IPv6 Deployment at ORNL

Transcription

1 IPv6 Deployment at ORNL Greg Hinkel ETCSS October 24, 2012

2 Outline Purpose Quick v6 intro Background v6 traffic Develop an IPv6 plan Contain v6 traffic v6 test network (Phase 1) Config examples v6 test network (Phase 2) Ipv6 addressing/ipam Issues/Concerns Summary 2 Managed by UT-Battelle

3 Purpose No FUD or need to justify v6 Little Theory Practical experience Things you may not get elsewhere 3 Managed by UT-Battelle

4 My Training IPv6 Security Scott Hogg and Eric Vyncke 1 day Intro to IPv6 class ORNL IPv6 interest group Joint Techs meetings Playing on our test network Lots of google searches 4 Managed by UT-Battelle

5 IPv6 address format AAAA:BBBB:CCCC:DDDD:EEEE:FFFF:0000:1111 ORNL Allocation Subnet Interface ID 2620:0:2b30: 1234: 0211:22ff:fe33: Managed by UT-Battelle

6 SLAAC StateLess Address Auto Configuration Automatic assignment of own v6 address Need prefix or subnet from router for global scope addr Interface ID EUI-64 address (based on MAC address) Privacy address Address scope Link local address Global address 6 Managed by UT-Battelle

7 SLAAC EUI-64 MAC Interface ID 0211:22ff:fe33:4455 Squeeze in ff:fe 7 Managed by UT-Battelle

8 Some well known v6 networks Address 8 Managed by UT-Battelle Description 0::/96 IPv4compatibility (obsolete RFC5156) ::/128 Unspecified (RFC4291) ::1/128 Loopback (RFC4291) ::ffff:0:0/96 IPv4-mapped IPv6 (RFC4291) 2001:0::/32 Teredo (RFC4380) 2001:db8::/32 Documentation (RFC3849) 2002::/16 6-to-4 (RFC3056) 3ffe::/16 fc00::/7 6bone (obsolete RFC3701) Unique local (RFC4193) fe80::/10 Link local (RFC 4291) fec0::/10 ff00::/8 Site local (obsolete - RFC3879) Multicast (RFC4291)

9 Well known v6 multicast addresses Address Description ff02::1 All nodes on the local network segment ff02::2 All routers on the local network segment ff02::5 OSPFv3 All SPF routers ff02::6 OSPFv3 All DR routers ff02::8 IS-IS for IPv6 routers ff02::9 RIP routers ff02::a EIGRP routers ff02::d PIM routers ff02::16 MLDv2 reports (defined in RFC 3810) ff02::1:2 All DHCP servers and relay agents on the local network segment (RFC 3315) ff05::1:3 All DHCP servers on the local network site (RFC 3315) ff0x::c Simple Service Discovery Protocol ff0x::fb Multicast DNS ff0x::101 Network Time Protocol ff0x::108 Network Information Service ff0x::114 Used for experiments 9 Managed by UT-Battelle

10 Transition technologies Ease migration to v6 Dual stack IPv4 and IPv6 both Tunnel (encapsulate v4 in v6 or vice versa) Teredo 6to4 ISATAP 6in4 10 Managed by UT-Battelle

11 Microsoft default v6 config Ethernet adapter Local Area Connection: Physical Address : F Autoconfiguration Enabled... : Yes Link-local IPv6 Address.... : fe80::2996:903a:bbc7:6bee%12 IPv4 Address : DHCPv6 IAID : DHCPv6 Client DUID : E2-C2-E F Tunnel adapter isatap.ornl.gov: Media State : Media disconnected Tunnel adapter Local Area Connection* 11: Connection-specific DNS Suffix : ornl.gov Description : Microsoft 6to4 Adapter Autoconfiguration Enabled... : Yes IPv6 Address : 2002:a05b:dbf2::a05b:dbf2 Default Gateway : 2002:c058:6301::c058: Managed by UT-Battelle

12 Background v6 Traffic There s a lot Link local IPv4 protocol 41 EUI-64 and privacy addresses ICMPv6 neighbor discovery Neighbor solicitation Neighbor advertisement Router solicitation DHCP solicitation Multicast (no broadcast) 12 Managed by UT-Battelle

13 Background Traffic (local link) 12:06: IP6 fe80::b43c:70ed:5eee:a861 > ff02::2: ICMP6, router solicitation, length 16 12:06: IP6 fe80::6da8:8cb0:bed8:485e.546 > ff02::1:2.547: dhcp6 solicit 12:06: IP6 fe80::6c:e05e:6ba4: > ff02::1:2.547: dhcp6 solicit 12:06: IP6 fe80::217:f2ff:fecb: > ff02::fb.5353: 0 [23a] PTR (QM)? _printer._tcp.local. (1015) 12:08: IP6 fe80::c8e:ddc6:952c:1410 > ff02::16: HBH ICMP6, multicast listener report v2, 1 group record(s), length 28 12:08: IP6 fe80::225:4bff:feb5:74ce.5353 > ff02::fb.5353: 0*- [0q] 2/0/4 TXT "model=imac9,1", PTR boyimac._rfb._tcp.local. (184) 12:16: IP6 fe80::cc9e:a409:e347:19ea > ff02::1:3.5355: UDP, length 28 12:17: IP6 fe80::40e2:b803:2ab6:38f > ff02::c.1900: UDP, length :17: IP6 fe80::40e2:b803:2ab6:38f > ff02::c.1900: UDP, length :55: IP6 :: > ff02::1:ff87:ff84: ICMP6, neighbor solicitation, who has fe80::223:dfff:fe87:ff84, length 24 13:55: IP6 fe80::223:dfff:fe87:ff84 > ff02::1: ICMP6, neighbor advertisement, tgt is fe80::223:dfff:fe87:ff84, length Managed by UT-Battelle

14 Background Traffic (border) 6to4 Relay (anycast address) IPv4 protocol 41 00:00:09 Deny protocol 41 src dst :00:10 Deny protocol 41 src dst :00:15 Deny protocol 41 src dst Managed by UT-Battelle

15 Develop a Plan Training Contain v6 communication Acquire IPv6 address block Upstream provider v6 enabled? Why are you enabling v6? Out of v4 addresses Requirement/Mandate Customer request Good netizens 15 Managed by UT-Battelle

16 ORNL s Plan (draft 1 or 2) Contain v6 traffic Block IP Protocol 41 at the border Don t route v6 until you re ready Disable v6 at host Acquire v6 address block Upstream providers already v6 enabled Build test network IPAM Other external facing servers Internal network gear Non public facing servers and user s workstations Tunnel the remainder OMB Mandate Externally facing servers DNS, servers 16 Managed by UT-Battelle

17 17 Managed by UT-Battelle

18 18 Managed by UT-Battelle v6 Test Network (phase 1) Border Protections Border Router ACLs Firewall ACLs Separate server and client subnets Dual Stack (Linux, MacOS, MS) Static addressing Limit v6 traffic to test network only. Later allow v6 communication with Internet. Local router config Internal DNS External v6 scan (before and after enabling v6 at border)

19 Border Router Config /* Addresses which should not appear as source or destination IPs; */ prefix-list V6-DO-NOT-ROUTE-ADDRS { /* IPv4 compatibility addr; */ 0::/96; /* Unspecified addr; */ ::/128; /* Loopback addr; */ ::1/128; /* IPv4-mapped IPv6 addr; */ ::ffff:0:0/96; /* Teredo addr; */ 2001:0::/32; /* Documentation addr; */ 2001:db8::/32; /* 6-to-4 addr; */ 2002::/16; /* ORNL internal use only */ 2620:0:2b30:1400::/56; /* 6bone addr; */ 3ffe::/16; /* Unique local addr; */ fc00::/7; /* Link local addr; */ inactive: fe80::/10; /* Formerly site local; */ fec0::/10; 19 Managed by UT-Battelle

20 filter v6-inbound-from-esnet { term allow-bgp-from-esnet-rtr { from { source-address { 2001:400:8202:28::2/128; next-header tcp; port 179; then { accept; term allow-icmpv6-from-esnet-rtr { from { source-address { fe80::/10; 2001:400:8202:28::2/128; destination-address { fe80::/10; 2001:400:8202:28::3/128; destination-prefix-list { V6-MULTICAST; next-header icmpv6; then accept; term drop-hostile-ips { from { source-prefix-list { HOSTILE-IPS; then { discard; 20 Managed by UT-Battelle

21 term drop-unallowed-src-addrs { from { source-prefix-list { V6-DO-NOT-ROUTE-ADDRS; V6-MULTICAST; V6-ORNL-INSIDE-ADDRS; then { discard; term drop-unallowed-dst-addrs { from { destination-prefix-list { V6-DO-NOT-ROUTE-ADDRS; then { discard; term deny-routing-header { from { next-header routing; then discard; term allow-some-icmpv6 { from { destination-prefix-list { V6-ORNL-INSIDE-ADDRS; V6-MULTICAST; next-header icmpv6; icmp-type [ echo-reply destination-unreachable packet-too-big parameter-problem redirect echorequest time-exceeded ]; 21 Managed by UT-Battelle then accept;

22 term deny-other-protocols { from { next-header-except [ tcp udp esp ah ]; then discard; term allow-our-addrs { from { destination-prefix-list { V6-ORNL-INSIDE-ADDRS; V6-MULTICAST; then { accept; term default { then discard; 22 Managed by UT-Battelle

23 filter v6-outbound-from-v6-dmz { term deny-unallowed-src { from { source-prefix-list { V6-DO-NOT-ROUTE-ADDRS; V6-MULTICAST; then { discard; term deny-unallowed-dst { from { destination-prefix-list { V6-DO-NOT-ROUTE-ADDRS; then { discard; term deny-routing-header { from { next-header routing; then discard; term allow-link-local { from { source-address { fe80::/10; destination-address { fe80::/10; then accept; 23 Managed by UT-Battelle

24 term allow-dst-ext-ornl-addrs { from { destination-address { 2620:0:2b30:0::/64; then accept; term deny-dst-ornl-addrs { from { destination-prefix-list { V6-ORNL-INSIDE-ADDRS; then discard; term allow-our-addrs { from { source-prefix-list { V6-ORNL-INSIDE-ADDRS; then accept; term default { then discard; 24 Managed by UT-Battelle

25 Default v6 config Linux Config Set static address ifconfig eth0 add 2620:0:2b30:4::8/64 Set static route route A inet6 add default gw 2620:0:2b30:4::1 /etc/sysconfig/network NETWORKING_IPV6=yes /etc/sysconfig/network-scripts/ifcfg-eth0 IPV6INIT=yes IPV6ADDR= 2620:0:2b30:4::8/64 ip6tables 25 Managed by UT-Battelle

26 Verify v6 connectivity ping6 (use I interface to ping link local addresses) traceroute6 DNS nslookup query=aaaa sixxs.net 2001:4860:4860::8888 host sixxs.net whatismyipv6.net ip -6 neigh ndp -an (MacOS) 26 Managed by UT-Battelle

27 v6 examples % ifconfig eth2 eth2 Link encap:ethernet HWaddr 00:60:DD:47:08:14 inet addr: Bcast: Mask: inet6 addr: 2620:0:2b30:b::3/64 Scope:Global inet6 addr: fe80::260:ddff:fe47:814/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:9000 Metric:1 RX packets: errors:0 dropped:0 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes: (394.5 GiB) TX bytes: (259.8 GiB) Interrupt:98 % ip -6 neigh fe80::260:ddff:fe46:7f24 dev eth2 lladdr 00:60:dd:46:7f:24 DELAY 2620:0:2b30:b::2 dev eth2 lladdr 00:60:dd:46:7f:24 REACHABLE fe80::21d:b5ff:fec3:27f0 dev eth2 lladdr 00:1d:b5:c3:27:f0 router STALE % ping6 fe80::260:ddff:fe46:7f24 connect: Invalid argument % ping6 -I eth2 fe80::260:ddff:fe46:7f24 PING fe80::260:ddff:fe46:7f24(fe80::260:ddff:fe46:7f24) from fe80::260:ddff:fe47:814 eth2: 56 data bytes 64 bytes from fe80::260:ddff:fe46:7f24: icmp_seq=0 ttl=64 time=1.46 ms 64 bytes from fe80::260:ddff:fe46:7f24: icmp_seq=1 ttl=64 time=0.091 ms 27 Managed by UT-Battelle

28 Some legit v6 traffic 00:15: IP6 fe80::218:b9ff:fe0b:fa41 > ff02::1: ICMP6, router advertisement, length 32 00:16: IP6 fe80::218:b9ff:fe0b:fa41 > 2620:0:2b30:4::8: ICMP6, neighbor solicitation, who has 2620:0:2b30:4::8, length 32 00:16: IP6 2620:0:2b30:4::8 > fe80::218:b9ff:fe0b:fa41: ICMP6, neighbor advertisement, tgt is 2620:0:2b30:4::8, length 24 00:39: IP6 2620:0:2b30:4::8.123 > 2001:4ca0::102:0:123:1:1.123: NTPv4, Client, length 48 00:39: IP6 2001:4ca0::102:0:123:1:1.123 > 2620:0:2b30:4::8.123: NTPv4, Server, length 48 00:45: IP6 2620:0:2b30:4:: > 2620:0:2b30:3::17.53: [1au] A? weather.noaa.gov. (45) 00:45: IP6 2620:0:2b30:4:: > 2620:0:2b30:3::17.53: [1au] AAAA? weather.noaa.gov. (45) 00:45: IP6 2620:0:2b30:3::17 > 2620:0:2b30:4::8: ICMP6, destination unreachable, unreachable port, 2620:0:2b30:3::17 udp port 53, length :45: IP6 2620:0:2b30:3::17 > 2620:0:2b30:4::8: ICMP6, destination unreachable, unreachable port, 2620:0:2b30:3::17 udp port 53, length :45: IP > : [1au] A? weather.noaa.gov. (45) 00:45: IP > : [1au] AAAA? weather.noaa.gov. (45) 00:45: IP > : ICMP udp port 53 unreachable, length 81 00:45: IP > : ICMP udp port 53 unreachable, length Managed by UT-Battelle

29 22:49: IP6 2620:0:2b30:4:: > 2001:4860:4860:: : [1au] PTR? ip6.arpa. (101) 22:49: IP6 2001:4860:4860:: > 2620:0:2b30:4:: : /0/0 PTR googlepublic-dns-b.google.com. (134) 00:46: IP6 fe80::218:b9ff:fe0b:fa41 > fe80::208:74ff:fe40:feac: ICMP6, neighbor solicitation, who has fe80::208:74ff:fe40:feac, length 32 00:46: IP6 fe80::208:74ff:fe40:feac > fe80::218:b9ff:fe0b:fa41: ICMP6, neighbor advertisement, tgt is fe80::208:74ff:fe40:feac, length 24 00:46: IP6 fe80::208:74ff:fe40:feac > fe80::218:b9ff:fe0b:fa41: ICMP6, neighbor solicitation, who has fe80::218:b9ff:fe0b:fa41, length 32 00:46: IP6 fe80::218:b9ff:fe0b:fa41 > fe80::208:74ff:fe40:feac: ICMP6, neighbor advertisement, tgt is fe80::218:b9ff:fe0b:fa41, length 24 13:25: IP6 fe80::218:b9ff:fe0b:fa41 > ff02::1: ICMP6, router advertisement, length 64 0x0000: 6e aff fe x0010: 0218 b9ff fe0b fa41 ff x0020: x0030: b90b fa41 0x0040: dc c d00 0x0050: a b x0060: Managed by UT-Battelle

30 v6 Test Network (phase 2) IDS/IPS setup External DNS - with hardware load balancer servers Host with IPv6 (no IPv4) for testing 30 Managed by UT-Battelle

31 31 Managed by UT-Battelle

32 IP Addressing/IPAM SLAAC EUI-64 Privacy Static/manual for servers DHCPv6 (not like DHCP) DUID unique per device Changes on OS reinstall, or multi-boot systems IAID unique per interface Not all DHCPv6 is alike (still under development) 32 Managed by UT-Battelle

33 Production Deployment Schedule Bandwidth testing hosts (perfsonar) Very small customer network any day now Nov, 2012 More - later 33 Managed by UT-Battelle

34 34 Managed by UT-Battelle Issues/Concerns/Problems No v6 shuns on Cisco firewall Addressing SLAAC - EUI-64, Privacy DHCPv6 No support for classes (DUID and IAID) vs. MAC Router configs for SLAAC and other IDS/IPS limited traffic/testing Verify vendor claims Doubles network management and monitoring Training sys admins, programmers, etc

35 Summary Develop a training/education plan Develop an implementation plan Setup a test network Practice and play 35 Managed by UT-Battelle