IPv6 in 60 minutes. aarnet Australia's Academic and Research Network

Transcription

1 20 IPv6 in 60 minutes Glen Turner Association of Independent Schools NSW ICT Managers' Conference 2011 aarnet Australia's Academic and Research Network

2 IPv6: fix the problems with IPv4 Better addressing Bigger, 32b 128b Better, Multiple addresses per interface No special cases like broadcast addresses Automated configuration Not manual, no special servers Multiple routers, with automatic failover Zero configuration access to local services Secure communications IPSec Class of service Differentiated Services

3 Network addresses Identifies a machine and how to get to it Three parts Network, how to get to it from outside Subnet, how to get to it from inside Host, a machine Network Sub-network Hosts The prefix length (aka subnet mask) specifies the split between the network and host

4 IPv4 addresses, a refresher 32 bits Each byte is written as a decimal Also need to know the prefix length Inside: /24 Outside: /16 Hosts find their address by Allocation and configuration by hand Allocation by a central server, configuration by DHCP 32 bits isn't much, so every bit is sacred Often subnet versus host addressing pressure

5 IPv6 addresses, basics 128 bits Like IPv4, the network/host division is specified by a prefix length, again it differs between inside and outside But there are enough bits to have a conventional division 48 bits for network About a billion corporate networks 16 bits for subnet 64 bits for hosts Enough for a medium-sized university Enough to take a link layer address, 48b MAC address, 64b EUI address

6 Textual representation Written in hexadecimal (base 16) f2fffeca792e Each 32 bits separated by a colon 2001:0388:4000:0000:0000:f2ff:feca:792e Leading zeroes are dropped 2001:388:4000:::f2ff:feca:792e Adjacent empty colons are condensed 2001:388:4000::f2ff:feca:792e And the prefix length added 2001:388:4000::f2ff:feca:792e/64

7 Issues with textual representation There is no regular expression which will match a IPv6 address All other network addresses are regular, so this change to programmers' expectations often leads to more code being re-written than you may expect It introduces a new character in IP addressing ::1 But colons are in URLs already, so But square brackets are in Wiki markup already, so [ And so on

8 Special addresses Subnet broadcast IPv4: All bits in host portion are 1, or IPv6: multicast group ff02::1 for all hosts, ff02::2 for all routers Null IPv4: All bits in host portion are 0 IPv6: :: Localhost /8 ::1/128

9 In practice $ ip -f inet addr show dev eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP qlen 1000 inet /27 brd scope global eth0 $ ip -f inet6 addr show dev eth0 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qlen 1000 inet6 2001:388:4000:4002:217:f2ff:feca:792e/64 scope global dynamic valid_lft sec preferred_lft sec inet6 fe80::217:f2ff:feca:792e/64 scope link valid_lft forever preferred_lft forever $ ip -f inet6 route show dev eth0 2001:388:4000:4002::/64 proto kernel metric 256 expires sec mtu 9000 advmss 8940 hoplimit fe80::/64 proto kernel metric 256 mtu 9000 advmss 8940 hoplimit ::/0 via fe80::20f:23ff:fea3:ec00 proto kernel metric 1024 mtu 9000 advmss 8940 hoplimit 64

10 Stateless autoconfiguration Routers advertise the network prefix Multiple routers can advertise to one subnet, and hosts can fail over between them, so VRRP comes standard Host chooses a host suffix Based on MAC address Or random, aka privacy address Where are the application-layer magic addresses learned from?

11 Zeroconf We need to be able to find local services without prior configuration Zeroconf adds a multicast-based DNS facility for local resources Interoperability islands mdns: Apple + Linux (+ Windows) UPnP SSDP: Microsoft (+ NetBSD) SLP: HP + Solaris (+ Linux) Many Windows applications and drivers implement mdns themselves Ugh

12 Stateless DHCP Stateless means always the same answer to the same question No recording of what address is assigned to where Can easily run multiple servers No records-keeping, so can run on routers We can use this to supply the IP address of magic servers, such as DNS

13 DHCPv6 Traditional DHCP over IPv6 to centrally assign IPv6 addresses Not recommended for sites

14 Interfaces hold multiple addresses Eases migration from one ISP to another Allows for link-local addresses in the absence of global connectivity Allows for service-bound addresses $ ifconfig eth0 eth0 Link encap:ethernet HWaddr 00:17:F2:CA:79:2E inet addr: Bcast: Mask: inet6 addr: 2001:388:4000:4002:217:f2ff:feca:792e/64 Scope:Global inet6 addr: fe80::217:f2ff:feca:792e/64 Scope:Link

15 Subnets have multiple routers IPv4 very much assumes only one default route is visible to a host IPv6 allows for multiple default routes, with priorities, to be visible to the host Upon detection of a dead gateway, IPv6 will use a remaining router

16 DNS is the migration mechanism Typical IPv4 DNS host records: thrace.adelaide.aarnet.edu.au. IN A in-addr.arpa. IN PTR thrace.adelaide.aarnet.edu.au. Typical IPv6 DNS host records: thrace.adelaide.aarnet.edu.au. IN AAAA 2001:388:4000:4002:217:f2ff:feca:792e e a.c.e.f.f.f.2.f ip6.arpa. IN PTR thrace.adelaide.aarne

17 Routing IPv4 and IPv6 are distinct protocols, with a shared design heritage Some routing protocols could be extended to carry IPv6 addresses (BGP, EIGRP, IS-IS) OSPFv2 hardcodes the size of IPv4 addresses So OSPFv3 was developed, it hardcodes the size of IPv6 addresses A dual-stack network runs both OSPFv2 and OSPFv3 If you have vendor lockin with IPv4 routing, convenient to avoid that for IPv6 routing

18 1. Paperwork Allocate IPv6 prefix Develop addressing plan Lay IPv6 design over IPv4 design There are 16 bits for subnetting, use the top 4 or so for site aggregation, leaving about 12 for subnets per site Allocate a /64 per leaf subnet

19 2. Link to ISP Configure a IPv6 address and routing on existing ISP link copying design from IPv4 Static routing or BGP, depending upon site and ISP requirements Create or inject interior default route

20 3. Activate IPv6 on backbone This brings the first problem: the poor quality of IPv6 support on some firewalls and other middleboxes Don't use EUI-64, but be compatible

21 4. Establish networking servers Unless good reason otherwise use autoconfiguration (EUI-64 addressing) with stateless DHCP Stateless DHCP provides DNS and NTP server addresses These will be IPv4 addresses, because of Windows Xp Use Dynamic DNS for the average host If you plan on IPv6-only devices then use an anycast IPv6 server on the well-known addresses

22 5. Find a sucker early adopter Computing hobbyists, ourselves System administrators

23 6. Transition public-facing services Web, , Issue: Microsoft Exchange 2003 Decision: EUI-64 or fixed address in the /64

24 7. Transition the masses Issue: people how travel to other sites which have IPv6 configured but no connectivity Issue: another round of fighting with middlerubbish such as VPN servers and clients Issue: accounting

25 8. Transition inward-facing services Problem: disconnect between network engineering and applications Upgrade cycle of interior applications Convincing applications programmers that the work is necessary, a hard task since they are being asked to learn something new Package upgrades Disruption Money

26 9. Finish the job Delegation using IPv6 to DNS servers Not available to edu.au Activate equivalent IPv6 features on switches as used on IPv4 To prevent address spoffing and so on Be careful not to deploy services which really only make sense for IPv4 VRRP Monitoring systems

27 How does NAT work? Inspect outgoing traffic Collect (src_addr, src_port, dst_addr, dst_port) Re-write src_addr to my exterior interface, find an unused source port on my exterior interface and re-write src_port to that Record these addresses and ports in the expectation table ( , 20000, , 80) ( , 10000, , 80) ( , 20000, , 10000, , 80)

28 How does NAT work? Inspect incoming traffic Is the incoming (src_addr, src_port, dst_addr, dst_port) in the expectation table? Re-write the dst_addr and dst_port to the original values in the table ( , , 20000) ( , , 10000) ( , 20000, , 10000, , 80)

29 Wrinkles with NAT Some protocols embed IPv4 addresses These need to be rewritten too May be complex and thus dangerous to do in the forwarding plane eg: SNMP uses ASN.1 encoding Some protocols embed forthcoming connection information FTP, Cisco Skinny, a lot of multimedia These wrinkles are handled by NAT modules inspect the traffic, add entries to the expectation table

30 Problems with NAT Complex Forwarding plane moves from ASIC to CPU Jitter and complexity attacks Some packets need a lot more work than others Exploits of code with errors Complex code, so errors certain Huge amounts of state Abundant opportunity for resource exhaustion Timeouts Some traffic simply isn't suitable: low-power devices, sensors, episodic multimedia

31 Benefits of NAT Has lead to the widespread deployment of stateful, deep packet inspection firewalls Although coding inspection for NAT and firewall can require choices, so NAT is not the best choice of DPI firewall Which is why defence runs real addresses But you can deploy a DPI firewall without also needing to NAT. So moving to IPv6 globally visible addresses doesn't imply a loss of security Reduced the rate of IPv4 address exhaustion, delaying the crisis until now

32 Carrier-class NAT If ISPs run out of addresses, they can use network address translation

33 Implications The edge of the customer is no longer globally reachable as it is no longer a globally-unique address The customer cannot run web servers, , etc But schools like to have their resources hosted on-site That's where the users are It may not be in the ISP's interest to support the protocols you want to use

34 20 IPv6 in 60 minutes Glen Turner Association of Independent Schools NSW ICT Managers' Conference 2011 aarnet Australia's Academic and Research Network