IPv6 Operation. Jordi Palet CEO/CTO - Consulintel August 2003, Seoul

Transcription

1 IPv6 Operation Jordi Palet CEO/CTO - Consulintel August 2003, Seoul -1

2 Euro6IX: The Concept How to pronounce it: forget IX and read 6 ( SIX ) Build a large, scalable and native IPv6 Backbone of Traffic Exchanges, with connectivity across Europe and other IPv4/v6 Exchangers In order to promote and allow other players to trial v6 and port/develop key applications and services In order to break the chicken and egg issue! Gain REAL IPv6 experience, in a real world with not just research users, involving Telcos/ISPs/ASPs, among others: Allow new players into our trials Bring IPv6 into a production transit service -2

3 Euro6IX Goal Support the fast introduction of IPv6 in Europe. Main Steps: Network design & deployment Research on network advanced services Development of applications validated by user groups & international trials Active dissemination: participation in events/conferences/papers contributions to standards project web site -3

4 Objectives 1. Research an appropriate architecture, to design and deploy the first Pan-European noncommercial IPv6 Internet Exchange Network. 2. Use this infrastructure to research, test and validate IPv6-based applications & services. 3. Open the network to specific User Groups for its validation in trials. 4. Dissemination, liaison and coordination with clusters, fora, standards organizations (e.g. IETF, RIPE) and third parties. -4

5 Updated Network Map name IPv6 IX IPv6 Node Link Sponsor/s 34 Mbps Native Link Node to IX Link Lisbon Aveiro PT/TEF Lannion Madrid Southampton TEF Alcobendas Murcia London Caen Issy FT Paris FT Bretigny Bern Zurich TI DT TI Torino 1) IPv6 in IPv6 Tunnel in own network 2) IPv6 over IPv4 over internet/6bone Other similar tunnels could be setup in other links if needed Viby Berlin -5

6 Layer 3 IX Infrastructure providing both layer 2 and layer 3 interconnection service. Several IXs can make direct peering offering also Wide Area Layer 3 transport as an Internet Service Provider. Every IXs will use an assigned xtla prefix (x=p or s) to assign NLA prefixes to ISPs or customers connecting to the IX. Project partners will use their xtla prefix to assign NAL to customers and regional ISP connecting to IX. -6

7 Layer 3 IXs Network Architecture R L3 Internet Exchange Euro6IX Backbone R L3 Internet Exchange R L3 Internet Exchange Standard IX customers Next Generation IX customers -7

8 IX Model C L2 infrastructure (fully redundant) where the IX services are placed Routers infrastructure (long-haul providers and customers) Layer 3 mediation function router (L3MF) is the real new element of this model Hosted long-haul ISP routers IX Infrastructure and services Hosted regional ISP routers Regional ISPs ISP Customers LH ISP1 R LH ISP2 R R R R Next Generation IX Subscribers LH ISP3 R R Hosting building L3MF router Long Haul Pr. customers -8

9 RFC2374 Benefits This model is based on the RFC 2374 to verify that: a customer could change its service provider without changing its addressing space the renumbering functionality could be realized more easily (no renumbering in the better case) the multihoming functionality could be realized more easily IX plays an intermediation role between the ISP and the customers (Layer 3 mediation function router) Routing: ibgp+igp: inside the Long Haul Provider Euro6IX is the collection of the routers inside the IX emulating the LHP (single AS) ebgp4+: between the customers and the IX ebgp4+: between the IX and the LHPs -9

10 Address Assignment Euro6IX Address Space (e.g. 2001:xyzk:: /35) 1 Address delegation Euro6IX Other long-haul ISPs L2 standard IPv6 IX services R Two options L3 mediation 1. IPv6 addresses assigned by the long-haul ISPs (e.g. Euro6IX) 2. IPv6 addresses directly assigned by the IX IX Address Space (e.g. TILAB, 2001:06b8::/35) Address delegation 2 Standard IX customer Next Generation IX customers -10

11 IX Euro6IX Backbone Autonomous System Routing R IX Other IXs IX IGP IS-IS ebgp4+ OSPFv6 RIPng ibgp4+ ebgp4+ R Euro6IX IPv6 Exchange R ebgp4+ Standard IX customer Next Generation IX customer Euro6IX Sites -11

12 Static VPNs with IPv6 To evaluate the current status of the main open source IPsec/IKE implementations and some commercial IPsec/IKE solutions To deploy of a static VPN service in the Euro6IX test-bed Configuration and installations guides for IPsec/IKE Test reports of interoperability and conformance -12

13 UMU PKIv6 Description Main Objective: Establish a high security infrastructure for distributed systems Main Features: PKI supporting IPv6 Developed in Java Multiplatform Issue, renew and revoke certificates Final users can use either RAS or Web LDAPv6 directory support Use of smart cards (file system, RSA or Java Cards)... allowing user mobility and increasing security PKI Certification Policy support VPN devices certification support (using the SCEP protocol) Support for the OCSP protocol and Time Stamp Web administration -13

14 UMU PKIv6 Architecture LDAP Server End User VPN Device Administrator Certification Authority IPv6 Plain connection IPv6 SSL connection SCEP over IPv6 WWW Secure Request Server Data Base Registration Authority -14

15 UMU PKIv6 Advanced Services TSP Message OCSP Message Time Stamping Authority TimeStamp Server (associated with a NTP server) TSPClient Certificate OCSP Authority Certificate OCSP Client Certification Authority OCSP Server (for on-line revocation support) SCEP Server IPsec device VPN Device SCEP Server (for requesting certificates from an IPsec device) SCEP Client -15

16 UMU PKIv6 RA Snapshot Requesting a certificate Validating a certificate -16

17 UMU PKIv6 CA Snapshot CA Internal Management Process -17

18 IX Based Services IX becomes a place where new services are offered to the users. IX is an aggregation point, so it can provide those services who can benefit by this user aggregation (e.g. in a based multicast network, the RP could be located inside the IX, because a lot of users connect to it). Network Services Multicast, AAA, QoS, DNSSec Transition Mechanisms: NAT-PT, Tunnel Broker, 6to4 Route Server mechanism Application Services HTTP, FTP, SMTP VideoConference/e-learning services P2P applications Monitoring Services Routing/Traffic/Reachability Monitoring (Magalia, AS-Path tree, Looking Glass) -18

19 The UK6x (LON6IX) Layer 2 & 3 IPv6 Internet exchange First in the UK Uses commercial IPv6 addresses Located at the heart of the UK Internet Telehouse Open to all Primary aims are: to stimulate the IPv6 environment in the UK, Europe and the World to further the understanding of IPv6-19

20 UK6x Core Architecture Ethernet switch for Layer 2 peering ATM switch for additional customer access mechanisms Router for Layer 3 functionality 2001:618::/32 used for address allocation 2001:7F8:2::/48 used for infrastructure Maintenance via Looking Glass, ASpath-tree etc. Router IPv6 Service Environment Customers MP3, Video, Quake, Mobile IPv6 HA, Debian mirror Customers Ethernet ATM Switch Customers DNS WWW -20

21 UK6x Connectivity Customers Customers Customers IPv4 Internet Manual, 6to4 or via Tunnel Broker Customers Customers GPRS Customers -21

22 DNSv6 (I) 1995: AAAA, nibble and IP6.INT (RFC1886) 2000: A6, bit-string and IP6.ARPA (RFC2874) 2002: A6 and bit-string -> Experimental (RFC3363) Servers and resolvers with IPv6 MUST support EDNS0 (RFC3226) Good support in DNS servers Some TLDs with IPv6 and AAAA -22

23 DNSv6 (II) Difference between transport and content IPv6 User Local Server euro6ix.org. Server org. Server root server AAAA AAAA -23

24 DNSv6 (III) What does these all means? AAAA as easy as A records Reverse lookups are little bit more difficult to manage Be aware of the lack of IPv6 transport up to the root servers -> need of IPv4 connectivity -24

25 DNSsecv6 (I) Provide integrity and authentication to security aware DNS entities: for both queries and zone transfers Defined independently of the IP version used DNS resolvers and servers with DNSsec MUST support EDNS0 (RFC3226) Storage of authenticated public keys in the DNS (support for general public key distribution services as well as DNS security) Use cryptographic digital signatures which are included in secured zones as RRs TSIG (Transaction signatures) to secure DNS messages. Private shared keys. Simple and lightweight. (RFC 2845) -25

26 DNSsecv6 (II) Each node in the DNS tree is associated with a public key. Each key is authenticated by the parent zone, up to the root (globally secure) Or up to a security security root (locally secure) Handling of DNSsec keys The querier will receive signatures of RRs and the public key, for signatures the private key associated with the public key of the domain is used A DNSsec aware resolver will follow the chain of trust of public keys, until it reaches a trusted one. -26

27 DNSsecv6 (III) IPv6 User Local Server euro6ix.org. Server org. Server root server AAAA + SIG (euro6ix.org) KEY (euro6ix.org) + SIG (org) KEY(org) AAAA KEY(org) + SIG(root) -27

28 IX service PKIv6 to publish certificates using DNSSEC Scenario 1: Root CA and Name Server are together in the IX Name Name server server zone zone IX IX update update IX IX update update Name Name server server zone zone ISP-1 ISP-1 ISP-1 ISP-1 Root CA Root CA Root Root CA CA -28

29 IX service PKIv6 to publish certificates using DNSSEC Scenario 2: Root CA is out Name Name server server zone zone IX IX IX-1 IX-1 update update ISP-1 ISP-1 Name Name server server zone zone ISP-1 ISP-1 update update IX-2 IX-2 Root Root CA CA Root CA Root CA -29

30 Euro6IX Work (I) DNSsec pilot Locally secured domain: sigz.euro6ix.org TSIG for zone transfers (symmetric keys) DNSsec for secure queries -30

31 DNSsec pilot Euro6IX Work (II) Forward server euro6ix.org. Security Root sigz.euro6ix.org umu. upm. consulintel. -31

32 Euro6IX Work (III) DNSsec emulator tool OBJECTIVE: creation of complex DNS scenarios made of complete name server hierarchies inside one computer, in order to test different scenarios and configuration alternatives before deploying the service to real servers. -32

33 Euro6IX Work (IV) Certificates management with DNSsec Study the use of a secure DNS service to publish digital certificates in cooperation with a PKI The CERT RR can be used to store certificates in the DNS. The types of certificates currently defined are X.509, SPKI and PGP certificates. It is intended that personal public keys should be stored in the DNS using the CERT record, and not by using the KEY record. -33

34 DNSv6 Open Issues Autoconfiguration: DHCPv6, RA, others? Reverse lookups: IP6.INT -> IP6.ARPA Root servers with IPv6 DNSsec Key management root servers with DNSsec -34

35 Multicast Advantages Network bandwidth optimization (e.g. multicast network makes a copy of the packets only when needed) Source optimization (e.g. no need to transmit a packet per destination) Well scalable technology (e.g. when a receiver is added to a network, no addiction cost is required) -35

36 Operating Multicast: M6Bone Core routers running typically PIM-Sparse Mode Access routers running PIM-SM and additionally MLD (for group managing) Hosts implementing the MLD protocol Users are grouped in the so-called multicast groups. All the hosts inside a multicast group, have the same multicast address and when a host wants to add or to leave a group, it has only to communicate this to the border router of the network where it is connected to. -36

37 The M6Bone -37

38 Implementing QoS In a typical model for QoS implementation over an administrative domain, the network is composed by a core and edge (usually PoPs) routers. Following the DiffServ model in its simplest way, the traffic coming from the customers is received by the edge routers, marked on DSCP, and policed or shaped according to the SLAs. In this simple model, with a single Service Provider all the tasks are performed within the same administrative domain, and it can be insured that the marking, policing and queuing tasks applied to the packets along the network are coherent. ISP -38

39 Implementing QoS in Real Life The real world, like in Euro6IX, is not a single Service Provider, but a lot of them. To implement a global QoS we need to define agreements of SLSs between the partners (different administrative domains). In some cases the remarking could be needed. The definition of SLAs is needed in order to define how much traffic is allowed between the providers. In the case which some external entities are used by the Providers, to manage the QoS provisioning, interoperability is already needed between these entities in order to negotiate the SLAs dynamically. ISP1 ISP2 ISP3-39

40 Euro6IX model of QoS The Euro6IX models also brings the new L3 IX. This situation doesn't changes anything the model. The IX network should be considered as one Service Provider more. The only new requirement from the 6IX is the provisioning of L2 QoS, using 801.2P technology. This is needed to support in a coherent way the L3 QoS. But not just the Ethernet-based should do it. All the other connections either ATM or FR should do the same, if possible. -40

41 AAAv6 Radius for IPv6 is standardized, but not well implemented (RFC3162) Almost no implementations using UDP/IPv6 Some IDs for DIAMETER usage with IPv6 Some preliminary implementations

42 Network Access Well supported and implemented: PPPoA (RFC2364) PPPoE (RFC2516) IPv6 over PPP (RFC2472) The question is how the remote host obtains the global IPv6 address instead of the link-local one. Usually: Router Advertisement DHCPv6 (RFC3315) -42

43 Mobility Mobile IPv6 (proposed standard draft-ietf-mobileipipv6-24.txt last July) describes basic functionality and agents that take part on it Other documents in progress, including: Security in signaling for MIPv6 ( Handovers enhancements (HMIPv6, and FMIPv6 AAA management ( QoS issues for MIPv6 ( -43

44 Network Management IPv6 Network Management Tool (Magalia) Intrusion Detection System Firewalls Route Server -44

45 How IP Can Reach all the Planet: 6POWER IPv6, QoS & Power Line Integration -45

46 6QM IPv6 Quality of Service Measurement -46

47 6QM: Objectives Development of a measurement device for IPv6. Development of a measurement server. Integration and local test of the developed components, for the further trial and evaluation of the developed system. Dissemination and Linkage with other related Foras and Projects, in order to publicize the project results. -47

48 Structure of IP OSS Management Layer Business Service Provisioning Order management Surveillance/ SLA guarantee SLA Manager Billing Accounting Target of this project Network Policy/VPN Server Network manager IP measurement server Element Control Monitor Traffic GW IP Measurement device IPv6 Network IP Measurement device GW End- user GW Contents provider -48

49 Measurement Device and Server The measurement device inserts precise timestamp information when it captures the IPv6 packet. Each device has time synchronization functionality, by GPS, or any other equivalent mechanism. The measurement server collects the captured IPv6 packet. Then it provides usage and also QoS metrics (delay, loss, jitter and so on). -49

50 IP Measurement System Structure Report QoS measurement server Reporting: delay, loss, jitter, packets amount, bytes amount Collected packets GPS receiver GPS receiver Measurement device Measurement device Captured Packets Client IP network Server -50

51 QoS & Management The operators and ISPs must be capable to control the QoS, to measure it objectively and to share information with the clients according the SLAs contracts. These measures are useful also to compare ISPs (comparison of SLAs provided by different ISPs). Is necessary to carry out measurement on both, network and application level. The correlation processing in the application level needs elaborating very complex rules, so 6QM project focus is only on the network level itself. -51

52 6QM Expected Achievements Operational rules and practical tools. Small test-beds and measurement systems, towards their use in large-scale networks. Build formal models based on empiric measures achieved on operational IPv6 networks (e.g., Euro6IX, 6NET) Implicate other network communities to build a significant and representative scenario. -52

53 IPv6 Commercial Deployment in Europe Jordi Palet European IPv6 Task Force & Steering Committee IPv6 Forum, Education & Promotion WG Co-chair Consulintel, CTO/CEO -53

54 The European IPv6 Task Force The European Commission created the IPv6 TF (2001) Goal: Prepare the roadmap for the IPv6 adoption and large scale deployment in 2005 "Our objective is to ensure that Europe's competitiveness in wireless technology is not jeopardized by the lack of a clear road map towards IPv6," European Enterprise Commissioner Erkki Liikanen said in his opening speech to the IPv6 Task Force. -54

55 The move to IPv6 is Global January 2002: The TF concluded February, March and June 2002: The EC and the Council publish different documents adopting the TF conclusions. e-europe 2005: IPv6, Broadband and 3G Continuation of the TF, in a 2 nd phase, with the support of the Steering Committee project Several European countries (Spain, France, UK, Germany, Switzerland, ), initiated local activities Several TF-like groups across the world, cooperating together -55

56 R&D Arena : Past & Present A few research projects 2-3 years ago (FP5 - IST program) Now several Research projects representing investments over 180 MEuros (90 from the EC) Major platforms and networks: 6NET, Euro6IX Available NOW, and interconnected With international peering to Japan, Korea, Abilene (Internet2), Also to provide native connectivity for other projects Over 40 projects: With IPv6 as the main focus (6POWER, 6QM, 6WINIT, ), or Using IPv6 for new applications and services (Android, Crumpet, ) 6LINK to support the collaboration in the IPv6 Cluster Eurov6 to provide permanent and nomadic showrooms for the industrial and R&D achievements -56

57 R&D Arena : The Future Next IST Program, FP6, clearly supports IPv6, Broadband and 3G as key technologies Over 900 MEuros in the 1st call (4-5 calls) International cooperation expected and highly encouraged The IPv6 Cluster facilitated the creation of the ALL-IPv6-World WG 20 Activity areas suggested Towards new applications and services IPv6 as a key enabler of Ambient Intelligence

58 Deployment Status European industry is supporting IPv6 In a short term Manufacturers of devices, routers Appliance manufacturers Application developers Several Telcos and ISPs seriously considering commercial deployment, some already started A few already providing services GEANT moving to IPv6 NOW Education programs still needed -58

59 Pre-Commercial Trials IPv6 IX IPv6 Node name Link Sponsor/s 34 Mbps Native Link Node to IX Link London Viby Lisbon Aveiro PT/TEF Lannion Madrid Southampton TEF Alcobendas Murcia Caen Issy FT Paris FT Bretigny Bern Zurich TI DT TI Torino 1) IPv6 in IPv6 Tunnel in own network 2) IPv6 over IPv4 over internet/6bone Other similar tunnels could be setup in other links if needed Berlin -59

60 And Moving To Commercial *** With Contributions from Several European Telcos and National IPv6 Task Forces -60

61 Portugal IPv6 Portuguese Task Force created with the support of UMIC (Governmental entity responsible for incentive the innovation in Portugal and follow the eeurope 2005 European program). Strong involvement in R&D activities (Portugal Telecom Inovação). No ISPs starting IPv6 commercial operation or public trials in Portugal. No publicly known dates defined to start. GigaPIXv6 (public IX operated by FCCN) started operation several months ago. FCCN, Vodafone Portugal, Telepac (Portugal Telecom Group) and other small regional operators (NFSi). Some companies are performing small internal trials with several access networks. Telepac: Internal trial with ISDN and preparing for ASDL. Commercial around 2004 Other companies from PT Group investing in IPv6 training. Documentation being written for high level instances on PT, pointing to start thinking seriously in IPv6. -61

62 France Strong participation on the France IPv6 Task Force Deployment of internal IPv6 network between sites of FTR&D since Deployment of a national scale IPv6 and dual-stack high bandwidth network within VTHDv6 project (national research project). Experimentation of a WLAN IPv6 network within Strasbourg University campus. Strong involvement in R&D activities Operational: Opentransit France Telecom's carrier has deployed an IPv6 native backbone, in order to help customers to move forward RIGHT NOW. IPv6 in 2 IX -62

63 Italy IPv6 Task Force being kick-off next October Early participants in IPv6 standards and R&D Strong involvement in R&D activities ngnet.it Telecom Italia initiative More than experimental users to Tunnel Broker service 2000 users connected together Applications services: IPv6 only IRC server with more 1000 users connected together Other Telcos starting to be involved in IPv6 in Italy. Wind Edisontel IPv6 in the two main IX Milan Internet Exchange NAMEX (Rome) -63

64 Spain Strong participation in the Spanish IPv6 Task Force, supported by the Ministry of Science and Technology Strong involvement in R&D activities IPv6 in two IX DNS root server mirror moving to IPv6 (Espanix) 1 st Newspaper offering all the contents in IPv6 (El Mundo) 1 st Hotel of the World with IPv6 1 st ISP already commercial (arsys) Several ISPs starting soon LMDS service with IPv6 soon WLAN service with IPv6 soon NAP with IPv6 soon Telefónica Data: Transit Pre-commercial pilot, with several customers. Feel more interest, but still no real business. May be after

65 Switzerland Swisscom Mobile: Plans for GPRS/UMTS, first testing for WLAN. Commercial expected in 2004 (WLAN) and 2005 (UMTS) Swisscom Enterprise Solutions (ISP for business customers): RIPE IPv6 /32 since Sept 2002, test environment with native IPv6 connectivity to Euro6IX since June Bluewin (ISP for residential customers): RIPE IPv6 /32 since May 2002, test environment. Commercial expected 2004/2005 Swisscom Innovations (Swisscom R&D): 6Bone TLA since 1997, testlabs since then, operational Intranet with IPv6 support since April

66 Others Germany Deutsche Telekom and T-Systems are working on IPv6 in projects (European projects, Customer projects) for several years. Deutsche Telekom has done an IPv6 Showcase with industry partners and is founding member of the IPv6 Forum and the European and German IPv6 Task Force. T-Systems, the system integration subsidiary of Deutsche Telekom, is offering IPv6 in customer projects on a project basis. UK Pre-commercial trials by a number of leading Telco s, ISPs, IX, corporations, SMEs and individuals. BT is heavily involved in R&D, the IPv6 Forum and IPv6 Task Force. Several European IXs, some ISPs. Global carriers with presence in Europe: Global Crossing, NTT/Verio, Telia. A few others working on it, but not public info. Other countries also involved, including Belgium, Denmark, Sweden and Netherlands. -66

67 Deployment 6NET Euro6IX Promotion Eurov6 IPv6TF-SC Clustering 6LINK Others More specific The FP5 IPv6 Picture -67

68 Big Experimentation Platforms In Particular 6NET and Euro6IX Total budget: 34 M Total EU funding: 18 M

69 IPv6 Project Cluster

70 6LINK: Objectives Consensus building IPv6 development IPv6 deployment Dissemination Exploitation of consensus Common trials Coordinated input to standards development -70

71 IST IPv6 Cluster Register and get: Newsletter (every 2 months) Standards report (every 4 months) Applications Database Publications Contact with IPv6 EU Researchers -71

72 Contact: Thanks! Jordi Palet (Consulintel): Madrid 2004 IPv6 Summit, information soon available at: Euro6IX Project Coordinators Jordi Palet Martínez (Consulintel): Carlos Ralli Ucendo (Telefónica I+D): -72