Uses link local addresses To identify the OSPFv3 adjacency neighbors Two New LSA Types Link-LSA (LSA Type 0x2008) There is one Link-LSA per link. This LSA advertises the router's link-local address, list of all IPv6 prefixes and options associated with the link to all other routers attached to the link Intra-Area-Prefix-LSA (LSA Type 0x2009) Carries all IPv6 prefix information that in IPv4 is included in Router-LSAs and Network-LSAs Two LSAs are renamed Type-3 summary-lsas, renamed to Inter-Area-Prefix-LSAs Type-4 summary LSAs, renamed to Inter-Area-Router-LSAs 74

75 OSPFv3 Differences from OSPFv2 Multicast Addresses FF02::5 Represents all SPF routers on the link local scope, Equivalent to in OSPFv2 FF02::6 Represents all DR routers on the link local scope, Equivalent to in OSPFv2 Removal of Address Semantics IPv6 addresses are no longer present in OSPF packet header (Part of payload information) Router LSA, Network LSA do not carry IPv6 addresses Router ID, Area ID and Link State ID remains at 32 bits DR and BDR are now identified by their Router ID and no longer by their IP address Security OSPFv3 uses IPv6 AH & ESP extension headers instead of variety of mechanisms defined in OSPFv2 75

76 OSPFv3 LSA Types LSA Description LSA Code LSA Type Bits Set=1 Router LSA 1 0x2001 S1 Network LSA 2 0x2002 S1 U Bit LSA Handling 0 Treat the LSA as if it had link-local flooding scope 1 Store and flood the LSA as if the type is understood Inter-Area-Prefix-LSA 3 0x2003 S1 Inter-Area-Router-LSA 4 0x2004 S1 AS-External-LSA 5 0x4005 S2 Deprecated 6 0x2006 S1 NSSA-LSA 7 0x2007 S1 Link-LSA 8 0x0008 Intra-Area-Prefix-LSA 9 0x2009 S1 S2 S1 Flooding Scope 0 0 Link-Local Scoping - Flooded only on originating link 0 1 Area Scoping - Flooded only in originating area 1 0 AS Scoping - Flooded throughout AS 1 1 Reserved LSA Type Format 1Bit 1Bit 1Bit 13 Bits U S2 S1 LSA Function Code 76

77 OSPFv3 Configuration Example Router 2 Router 1 POS3/0 POS 2/0 Area 1 Area :410:ffff:1::1/ :db8:ffff:1::1/ :db8:ffff:1::2/64 POS1/1 Router1# interface POS1/1 ipv6 address 2001:410:FFFF:1::1/64 ospfv3 100 area 0 ipv6! interface POS2/0 ipv6 address 2001:db8:FFFF:1::2/64 ospfv3 100 area 1 ipv6! router ospfv3 100 router-id Router2# interface POS3/0 ipv6 address 2001:db8:FFFF:1::1/64 ospfv3 100 area 1 ipv6! router ospfv3 100 router-id Enables IPv6 facing Area 0 Interlink connection (could use link-local) Interlink connection (could use link-local) 32 bit ID specified in dotted decimal notation 77

78 BGP-4 Extensions for IPv6 (MP-BGP) BGP-4 carries only 3 pieces of IPv4 specific information NLRI in the UPDATE message contains an IPv4 prefix NEXT_HOP path attribute in the UPDATE message contains a IPv4 address BGP Identifier in the OPEN message & AGGREGATOR attribute RFC 4760 defines multi-protocol extensions for BGP-4 to support protocols other than IPv4 New BGP-4 optional and non-transitive attributes: MP_REACH_NLRI MP_UNREACH_NLRI Protocol independent NEXT_HOP attribute Protocol independent NLRI attribute 78

79 MP-BGP for IPv6 Considerations TCP Interaction BGP-4 runs over a TCP (179) session using IPv4 or IPv6 The NLRI BGP carried (IPv4, IPv6, MPLS) is agnostic of the session protocol Router ID If IPv4 session is not used, a BGP router-id must still exist in a 32 bit dotted decimal notation The RID does not have to be in valid IPv4 format. For example, is valid The sole purpose of RID is for identification In BGP it is used as a tie breaker and is sent within the OPEN message Next-hop contains a global IPv6 address (or potentially a link local address) Link local address as a next-hop is only set if the BGP peer shares the subnet with both routers (advertising and advertised) 79

80 BGP IPv6 Configuration Global Address Peering Router 2 E0/0 2001:db8:2:1::1 2001:db8:a: : AS65002 TCP over IPv6 BGP Session Router2#! interface Ethernet0/0 ipv6 address 2001:db8:2:1::1/64! router bgp bgp router-id no bgp default ipv4-unicast neighbor 2001:db8:2:1::f remote-as address-family ipv6 neighbor 2001:db8:c18:2:1::f activate network 2001:db8:a::/48 exit-address-family Router ID in dotted decimal notation Disable IPv4 prefix exchange Only use IPv6 address family Activate IPv6 session with neighbour IPv6 prefix to be advertised 2001:db8:2:1::f E0/0 Router 1 AS

81 BGP IPv6 NLRI Configuration over IPv4 Peer Router 2 E0/ :db8:2:1::1 2001:db8:a:: AS65002 TCP over IPv4 BGP Session Router2#! router bgp bgp router-id Allow IPv6 AFI to be passed in NLRI neighbor remote-as 65001! address-family ipv6 neighbor activate Enable BGP session over IPv4 to carry IPv6 prefxies neighbor route-map SETNH out network 2001:db8:a::/48 IPv6 prefix to be advertised! route-map SETNH permit 10 set ipv6 next-hop 2001:db8:2:1:1 Ensure IPv6 NLRI has a suitable next-hop (same family) :db8:2:1::f E0/0 Router 1 AS65001 This configuration sets up an IPv4 neighbour session IPv4 session transports IPv6 prefixes (NLRI) Rewrites the next hop to a valid IPv6 address in the update Inbound or Outbound route-maps can be used Next hop needs to be set to correct IPv6 address 81

82 BGP IPv4 NLRI Configuration over IPv6 Peer Router 2 E0/ :db8:2:1:: :db8:2:1::f E0/0 Router 1 AS65002 TCP over IPv6 BGP Session AS65001 Router2#! router bgp bgp router-id neighbor 2001:db8:2:1::f remote-as 65001! address-family ipv4 neighbor 2001:db8:2:1::f activate neighbor 2001:db8:2:1::f route-map SETNH in! route-map SETNH permit 10 set ip next-hop This configuration sets up an IPv6 neighbour session IPv6 session transports IPv4 prefixes (NLRI) Next hop needs to be set to correct IPv4 address Inbound or Outbound route-map can be used Allow IPv4 AFI to be passed in NLRI Enable BGP session over IPv6 to carry IPv4 prefixes Change next-hop for incoming IPv4 prefixes Ensure IPv4 NLRI has a suitable next-hop (same family) 82

83 BGP IPv6 Configuration Link-Local Peering Router 2 AS65002 E0/0 fe80::a8bb:ccff:feab:cdef TCP over IPv6 BGP Session Router2#! router bgp neighbor fe80::a8bb:ccff:fe01:f600%ethernet0/0 remote-as 65001! address-family ipv6 neighbor fe80::a8bb:ccff:fe01:f600%ethernet0/0 activate neighbor fe80::a8bb:ccff:fe01:f600%ethernet0/0 route-map SETNH out redistribute connected no synchronization! route-map SETNH permit 10 set ipv6 next-hop 2001:100:1:1::2 fe80::a8bb:ccff:fe01:f600 E0/0 Router 1 AS65001 Not a recommended option CLI supports RFC 4007 scoped zones Can specify link-local neighbor address % source interface. This format useful for when you have multiple L2 links to a BGP neighbor. Unnecessary complexity can be difficult to diagnose problems, link-local address can change 83

84 BGP Address Families Configuration Tips When initially configuring the router Put all IPv6 configuration directly into IPv6 address family Put all IPv4 configuration directly into IPv4 address family router bgp no bgp default ipv4-unicast! address family ipv4 neighbor remote-as neighbor prefix-list ipv4-ebgp in neighbor prefix-list v4out out network ! address-family ipv6 neighbor 2001:db8:1:1019::1 remote-as neighbor 2001:db8:1:1019::1 prefix-list ipv6-ebgp in neighbor 2001:db8:1:1019::1 prefix-list v6out out network 2001:db8::/32! ip prefix-list ipv4-ebgp permit /0 le 32 ip prefix-list v4out permit /16 ipv6 prefix-list ipv6-ebgp permit ::/0 le 128 ipv6 prefix-list v6out permit 2001:db8::/32 Generic Configuration Specific IPv4 Configuration Specific IPv4 Configuration Generic Configuration 84

85 BGP Address Families Resultant Configuration Router will sort generic from specific address family configuration When the configuration is saved or displayed on console router bgp no bgp default ipv4-unicast neighbor 2001:db8:1:1019::1 remote-as neighbor remote-as 65002! address-family ipv4 neighbor activate neighbor prefix-list ipv4-ebgp in neighbor prefix-list v4out out network exit-address-family! address-family ipv6 neighbor 2001:db8:1:1019::1 activate neighbor 2001:db8:1:1019::1 prefix-list ipv6-ebgp in neighbor 2001:db8:1:1019::1 prefix-list v6out out network 2001:db8::/32 exit-address-family! ip prefix-list ipv4-ebgp permit /0 le 32 ip prefix-list v4out permit /16 ipv6 prefix-list ipv6-ebgp permit ::/0 le 128 ipv6 prefix-list v6out permit 2001:db8::/32 Neighbours added to generic configuration Activate command automatically included Activate command automatically included Common generic configuration 85

86 World IPv6 Launch As the successor to the current Internet Protocol, IPv4, IPv6 is critical to the Internet's continued growth as a platform for innovation and economic development. 6 th June Get involved 86

87 Complete Your Online Session Evaluation Complete your session evaluation: Directly from your mobile device by visiting and login by entering your badge ID (located on the front of your badge) Visit one of the Cisco Live internet stations located throughout the venue Open a browser on your own computer to access the Cisco Live onsite portal Don t forget to activate your Cisco Live and Networkers Virtual account for access to all session materials, communities, and on-demand and live activities throughout the year. Activate your account at any internet station or visit 87

88 88