Preporučeni redosled. next-header

Transcription

1 IP version 6 Dr Nenad Krajnović krajko@etf.bg.ac etf.bg.ac.rs Razlozi za uvođenje IPv6 Potrošen adresni prostor Mogućnost da se integrišu nove stvari kao što je automatsko konfigurisanje, sigurnost i zaštita, QoS Širenjem Interneta sve više raznih ureñaja se povezuje na mrežu, kao što su mobilni telefoni (procene su da je bilo 1,75 milijardi smart mobilnih telefona) 2 IPv6 Definisan u okviru RFC 2460 (specifikacija je dopunjena kroz veći broj novijih RFC-ova) Arhitektura adresiranja je definisana u okviru RFC 4291 (dopunjena u novijim RFC-ovima) Uvodi 128-bitni adresni prostor Modifikuje se format zaglavlja IP datagrama u cilju smanjenja broja polja 3 1

2 IPv6 - nastavak Unapreñen način tretiranja opcija u okviru zaglavlja Uvodi se labela koja identifikuje tok podataka Uvedena je ekstenzija koja omogućava identifikaciju pošiljaoca i zaštitu podataka (AH i ESP) AH Authentication Header ESP Encapsulating Security Payload 4 Format paketa Version Traffic Class Flow Label Payload Length Next Header Hop Limit Source Address Destination Address Format paketa - objašnjenja Version 4 bita oznaka verzije (6). Traffic Class 8 bita polje klase servisa. Flow Label 20 bita labela koja identifikuje tok podataka; definisano u RFC Payload Length 16 bita dužina dela datagrama koji sledi posle osnovnog IPv6 zaglavlja izražena u broju okteta. 6 2

3 Format paketa - objašnjenja Next Header 8 bita identifikuje tip zaglavlja koje sledi odmah posle osnovnog zaglavlja 7 Višestruko zaglavlje 8 Redosled obrade dodatnih zaglavlja (RFC 2460) Preporučeni redosled Dodatno zaglavlje Oznaka za next-header 1 Hop-by by-hop options header 0 2 Destination options header 60 3 Routing header 43 4 Fragment header 44 5 Authentication header (AH) 6 ESP header 7 Upper-layer header: TCP UDP AH=51 ESP=50 TCP = 6 UDP =

4 Format paketa - objašnjenja Hop Limit 8 bita brojač broja skokova (nekada se koristilo polje TTL); ako vrednost dostigne nulu datagram se odbacuje 10 Format paketa - objašnjenja Source, Destination Address po 128 bita IPv6 adresa Moguće je adresirati 2 na 128-mi stepen različitih adresa: 340,282,366,920,938,463,463,374,607,431,768,211, Tipovi IPv6 adresa Tri tipa adresa: unicast označava adresu jednog interfejsa na ureñaju multicast označava grupu interfejsa (uglavnom na različitim računarima); paket poslat na ovu adresu stiže do svih adresiranih interfejsa anycast označava grupu interfejsa; paket poslat na anycast adresu stiže do jednog od interfejsa opisanih ovom adresom (po pravilu najbližeg definisano pojmom rastojanja u protokolu rutiranja) 12 4

5 Broadcast adresa? Broadcast adresa se više ne koristi Tu funkciju obavlja multicast adresa Adrese sa svim 0-ma ili svim 1-ma u host delu sada postaju regularne adrese 13 Arhitektura adresiranja Način dodele adrese se značajno razlikuje u odnosu na IPv4 Svaki interfejs mora da ima barem jednu tzv. link-locallocal adresu a može da ima proizvoljan broj drugih adresa Jedna unicast adresa može se koristiti za više fizičkih interfejsa na jednom ureñaju (za load balancing) 14 Način pisanja IPv6 adresa Najčešće se koristi format: x:x:x:x:x:x:x:x gde svako x predstavlja heksadecimalni zapis 16-bitnog polja FEDC:BA98:7654:3210:FEDC:BA98:7654:

6 Način pisanja IPv6 adresa U U cilju pojednostavljenja, nije neophodno pisati vodeće nule ili veći broj nula: 1080:0:0:0:8:800:200C:417A ili 1080::8:800:200C:417A FF01:0:0:0:0:0:0:101 ili FF01::101 0:0:0:0:0:0:0:1 ili ::1 16 Tipovi adresa Address type Binary prefix notation IPv6 Unspecified (128 bits) ::/128 Loopback (128 bits) ::1/128 Multicast FF00::/8 Link-local unicast FE80::/10 Site-local unicast FEC0::/10 Global unicast (everything else) 17 Dodeljivanje adresa Kombinacija alokacije i automatskog dodeljivanja Adresa mreže se i dalje definiše po CIDR principu Krajnji korisnik svoj adresni blok dobija od ISP-a Definisanje host dela adrese je automatizovano 18 6

7 Dodeljivanje adresa Poslednjih 64 bita u IPv6 unicast adresi se nazivaju Interface Identifier i moraju da budu jedinstveni unutar jedne podmreže (subnet). Interface Identifier treba da bude u modifikovanom EUI-64 formatu. RFC 6177 daje preporuku kako deliti adresni prostor. Moguće su i druge mrežne adrese osim / Modifikovani EUI-64 format u bit označava važnost vrednosti: 1 global scope (adresa se formira na osnovu MAC adrese) 0 local scope (adresa se formira na slučajan način) 20 Lokalne adrese Link local FE80::/10 Predviñena za adresiranje na jednom linku. Koristi se za automatsko dodeljivanje adresa, otkrivanje suseda ili kada nema rutera. Ruter ne sme da prosleñuje pakete sa ovom adresom. 21 7

8 Lokalne adrese Site local FEC0::/10 Predviñenja za adresiranje unutar jednog site-a. Ruter ne sme da propušta pakete sa ovom adresom. RFC 3879 preporučuje da se ovako formirane adrese NE koriste!!! 22 Globalna unicast adresa Adresni blok koji se trenutno distribuira 2001::/16 23 Više adresa po jednom interfejsu IPv6 dozvoljava da jedan fizički interfejs ima više IPv6 adresa: inet6 2001:bafa:21:0:225:90ff:fe3c:40ca prefixlen 64 scopeid 0x0<global> inet6 fe80::225:90ff:fe3c:40ca prefixlen 64 scopeid 0x20<link> inet6 2001:bafa:21:: 1::4 prefixlen 64 scopeid 0x0<global> IPv6 is enabled, link-local local address is FE80::3E08:F6FF:FE8C:943F Global unicast address(es): 2001:BAFA:21::15, subnet is 2001:BAFA BAFA:21::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:13 FF02::1:FF8C:943F 24 8

9 Multicast adresa 25 Rezervisane multicast adrese Rezervisana multicast adresa FF02::1 FF02::2 FF02::9 FF02::1:FFxx:xxxx FF05::101 Opis namene Svi nodovi na linku (link-local scope). Svi ruteri na linku. Svi routing information protocol (RIP) ruteri na linku. Sve solicited-node multicast adrese koje se koriste za autoconfiguration hosta i neighbor discovery (slično ARP-u kod IPv4). xx:xxxx je 24 bita najmanje težine odgovarajuće unicast ili anycast adrese noda. Svi Network Time Protocol (NTP) serveri. 26 IPv6 Multicast adrese - Scope 8 bits 4 bits 4 bits 112 bits Flag Scope Group ID Scope je polje dužine 4 bita koje se koristi za definisanje oblasti važenja multicast adrese Scope (nepotpuna lista): 0 Reserved 1 Interface-Local scope 2 Link-Local scope 5 Site-Local scope 8 Organization-Local scope E Global scope 27 9

10 IPv6 Multicast adrese - Flag 8 bits 4 bits 4 bits 112 bits Flag Scope Group ID 00PT Flag T 0 - Permanent, well-known multicast address assigned by IANA. Includes both assigned and solicited-node multicast addresses. 1 - Non-permanently-assigned, dynamically" assigned multicast address. Jedan primer je adresa FF18::BAFA:2356, koja se koristi za multicast aplikacije unutar organizacije. Flag P - Prefix for unicast-based assignments 28 Assigned IPv6 Multicast Addresses IPv6 Adrese Multicast Assigned FF00::/8 Solicited-Node FF02::1:FF00:0000/104 RFC 2375, IPv6 Multicast Address Assignments, defines the initial assignment of IPv6 multicast addresses that have permanently assigned Global IDs. Reference for assigned multicast addresses: (IANA) IPv6 Multicast Address Space Registry - multicast-addresses.xhtml 29 Flag = 0, Assigned multicast Scope = 2, Link-local scope Assigned Multicast Addresses with Link-local Scope Prefix Flag Scope Predefined Group ID Compressed Format Description (IPv6 assumed) FF 0 2 0:0:0:0:0:0:1 FF02::1 All-devices FF 0 2 0:0:0:0:0:0:2 FF02::2 All-routers FF 0 2 0:0:0:0:0:0:5 FF02::5 OSPF routers FF 0 2 0:0:0:0:0:0:6 FF02::6 OSPF DRs FF 0 2 0:0:0:0:0:0:9 FF02::9 RIP routers FF 0 2 0:0:0:0:0:0:A FF02::A EIGRP routers FF 0 2 0:0:0:0:0:1:2 FF02::1:2 DHCP servers/relay agents 30 10

11 Assigned Multicast Addresses with Site-local Scope Flag = 0, Assigned multicast Scope = 5, Site-local scope Prefix Flag Scope Predefined Group ID Compressed Format Description (IPv6 assumed) FF 0 5 0:0:0:0:0:0:2 FF05::2 All-routers FF 0 5 0:0:0:0:0:1:3 FF05::1:3 All DHCP servers Koristi se za komunikaciju unutar sajta, uz mogućnost rutiranja unutar sajta. Da bi IPv6 multicast rutiranje funkcionisalo, mora da se aktivira: Router(config)# ipv6 multicast-routing 31 All IPv6 Devices Assigned Multicast Address ICMPv6 Router Advertisement FF02::1 FE80::225:90ff:fe3c:40ca Rest of IPv6 Packet Destination IPv6 Address Source IPv6 Address (Link-local address) Router(config)# ipv6 unicast-routing FF02::1 All IPv6 Devices All IPv6 devices, including the router, belong to this group. Every IPv6 device will listen and process packets to this address. Isn t this the same as a broadcast? No, because it maps to a Layer 2 MAC address which is more efficient ICMPv6 Router Advertisement 32 All IPv6 Routers Assigned Multicast Address ICMPv6 Router Solicitation FF02::2 FE80::12:3456:7890:BAFA Rest of IPv6 Packet Destination IPv6 Address Source IPv6 Address Router(config)# ipv6 unicast-routing FF02::2 All IPv6 Routers All IPv6 routers belong to this group. (Process these packets.) Used by devices to communicate with an IPv6 Router. ICMPv6 Router Solicitation 33 11

12 Verifying IPv6 Multicast Addresses on the Router Router# show ipv6 interface gigabitethernet 0/0 GibabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::fe3c:40ca Global unicast address(es): 2001:9:BAFA::fe3c:40ca, subnet is 2001:B9:BAFA::/64 Joined group address(es): FF02::1 FF02::2 FF02::5 FF02::6 FF02::1:FF00:1 Member of these Multicast Groups All-IPv6 devices on this link All-IPv6 routers on this link: IPv6 routing enabled OSPFv3 All OSPF Routers (similar to ) OSPFv3 All DR Routers (similar to ) Solicited-node multicast addresses FF02 2 means link-local scope What is a solicited node multicast address? 34 Solicited-Node IPv6 Multicast adresa IPv6 Adrese Multicast Assigned FF00::/8 Solicited-Node FF02::1:FF00:0000/104 Unicast: GUA, Link-Local, Pored svake unicast adrese koja se dodeli interfejsu, uređaj će imati i specijalnu multicast adresu koja je poznata kao solicite-node multicast adresa. 35 Solicited-Node Multicast adresa PC2 Unicast Addresses Solicited Node Multicast Global Unicast 2001:DB9:BAFA:1::300 FF02::1:FF00:300 Link-local unicast FE80::5555:6666:7777:8888 FF02::1:FF77:8888 Šta je solicited-node multicast adresa? A Layer 3 multicast address with link-local scope FF02 (within the subnet/vlan). There is a solicited node multicast address for every IPv6 unicast (or anycast) address including: Global Unicast Address (GUA) Link-local Address Used in ICMPv6 Neighbor Discovery messages during: Address Resolution Similar to ARP for IPv4 Duplicate Address Detection (DAD) Similar to gratuitous ARP for IPv

13 Solicited-Node Multicast adresa PC2 Unicast Addresses Solicited Node Multicast Global Unicast 2001:DB9:BAFA:1::300 FF02::1:FF00:300 Link-local unicast FE80::5555:6666:7777:8888 FF02::1:FF77:8888 Kako se kreiraju? Postoji direktna veza izmeñu unicast/anycast adrese i njima odgovarajuće solicited-node multicast adrese. Solicited-node multicast adresa formira se od: Prefiksa FF02:0:0:0:0:1:FF00::/104 (FF02::1:FFxx:xxxx). Na taj prefiks se dodaju 24 bita najnižeg prioriteta unicast/anycast adrese. Kao i ostale multicast adrese i solicited-node multicast adresa se mapira u odgovarajuću Ethernet MAC adresu. 37 Kako se kreiraju Solicited-Node Multicast adrese? PC2 s Global Unicast Address Global Routing Prefix Subnet Interface ID ID PC2 s IPv6 Solicited-Node Multicast Address 24 bits 2001:0DB9:BAFA :0000:00 00:0300 Copy 24 bits FF FF 00: bits Solicited-node Multicast address mapped to Ethernet destination MAC address PC2 s IPv6 global unicast address: 2001:DB9:BAFA:1::300 PC2 s IPv6 solicited-node multicast address: FF02::1:FF00:300 PC2 s mapped Ethernet multicast address : FF Ability to filter at the NIC IPv6 Multicast Copy 32 bits Low-order 32 bits of IPv FF multicast address mapped to low-order 32 bits of MAC address. 38 Duplirane Solicited-Node Multicast Adrese PC A Global Unicast PC B Global Unicast Unicast Addresses Same for both PCs Solicited Node Multicast 2001:DB9:BAFA:1:AAAA::300 FF02::1:FF00: :DB9:BAFA:1:BBBB::300 FF02::1:FF00:300 Global Routing Prefix Subnet ID Interface ID 40 bits 24 bits PC A 2001:0DB9:BAFA 0001 AAAA:0000:00 00:0300 PC B 2001:0DB9:BAFA 0001 BBBB:0000:00 00:0300 Although rare, solicited node multicast addresses may not be unique. Possible to have multiple devices with the same solicited node multicast address (and same Ethernet multicast) if the low-order order 24 bits match High-order 40 bits of interface ID will differ. No problem, ICMPv6 NS contains target unicast address

14 Prednosti korišćenja Solicited-Node Multicast adresa PC2 Global Unicast Unicast Addresses Solicited Node Multicast Ethernet MAC 2001:DB9:BAFA:1::300 FF02::1:FF00: FF Link-local FE80::5555:6666:7777:8888 FF02::1:FF77: FF Zašto su solicited-node multicasts bolje nego broadcast adrese? Multicasts adrese se mapiraju u Ethernet MAC adrese i Ethernet NICs (hardware or drivers) mogu da ih filtriraju. Zašto je to dobro? 40 Prednosti korišćenja Solicited- Node Multicast adresa Ethernet Broadcast Destination MAC Address: Broadcast Data must be passed to upper layer for processing (ARP for example). Ethernet Broadcast IPv4 or IPv6 Multicast IP multicast packets can be filtered by the switch, only sending packets to members of that group. IPv4 - IGMP (Internet Group Management Protocol) IPv4/IPv6 Multicast IGMP/MLD Snooping IPv6 - MLD (Multicast Listener Discovery) However, Solicited Node Multicasts are forwarded out all ports because of the potentially huge forwarding tables needed to to store these addresses 41 Ethernet NICs and Solicited-Node Multicasts PC2 Processes the following IPv6 and Ethernet MAC Addresses Unicast Addresses 24 bits Solicited Node Multicast Ethernet MAC Ethernet NIC N/A N/A 00-1B A2-1E Global Unicast 2001:DB8:CAFE:1::200 FF02::1:FF00: FF Link-local FE80::1111:2222:3333:4444 FF02::1:FF33: FF Multicast (All-IPv6- Devices) 32 bits FF02::1 N/A Besides its own MAC address, the Ethernet NIC will accept multicast addresses created from the: Solicited node multicast (global unicast address) 00-1B A2-1E Solicited node multicast (link-local local address) Any assigned multicast address such as All-IPv6-Devices. * Ethernet MAC addresses such as IPv4 broadcasts and those associated with other protocols are not shown. LAN Card Copyright lamart

15 Verifying the Solicited-Node Multicasts Router# show ipv6 interface gigabitethernet 0/0 GigabitEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::FE99:47FF:FE75:C3E0 Global unicast address(es): 2001:DB8:CAFE:1::1, subnet is 2001:DB8:CAFE:1::/64 Joined group address(es): FF02::1 FF02::2 FF02::1:FF00:1 FF02::1:FF75:C3E0 <output omitted for brevity> Member of these Multicast Groups All-IPv6 devices on this link All-IPv6 routers on this link: IPv6 routing enabled Solicited-node multicast address Global Unicast Solicited-node multicast address link-local FF02 2 means link-local scope Router s NIC will process destination MAC addresses for assigned and solicited node multicasts such as FF and FF-75- C3-E0 (solicited node) 43 My IPv4! Here is the MAC My IPv6! Here is the MAC ICMPv6 ND Address Resolution PC2 2 2 ARP Reply Neighbor Advertisement IP to data link (MAC) address mapping: IPv4 addresses use ARP IPv6 addressing use ICMPv6 Neighbor Discovery messages Neighbor Solicitation (via Solicited-Node) Neighbor Advertisement Devices store this mapping in their Neighbor Cache 1 ARP Request Neighbor Solicitation 1 PC1 3 Know IPv6, what is the MAC? Know IPv4, what is the MAC? ARP Cache Neighbor Cache 3 ICMPv6 Neighbor Discovery Neighbor Solicitation Neighbor Advertisement 44 Advantages of Solicited-Node Multicast IPv4 ARP Requests Destination MAC Address: Layer 2 Broadcast Data must be passed by NIC to upper layer for processing examine target IPv4 address. Ethernet Broadcast passed to upper layer Ethernet DA: Broadcast ARP Message ARP Message with Target IPv4 Address IPv6 Address Resolution Destination IPv6: Solicited-Node Multicast Destination MAC Address: Layer 2 Multicast Ethernet Multicast filtered by the NIC Ethernet DA: Multicast IPv6 DA: Solicited- Node Multicast ICMPv6 NS ICMPv6 NS with Target IPv6 Address 45 15

16 My IPv6! Here is the MAC? PC2 MAC Address 00-1B A2-1E Solicited-Node Example 2001:DB8:CAFE:1::/ Neighbor Neighbor Advertisement Solicitation Know IPv6, what is the MAC? PC1 MAC Address B-D9-C :DB8:CAFE:1::200/64 FF02::1:FF00:200 (Solicited Node Multicast) ICMPv6 NS: Target IPv6 Address (GUA of PC2) Destination IPv6: Solicited-Node Multicast Destination MAC Address: Layer 2 Multicast 2001:DB8:CAFE:1::100/ Neighbor Cache 2001:DB8:CAFE:1:: B A2-1E 1 PC1> ping 2001:DB8:CAFE:1::200 Ethernet Destination MAC: FF IPv6 Destination Address: FF02::1::FF00:200 ICMPv6 Neighbor Solicitation Target IPv6 Address 2001:DB8:CAFE:1:: Source for group FF3E:40:2001:DB8:CAFE:1:BBBB:BBBB MLDv2 Joining a Group General query to FF02::1 R1 MLD Querier (All-IPv6 devices with link-scope) Never mind, A got it. A B C Listener Report for group to FF02::16 (All MLDv2 Routers) Listener Report for group FF3E:40:2001:DB8:CAFE:1:BBBB:BBBB to FF02::16 (All MLDv2 Routers) Suppressed Listener Report for group to FF02::16 (All MLDv2 Routers) Multicast Listener Discovery (MLDv2) for IPv6 similar to Internet Group Management Protocol (IGMPv2) for IPv4. Hosts use MLD to dynamically register themselves in a multicast group on a particular network. Hosts send Listener Report messages to their local multicast router, informing the router as to which multicast addresses it wants to receive traffic. Routers configured for MLD (MLD Queriers) listen to Listener Report messages from hosts. Routers periodically send out queries to discover which multicast groups are still active. 47 Source for group FF3E:40:2001:DB8:CAFE:1:BBBB:BBBB MLDv2 Leaving a Group Is there anyone else? Traffic continues for MLD Querier R1 Address specific query for to A I m done. B I still want C it! Listener Done for group to FF02::16 (All MLDv2 Routers) Listener Report for group to FF02::16 (All MLDv2 Routers) When a host no longer wants to receive traffic for a multicast group, it can inform the router by sending a Multicast Listener Done message

17 MLDv2 Snooping MLD Querier I will send packets for this group out this interface. R1 I will also send packets for this group out this interface. A C Listener Report for group to FF02::16 (All MLDv2 Routers) B Listener Report for group to FF02::16 (All MLDv2 Routers) A switch can snoop Listener Reports from the hosts and creates an entry in its Layer 2 forwarding table for the port it was received. If another host sends a listener report for the same group, the switch snoops their reports and adds them to the existing Layer 2 forwarding table entry. With MLD snooping enabled, multicast messages for this group are only sent out ports with hosts that are members of that group. Remember, solicited node multicasts are forwarded out all ports because of the potentially huge forwarding tables needed to to store these addresses. 49 For more on IPv6 Multicast MLD Querier I will send packets for this group out this interface. R1 I will also send packets for this group out this interface. A C Listener Report for group to FF02::16 (All MLDv2 Routers) B Listener Report for group to FF02::16 (All MLDv2 Routers) For more on Multicast and MLD see IPv6 Multicast Primer (PowerPoint PDF) by Tim Martin (CCIE #2020, Cisco Solutions Architect) 50 Path MTU discovery IPv6 je napustio princip fragmentacije paketa. Uvedena je obaveza korišćenja path MTU discovery mehanizma u cilju odreñivanja najmanjeg MTU duž putanje komunikacije. Inicijalni paket koji se šalje ima dužinu koja odgovara MTU vrednosti interfejsa preko koga se šalje

18 Path MTU discovery Ukoliko paket naiñe na link čije je MTU manji, taj ruter šalje ICMPv6 poruku Packet Too Big u okviru koje šalje i svoj MTU. Izvorni host šalje novi paket čija dužina odgovara MTU vrednosti koja je dobijena. Proces se ponavlja dok paket ne stigne do odredišnog hosta. Dobijeni MTU se pamti za navedenu sesiju. 52 Literatura: pv6-presentations.htmlpresentations.html 53 IP version 6 Dr Nenad Krajnović krajko@etf.bg.ac etf.bg.ac.rs 18