Avaya Networking IPv6 Using Fabric Connect to ease IPv6 Deployment. Ed Koehler Director DSE Ron Senna SE Avaya Networking Solutions Architecture

Transcription

1 Avaya Networking IPv6 Using Fabric Connect to ease IPv6 Deployment Ed Koehler Director DSE Ron Senna SE Avaya Networking Solutions Architecture IAUG Newport RI, November 2013

2 Agenda IPv6, The fundamentals and issues at hand IPv6 basics IPv6 transition methods Using IEEE 802.1aq Shortest Path Bridging Layer 2 Virtual Services Networks to ease IPv6 deployment The VSP 9000 Test Bed Activity The use of Configured Tunnels over IP Shortcuts using IEEE 802.1aq Shortest Path Bridging Summary 2

3 Why not IPv4? IPv4 28 years old Has simply run out of steam AND addresses Inefficient allocation of addressing that can not be reversed (4.3 billion address space but only around 1.5 billion devices connected to the Internet) Flawed due to several modifications most notably NAT NAT -> Eliminated the flat address space and transparency Multicast and IPSec an add-on Etc. All contiguous public IPv4 address space is exhausted Some recycling efforts underway, but this will NOT extend IPv4 notably 3

4 Why IPv6? IPv6 offers Larger address space for global reachability and scalability Restores a flatter address space Simplified header format for efficient packet handling Hierarchical network architecture for routing efficiency Auto-configuration and plug-and-play support Elimination of need for NAT Embedded security with mandatory IPSec implementation Enhanced support for Mobile IP and Mobile Computing Devices Multicast is an embedded part of the protocol*. * This comment refers to link layer functionality in that Multicast Listener Discovery (MLDv1/v2) is an extension of Neighbor Discovery (ND) and ICMPv6. A L3 multicast routing protocol such as PIMv6 is still required. 4

5 So, what s new and improved - and what remains the same? TCP/IPv4 stack model Application Layer HTTP, SIP, DNS, DHCPv4, FTP, etc. Transport Layer TCPv4, UDPv4 Internet Layer IPv4, ICMPv4, IPsec Link Layer Ethernet, ARP, OSPFv2, etc. TCP/IPv6 stack model Application Layer HTTP, SIP, DNS, DHCPv6, FTP, etc. Transport Layer TCPv6, UDPv6 Internet Layer IPv6, ICMPv6, IPsec Link Layer Ethernet, ND, OSPFv3, etc. 5

6 What s new and improved? 20 octects, 12 fields, including 3 flag bits + fixed max number of options IPv4 Header 40 octects, 8 fields +Unlimited Chained Extensions. IPv6 Header 6

7 What s new and improved? IPv6 address length is now 128 bits large possible addresses: 340,282,366,920,938,463,463,374,607,431,768,211,456 (3.4 x ) addresses (IPv4 = 4,294,967,296 addresses) Solves IP address exhaustion : 1 million addresses per person on the planet 20 networks per m 2 on planet Typical unicast IPv6 address: 64 bits for subnet ID, 64 bits for interface ID Allows addresses to be permanently assigned to end devices (DSL, PDA s, mobile terminals, PC s,...) 7

8 IPv6 Terminology Neighbors Allows for hierarchical routing and effective route summarization Host Host Host LAN segment Bridge Intra-subnet router Router Link=One or more LAN segments bounded by routers Subnet Network Additional subnets 8

9 Routing Hierarchy Concept 3000:004D:0C00::/38 Level 1 Hierarchy Ex. C00::-D80 Level 1 Hierarchy Ex. E00-F :4D:C00::/ :4D:C00::/ :4D:D00::/ :4D:E00::/ :4D:F00::/41 Level 2 Hierarchy Ex. C00::-C00:C :4D:C80::/ :4D:D80::/ :4D:E80::/ :4D:F80::/ :4D:C00::/ :4D:C00::/ :4D:C00:4000:/ :4D:C00:8000:/ :4D:C00:C000:/ :4D:C00:2000:/ :4D:C00:6000:/ :4D:C00:A000:/51 IPv6 Internet Route summarization & policy on 3000:4D:C00::/41 9

10 IPv6 Addressing (RFC 4291) IPv6 Address Types Unicast addresses Global Link local special addresses like Unspecified and loopback addresses Multicast addresses Similar operation to IPv4 Anycast addresses A Unicast address used for several devices to allow to communicate with the closer device to the source No more broadcast addresses 10

11 IPv6 Address Representation Addresses are 128 bits (16 bytes) long (versus 4 bytes in IPv4) 128 bits divided into 8 blocks of 16 bits each Each 16 bits are converted into a 4 digit hexadecimal number divided by colons : The preferred format is xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx Leading zeros can be removed can be represented with a single 0 sequences of 0 blocks are represented by :: can only appear once in an address. 2001:10F2:0000:0000:25AB:0000:0000:0001 or 2001:10F2:0:0:25AB:0:0:1 or 2001:10F2:0:0:25AB::1 or 2001:10F2::25AB:0:0:1 IPv6 representation 11

12 IPv6 Address Prefixes IPv6 prefixes indicate a network identifier or a fixed part of the address Are represented as address/prefix length Examples: 2001:10F2::/48 for a summarized route prefix and 2001:10F2:0:102F::/64 for a subnet or link prefix 12

13 IPv6 Unicast address Types: Global Unicast An address used to identify a single interface. A packet destined for a unicast address is delivered to the interface identified by that address. Global unicast addresses (RFC 3587) Globally routable addresses (same as public IPv4 addresses) Global routing prefix is used for the route prefix exchange external to the site 48 bits or n bits Provider 16 bits or 64-n Site 64 bits Host Global Routing Prefix Subnet ID Interface ID 13

14 IPv6 Unicast address Types: Link-local Unicast Link-local with higher 10 bits at (FE80) Prefix is FE80::/10, never forwarded beyond a link by routers 10 bits FE80 54 bits 64 bits Interface ID Host Host Host LAN segment Bridge Intra-subnet router Router Link=One or more LAN segments bounded by routers Subnet 14

15 IPv6 Multicast addresses As in IPv4, a multicast address is assigned to a set of interfaces belonging to different nodes. A packet destined to a multicast address is routed to all interfaces identified by that address. The IPv6 multicast address uses the FF00::/8 prefix 8 bits 4 bits 4 bits 112 bits Flags Scope Group ID Flags: First 1-3 bits are reserved, Bit 4: 1 if temporary, 0 if Permanent (well known address assigned by IANA). Scope: Used to limit the scope of multicast address (1 - node local, 2 - link-local, 3 subnet local, 4 admin local, 5 - site-local, 8 - organization-local, B - community-local, E global) Defined multicast addresses All-Nodes addresses FF01::1 (Node Local), FF02::1 (Link Local) All-Routers addresses FF01::2 (Node Local), FF02::2 (Link Local), FF05::2 (Site Local) 15

16 Solicited-Node Multicast Address This address is formed by taking the low-order 24 bits of an IPv6 address and appending those bits to the well know prefix FF02::1:FF00::/104. Thus the range of Solicited Node multicast address goes from FF02::1:FF00:0000- FF02::1:FFFF:FFFF For example for MAC B3-1E and IPv6 address fe80::202:b3ff:fe1e:8329. The corresponding solicited host multicast address is FF02::1:FF1E: bits 64 bits Unicast prefix Interface ID 24 bits FF02:0:0:0:0:1:F:F Acts as a pseudo-unicast address for very efficient address resolution & DAD 16

17 Anycast address The anycast address is a global address that is assigned to a set of interfaces belonging to different nodes. These addresses are also group addresses in which the member of the group to respond is the closest to the source. One-to-one-of-many delivery to a single interface The anycast address has the following restrictions: An anycast address must not be used as source address of IPv6 packet. An anycast address must not be assigned to an IPv6 host. It may be assigned to an IPv6 router The use of anycast addresses is very potentially very interesting because of the closest router, the closest name server or time server can be accessed by an anycast address. 17

18 Special Addresses Unspecified address 0:0:0:0:0:0:0:0 called all zeros, can be abbreviated as :: Indicates the absence of a valid address It can be used as a source address by a host during boot process when it sends out a request for address configuration information. It should never be statically or dynamically assigned to an interface and should never appear as destination ip address. The Loopback address 0:0:0:0:0:0:0:0:1 can be abbreviated as ::1 (equivalent to ) It is helpful in troubleshooting and testing the IP stack because it can be used to send a packet to the protocol stack without sending it out on the subnet. It should never be statically or dynamically assigned to an interface. 18

19 IANA IPv6 Address space IPv6 Prefix Allocation Reference 0000::/8 Reserved by IETF [RFC3513] 0100::/8 Reserved by IETF [RFC3513] 0200::/7 Reserved by IETF 0400::/6 Reserved by IETF [RFC3513] 0800::/5 Reserved by IETF [RFC3513] 1000::/4 Reserved by IETF [RFC3513] 2000::/3 Global Unicast [RFC3513] 4000::/3 Reserved by IETF [RFC3513] 6000::/3 Reserved by IETF [RFC3513] 8000::/3 Reserved by IETF [RFC3513] A000::/3 Reserved by IETF [RFC3513] C000::/3 Reserved by IETF [RFC3513] E000::/4 Reserved by IETF [RFC3513] F000::/5 Reserved by IETF [RFC3513] F800::/6 Reserved by IETF [RFC3513] FA00::/7 Reserved by IETF [RFC3513] FC00::/7 Unique Local Unicast [RFC4193] FE00::/9 Reserved by IETF [RFC3513] FE80::/10 Link Local Unicast [RFC3513] FEC0::/10 Reserved by IETF [RFC3879] FF00::/8 Multicast [RFC3513] Deprecated 19

20 Ethernet II Encapsulation of IPv6 Packets IPv6 Packet IPv6 Extension Headers Upper Layer PDU bytes IPv6 Packet Preamble 8 bytes DA 6 bytes SA 6 bytes Type 2bytes (86DD) Payload Frame check 2bytes byte 20

21 ICMPv6 Basics (RFC 2463) Updated version of the Internet Control Message Protocol (ICMP) for IPv6 is much more powerful than ICMP for IPv4. Reports delivery or forwarding errors (Destination Unreachable, Packet Too Big, Time Exceeded, Parameter Problem) and informational messages like echo request and echo reply) Additionally provides a framework for informational messages like: Neighbor Discovery (ND) Multicast Listener Discovery (MLD) Path MTU discovery A value of 58 in the Next Header field of the basic IPv6 packet header identifies an IPv6 ICMP packet. 21

22 Neighbor Discovery (RFC 4861) The neighbor discovery protocol enables IPv6 nodes and routers to: Determine the link-layer address of a neighbor on the same link. Find neighboring routers. Keep track of neighbors. The IPv6 neighbor discovery process uses the following mechanisms for its operation: Neighbor solicitation Neighbor advertisement 22

23 Router Discovery IPv6 router discovery is a process used by IPv6 nodes to discover the routers on the local link. The IPv6 router discovery process uses the following messages: Router advertisements Router solicitations 23

24 So what s the problem? IPv4 only getting from here to here IPv6 only DNS&DHCPv4 Internet servers DNS&DHCPv6 Internet servers 24

25 Some scenarios for IPv4-IPv6 transition Enterprises = translation Content providers IPv6 only Network Dual Stack IPv6 Internet DNS (AAAA) IPv4 Internet Network Network IPv4 only IPv6 only Dual Stack IPv4 Only* DNS Network IPv4 Only * * Assumed legacy protocol Network position 25

26 So some transition mechanisms needed Tunneling IPv6 Internet Configured, 6to4, ISATAP, Teredo, etc. Internet IPv4 Internet Internet IPv4 Network Dual Stack machines IPv4 & IPv6 Servers & Clients 26

27 So some transition mechanisms needed Translation IPv6 Internet NAT64 ALG/Proxy Internet IPv4 Internet IPv4 Network IPv4 machines Internet 27

28 So some transition mechanisms needed IPv6 Internet Dual Stack Internet IPv4 Internet Dual Stack Network Dual Stack machines IPv4 & IPv6 Internet Application Layer HTTP, SIP, DNS, DHCPv4, DHCPv6, FTP, etc. Transport Layer TCPv4, UDPv4 Internet Layer IPv4, ICMPv4 Transport Layer TCPv4, UDPv4 Internet Layer IPv6, ICMPv6 Link Layer Ethernet, ARP, ND, OSPF, etc. 28

29 Data Plane IPv6 FIB IPv4 FIB Control Plane IPv6 RIB IPv4 RIB Summary of Transition strategies for deployment Typical dual-stack implementation OSPFv3 RIPng Static IS-IS BGP OSPFv2 RIPv1/v2 No One-size fits all > Generally wise to adopt a phased transition strategy in a risk-averse manner Dual-stack approach Tunnel approaches (configured, 6-4 etc) Protocol translation approaches (NAT64) > Co-existence is a very important phase > Inter-working and transition cannot be separated. Look for approach maturity. > OAM cannot be neglected > There will be workarounds and compromises. Plan for it early. Co-existence / Transition mechanism Dual stack* Best approach for Enterprise Core Networks Tunneling mechanisms (incl. dual-stack). Lower priority if SPB or MPLS is used in core. Primary use remote access or branch Translation mechanisms unavoidable but should be minimized req d for legacy content providers Risk factor Maturity of approach Vendor support Low High High OK Low-Med Medium Medium OK IPsec compatibility Med Low Low Has issues. 29

30 Using SPB to ease IPv6 deployment into the Enterprise Provide Virtual Service Networks for IPv6 communities Simple, scalable, ubiquitous Allows for deployment of IPv6 as a core networking protocol with minimal impact to existing IPv4 environment Mitigates transition mechanisms such as NAT64 and tunnelling Dual Stack IPv4/IPv6 Hosts IPv4 Router IPv4 VSN Virtual Service Network IPv4/IPv6 VSN Virtual Service Network IPv6 Router IPv6 INET

31 IPv6 Transport over IEEE 802.1aq L2 I-SID s IEEE 802.1aq and RFC6329 defines the treatment of three classes of frame type at the UNI port: Unknown MAC Broadcast Multicast Any frame entering at the UNI port that matches one of these types will be treated with a process known as tandem replication or constrained multicast. In that the behavior is limited to the I-SID it is generated in A special multicast 802.1ah destination B-MAC is created that allows for any SPB node to replicate accordingly. 31

32 Layer 2 Virtual Service Networks Using L2 extension capabilities to extend and interconnect IPv6 communities across the Enterprise Native IPv6 Resources IPv6 Default Router IPv6 Migration with ease Shared infrastructure while maintaining traffic separation Dual Stack Switches Dual Stack Hosts IPv6/IPv4 Virtual Service Network IPv4 Virtual Service Network IPv4 Default Router IPv4 Hosts Dual Stack Hosts Legacy IPv4 Resources IPv6 Router IPv4 Hosts IPv4 Router 32 32

33 Dual stack scenario using L2 Virtual Service Networks A simple topology example IPv6 Network IPv6: 2001:db8:face::1 Dual Stack Host IPv6: 2001:db8:face:11 IPv4: IPv4 Network Dual Stack Layer 2 VSN VSN 100 IPv4: VLAN 100 Dual Stack Host IPv6: 2001:db8:face:10 IPv4:

34 Dual stack scenario using L2 Virtual Service Networks A multiple subnet topology example Dual Stack Host IPv6: 2001:db9:face:11 IPv4: IPv6 Network IPv6: 2001:db8:face::1 *Router Redundancy can be supported by VRRPv6 or R/SMLT Dual Stack Host IPv6: 2001:db8:face:11 IPv4: IPv6: 2001:db9:face::1 Dual Stack Layer 2 VSN VLAN 100 Dual Stack Layer 2 VSN VSN 200 IPv4: Dual Stack Host IPv6: 2001:db9:face:10 IPv4: IPv4 Network VSN 100 IPv4: Dual Stack Host IPv6: 2001:db8:face:10 IPv4:

35 Dual stack scenario using L2 Virtual Service Networks Using VRRPv6 for full routed core resiliency (IPv4 and end hosts remove for simplicity) IPv6 Network IPv6 VIP: FE80:db8:face::1 VLAN 100 Dual Stack Layer 2 VSN VSN 100 VLAN 100 Dual Stack Layer 2 VSN VSN 200 IPv6 VIP: FE80:db9:face::1 35

36 Full Hybrid Dual Stack Enterprise Default Route Perspective Shared infrastructure while maintaining traffic separation Native IPv6 Resources Dual Stack Switches Dual Stack Hosts IPv6/IPv4 Virtual Service Network IPv4 Virtual Service Network IPv4 Default Router IPv4 Hosts Dual Stack Hosts Legacy IPv4 Resources IPv6 Router IPv4 Hosts IPv4 Router 36 36

37 The future of IPv6 over Fabric Connect Research and Development is underway to inject IPv6 reachability information into IS-IS/SPB. New Type Length Values Use of SPB IP Shortcuts just as in IPv4 Both unicast and multicast will be supported eliminating the need for PIMv6 in the core if desired L3 VSN s are also being investigated for end to end IPv6 VPN environments over SPB. This will be a futher development 37

38 A note on Autoconfiguration and DHCPv6 In summary, by default, the router, i.e. VSP 9000, can control the behavior of the Windows 7 host via the Router Advertisement messages. In the Router Advertisement message are the M and O flags which are used to indicate to the host whether to use DHCPv6 for additional addresses or configuration settings. By default both the Router Advertisement M and O flags are set to 0 which indicates to the host to not use DHCPv6. In turn, the default behavior of the Windows host is to use the router link-local address for the default route and for DNS, the IPv4 DNS entry learned via DHCP or for IPv6, the host either need a manual entry or you can use the well-known DNS addresses. On the router, if you set the Router Advertisement M and/or O flags, this will tell the host to DHCPv6 for get additional addresses (M = 1), or obtain additional configuration information, i.e. DNS (O=1), or obtain both additional addresses and configuration information (M=1, O=1); in all cases, the host still uses the link-local address of the router as the gateway. In all instances the default IPv6 gateway is established by router advertisements. IETF drafts in existence for DHCPv6 option similar to IPv4. 38

39 Summary IPv6 is here supported in the VSP9K! IPv6 is supportable in a very flexible & scalable fashion with the use of IEEE 802.1aq Shortest Path Bridging For general distribution of dual stack communities use L2 VSN s to extend IPv6 subnets anywhere in the Enterprise For the interconnection of IPv6 islands use IPv6 configured tunnels over SPB/ISIS IPv4 Shortcuts Research and development is underway for the implementation of IPv6 Shortcuts in SPB/ISIS It is likely that the L2 VSN methodology will still be strongly desired within the core to enforce hierarchical routing with larger link prefixes (i.e. /52 or /48) 39

40