IP Version 6. Do I Know This Already? Quiz

Transcription

1 Do I Know This Already? Quiz IP Version 6 This chapter begins with coverage of fundamental topics of IPv6, then progresses into IPv6 routing protocols and other key related technologies. As you will see, IPv6 has a great deal in common with IPv4. Once you understand the IPv6 addressing format and basic configuration commands, you should begin to feel comfortable with IPv6 as a Layer 3 protocol because it shares so many of IPv4 s characteristics. IPv6 and IPv4 also have similar basic configuration options and show commands. Do I Know This Already? Quiz Table 20-1 outlines the major headings in this chapter and the corresponding Do I Know This Already? quiz questions. Table 20-1 Do I Know This Already? Foundation Topics Section-to-Question Mapping Foundation Topics Section Questions Covered in This Section Score IPv6 Addressing and Address Types 1 3 Basic IPv6 Functionality Protocols 4 5 OSPFv3 6 8 EIGRP for IPv Tunneling Techniques IPv6 Multicast 13 Total Score In order to best use this pre-chapter assessment, remember to score yourself strictly. You can find the answers in Appendix A, Answers to the Do I Know This Already? Quizzes.

2 742 Chapter 20: IP Version 6 1. Aggregatable global IPv6 addresses begin with what bit pattern in the first 16-bit group? a. 000/3 b. 001/3 c. 010/2 d. 011/2 e. None of these answers is correct. 2. Anycast addresses come from which address pool? a. Unicast b. Broadcast c. Multicast d. None of these answers is correct. Link-local and anycast addresses are drawn from reserved segments of the IPv6 address space. 3. How is the interface ID determined in modified EUI-64 addressing? a. From the MAC address of an Ethernet interface with zeros for padding b. From the MAC address of an Ethernet interface with hex FFFE inserted in the center c. By flipping the U/L bit in the Interface ID d. From a MAC address pool on a router that has no Ethernet interfaces 4. Neighbor discovery relies on which IPv6 protocol? a. ARPv6 b. IGMPv4 c. IPv6 multicast d. ICMPv6 5. Which protocol provides the same functions in IPv6 as IGMP does in IPv4 networks? a. ICMPv6 b. ND c. MLD d. TLA e. No equivalent exists.

3 Do I Know This Already? Quiz OSPFv3 provides which of the following authentication mechanisms? a. Null b. Simple password c. MD5 d. None of these answers are correct. 7. OSPFv3 uses LSAs to advertise prefixes, as does OSPFv2. Which of these LSA types are exclusive to OSPFv3? a. Link LSA b. Intra-Area Prefix LSA c. Inter-Area Prefix LSA d. External LSA e. None of these answers are correct. 8. OSPFv3 requires only interface mode configuration to start on an IPv6-only router. a. True b. False 9. In EIGRP for IPv4, the default metric is based on k values for bandwidth and delay. Which of the following k values does IPv6 EIGRP use for its default metric calculation? a. Bandwidth b. Delay c. Reliability d. Load e. MTU f. All of these answers are correct. 10. IPv6 EIGRP shares a great deal in common with EIGRP for IPv4. Which of the following best characterizes IPv6 EIGRP behavior with respect to classful and classless networks? a. IPv6 EIGRP is classful by default, but can be configured for classless operation using the no auto-summary command under the routing process. b. IPv6 EIGRP is always classful. c. IPv6 EIGRP is always classless. d. IPv6 EIGRP defaults to classful operation but can be configured for classless operation on a per-interface basis.

4 744 Chapter 20: IP Version Which of the following IPv6 tunnel types support only point-to-point communication? a. Manually configured b. Automatic 6to4 c. ISATAP d. GRE 12. Which of the following IPv6 tunnel modes does Cisco recommend using instead of automatically configured IPv4-compatible tunnels? a. ISATAP b. 6to4 c. GRE d. Manually configured e. None of these answers is correct. 13. Source-specific multicast is a variation on which PIM mode? a. PIM sparse mode b. PIM dense mode c. PIM sparse-dense mode d. Bidirectional PIM e. Anycast RP f. None of these answers are correct.

5 Foundation Topics 745 Foundation Topics You must know IPv4 addressing intimately to even reach this point in your CCIE study efforts. This chapter takes advantage of that fact to help you better learn about IPv6 addressing by making comparisons between IPv4 and IPv6. But first, you need to briefly explore why we need IPv6 or, more precisely perhaps, why we will need it in the future. IPv6 was created to meet the need for more host addresses than IPv4 can accommodate a lot more. In the early 1990s, when the number of Internet-connected hosts began to show signs of massive growth, something of a crisis was brewing among the standards bodies about how to deal with that growth in a way that would scale not just to the short-term need, but long term as well. It takes a lot of analysis and time to create a new addressing standard that meets those goals. Internet growth required faster solutions than a full-blown new addressing standard could support. Two methods were quickly implemented to meet the short-term need: RFC 1918 private IP addresses and NAT/PAT. In a way, these techniques have been so successful at reducing the growth of Internet routing tables that they have pushed out the need for IPv6 by at least a decade, but that need still exists. The day is coming when the world will simply have to move to IPv6 for reasons of application requirements, if not for near-term exhaustion of IPv4 addresses. One driver in this progression is peer-to-peer applications, which have grown greatly in popularity and are complex to support with NAT/PAT. Another is that the organic growth of the Internet around IPv4 has led to suboptimal and inadequate address allocation among the populated areas of the world, especially considering the surge in Internet growth in highly populated countries that were not part of the early Internet explosion. IPv6 gives us a chance to allocate address ranges in a more sensible way, which will ultimately optimize Internet routing tables. At the same time, IPv6 provides an almost unimaginably vast pool of host IP addresses. At some point, NAT may become a distant memory of an archaic age. Let s examine what makes IPv6 what it is and how it differs from IPv4. The key differences in IPv6 addressing compared to IPv4 follows: IPv6 addresses are 128 bits long, compared to 32 bits long for IPv4. In other words, IPv6 addresses are 2 96 times more numerous than IPv4 addresses. IPv6 addresses are represented in hexadecimal rather than decimal and use colon-separated fields of 16 bits each, rather than decimal points between 8-bit fields, as in IPv4.

6 746 Chapter 20: IP Version 6 In a Cisco IOS router, you can configure multiple IPv6 addresses on an interface (logical or physical), all of them with equal precedence in terms of the interface s behavior. By comparison, you can configure only one primary IPv4 address per interface with optional secondary addresses. Globally unique IPv6 addresses can be configured automatically by a router using the builtin autoconfiguration process without the assistance of protocols such as DHCP. IPv6 uses built-in neighbor discovery, by which an IPv6 node can discover its neighbors and any IPv6 routers on a segment, as well as whether any routers present are willing to serve as a default gateway for hosts. The concepts of private IPv4 addressing in RFC 1918 do not apply to IPv6; however, several different types of IPv6 addresses exist to provide similar functionality. The preceding list provides several key differences between IPv4 and IPv6; the next section explores the details of these concepts and provides an introduction to IPv6 configuration in Cisco IOS. IPv6 Addressing and Address Types This section covers the basics of IPv6 addressing, starting with how IPv6 addresses are represented and then exploring the different types of IPv6 addresses. After laying that foundation, the Basic IPv6 Functionality Protocols section gets into the family of protocols that enables IPv6 to fully function as a network layer protocol. IPv6 Address Notation Because of the length of IPv6 addresses, it is impractical to represent them the same way as IPv4 addresses. At 128 bits, IPv6 addresses are four times the length of IPv4 addresses, so a more efficient way of representing them is called for. As a result, each of the eight groups of 16 bits in an IPv6 address is represented in hex, and these groups are separated by colons, as follows: 1234:5678:9ACB:DEF0:1234:5678:9ABC:DEF0 In IPv6, as in IPv4, unicast addresses have a two-level network:host hierarchy (known in IPv6 as the prefix and interface ID) that can be separated into these two parts on any bit boundary in the address. The prefix portion of the address includes a couple of components, including a global routing prefix and a subnet. However, the two-level hierarchy separates the prefix from the interface ID much like it divides the network and host portions of an IPv4 address. Instead of using a decimal or hex subnet mask, though, IPv6 subnets use slash notation to signify the network portion of the address, as follows: 1234:5678:9ABC:DEF0:1234:5678:9ABC:DEF0/64

7 IPv6 Addressing and Address Types 747 An IPv6 address with a prefix length of 64 bits, commonly called a /64 address in this context, sets aside the first half of the address space for the prefix and the last half for the interface ID. After more coverage of the ground rules for IPv6 addressing, this chapter covers the ways that prefixes and interface IDs are developed for unicast addresses, as well as the additional address types used in IPv6 networks. Address Abbreviation Rules Even in the relatively efficient format shown earlier, the previous IPv6 addresses can be cumbersome because of their sheer length. As a result, a couple of abbreviation methods are used to make it easier for us to work with them. These methods include the following: Whenever one or more successive 16-bit groups in an IPv6 address consist of all 0s, that portion of the address can be omitted and represented by two colons (::). The two-colon abbreviation can be used only once in an address, to eliminate ambiguity. When a 16-bit group in an IPv6 address begins with one or more 0s, the leading 0s can be omitted. This option applies regardless of whether the double-colon abbreviation method is used anywhere in the address. Here are some examples of the preceding techniques, given an IPv6 address of 2001:0001:0000:0000:00A1:0CC0:01AB:397A. Valid ways of shortening this address using the preceding rules include these: 2001:1:0:0:A1:CC0:1AB:397A 2001:0001::00A1:0CC0:0174AB:397A 2001:1::A1:CC0:1AB:397A All of these abbreviated examples unambiguously represent the given address and can be independently interpreted by any IPv6 host as the same address. IPv6 Address Types Like IPv4 addresses, several types of IPv6 addresses are required for the various applications of IPv6 as a Layer 3 protocol. In IPv4, the address types are unicast, multicast, and broadcast. IPv6 differs slightly in that broadcast addressing is not used; special multicast addresses take the place of IPv4 broadcast addresses. However, three address types remain in IPv6: unicast, multicast, and anycast. This section of the chapter discusses each one. Table 20-2 summarizes the IPv6 address types.

8 748 Chapter 20: IP Version 6 Table 20-2 IPv6 Address Types Address Type Range Application Aggregatable global unicast 2000::/3 Host-to-host communication; same as IPv4 unicast. Multicast FF00::/8 One-to-many and many-to-many communication; same as IPv4 multicast. Anycast Same as Unicast Application-based, including load balancing, optimizing traffic for a particular service, and redundancy. Relies on routing metrics to determine the best destination for a particular host. Link-local unicast FE80::/10 Connected-link communications. Solicited-node multicast FF02::1:FF00:0/104 Neighbor solicitation. Many of the terms in Table 20-2 are exclusive to IPv6. The following sections examine each of the address types listed in the table. Unicast Unicast IPv6 addresses have much the same functionality as unicast IPv4 addresses, but because IPv6 s 128-bit address space provides so many more addresses to use, we have much more flexibility in assigning them globally. Because one of the intents for IPv6 addressing in public networks is to allow wide use of globally unique addresses, aggregatable global unicast IPv6 addresses are allocated in a way in which they can be easily summarized to reasonably contain the size of global IPv6 routing tables in service provider networks. In addition to aggregatable global unicast addresses, several other aspects of IPv6 unicast addressing deserve mention here and follow in the next few sections. Aggregatable Global Addresses In current usage, aggregatable global addresses are assigned from the IPv6 addresses that begin with binary 001. This value can be written in prefix notation as 2000::/3, which means all IPv6 addresses whose first 3 bits are equal to the first 3 bits of hex 2000." In practice, this includes IPv6 addresses that begin with hex 2 or 3. (Note that RFC 3587 later removed the restriction to only allocate aggregatable global unicast addresses from the 2000::/3, but in practice, these addresses are still allocated from this range.) To ensure that IPv6 addresses can be summarized efficiently when advertised toward Internet routers, several global organizations allocate these addresses to service providers and other users. See RFC 3587 and RFC 3177 for more details.

9 IPv6 Addressing and Address Types 749 Aggregatable global address prefixes are structured so that they can be strictly summarized and aggregated through a hierarchy consisting of a private network and a series of service providers. Here is how that works, based on RFC 3177, starting after the first 3 bits in the prefix: The next 45 bits represent the global routing prefix. The last 16 bits in the prefix, immediately preceding the Interface ID portion of the address, are Site Level Aggregator (SLA), bits. These bits are used by an organization for its own internal addressing hierarchy. This field is also known as the Subnet ID. The last 64 bits make up the interface ID. Figure 20-1 shows the aggregatable global unicast IPv6 address format. Figure 20-1 IPv6 Address Format Prefix Interface ID 64 Bits 3 Bits 45 Bits Bits Global Prefix 16 Bits SLA or Subnet ID The interface ID portion of an aggregatable global IPv6 address can be explicitly assigned in Cisco IOS or derived using a number of methods explored later in this chapter in the IPv6 Address Autoconfiguration section. These addresses should use an Interface ID in the modified EUI-64 format, discussed later in this chapter. Depending on how these addresses are assigned, however, the Universal/Local bit, which is the 7th bit in the Interface ID field of an IPv6 address, can be set to 0 (locally administered) or 1 (globally unique) to indicate the nature of the Interface ID portion of the address. Link-Local Addresses As the term implies, link-local addresses are used on a data link or multiaccess network, such as a serial link or an Ethernet network. Because these addresses are link-local in scope, they are guaranteed to be unique only on that link or multiaccess network. Each interface type, regardless of whether it is serial, PPP, ATM, Frame Relay, Ethernet, or something else, gets a link-local address when IPv6 is enabled on that interface.

10 750 Chapter 20: IP Version 6 Link-local addresses always begin with FE80::/10. The Interface ID portion of the address is derived using the modified EUI-64 format, discussed later in this chapter. The remaining 54 bits of the prefix are always set to 0. On Ethernet interfaces, the IEEE 802 MAC address is the basis for the Interface ID. For other interface types, routers draw from a pool of virtual MAC addresses to generate the Interface IDs. An example of a fully formed link-local address follows: FE80::207:85FF:FE80:71B8 As you might gather from the name, link-local addresses are used for communication between hosts that do not need to leave the local segment. By definition, routers do not forward link-local traffic to other segments. As you will see later in this chapter, link-local addresses are used for operations such as routing protocol neighbor communications, which are by their nature linklocal. IPv4-Compatible IPv6 Addresses Many transition strategies have been developed for IPv4 networks to migrate to IPv6 service and for IPv6 networks to intercommunicate over IPv4 networks. Most of these strategies involve tunneling. Similarly, a mechanism exists for creating IPv6 addresses that are compatible with IPv4. These addresses use 0s in the first 96 bits of the address and one of the two formats for the remaining portion of the address. Take a look at an example, given the IPv4 address The following are valid IPv4-compatible IPv6 addresses that correspond to this IPv4 address (all of these are in hexadecimal, as IPv6 addresses are universally represented): 0:0:0:0:0:10:10:100:16 ::10:10:100:16 ::A:A:64:10 IPv4-compatible IPv6 addresses are not widely used and do not represent a design best practice, but you should be familiar with their format. See the section Tunneling, later in this chapter for more detail on IPv4-compatible address usage in the corresponding tunnel type and on the deprecation of this tunneling type in Cisco IOS. Assigning an IPv6 Unicast Address to a Router Interface To configure any IPv6 address or other IPv6 feature, you must first globally enable IPv6 on the router or switch: Stengel(config)# ipv6 unicast-routing

11 IPv6 Addressing and Address Types 751 Next, configure a global unicast address: Stengel(config-if)# ipv6 address 2001:128:ab2e:1a::1/64 Routers automatically configure a link local IPv6 address on all IPv6-enabled interfaces. However, you can configure the link local address with the following command. (Note the the link-local keyword to designate the address type.) Stengel(config-if)# ipv6 address fe80::1 link-local Unlike IPv4, IPv6 allows you to assign many addresses to an interface. All IPv6 addresses configured on an interface get equal precedence in terms of IP routing behavior. Multicast Multicast for IPv6 functions much like IPv4 multicast. It allows multiple hosts to become members of (that is, receive traffic sent to) a multicast group without regard to their location or number. A multicast receiver is known as a group member, because it joins the multicast group to receive traffic. Multicast addresses in IPv6 have a specific format, which is covered in the next section. Because IPv6 has no broadcast addressing concept, multicast takes the place of all functions that would use broadcast in an IPv4 network. For example, the IPv6 DHCP process uses multicast for sending traffic to an unknown host on a local network. As in IPv4, IPv6 multicast addresses are always destinations; a multicast address cannot be used as a source of any IPv6 traffic. IPv6 multicast is covered in more detail in the last section of this chapter. IPv6 Multicast Address Format Multicast addresses in IPv6 always begin with FF as the first octet in the address, or FF00::/8. The second octet specifies the lifetime and scope of the multicast group. Lifetime can be permanent or temporary. Scope can be local to any of the following: Node Link Site Organization Global

12 752 Chapter 20: IP Version 6 The multicast address format is shown in Figure Figure 20-2 IPv6 Multicast Address Format 16 Bits All 0s Interface ID 64 Bits 8 Bits FF 8 Bits Lifetime Scope 4 Bits 4 Bits 0000 = Permanent 0001 = Temporary Scope 0001 = Node 0010 = Link 0101 = Site 1000 = Organization 1110 = Global Table 20-3 shows several well-known IPv6 multicast group addresses and their functions. Table 20-3 IPv6 Multicast Well-Known Addresses Function Multicast Group IPv4 Equivalent All hosts FF02::1 Subnet broadcast address All Routers FF02:: OSPFv3 routers FF02:: OSPFv3 designated routers FF02:: EIGRP routers FF02::A PIM routers FF02::D In an IPv6 network, as in IPv4, there is an all-nodes multicast group (FF02::1), of which all IPv6 hosts are members. All routers must join the all-routers multicast address (FF02::2). In addition, IPv6 multicast uses a solicited-node group that each router must join for all of its unicast and anycast addresses. The format for solicited-node multicast addresses is FF02::1:FF00:0000/104

13 IPv6 Addressing and Address Types 753 Note that all but the last 24 bits of the address are specified by the /104 prefix. Solicited-node addresses are built from this prefix concatenated with the low-order 24 bits ( = 24) of the corresponding unicast or anycast address. For example, a unicast address of 2001:1AB:2003:1::CBAC:DF01 has a corresponding solicited-node multicast address of FF02::1:FFAC:DF01 Solicited-node addresses are used in the Neighbor Discovery (ND) process, covered later in this chapter. Multicast in IPv6 relies on a number of protocols with which you are already familiar, including PIM. Multicast Listener Discovery is another key part of IPv6 multicast. These topics and other related multicast subjects are covered later in this chapter in the IPv6 Multicast section. Anycast In some applications, particularly server farms or provider environments, it may be desirable to pool a number of servers to provide redundancy, load balancing, or both. Several protocols can provide this functionality in IPv4 networks. IPv6 has built-in support for this application in the form of anycast addressing. Anycast addresses can be assigned to any number of hosts that provide the same service; when other hosts access this service, the specific server they hit is determined by the unicast routing metrics on the path to that particular group of servers. This provides geographic differentiation, enhanced availability, and load balancing for the service. Anycast addresses are drawn from the IPv6 unicast address pool and, therefore, are not distinguishable from unicast addresses. RFC 2526 recommends a range of addresses for use by anycast applications. Once an address is assigned to more than one host, it becomes an anycast address by definition. Because anycast addresses cannot be used to source traffic, however, a router must know if one of its interface IPv6 addresses is an anycast address. Therefore, Cisco IOS Software requires the anycast keyword to be applied when an anycast address is configured, as in this example: Mariano(config-if)# ipv6 address 3001:fffe::104/64 anycast All IPv6 routers additionally must support the subnet router anycast address. This anycast address is a prefix followed by all 0s in the interface ID portion of the address. Hosts can use a subnet router anycast address to reach a particular router on the link identified by the prefix given in the subnet router anycast address.

14 754 Chapter 20: IP Version 6 The Unspecified Address One additional type of IPv6 address deserves mention in this section, as it is used for a number of functions in IPv6 communications. This address, which is used for some types of requests covered later in this chapter, is represented simply by ::. The unspecified address is always a source address used by an interface that has not yet learned its unicast address. The unspecified address cannot be assigned to an interface, and it cannot be used as a destination address. IPv6 Address Autoconfiguration One of the goals of IPv6 is to make life easier for network administrators, especially in dealing with the almost unimaginably vast address space that IPv6 provides compared to IPv4. Automatic address configuration, or simply autoconfiguration, was created to meet that need. An IPv6 host can automatically configure its complete address, or just the interface ID portion of its address, depending on which of the several methods for autoconfiguration it uses. Those methods include Stateful autoconfiguration Stateless autoconfiguration EUI-64 One method, stateful autoconfiguration, assigns a host or router its entire 128-bit IPv6 address using DHCP. Another method, stateless autoconfiguration, dynamically assigns the host or router interface a 64-bit prefix, and then the host or router derives the last 64 bits of its address using the EUI-64 process described in this section. Because the EUI-64 format is seen so frequently, it is important to cover those details now. However, particularly for those who have not learned much about IPv6 before reading this chapter, it is better to defer the rest of the details about autoconfiguration until the section titled IPv6 Address Autoconfiguration later in this chapter. EUI-64 Address Format One key aspect of IPv6 addressing is automatic configuration, but how does an IPv6 host ensure that autoconfigured addresses are globally unique? The answer to this question comes in two parts. The first part is to set aside a range and structure for aggregatable global addresses, as described earlier. Once a network administrator has set the prefix for a given network, the second part takes over. That second step is address autoconfiguration, but what format should a host use for these addresses to ensure that they are globally unique? That format is EUI-64.

15 IPv6 Addressing and Address Types 755 With EUI-64, the interface ID is configured locally by the host to be globally unique. To do that, the host needs a globally unique piece of information that it already knows. That piece of information cannot be more than 64 bits long, because EUI-64 by definition requires a 64-bit prefix and a 64-bit interface ID. But it needs to be both long enough and from a source that is known to be globally unique. To meet this need, Ethernet hosts and Cisco routers with Ethernet interfaces use their 48-bit MAC addresses as a seed for EUI-64 addressing. But because the MAC address is 48 bits long and the EUI-64 process makes up the last 64 bits of an IPv6 address, the host needs to derive the other 16 bits from another source. The IEEE EUI-64 standard places the hex value FFFE into the center of the MAC address for this purpose. Finally, EUI-64 sets the universal/local bit, which is the 7th bit in the Interface ID field of the address, to indicate global scope. Here is an example. Given the IPv6 prefix 2001:128:1F:633 and a MAC address of 00:07:85:80:71:B8, the resulting EUI-64 address is 2001:128:1F:633:207:85FF:FE80:71B8/64 The bold part of the address is the complete interface ID. Note how the underlined characters indicate the setting of the U/L bit and the insertion of FFFE after the OUI in the MAC address. Configure this address on a router s Fast Ethernet interface, as shown in Example Example 20-1 Configuring an EUI-64 IPv6 Address Matsui(config)# int fa0/0 Matsui(config-if)# ipv6 address 2001:128:1f:633::/64 eui-64 To view the result, use the relevant show commands. Example 20-2 shows a sample of the show ipv6 interface brief command. This shows both the global unicast addresses and link-local address assigned to this interface. The example shows interface Fa0/0 with the aggregatable global unicast address configured in Example 20-1, and the link-local unicast address automatically created by the router. Example 20-2 Checking an IPv6 Interface s Configured Addresses Matsui# show ipv6 interface brief FastEthernet0/0 [up/up] FE80::207:85FF:FE80:71B8 2001:128:1F:633:207:85FF:FE80:71B8 The shaded section of the unicast address in Example 20-2 shows the EUI-64-derived portion of the address. To see the full output, omit the brief keyword and specify the interface, as shown in

16 756 Chapter 20: IP Version 6 Example In this example, the router explicitly informs you that the address was derived by EUI-64 by the [EUI] at the end of the global unicast address. Example 20-3 Detailed Interface Configuration Output Matsui# show ipv6 interface fa0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::207:85FF:FE80:71B8 No Virtual link-local address(es): Global unicast address(es): 2001:128:1F:633:207:85FF:FE80:71B8, subnet is 2001:128:1F:633::/64 [EUI] Joined group address(es): FF02::1 FF02::2 FF02::A FF02::1:FF80:71B8 MTU is 1500 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ICMP unreachables are sent ND DAD is enabled, number of DAD attempts: 1 ND reachable time is milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds ND advertised default router preference is Medium Hosts use stateless autoconfig for addresses. IPv6 addressing:eui-64;eui-64 address format Basic IPv6 Functionality Protocols IPv6 uses a number of protocols to support it. Because IPv6 is fundamentally similar to IPv4, some of these protocols will be familiar to you and are covered in other parts of this book for example, ICMP, CDP, and DHCP. However, some aspects of IPv6 operation, and indeed some of its greatest strengths, require functional support from protocols not included in the IPv4 protocol suite. Key among them is Neighbor Discovery Protocol, which provides many functions critical in IPv6 networks. Other protocols, such as CDP, DNS, and ICMP, will be quite familiar. Because neighbor discovery is such a critical function in IPv6 networks, this part of the chapter starts with that and then moves on to the more familiar protocols. Neighbor Discovery A major difference between IPv4 and IPv6 involves how IPv6 hosts learn their own addresses and learn about their neighbors, including other hosts and routers. Neighbor Discovery Protocol, also

17 Basic IPv6 Functionality Protocols 757 known as ND or NDP, facilitates this and other key functions. ND is defined in RFC The remainder of this section introduces ND functionality, lists its main features, and then lists the related ICMPv6 messages, which are beyond the scope of the exam but are useful for study and reference. In IPv6 networks, ND Protocol uses ICMPv6 messages and solicited-node multicast addresses for its core functions, which center on discovering and tracking other IPv6 hosts on connected interfaces. ND is also used for address autoconfiguration. Major roles of IPv6 ND include the following: Stateless address autoconfiguration (detailed in RFC 2462) Duplicate address detection (DAD) Router discovery Prefix discovery Parameter discovery (link MTU, hop limits) Neighbor discovery Neighbor address resolution (replaces ARP, both dynamic and static) Neighbor and router reachability verification ND uses five types of ICMPv6 messages to do its work. Table 20-4 defines those functions and summarizes their goals. Table 20-4 ND Functions in IPv6 Message Type Router Advertisement (RA) Router Solicitation (RS) Information Sought or Sent Source Address Destination Address Routers advertise their presence and link prefixes, MTU, and hop limits. Hosts query for the presence of routers on the link. Router s link-local address Address assigned to querying interface, if assigned, or :: if not assigned FF02::1 for periodic broadcasts; address of querying host for responses to an RS ICMP Type, Code 134, 0 FF02::2 133, 0

18 758 Chapter 20: IP Version 6 Table 20-4 ND Functions in IPv6 (Continued) Message Type Neighbor Solicitation (NS) Neighbor Advertisement (NA) Redirect Information Sought or Sent Source Address Destination Address Hosts query for other nodes link-layer addresses. Used for duplicate address detection and to verify neighbor reachability. Sent in response to NS messages and periodically to provide information to neighbors. Sent by routers to inform nodes of better next-hop routers. Address assigned to querying interface, if assigned, or :: if not assigned Configured or automatically assigned address of originating interface Link-local address of originating node Solicited-node multicast address or the target node s address, if known Address of node requesting the NA or FF02::1 for periodic advertisements Source address of requesting node ICMP Type, Code 135, 0 136, 0 137, 0 Neighbor Advertisements IPv6 nodes send Neighbor Advertisement (NA) messages periodically to inform other hosts on the same network of their presence and link-layer addresses. Neighbor Solicitation IPv6 nodes send NS messages to find the link-layer address of a specific neighbor. This message is used in three operations: Duplicate address detection Neighbor reachability verification Layer 3 to Layer 2 address resolution (as a replacement for ARP) IPv6 does not include ARP as a protocol but rather integrates the same functionality into ICMP as part of neighbor discovery. The response to an NS message is an NA message. Figure 20-3 shows how neighbor discovery enables communication between two IPv6 hosts.

19 Basic IPv6 Functionality Protocols 759 Figure 20-3 Neighbor Discovery Between Two Hosts Host A Host B Neighbor Solicitation Src = A Dst = Solicited-node multicast of B Data = Link-layer address of A Query = What is your link address? Neighbor Advertisement Src = B Dst = A Data = Link-Layer Address of B A and B can now exchange packets on this link. NOTE Figures 20-3 and 20-4 were redrawn from Figures 12 and 13, respectively, in Implementing IPv6 Addressing and Basic Connectivity at products/sw/iosswrel/ps5187/products_configuration_guide_chapter09186a00806f3a6a.html. Router Advertisement and Router Solicitation A Cisco IPv6 router begins sending RA messages for each of its configured interface prefixes when the ipv6 unicast-routing command is configured. You can change the default RA interval (200 seconds) using the command ipv6 nd ra-interval. Router advertisements on a given interface include all of the 64-bit IPv6 prefixes configured on that interface. This allows for stateless address autoconfiguration using EUI-64 to work properly. RAs also include the link MTU, hop limits, and whether a router is a candidate default router. IPv6 routers send periodic RA messages to inform hosts about the IPv6 prefixes used on the link and to inform hosts that the router is available to be used as a default gateway. By default, a Cisco router running IPv6 on an interface advertises itself as a candidate default router. If you do not want a router to advertise itself as a default candidate, use the command ipv6 nd ra-lifetime 0. By sending RAs with a lifetime of 0, a router still informs connected hosts of its presence, but tells connected hosts not to use it to reach hosts off the subnet. If, for some reason, you wanted to hide the presence of a router entirely in terms of router advertisements, you can disable router advertisements on that router by issuing the ipv6 nd suppress-ra command.

20 760 Chapter 20: IP Version 6 Figure 20-4 shows how ND enables communication between two IPv6 hosts. Figure 20-4 Router Advertisements Make Hosts Aware of a Router s Presence and Provide Information Necessary for Host Configuration Router Advertisement Router Advertisement Src = Router Link-Local Address Dst = All-Nodes Multicast Address Data = Options, Prefix, Lifetime, Autoconfig flag At startup, IPv6 hosts can send Router Solicitation (RS) messages to the all-routers multicast address. Hosts do this to learn the addresses of routers on a given link, as well as their various parameters, without waiting for a periodic RA message. If a host has no configured IPv6 address, it sends an RS using the unspecified address as the source. If it has a configured address, it sources the RS from the configured address. Duplicate Address Detection IPv6 DAD is a function of neighbor solicitation. When a host performs address autoconfiguration, it does not assume that the address is unique, even though it should be because the seed 48-bit MAC address used in the EUI-64 process should itself be globally unique. To verify that an autoconfigured address is unique, the host sends an NS message to its own autoconfigured address s corresponding solicited-node multicast address. This message is sourced from the unspecified address, ::. In the Target Address field in the NS is the address that the host seeks to verify as unique. If an NA from another host results, the sending host knows that the address is not unique. IPv6 hosts use this process to verify the uniqueness of both statically configured and autoconfigured addresses. For example, if a host has autoconfigured an interface for the address 2001:128:1F:633:207:85FF: FE80:71B8, then it sends an NS to the corresponding solicited-node address, FF02::1:FE80:71B8/ 104. If no other host answers, the node knows that it is okay to use the autoconfigured address. The method described here is the most efficient way for a router to perform DAD, because the same solicited-node address matches all autoconfigured addresses on the router. (See the earlier section IPv6 Address Autoconfiguration for a discussion of solicited-node addresses.)

21 Basic IPv6 Functionality Protocols 761 Neighbor Unreachability Detection IPv6 neighbors can track each other, mainly for the purpose of ensuring that Layer 3 to Layer 2 address mapping remains current, using information determined by various means. Reachability is defined not just as the presence of an advertisement from a router or a neighbor, but further requires confirmed, two-way reachability. However, that does not necessarily mean that a neighbor has to ask another node for its presence and receive a direct reply as a result. The two ways a node confirms reachability are as follows: A host sends a probe to the desired host s solicited-node multicast address and receives an RA or an NA in response. A host, in communicating with the desired host, receives a clue from a higher-layer protocol that two-way communication is functioning. One such clue is a TCP ACK. Note that clues from higher-layer protocols work only for connection-oriented protocols. UDP, for example, does not acknowledge frames and, therefore, cannot be used as a verification of neighbor reachability. In the event that a host wants to confirm another s reachability under conditions where no traffic or only connectionless traffic is passing between these hosts, the originating host must send a probe to the desired neighbor s solicited-node multicast address. ICMPv6 Like ICMP for IPv4, ICMPv6 provides messaging support for IPv6. As you learned in the previous section, ICMPv6 provides all the underlying services for neighbor discovery, but it also provides many functions in error reporting and echo requests. ICMPv6 is standardized in RFC 2463, which broadly classifies ICMPv6 messages into two groups: error reporting messages and informational messages. To conserve bandwidth, RFC 2463 mandates configurable rate limiting of ICMPv6 error messages. The RFC suggests that ICMPv6 may limit its message rate by means of timers or based on bandwidth. No matter which methods are used, each implementation must support configurable settings for these limits. To that end, Cisco IOS Software implements ICMP rate limiting by setting the minimum interval between error messages and allows credit to build using a token bucket. To limit ICMPv6 error messages, use the ipv6 icmp error-interval command, in global configuration mode. The default interval is 100 ms, and the default token-bucket size is 10 tokens. With this configuration, a new token (up to a total of 10) is added to the bucket every 100 ms. Beginning when the token bucket is full, a maximum of 10 ICMPv6 error messages can be sent in rapid succession. Once the token bucket empties, the router cannot send any additional ICMPv6 error messages until at least one token is added to the bucket.

22 762 Chapter 20: IP Version 6 Unicast Reverse Path Forwarding In IPv6, unicast RPF helps protect a router from DoS attacks from spoofed IPv6 host addresses. When you configure IPv6 unicast RPF by issuing the ipv6 verify unicast reverse-path command on an interface, the router performs a recursive lookup in the IPv6 routing table to verify that the packet came in on the correct interface. If this check passes, the packet in question is allowed through; if not, the router drops it. Cisco IOS Software gives you the option of defining a sort of trust boundary. This way, a router can verify only selected source IPv6 addresses in the unicast RPF check. To do this, configure an access list on the router and call it with the ipv6 verify unicast reverse-path command. In Example 20-4, the router will perform the RPF check on all IPv6 packets that enter the router s Fast Ethernet 0/0 interface. The router will then drop packets that meet both of these conditions: 1. The RPF check fails. 2. The source address is within the 2007::/64 range. If either of these conditions is not met, the packet will be routed. If both conditions are met, the router drops the packet. Example 20-4 Unicast Reverse-Path Forwarding Configuration HiramMaxim(config)# ipv6 access-list urpf HiramMaxim(config-ipv6-acl)# deny ipv6 2007::/64 any HiramMaxim(config-ipv6-acl)# permit ipv6 any any HiramMaxim(config-ipv6-acl)# interface fa0/0 HiramMaxim(config-if)# ipv6 verify unicast reverse-path urpf HiramMaxim(config-if)# end HiramMaxim# ipv6 interface fa0/0 FastEthernet0/0 is up, line protocol is up IPv6 is enabled, link-local address is FE80::207:85FF:FE80:7208 No Virtual link-local address(es): Global unicast address(es): 2002:192:168:1::1, subnet is 2002:192:168:1::/ :192:168:2::1, subnet is 2002:192:168:2::/64 [ANY] Joined group address(es): FF02::1 FF02::2 FF02::A FF02::D FF02::16 FF02::1:FF00:1 FF02::1:FF80:7208 MTU is 1500 bytes ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled

23 Basic IPv6 Functionality Protocols 763 Example 20-4 Unicast Reverse-Path Forwarding Configuration (Continued) ICMP unreachables are sent Input features: RPF Unicast RPF access-list urpf Process Switching: 0 verification drops 0 suppressed verification drops CEF Switching: 0 verification drops 0 suppressed verification drops ND DAD is enabled, number of DAD attempts: 1 ND reachable time is milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds ND advertised default router preference is Medium Hosts use stateless autoconfig for addresses. For more information about how RPF checks work, see Chapter 16, Introduction to IP Multicasting. DNS DNS for IPv6 is quite similar to DNS for IPv4; it provides resolution of domain names to IPv6 addresses. One key difference is the name used for DNS records for IPv6 addresses. In IPv4, these are known as A records; in IPv6, RFC 1886 cleverly terms them AAAA records, because IPv6 addresses are four times longer (in bits) than IPv4 addresses. RFC 1886 and RFC 2874 are both IPv6 DNS extensions. RFC 2874 calls IPv6 address records A6 records. Today, RFC 1886 is most commonly used; however, RFC 2874 expects to eventually obsolete RFC IPv6 DNS extensions also provide the inverse lookup function of PTR records, which maps IPv6 addresses to host names. CDP Cisco Discovery Protocol provides extensive information about the configuration and functionality of Cisco devices. Because of its extensibility, it should be no surprise to you that CDP also provides information about Cisco IPv6 host configuration. To see IPv6 information

24 764 Chapter 20: IP Version 6 transmitted in CDP frames, you must use the detail keyword for the show cdp neighbor command, as shown in Example Example 20-5 IPv6 Information Available from CDP Output Rivers# show cdp neighbors detail Device ID: Mantle Entry address(es): IP address: IPv6 address: FE80::207:85FF:FE80:7208 (link-local) IPv6 address: 2001::207:85FF:FE80:7208 (global unicast) Platform: Cisco 1760, Capabilities: Router Switch Interface: Serial0/0, Port ID (outgoing port): Serial0/0 Holdtime : 159 sec (output omitted for brevity) DHCP One alternative to static IPv6 addressing, namely stateless autoconfiguration, was covered earlier. Another alternative also exists: stateful autoconfiguration. This is where DHCPv6 comes in. DHCPv6 is specified in RFC Two conditions can cause a host to use DHCPv6: The host is explicitly configured to use DHCPv6 based on an implementation-specific setting. An IPv6 router advertises in its RA messages that it wants hosts to use DHCPv6 for addressing. Routers do this by setting the M flag (Managed Address Configuration) in RAs. To use stateful autoconfiguration, a host sends a DHCP request to one of two well-known IPv6 multicast addresses on UDP port 547: FF02::1:2, all DHCP relay agents and servers FF05::1:3, all DHCP servers The DHCP server then provides the necessary configuration information in reply to the host on UDP port 546. This information can include the same types of information used in an IPv4 network, but additionally it can provide information for multiple subnets, depending on how the DHCP server is configured. To configure a Cisco router as a DHCPv6 server, you first configure a DHCP pool, just as in IPv4 DHCP. Then, you must specifically enable the DHCPv6 service using the ipv6 dhcp server poolname interface command.

25 Access Lists and Traffic Filtering 765 Access Lists and Traffic Filtering Cisco IOS has the same traffic filtering and related concepts for IPv6 as for IPv4. Access lists serve the same purposes in IPv6 as in IPv4, including traffic filtering and access control for interface logins. You should be aware of a few key differences between access-list behavior for the two network layer protocols, however: Because Neighbor Discovery is such a key protocol in IPv6, access lists implicitly permit ND traffic. This is necessary to avoid breaking ND s ARP-like functionality. You can override this implicit-permit behavior using deny statements in IPv6 access lists. When IPv6 access lists are used for traffic filtering, the command syntax differs from that for IPv4. To configure an interface to filter traffic using an access list, use the ipv6 traffic-filter access-list-name {in out} command. IPv6 access lists are always named; they cannot be numbered (unless you use a number as a name). IPv6 access lists are configured in named access-list configuration mode, which is like IPv4 named access-list configuration mode. However, you can also enter IPv4-like commands that specify an entire access-list entry on one line. The router will convert it to the correct configuration commands for named access-list configuration mode. With these exceptions, access-list applications, behavior, and configuration are generally similar for IPv6 and IPv4. Example 20-6 shows an access list that permits all Telnet traffic to a particular subnet and also matches on a DSCP setting of CS1. In addition, this entry logs ACL hits (and denies, for the second entry) for tracking purposes. The show access-list command is also shown to illustrate how similar IPv6 ACL behavior is to IPv4 ACLs. Example 20-6 IPv6 Access Lists cano(config)# ipv6 access-list restrict-telnet cano(config-ipv6-acl)# permit tcp any 2001:1:2:3::/64 eq telnet dscp cs1 log cano(config-ipv6-acl)# deny tcp any any log-input cano(config-ipv6-acl)# line vty 0 4 Next, the access list is applied inbound on VTY lines 0-4. cano(config-line)# access-class restrict-telnet in cano(config-line)# end cano# show access-lists IPv6 access list restrict-telnet permit tcp any 2001:1:2:3::/64 eq telnet dscp cs1 log (1 match) sequence 10 deny ipv6 any any log-input (2 matches) sequence 20 cano#

26 766 Chapter 20: IP Version 6 IPv6 Static Routes Now that we have laid the foundation for IPv6 addressing and basic services, the next section of this chapter focuses on routing. This section begins with static routes and then covers the two IPv6 routing protocols on the CCIE Routing and Switching qualifying exam blueprint, OSPFv3 and IPv6 EIGRP. Static routing in IPv6 works almost exactly as it does in IPv4, but with several twists: An IPv6 static route to an interface has a metric of 1, not 0 as in IPv4. An IPv6 static route to a next-hop IP address also has a metric of 1, like IPv4. Floating static routes work the same way in IPv4 and IPv6. An IPv6 static route to a broadcast interface type, such as Ethernet, must also specify a nexthop IPv6 address, for reasons covered next. As mentioned in the preceding list, IPv6 static routes that point to a broadcast interface must also specify a next-hop IP address. This is because, as you will recall from earlier in this chapter, IPv6 does not use ARP, and, therefore, there is no concept of proxy ARP for IPv6. A next-hop router will not proxy for a destination that is off the subnet. Therefore, static routes must specify the nexthop IP address in situations where you specify a broadcast interface as a next hop. One valuable tip for real-life configuration work, especially where time is of the essence (as it is in the CCIE lab exam): Before you begin configuring routing processes or static routes, enable IPv6 routing debugging using the debug ipv6 routing command. This has the benefit of showing you all changes to the IPv6 routing table, including any that you may not intend Example 20-7 shows the configuration of a sample IPv6 static route and how it looks in the routing table. Example 20-7 IPv6 Static Route Configuration and show Commands Martin(config)# ipv6 route 2001:129::/ ::207:85FF:FE80:7208 Martin(config)# end Martin# Apr 2 19:22:30.191: %SYS-5-CONFIG_I: Configured from console by console Martin# show ipv6 route IPv6 Routing Table - 9 entries Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP U - Per-user Static route I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2 ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2 D - EIGRP, EX - EIGRP external