IPv6 Deployment Study

Transcription

1 IPv6 Deploymet Study ISP Workshops These materials are licesed uder the Creative Commos Attributio-NoCommercial 4.0 Iteratioal licese ( Last updated 8 th April

2 Ackowledgemets p This material origiated from the Cisco ISP/IXP Workshop Programme developed by Philip Smith & Barry Greee p Use of these materials is ecouraged as log as the source is fully ackowledged ad this otice remais i place p Bug fixes ad improvemets are welcomed Please workshop (at) bgp4all.com Philip Smith 2

3 Notes p This presetatio is still uder developmet I started writig it i 2006 as ISPs started to deploy IPv6 Apologies for the holes ad blaks Cotet beig gathered as experieces are beig gaied, related to me, etc Feedback welcome Philip Smith 3

4 Ageda p Goals p Network Assessmet p Network Optimisatio p Procurig IPv6 Address Space p IPv6 Address pla p Deployig Addressig & IGP p Deployig ibgp p Seekig IPv6 Trasit p Forward ad Reverse DNS p Services & Customers 4

5 Goals What do we wat to achieve? 5

6 Goals p Ultimate aim is to provide IPv6 to our customers: Customers = ed users Customers = cotet providers p Strategy depeds o etwork trasport: Native IP backboe p Dual Stack is the solutio MPLS backboe (tuels) p 6PE or 6VPE is the solutio p The core ifrastructure will remai IPv4 oly 6

7 Native IP Backboe p Routers are the ifrastructure Customer coectios coect to the ative backboe VPN services provided usig GRE, IPSEC, IPiIP etc Providig IPv6 for customers meas upgradig the ative ifrastructure to dual-stack IPv4 IPv4 IPv4 IPv4 IPv4 IPv6 IPv6 IPv6 IPv6 IPv6 7

8 MPLS Backboe p Routers are the ifrastructure Public ad Private etwork access provided withi the MPLS cloud The core etwork does NOT eed to be IPv6 aware IPv6 access provided by 6PE or 6VPE Provider Edge routers eed dual stack capability IPv4 IPv6 PE IPv4 MPLS IPv4 MPLS IPv4 MPLS P P PE IPv4 IPv6 8

9 Network Assessmet What ca ru IPv6 today, ad what eeds to be upgraded? 9

10 Assessmet p First step i ay deploymet: Assess & review existig etwork ifrastructure p Primarily routers across backboe Perhaps also critical servers ad services (but ot essetial as iitial focus is o routig ifrastructure) 10

11 Process p Aalyse each locatio/pop p Documet Router or ay other L3 device RAM (istalled ad used) No-Volatile Cofiguratio memory Software release versios Most etwork operators already keep track of this ifo p If ot, RANCID ( makes this very easy p Saity check Check existig coectivity Remove uused cofiguratio Shutdow ad clea up uused iterfaces 11

12 Software Issues p Cisco Software images: Need AdvacedIPServices or IP Plus images to support IPv6 p 12.3 Cisco IOS has limitatios o some platforms: 2600 (o XM) ad 3620 have o OSPFv eeds 16M RAM ad 16M FLASH but has o SSH/crypto support p 12.4 Cisco IOS geerally fie, but older platforms ot supported p 15.0 ad later Cisco IOS is recommeded Some platforms have IPv4/IPv6 feature parity 12

13 Next Steps p Upgrade RAM ad FLASH for platforms idetified as beig deficiet p Replace routers which ca ot ru most recet Cisco IOS software (12.2SRE/SXI, 12.3, 12.4 & 15.0) This will impact 2600 (o-xm), 3620, elderly 7200s (pre NPE200), &c p Decide o a software strategy 15.0 everywhere (bigger impact as some platforms which support 12.3/12.4 are ot supported for 15.0 e.g. 2500, 2600, 3600) Mix of 12.3 ad 12.4 for older platforms 13

14 Cisco Router Software Strategy p CRS routers p GSRs IOS-XR supports IPv6 12.0S supports IPv6 Or use IOS-XR p 6500 ad SXI & 12.2SRE support IPv6 o work should be required But uless Sup720 3BXL or later is used, FIB sizes must be watched p Nexus Switches NX-OS supports IPv6 But check platform specific depedecies 14

15 Cisco Router Software Strategy p ASR 1000 series IOS-XE supports IPv6 p 7200 series & 7301 IOS 12.4 or 15.x IOS p Remaiig platforms Use 12.4 or 15.x IOS if supported Otherwise use 12.3(26) if supported p Geeral Advice: Try ad ru most recet software image to esure that the latest features ad bug fixes are icluded 15

16 Result p Oce the previous steps are completed, etire etwork is ruig IPv6 capable software p Deploymet of IPv6 ca ow begi 16

17 Network Optimisatio Is the IPv4 etwork the best it ca be? 17

18 Optimisatio p IPv4 etworks have bee deployed ad operatioal for may years Your etwork may fall ito this category p Optimisatio meas: Does the ibgp desig make sese? Are the OSPF areas i the right places? Does the ISIS backboe make sese? Do all routig protocols have the latest best practices implemeted? Are the IGP metrics set so that primary ad backup paths operate as expected? 18

19 Motivatio for Optimisatio p IPv6 deploymet (apart from MPLS cores) will be dual stack Which meas sittig alogside existig IPv4 cofiguratios p Aim is to avoid replicatig IPv4 shortcuts or mistakes whe deployig IPv6 IPv6 cofiguratio will replicate existig IPv4 cofiguratio p Improvemets i routig protocol BCPs should be deployed ad tested for IPv4 Take the opportuity to moderise the etwork 19

20 ibgp cosideratios p Full mesh ibgp still? Perhaps cosider migratio to route reflectors p Route reflector cofiguratio Proper redudacy i place? Overlappig clusters, oe reflector per cluster Direct path betwee cliet ad reflector p BGP best practices deployed Peer-group strategy? (Will have to be replicated for IPv6) Full routes i core ibgp? Partial routes i edge/rr cliet ibgp Commuity strategy for iteral ad exteral aoucemets? 20

21 OSPF cosideratios p IOS 12.4 OSPFv2 supports same CLI as OSPFv3 etwork x.x.x.x m area A commad sytax is replaced by cofigurig OSPF o the actual iterface As for OSPFv3 (ad IS-IS) Covert OSPFv2 to moder CLI the easy to replicate cofiguratio for OSPFv3 p Are the OSPF areas cofigured as iteded? Cotiguous area 0, with redudat liks? p Are the iterface metrics cofigured as iteded? Easy to miss bits of cofiguratio They will be replicated i IPv6 (uless the itetio is to have differet traffic flow patters from IPv4) 21

22 IS-IS cosideratios p This is a good time to check NSAP umberig pla p Need to deploy wide metrics Multi-topology ISIS requires the use of wide metrics (Narrow metrics do t scale for moder etworks ayway!) p Deploy multi-topology IS-IS Do this before eablig IPv6 IS-IS otherwise IPv4 IS-IS could break MT-ISIS broke o Cisco IOS 12.3 ad 12.4 must use 12.4T or later p Are the iterface metrics cofigured as iteded? Easy to miss bits of cofiguratio They will be replicated i IPv6 (uless the itetio is to have differet traffic flow patters from IPv4) 22

23 Procurig IPv6 address space Now we eed addresses 23

24 Where to get IPv6 addresses p Your upstream ISP p Africa AfriNIC p Asia ad the Pacific APNIC p North America ARIN p Lati America ad the Caribbea LACNIC p Europe ad Middle East RIPE NCC 24

25 Iteret Registry Regios 25

26 Gettig IPv6 address space (RIR) p If existig Regioal Iteret Registry accout holder with a IPv4 allocatio: Just ask for a IPv6 allocatio ad it will be give it really is as simple as that! p Become a accout holder of your Regioal Iteret Registry ad get your ow IPv6 allocatio IPv6 allocatio policies are documeted o each RIR website The followig slides describe cosideratios whe costructig such a pla p Note Well: There is plety of IPv6 address space The RIRs require high quality documetatio 26

27 Gettig IPv6 address space (o-rir) p From your upstream ISP Get oe /48 from your upstream ISP More tha oe /48 if you have more tha 65k subets p If you eed to multihome: Apply for a /48 assigmet from your RIR Tryig to multihome with provider s /48 will be operatioally challegig p Provider policies, filters, etc 27

28 Address Plaig p IPv6 address space available to each etwork operator is large compared with IPv4 Desig a scalable pla Be aware of idustry curret practices Separatio of ifrastructure ad customer addressig Distributio of address space accordig to fuctio 28

29 Addressig Plas Ifrastructure p Network Operators should procure a /32 from their RIR p Address block for ifrastructure /48 allows 65k subets i the backboe p Address block for router loop-back iterfaces Number all loopbacks out of oe ifrastructure /64 /128 per loopback p Poit-to-poit liks /64 reserved for each, address as a /127 p LANs /64 for each LAN 29

30 Addressig Plas Customer p Customers get oe /48 Uless they have more tha 65k subets i which case they get a secod /48 (ad so o) p Idustry stadard for customer assigmets today: /64 for just oe LAN (hosted server) /60 for mobile hadset tetherig (3GPP Release 10 owards) /56 for a small etwork (home user / small busiess) /48 for a large etwork (eterprise) 30

31 Addressig Plas ISP Ifrastructure p Phase Oe 2001:DB8::/32 /64 Loopbacks 2001:DB8:0::/48 Backboe PtP & LANs 2001:DB8:1::/48 to 2001:DB8:ffff::/48 Customers 31

32 Addressig Plas ISP Ifrastructure p Phase Oe 2001:DB8::/32 /64 Loopbacks 2001:DB8:0::/48 Backboe PtP & LANs 2001:DB8:1::/48 to 2001:DB8:ffff::/48 Customers p Phase Two secod / :DB8::/ :DB8:1::/48 to 2001:DB8:ffff::/48 /64 /48 /64 / :db9:1::/48 to 2001:db9:ffff::/48 Origial assigmets New Assigmets 32

33 Addressig Plas p Registries will usually allocate the ext block to be cotiguous with the first allocatio Miimum allocatio is /32 Very likely that subsequet allocatio will make this up to a /31 or eve a /28 (the ext ibble boudary) So pla accordigly 33

34 Addressig Plas (cotd) p Documet ifrastructure allocatio Eases operatio, debuggig ad maagemet Makes IPv6 DNS easier to operate p Documet customer allocatio Customers get /48 each (see later) Prefix cotaied i ibgp Eases operatio, debuggig ad maagemet Submit etwork object to RIR Database 34

35 Addressig Tools p Examples of IP address plaig tools: NetDot etdot.uorego.edu OpeNetAdmi opeetadmi.com HaCi sourceforge.et/projects/haci Racktables racktables.org IPAT ethead.de/idex.php/ipat freeipdb home.globalcrossig.et/~freeipdb/ p Examples of IPv6 subet calculators: ipv6ge code.google.com/p/ipv6ge/ sipcalc 35

36 Costructig a Deployable Addressig Pla We have got the address space, what ext 36

37 Deployable Address Pla p Documetatio IPv4 addresses are probably short eough to memorise IPv6 addresses are ulikely to be memorable at all p Documet the address pla What is used for ifrastructure What goes to customers Flat file, spreadsheet, database, etc But documetatio is vital Especially whe comig to populatig the DNS later o 37

38 Deployable Address Pla p Pick the first /48 for our ISP ifrastructure Reaso: keeps the umbers short Short umbers: less chace of trascriptio errors Compare: 2001:DB8:EF01:D15C::1/128 with 2001:DB8::1/128 For Loopback iterface addresses p Out of this /48, pick the first /64 for loopbacks Reaso: keeps the umbers short 38

39 Deployable Address Pla p For the ifrastructure /48: First /64 for loopbacks Remaiig /64s used for iteral poit-to-poit liks p Secod /48: Use for poit-to-poit liks to customers Uless you use uumbered iterfaces That gives /64s for customer liks p Remaiig /48s are for delegatio to customers 39

40 Example: Loopback addresses p 2001:DB8:0::/48 is used for ifrastructure p Out of this, 2001:DB8:0:0::/64 is used for loopbacks Each loopback is umbered as a /128 p Scheme adopted is: 2001:DB8::PPRR/128 p Where PP is the PoP umber (01 through FF) p Where RR is the router umber (01 through FF) Scheme is good for: p 255 PoPs p 255 routers per PoP p keepig addresses small/short 40

41 Loopbacks Example PoP 1 Routers Loopbacks PoP 10 Routers Loopbacks cr1 2001:DB8::101/128 cr1 2001:DB8::A01/128 cr2 2001:DB8::102/128 cr2 2001:DB8::A02/128 br1 2001:DB8::103/128 sr1 2001:DB8::A05/128 br2 2001:DB8::104/128 sr2 2001:DB8::A06/128 sr1 2001:DB8::105/128 ar1 2001:DB8::A10/128 sr2 2001:DB8::106/128 ar2 2001:DB8::A11/128 ar1 2001:DB8::110/128 gw1 2001:DB8::A20/128 ar2 2001:DB8::111/128 gw2 2001:DB8::A21/128 gw1 2001:DB8::120/128 etc gw2 2001:DB8::121/128 etc 41

42 Example: Backboe Poit to Poit liks p Backboe Poit to Poit liks come out of Ifrastructure block 2001:DB8:0::/48 Scheme adopted is: p 2001:DB8:0:PPLL::Z/64 Where p PP is the PoP umber (01 through FF) p LL is the LAN umber (00 through 0F) p LL is the P2P lik umber (10 through FF) p Z is the iterface address (0 or 1) Scheme is good for 16 LANs ad 240 backboe PtP liks per PoP, ad for 255 PoPs 42

43 LANs ad PtP Liks Example PoP 1 Loopbacks PoP 14 Loopbacks LAN1 2001:DB8:0:101::/64 LAN1 2001:DB8:0:E01::/64 LAN2 2001:DB8:0:102::/64 LAN2 2001:DB8:0:E02::/64 LAN3 2001:DB8:0:103::/64 LAN3 2001:DB8:0:E03::/64 PtP1 2001:DB8:0:111::/64 LAN4 2001:DB8:0:E04::/64 PtP2 2001:DB8:0:112::/64 LAN5 2001:DB8:0:E05::/64 PtP3 2001:DB8:0:113::/64 PtP1 2001:DB8:0:E11::/64 PtP4 2001:DB8:0:114::/64 PtP2 2001:DB8:0:E12::/64 PtP5 2001:DB8:0:115::/64 PtP3 2001:DB8:0:E13::/64 PtP6 2001:DB8:0:116::/64 etc PtP7 2001:DB8:0:117::/64 etc Note: PtP liks have /64 reserved but are addressed as /127s 43

44 Liks to Customers p Some ISPs use ip uumbered for IPv4 iterface liks So replicate this i IPv6 by usig ipv6 uumbered to address the liks This will ot require oe /48 to be take from the ISP s /32 allocatio p Other ISPs use real routable addresses So set aside the secod /48 for this purpose Gives possible customer liks, assumig a /64 for each lik 44

45 Customer Liks Example Customer Customer 1 Customer 2 Customer 3 Customer 4 (lik oe) Customer 4 (lik two) Customer 5 Customer 6 etc Poit to poit lik address 2001:DB8:1:0::/ :DB8:1:1::/ :DB8:1:2::/ :DB8:1:3::/ :DB8:1:4::/ :DB8:1:5::/ :DB8:1:6::/64 Note1: PtP liks are umbered out of 2001:DB8:1::/48 Note2: PtP liks have /64 reserved but are addressed as /127s 45

46 Example: Customer Allocatios p Master allocatio documetatio would look like this: /48 Address Block Purpose 2001:DB8:0::/48 Ifrastructure 2001:DB8:1::/48 Customer Poit to Poit Liks 2001:DB8:2::/48 Reserved 2001:DB8:10::/48 Customer Oe 2001:DB8:11::/48 Customer Two 2001:DB8:12::/48 Customer Three Etc p Ifrastructure ad Customer PtP liks would be documeted separately as earlier 46

47 Summary p First /48 for ifrastructure Out of that, first /64 for Loopbacks p PoP structure withi IPv6 addressig is very possible Greater flexibility tha with IPv4 Possible to come up with a simple memorable scheme p Documetatio vitally importat! 47

48 Deployig Addressig ad IGP Let s ow touch the etwork 48

49 Deployig addressig ad IGP p Strategy eeded: Start at core ad work out? Start at edges ad work i? Does it matter? p Oly strategy eeded: Do t miss out ay PoPs Coectivity is by IPv4, so sequece should t matter Startig at core meas addressig of poit to poit liks is doe from core to edge (may ISPs use strategy of low umber towards core, high umber towards edge) But it really does t matter where you start 49

50 Deployig: Router1 i PoP1 p Start with addressig Address all the PtP liks o Router1 iterface serial 0/0 ipv6 address 2001:DB8:0:110::0/127 iterface hssi 1/0 ipv6 address 2001:DB8:0:111::0/127 Go to the other ed of each PtP lik ad apply the correspodig addressig there also iterface serial 2/0/0 ipv6 address 2001:DB8:0:110::1/127...ad iterface hssi 3/1 ipv6 address 2001:DB8:0:111::1/127 50

51 Deployig OSPF p Cofigure OSPFv3 o the liks that will ru OSPF ipv6 router ospf 100 log adjacecy-chages detailed passive-iterface default o passive-iterface serial 0/0 o passive-iterface hssi 1/0 iterface serial 0/0 ipv6 ospf 100 area 0 iterface hssi 1/0 ipv6 ospf 100 area 0 p No eed to do the OSPF o the other ed yet Those routers will be doe i due course, ad saves time jumpig back ad forth 51

52 Deployig IS-IS (1) p Update IS-IS to support wide metrics ad multi-topology If usig arrow metrics, Cisco IOS has a metric-style trasitio optio Multi-topology allows differet IPv4 ad IPv6 topologies router isis as100 <existig is-is for ipv4 cofiguratio> metric-style wide address-family ipv6 multi-topology p Make sure this is doe o all routers before turig o IPv6 adjacecies 52

53 Deployig IS-IS (2) p Cofigure IS-IS o the liks that will ru IS-IS iterface serial 0/0 ip router isis as100 ipv6 router isis as100 iterface hssi 1/0 ip router isis as100 ipv6 router isis as100 p Must do IS-IS o the other ed too if usig sigle topology Otherwise IS-IS adjacecy may go dow due to address family mismatch (Multi-topology IS-IS will ot care) 53

54 Deployig the IGP p Repeat this strategy for all remaiig routers i the PoP IPv6 addresses are active OSPF/IS-IS is ready to ru 54

55 Deployig o PoP LANs p LANs eed special treatmet Eve those that are oly poit to poit liks p Issues: ISPs do t wat to have Router Advertisemets active o etwork ifrastructure LANs Activatig IPv6 o a LAN which is t adequately protected may have security cosequeces p Servers may auto cofigure IPv6 p No firewall filterig meas o security Þ compromise 55

56 Deployig o PoP LANs p Example of Poit to Poit lik (12.3 ad 12.4): iterface GigabitEtheret0/0 descriptio Crossover Lik to CR2 ipv6 address 2001:DB8:0:115::0/127 ipv6 d suppress-ra ipv6 ospf 100 area 0 p Example of local aggregatio LAN (12.4T): iterface GigabitEtheret0/1 descriptio Gateway Aggregatio LAN ipv6 address 2001:DB8:0:100::1/64 ipv6 d ra suppress ipv6 ospf 100 area 0 56

57 Deployig o LANs p Example of local services LAN (12.4): iterface GigabitEtheret0/1 descriptio Services LAN ipv6 address 2001:DB8:0:101::1/64 ipv6 d suppress-ra ipv6 traffic-filter SERVER-IN i ipv6 traffic-filter SERVER-OUT out Where the server-i ad server-out filters are ipv6 access-lists cofigured to: p Allow miimal access to servers (oly ssh for ow), or p To match their IPv4 equivalets 57

58 Deployig OSPF o LANs p Whe implemetig OSPF, use the same metrics ad cofiguratio as for the IPv4 versio of the IGP If OSPFv2 cofiguratio set the two core routers to be Desigated ad Backup Desigated routers, make it the same for IPv6: iterface FastEtheret 0/0 ip ospf priority 10 ipv6 ospf priority 10 Ay other OSPFv2 metrics should be replicated for OSPFv3: ip ospf hello-iterval 3 ip ospf dead-iterval 15 ipv6 ospf hello-iterval 3 ipv6 ospf dead-iterval 15 58

59 Deployig IS-IS o LANs p ISIS has cocept of DIS oly for a LAN Existig IPv4 DIS will be used for IPv6 because topology is cogruet iterface FastEtheret 0/0 isis priority 96 level-2 No chages eeded whe addig IPv6 59

60 Checks p Before lauchig ito BGP cofiguratio Saity check the OSPFv3 cofiguratio p Are all adjacecies active? Each router should have the same umber of OSPFv2 ad OSPFv3 adjacecies p Does each iterface with a ip ospf <pid> cofiguratio have a correspodig ipv6 ospf <pid> cofiguratio? p Have iterfaces ot beig used for OSPFv3 bee marked as passive Ad do they match those marked as passive for OSPFv2? 60

61 Checks p Does the umber of etries i the OSPFv3 routig table match the umber of etries i the OSPFv2 routig table Compare the umber of etries i sh ip route ospf ad sh ipv6 route ospf Examie differeces ad work out the reaso why p Do IPv4 ad IPv6 traceroutes through the etwork Are the paths the same? Are the RTTs the same? Discrepacies must be ivestigated ad fixed 61

62 Deployig ibgp Fuctioig IGP meas all routers reachable 62

63 Deployig ibgp p Strategy is required here Startig at edge makes little sese Startig at core meas route reflector mesh builds aturally p Modify BGP defaults p Prepare templates Set up peer-groups i master cofiguratio file There should already be a master cofiguratio for IPv4 63

64 Modify BGP defaults (1) p Disable default assumptio that all peers are IPv4 uicast peers o bgp default ipv4-uicast p Failure to do this does t break aythig But makes the IOS cofiguratio ad sh bgp ipvx output look messy There will be lots of o eighbour x:x:x::x activate for IPv6 peers i the IPv4 address family, ad lots of o eighbour x.x.x.x activate for IPv4 peers i the IPv6 address family 64

65 Modify BGP defaults (2) p Switch BGP to usig address families Happes auto-magically oce first address family cofiguratio etered But remember to apply p IPv4 cofiguratio iformatio to the IPv4 address family p IPv6 cofiguratio iformatio to the IPv6 address family router bgp 100 address-family ipv4 <eter IPv4 cofiguratio as before> address-family ipv6 <eter all IPv6 cofiguratio here> 65

66 Modify BGP defaults (3) p Make BGP distaces all the same: distace bgp This makes ebgp, ibgp ad locally origiated prefixes have all the same protocol distace (This should already be cofigured for IPv4) p Switch off sychroisatio Off by default, but o harm caused by icludig the commad i templates o sychroizatio (There is o auto summarisatio as there is for IPv4) 66

67 Creatig IPv6 templates p Typical ibgp peer-groups might be: core-ibgp router participates i full mesh ibgp rr-cliet eighbour is a cliet of this route reflector rr eighbour is a route reflector p These should be replicated for IPv6: corev6-ibgp router participates i full mesh ibgp rrv6-cliet eighbour is a cliet of this route reflector rrv6 eighbour is a route reflector Keep the ames the same just add v6 i the appropriate place to differetiate p Peer-groups are to be created withi the appropriate address family 67

68 Next Steps p Load all these templates ito the routers across the backboe Or simply upload them as each router has IPv6 ibgp deployed o it p Origiate the IPv6 address block o the chose core routers withi the backboe Make sure there is more tha oe, ad the prefix is origiated i more tha oe PoP (for redudacy) BGP etwork statemet ad matchig static route to Null0 same as for IPv4 68

69 Deployig: Core Router1 i PoP1 p Esure that the IPv6 peer-groups are i place tftp load the cofiguratio file from cofiguratio server p Full mesh ibgp Set up cofiguratio for all other core routers (those participatig i the full mesh ibgp) Do t log ito other routers yet just work o CR1 p Route Reflector Cliets Set up the eighbour cofiguratio for the route reflector cliets i this PoP p Isert ay required prefixes ito ibgp Usually static LAN /64s (they do NOT go i IGP) 69

70 Deployig: Core Router1 i PoP1 p Example: router bgp 100 address-family ipv6 eighbor corev6-ibgp peer-group eighbor corev6-ibgp remote-as 100 eighbor corev6-ibgp ext-hop-self eighbor corev6-ibgp update-source loopback0 eighbor rrv6-cliet peer-group eighbor rrv6-cliet remote-as 100 eighbor rrv6-cliet ext-hop-self eighbor rrv6-cliet update-source loopback0 eighbor rrv6-cliet route-reflector-cliet eighbor 2001:DB8::2 peer-group corev6-ibgp eighbor 2001:DB8::3 peer-group corev6-ibgp eighbor 2001:DB8::10 peer-group rrv6-cliet eighbor 2001:DB8::11 peer-group rrv6-cliet 70

71 Deployig: Gateway Router1 i PoP1 p Esure that the IPv6 peer-groups are i place tftp load the cofiguratio file from cofiguratio server p Route Reflector Set up the eighbor cofiguratio with the two route reflectors i the PoP The two core routers (the route reflectors) have already bee cofigured So the IPv6 ibgp sessio should come up 71

72 Deployig: Gateway Router1 i PoP1 p Example: router bgp 100 address-family ipv6 eighbor rrv6 peer-group eighbor rrv6 remote-as 100 eighbor rrv6 ext-hop-self eighbor rrv6 update-source loopback0 eighbor rrv6 sed-commuity eighbor 2001:DB8::1 peer-group rrv6 eighbor 2001:DB8::1 descriptio ibgp with CR1 eighbor 2001:DB8::2 peer-group rrv6 eighbor 2001:DB8::2 descriptio ibgp with CR2 72

73 Deployig ibgp p Repeat the previous strategy for all the routers i the first PoP p Ad the repeat for all the PoPs p No ebgp yet!! 73

74 Checks p Are all the ibgp peers up? Best to check o each route reflector If peerigs are still dow ivestigate reasos - usually because a loopback address is missig from OSPFv3 p Are there the same umber of IPv6 peers as there are IPv4 peers? If ot, what wet wrog? p Prefixes i ibgp There probably will be oe apart from the /32 aggregate block ad ay static LANs which have bee itroduced ito ibgp 74

75 Seekig IPv6 Trasit Hello World, I d like to talk to you 75

76 Seekig Trasit p ISPs offerig ative IPv6 trasit ow i the majority Should be easy to get IPv6 trasit p Next step is to decide: whether to give trasit busiess to those who will accept a dual stack coectio or Whether to stay with existig IPv4 provider ad seek a tuelled IPv6 trasit from a IPv6 provider p Either optio has risks ad challeges 76

77 Dual Stack Trasit Provider p Fall ito two categories: Those who sell you a pipe over which you sed packets Those who sell you a IPv4 coectio ad charge extra to carry IPv6 p ISPs i category A are much preferred to those i category B p Chargig extra for ative IPv6 is absurd, give that this ca be easily bypassed by tuellig IPv6 IPv6 is simply protocol 41 i the rage of IP protocol umbers 77

78 Dual Stack Trasit Provider p Advatages: Ca alig BGP policies for IPv4 ad IPv6 perhaps makig them more maageable Saves moey they charge you for bits o the wire, ot their colour p Disadvatages: Not aware of ay 78

79 Separate IPv4 ad IPv6 trasit p Retai trasit from resolute IPv4-oly provider You pay for your pipe at whatever $ per Mbps p Buy trasit from a IPv6 provider You pay for your pipe at whatever $ per Mbps p Luck may ucover a IPv6 provider who provides trasit for free Gettig more ad more rare as more ISPs adopt IPv6 79

80 Separate IPv4 ad IPv6 trasit p Advatages: Not aware of ay But perhaps situatio is uavoidable as log as mai IPv4 trasit provider ca t provide IPv6 Ad could be a tool to leverage IPv4 trasit provider to deploy IPv6 or lose busiess p Disadvatages: Do the $$ umbers add up for this optio? Separate policies for IPv4 ad IPv6 more to maage 80

81 Forward ad Reverse DNS Coectig over IPv6 ad fixig those traceroutes 81

82 Forward ad Reverse DNS p Populatig the DNS is a ofte omitted piece of a ISP operatio Ufortuately it is extremely vital, both for coectivity ad for troubleshootig purposes p Forward DNS for IPv6 Simply a case of icludig suitable AAAA records alogside the correspodig A records of a host p Reverse DNS for IPv6 Requires gettig the /32 address block delegated from the RIR, ad the populatig the ip6.arpa fields 82

83 Forward DNS p Operators typically access the router by coectig to loopback iterface address Saves havig to remember iterface addresses or ames - ad these chage ayway p Settig up the IPv6 etries meas addig a quad-a record beside each A record: cr1.pop1 A AAAA 2001:DB8::1:1 cr2.pop1 A AAAA 2001:DB8::1:2 gw1.pop1 A AAAA 2001:DB8::1:10 83

84 Forward DNS p Completig the ifrastructure zoe file as per the example is sufficiet Update the SOA record Reload the ameserver software All set p If coectig from a IPv6 eabled cliet IPv6 trasport will be chose before the IPv4 trasport (Part of the trasitio process from IPv4 to IPv6) For all coectios to IPv6 eabled devices which have etries i the forward DNS zoes This could have positive as well as egative cosequeces! 84

85 Reverse DNS p First step is to have the /32 address block delegated by the RIR p Prepare the local ameservers to hadle the reverse zoe, for example i BIND: zoe 8.b.d ip6.arpa" i { type master; file "ip6.arpa-zoes/db db8; allow-trasfer {"Exteral"; "NOC-NET";}; }; p Ad the create ad populate the zoe file 85

86 Reverse DNS p The db db8 zoe file headig: $TTL IN SOA s1.isp.et. hostmaster.isp.et. ( ;serial ;refresh 3600 ;retry ;expire 7200) ;miimum NS s1.isp.et. NS s2.isp.et. ;Hosts are list below here 86

87 Creatig the reverse zoe file p IPv6 addresses are 128 bits log Bits are grouped i 4 ad represeted by a hexadecimal digit Therefore a IPv6 address has 32 hexadecimal digits i it Each oe gets a field i IPv6 s reverse DNS p 2001:DB8::1:1 is the loopback address for cr1.pop1 We ca omit leadig zeros ad paddig zeros are replaced with a set of :: This caot be doe i Reverse DNS ip6.arpa zoe files p Equivalet reverse value would be: B.D ip6.arpa 87

88 Creatig the reverse zoe file p Major chore fillig up the zoe file with etries such as D.B ip6.arpa p Strategy eeded! Otherwise serious errors would result, reverse DNS would t fuctio, &c Missig out a sigle 0 will have cosequeces p Possible strategies: Delegate ifrastructure /48 to a separate zoe file Delegate PtP lik /48 to a separate zoe file Each customer /48 is delegated to a separate zoe file Etc 88

89 Creatig the reverse zoe file p Reverse zoe for the /32 could read like: ; header as previously ; ; Ifrastructure / NS s1.isp.et NS s2.isp.et. ; Customer PtP lik / NS s1.isp.et NS s2.isp.et. ; Customer Oe / NS s1.isp.et NS s2.isp.et. ; etc - fill i as we grow F.F.F.F NS s1.isp.et. F.F.F.F NS s2.isp.et. 89

90 Ifrastructure reverse zoe p Ad ow we have a /48 reverse zoe delegated for ifrastructure How do we populate this file?? Etries could still be like this: Ad we still would have to cout zeroes! p Suggestio 1: Delegate loopbacks to their ow /64 Keeps the loopback zoe file separate, ad perhaps easier to maage p Suggestio 2: PTR cr1.pop1.isp.et. Make use of the $ORIGIN directive 90

91 Example Ifrastructure Reverse Zoe ; Poit to Poit liks ; $ORIGIN B.D ip6.arpa. 1 PTR ge0-1.cr1.pop1.isp.et. 2 PTR ge0-0.br1.pop1.isp.et. $ORIGIN B.D ip6.arpa. 1 PTR ge0-1.cr1.pop1.isp.et. 2 PTR ge0-1.br2.pop1.isp.et. $ORIGIN B.D ip6.arpa. 1 PTR ge0-1.cr2.pop1.isp.et. 2 PTR ge0-1.br1.pop1.isp.et. $ORIGIN B.D ip6.arpa. 1 PTR ge0-1.cr2.pop1.isp.et. 2 PTR ge0-0.br2.pop1.isp.et. p Note the use of $ORIGIN ad how it keeps the actual lie with the PTR value simple 91

92 Example Loopback Reverse Zoe ; PoP1 ; $ORIGIN B.D ip6.arpa. 1.0 PTR cr1.pop1.isp.et. 2.0 PTR cr2.pop1.isp.et. 3.0 PTR br1.pop1.isp.et. 4.0 PTR br2.pop1.isp.et. 0.1 PTR gw1.pop1.isp.et. 1.1 PTR gw2.pop1.isp.et. 2.1 PTR gw3.pop1.isp.et. 3.1 PTR gw4.pop1.isp.et. ; etc p Note agai the use of $ORIGIN ad how it keeps the actual lies with the PTR value simple for each loopback iterface i the PoP 92

93 IPv6 DNS p Previous examples show how to build forward ad reverse DNS zoe files Forward is easy Reverse ca be troublesome uless care is applied ad there is a good strategy i place p There are tools out there which help build reverse DNS zoe files from IPv6 address databases Log term that will be a better approach! 93

94 Services Aggregatio LANs What about the servers? 94

95 Services Aggregatio LANs p This is talkig about the ISP cotet services How to attach them to a IPv6 etwork Not how to set up the services o them that s comig later p I IPv4 we had HSRP (or VRRP) p For IPv6 we have GLBP HSRP v2 is also usable, but GLBP allows for load balacig betwee default gateways 95

96 Settig up GLBP p As with HSRP, GLBP operates a virtual default gateway maaged by the two (or more) exteral routers o the LAN p Need to set aside a IP address which all devices use as the default gateway For IPv4, this was a real routable address For IPv6, this has to be a lik-local address FE80::1 seems to be ice ad short ad does t seem to be used for ay particular purpose Schema used is FE80::<glbp group umber> as the FE80:: address has to be uique o the router 96

97 Settig up GLBP Cofiguratio p Router 1: iterface GigabitEtheret0/3 glbp 41 ipv6 FE80::41 glbp 41 timers 5 10 glbp 41 priority 150 glbp 41 preempt glbp 41 load-balacig host-depedet glbp 41 ame NOC-LAN p Router 2: iterface GigabitEtheret0/3 glbp 41 ipv6 FE80::41 glbp 41 timers 5 10 glbp 41 load-balacig host-depedet glbp 41 ame NOC-LAN 97

98 Checkig GLBP status cr2#sh glbp GigabitEtheret0/3 - Group 41 State is Stadby 4 state chages, last state chage 00:44:30 Virtual IP address is FE80::41 Hello time 5 sec, hold time 10 sec Next hello set i secs Redirect time 600 sec, forwarder timeout sec Preemptio disabled Active is FE80::219:E8FF:FE8B:5019, priority 150 (expires i sec) Stadby is local Priority 100 (default) Weightig 100 (default 100), thresholds: lower 1, upper 100 Load balacig: host-depedet IP redudacy ame is "NOC-LAN" Group members: 0019.e873.8a19 (FE80::219:E8FF:FE73:8A19) local 0019.e88b.5019 (FE80::219:E8FF:FE8B:5019) There are 2 forwarders (1 active) Forwarder 1 State is Active 1 state chage, last state chage 00:56:16 MAC address is 0007.b (default) Ower ID is 0019.e873.8a19 Preemptio eabled, mi delay 30 sec Active is local, weightig 100 Forwarder 2 State is Liste MAC address is 0007.b (leart) Ower ID is 0019.e88b.5019 Time to live: sec (maximum sec) Preemptio eabled, mi delay 30 sec Active is FE80::219:E8FF:FE8B:5019 (primary), weightig 100 (expires i sec) Default Gateway Primary router 98

99 Settig up GLBP FreeBSD server p Cofigure the servers to use the virtual default gateway p Because lik local address is beig used, oe extra cofiguratio lie i /etc/rc.cof is eeded specifyig the default device: ipv6_eable="yes" ipv6_etwork_iterfaces="em0" ipv6_ifcofig_em0= 2001:DB8::1 prefixle 64" ipv6_defaultrouter="fe80::41%em0 Required otherwise the lik local address will ot be accepted as default gateway 99

100 Settig up GLBP Liux server p Cofigure the servers to use the virtual default gateway p Because lik local address is beig used, oe extra cofiguratio lie i /etc/syscofig/etwork is eeded specifyig the default device: NETWORKING=yes HOSTNAME=NOC-ALPHA NETWORKING_IPV6=yes IPV6_DEFAULTGW=FE80::41 IPV6_DEFAULTDEV=eth0 Required otherwise the lik local address will ot be accepted as default gateway 100

101 Services Network is doe, ow let s use it! 101

102 Ifrastructure complete p This was the easy part Network ifrastructure geerally is very simply to set up as dual stack IPv4 ad IPv6 p The ext steps are more complex p Services? Which to make available i IPv6 too? p Customers? Which ca be offered services, ad how? 102

103 ISP Services p DNS, Mail, Web Critical customer ad Iteret facig servers Simple to trasitio to dual stack p This ivolves: Settig up appropriate IPv6 filters o hostig LANs (hit: replicate IPv4 filters) Givig the servers IPv6 addresses Replicate the IPv4 firewall settigs for IPv6 Esurig that the server software is listeig o both IPv4 ad IPv6 ports Publishig quad-a records alog side the regular A records Testig! 103

104 Uix Webserver p Apache 2.x supports IPv6 by default p Simply edit the httpd.cof file HTTPD listes o all IPv4 iterfaces o port 80 by default For IPv6 add: Liste [2001:DB8:10::1]:80 p So that the webserver will liste to requests comig o the iterface cofigured with 2001:DB8:10::1/64 104

105 Uix Nameserver p p BIND 9 supports IPv6 by default To eable IPv6 ameservice, edit /etc/amed.cof: optios { liste-o-v6 { ay; }; }; zoe workshop.et" { type master; file workshop.et.zoe"; }; zoe 8.B.D ip6.arpa" { type master; file workshop.et.rev-zoe"; }; Tells bid to liste o IPv6 ports Forward zoe cotais v4 ad v6 iformatio Sets up reverse zoe for IPv6 hosts 105

106 Uix Sedmail p Sedmail 8 as part of a distributio is usually built with IPv6 eabled But the cofiguratio file eeds to be modified p If compilig from scratch, make sure NETINET6 is defied p The edit /etc/mail/sedmail.mc thus: Remove the lie which is for IPv4 oly ad eable the IPv6 lie thus (to support both IPv4 ad IPv6): DAEMON_OPTIONS(`Port=smtp, Addr=::, Name=MTA-v6, Family=iet6') Remake sedmail.cf, the restart sedmail 106

107 FTP Server p Vsftpd is discussed here Stadard part of may Liux distributios ow p IPv6 is supported, but ot eable by default Need to ru two vsftpd servers, oe for IPv4, the other for IPv6 p IPv4 cofiguratio file: /etc/vsftpd/vsftpd.cof liste=yes liste_address=<ipv4 addr> p IPv6 cofiguratio file: /etc/vsftpd/vsftpdv6.cof liste=no liste_ipv6=yes liste_address6=<ipv6 addr> 107

108 Other Servers ad Services 108

109 Maagig ad Moitorig the Network Watchig the Ifrastructure 109

110 Maagig ad Moitorig the Network p Existig IPv4 moitorig systems should ot be discarded IPv4 is ot goig away yet p How to Moitor IPv6? Netflow MRTG Others? 110

111 Netflow for IPv6 p Netflow Versio 9 supports IPv6 records p Cofigured o the router as: iterface fast 0/0 ipv6 flow igress ipv6 flow egress p Displayig status is doe by: show ipv6 flow cache p Which all gives the same o-router capability as with IPv4 111

112 Netflow for IPv6 p Public domai flow aalysis tool NFSEN (ad NFDUMP) support Netflow v5, v7 ad v9 flow records IPv6 uses v9 Netflow NFSEN tools ca be used to display ad moitor IPv6 traffic More iformatio: p p p ISPs usig existig IPv4 etflow moitorig usig NFSEN ca easily exted this to iclude IPv6 112

113 MRTG p MRTG is widely used to moitor iterface status ad loads o ISP ifrastructure routers ad switches p Dual stack iterface will result i MRTG reportig the combied IPv4 ad IPv6 traffic statistics p MRTG ca use IPv6 trasport (disabled by default) to access etwork devices 113

114 Other Maagemet Features p A dual stack etwork meas: Maagemet of the etwork ifrastructure ca be doe usig either IPv4 or IPv6 or both ISPs recogise the latter is of sigificat value p If IPv4 etwork breaks (e.g. routig, filters, device access), etwork devices may well be accessible over IPv6 Partial out of bad etwork p IPv6 is preferred over IPv4 (by desig) if AAAA ad A records exist for the device So remote logis to etwork ifrastructure will use IPv6 first if AAAA record provided 114

115 Customer Coectios Network is doe, ow let s coect payig customers 115

116 Customer Coectios p Givig coectivity to customers is the biggest challege facig all ISPs p Needs special care ad attetio, eve updatig of ifrastructure ad equipmet Mobile Cable/ADSL Dial Leased lies Wireless Broadbad 116

117 IPv6 to Mobile Customers p Access techologies are predomiatly 3G ad LTE p Ed-sites could rage from hadsets to major corporatios p Strategy depeds o ifrastructure ad device capability: Dual-stack usig 464XLAT Adroid IPv6-oly with NAT64 Apple ios Mobile operators eed to support both popular cosumer devices 117

118 IPv6 to Mobile Customers (1) p Dual-stack: Native IPv6 ad IPv4-NAT p IPv6 ative from hadset to cotet p IPv4 is carried withi IPv6 Ifrastructure is IPv6 oly Hadsets support 464XLAT (CLAT) p Most Adroid phoes (4.4.4 ad 5.1 owards) Operator eeds CGNAT to hadle PLAT fuctio for hadset access to IPv4 legacy sites p Tetherig Available i 3GPP Release 10 (DHCP-PD support) 118

119 IPv6 to Mobile Customers (2) p IPv6-oly with NAT64: Native IPv6 oly Ifrastructure is IPv6 oly Hadsets are IPv6-oly p Apple iphoe (ios 9 owards, iphoe6s owards) Operator eeds CGNAT to hadle NAT64 fuctio for hadset access to IPv4 legacy sites p Tetherig Available i 3GPP Release 10 (DHCP-PD support) 119

120 IPv6 to Broadbad Customers p Method 1: Use existig techology ad CPE This is the simplest optio it looks ad feels like existig IPv4 service IPv4: PPPoE (IPCP) IPv6: PPPoE (IPv6CP) + DHCPv6 PD Used by ISPs such as Iterode (AU) ad XS4ALL (NL) p Issues: IPv6 CPE i some markets are geerally more expesive p Customised coutry versios ofte delete IPv6 support Cheapest CPE have o IPv6 eed to be replaced/upgraded p p Solutio: Customers are very cost coscious $1 ca sway a purchasig decisio Operator publishes recommeded list of CPE (which support dual-stack)! p Ad sample cofiguratios 120

121 IPv6 to Broadbad Customers p Method 2: use 6rd This is for whe Broadbad ifrastructure caot be upgraded to support IPv6 Used by ISPs such as FREE (FR) Example: p Issues: p 2001:DB8:6000::/48 assiged to 6rd p Customer gets /32 by IPCP for ative IPv4 lik p IPv6 address is 2001:DB8:6000:0405::/64 for their LAN (takig last 16 bits of IPv4 address) p DHCPv6 PD ca be used here too (eg to give /56s to customers) All CPE eed to be replaced/upgraded to support 6rd p Solutio: Operator publishes recommeded list of CPE (which support 6rd)! 121

122 IPv6 to Dialup Customers p Use existig techology: Most dialup access routers are easily upgradable to support IPv6 Service looks ad feels like the IPv4 service PPP with IPv6CP (or with DHCPv6 PD (??)) CPE is usually PC or laptop (ad most OSes have supported IPv6 for may years) Service already offered for several years by may ISPs 122

123 IPv6 to Fixed Lik Customers p Use existig techology: Most access routers (PE) ad Customer routers (CPE) are easily upgradeable or replaceable to iclude IPv6 support Service looks ad feels like existig IPv4 service p Cofiguratio optios: IPv6 uumbered o poit to poit liks (or address them) Static routes, subet size accordig to busiess size Or use BGP with private or public (multihomed) ASN Whatever is doe for IPv4 should be repeated for IPv6 p Fixed lik Customers are probably the easiest to roll IPv6 out to Customer deployig IPv6 withi their ow etworks is a separate discussio (reru of this presetatio!) 123

124 IPv6 to Customers p What about addressig? Here is a typical strategy: Mobile Device: p /64 = 1 subet p /60 = 16 subets for tetherig (DHCP-PD with 3GPP release 10) Home/Small Orgaisatio: p /56 = 256 subets p Reserve the whole /48 p There is o IPv6 address shortage! Eterprise/Large Orgaisatio: p /48 = subets 124

125 Customer Coectios p What about customer ed systems? Is IPv6 available o all their computers ad other etwork coected devices? How to migrate those which are t? How to educate customer operatios staff What about their CPE? What about the lik betwee your edge device ad their CPE? What about security? 125

126 Customer Ed-Site p Re-ru of this presetatio, but: Do all devices eed IPv6? Realistically, IPv6 eeded o: p Ed-user devices (hadset, tablet, laptop, desktop) eed IPv6 Already tured o by default, remember J p Exteral facig servers eed IPv6 iitially (website, mail relay, public DNS) p Corporate Firewalls, Routers ad IDS Other iteral systems have o urget eed to deploy: p Iteral facig servers p IP phoe systems & Priters p Maagemet access to IP eabled devices p Network ad Buildig security moitorig systems 126

127 IOS Images for Cisco s Brach Office Routers p Need AdvacedIPServices or IPPlus Miimum specificatio is: Router RAM/Flash IOS Commets M/16F 12.3(26) No SSH M/16F 12.3(26) No OSPFv3 2600XM 96M/32F 12.3(26) 2600XM 128M/32F 12.4(25e) M/32F 12.4(25e) 1751/ M/16F 12.3(26) 1751/ M/32F 12.4(25e) 127

128 Coclusio We are doe! 128

129 Coclusio p Whe deployig IPv6 for the first time, a strategy ad plaig are of paramout importace p Presetatio has highlighted the steps i the plaig ad presetatio process Variatios o the theme are quite likely - there is o sigle correct way of proceedig 129

130 IPv6 Deploymet Study ISP Workshops 130