Introduc)on to IPv6. Administra)on de Réseaux Dino Lopez h<p://

Transcription

1 Introduc)on to IPv6 Administra)on de Réseaux Dino Lopez h<p://

2 Inspired from Ø The presenta)on Introduc)on to IPv6 and its Security of Cisco h<p:// Ø The presenta)on APNIC Tutorial: IPv6 Essen)als h<ps://training.apnic.net/docs/tip601.pdf Request For Comments (RFCs) 2

3 A bit of history 1968 DARPA Ø (Defense Advanced Research Projects Agency) contracts with BBN to create ARPAnet 1969 First four nodes Five nodes: Ø UCLA Stanford - UC Santa Barbara - U of Utah BBN nodes, 23 hosts connected 1974 TCP specifica)on by Vint Cerf & Bob Kahn 1983 TCP/IP Ø On January 1, the Internet counts

4 Address architecture Ini)ally, only 256 networks in the Internet Network classes : A, B, C 1992 Internet challenges Ø Address space deple)on Ø Wasteful alloca)ons Ø Rou)ng chaos, since no aggrega)on 4

5 Classful vs Classless A B C Classful 128 networks x 16M hosts 16K networks x 64K hosts 2M networks x 256 hosts Obsolete inefficient depletion of B space too many routes from C space Classless * 5 Best Current Practice Addresses Prefix Classful Net Mask... 8 / / / / / / C /20 16 C s /19 32 C s /18 /17 /16 64 C s 128 C s 1 B

6 Management by RIRs Source: h<ps:// 6

7 IPv6 history August 1990 Ø First wakeup call by Solensky in IETF on IPv4 address exhaus)on December 1994 Ø IPng area were formed within IETF to manage IPng effort [RFC1719] Ø List of technical criteria was defined to choose IPng [RFC1726] January 1995 IPng director recommenda)on to use 128 bit address [RFC1752] December 1995 Ø First version of IPv6 address specifica)on [RFC1883] December 1998 Ø Updated version changing header format from 1st version [RFC2460 7

8 IPv4 exhaus)on Source: h<p://bgp.potaroo.net/ 8

9 IPv4 BGP Table Source: h<p://bgp.potaroo.net/ 9

10 IPv6 improvements Large address space 128- bit addresses Management Ø Stateless autoconfigura)on Mul)cast Ø Buil)ng features for mul)cast groups and new anycast group Mobile IP Ø Eliminate triangular rou)ng through Route Op)miza)on Virtual Private Networks Ø Built- in support for ESP/AH encrypted/authen)cated VPN protocols Built- in support for QoS tagging No more broadcast No hop- by- hop segmenta)on Ø Path MTU discovery 10

11 IPv4 vs IPv6 header Source: h<ps://343networks.files.wordpress.com/ 11

12 IPv6 extension header The use of an extension header makes it easy to add new features in IPv6 The number of extension headers is variable The extension header is placed between the main IPv6 header and the payload Some values for the Next Header field Ø 0 Hop- by- hop op)on Ø 2 ICMP Ø 6 TCP Ø 17 UDP Ø 43 Source rou)ng Ø 44 Fragmenta)on Ø 50 Encrypted security payload 51 Authen)ca)on Ø 59 Null (No next header) Ø 60 Des)na)on op)on 12

13 Order of Extension Header Source node place the EH in the following order Ø 1. Hop- by- hop Ø 2. Rou)ng Ø 3. Fragment Ø 4. Authen)ca)on Ø 5. Encapsula)ng security payload Ø 6. Des)na)on op)on Ø 7. Upper- layer Order is important Ø Only hop- by- hop must be processed at every intermediate node Ø Rou)ng headers must be processed by intermediate routers Ø At the des)na)on, fragmenta)on must be handled before others 13

14 The MTU in IPv6 Path MTU discovery Ø The sender sends first a packet as big as required by the applica)on layer Ø If the device receives an ICMP packet with a too big message signaling, the sender must apply the provided MTU size Ø Each source needs to track the MTU size for each session Minimum MTU is 1280 Most efficient MTU is 1500 Maximum datagram size is 64k 14

15 IPv6 addresses representa)on Format Ø x:x:x:x:x:x:x:x where x is 16 bits hexadecimal field Ø 2001:0000:130F:0000:0000:09C0:876A:130B Ø Case insensi)ve Leading zeros in a field are op)onal: Ø 2001:0:130F:0:0:9C0:876A:130B Successive fields of 0 are represented as ::, but only once in an address: Ø 2001:0:130F::9C0:876A:130B Ø FF01:0:0:0:0:0:0:1 => FF01::1 Ø 0:0:0:0:0:0:0:1 => ::1 Ø 0:0:0:0:0:0:0:0 => :: RFC5952 recommends to use double colons for the rightmost set of :0: In an URL Ø h<p://[2001:db8:4f3a::206:ae14]:8080/index.html Prefix representa)on Ø Just like in IPv4 CIDR 15

16 IPv6 addressing model Unicast Ø An iden)fier for a single interface Mul)cast Ø Iden)fier for a group of nodes Anycast Ø Iden)fier for a set of interfaces Ø Anycast rou)ng find the closest peer 16

17 Global Unicast addresses Provider Site Host 3 45 bits 16 bits 64 bits Global Routing Prefix SLA Interface ID 001 Global Unicast Range Ø ::/3 Ø FFF:FFF:... :FFFF/3 17

18 Global Unicast Addresses All five RIRs are given a /12 from the /3 to further distribute within the RIR region Ø APNIC :0000::/12 Ø ARIN :0000::/12 Ø AfriNIC - 2C00:0000::/12 Ø LACNIC :0000::/12 Ø Ripe NCC - 2A00:0000::/12 6to4 Addresses Ø 2002::/16 Ø Designed for a special tunneling mechanism [RFC 3056] to connect IPv6 Domains via IPv4 Clouds Ø Automa)c tunnel transi)on Mechanisms for IPv6 Hosts and Routers Ø Need 6to4 relay routers in ISP network 18

19 IPv6 Local Addresses 128 bits 0 Interface ID bits FE80::/10 10 bits Link- local addresses Ø Ø Ø Ø Have a limited scope of the link Allow to communicate with anyone on the link (e.g. host or router) Mandatory and automa)cally configured fe80::/10 19

20 Extended Unique Iden)fier (EUI- 64) format FC 0F FC 0F FF FE FF FE 17 FC 0F X0 Where X= X = 1 1 = Unique 0 = Not Unique FF FE 17 FC 0F 20

21 Local addresses In 1995, RFC 1884 reserved the block fec0::/10 for site- local addresses Ø RFC 3879 (September 2004) deprecated this address range. In October 2005, RFC 4193 was published, reserving the address block fc00::/7 for use in private IPv6 networks. fc00::/7 is divided into 2 groups Ø The block fc00::/8 has not been defined yet. Proposed to be managed by an alloca)on authority. Ø The block fd00::/8 is defined for /48 prefixes, formed by seung the 40 least- significant bits of the prefix to a randomly generated bit string. This results in the format fdxx:xxxx:xxxx:: Ø Example webtools to generate ULA prefix * h<p:// * h<p:// consult.de/ipv6/createlula 21

22 Local addresses 128 Bits Global ID 40 Bits Interface ID FC00::/7 7 Bits Subnet ID 16 Bits Unique- Local Addresses used For: Ø Ø Ø Local communica)ons & inter- site VPNs Local devices such as printers, telephones, etc Site Network Management systems connec)vity Not routable on the Internet 22

23 Examples and Documenta)on Prefix For exemple 3fff:ffff::/32 For documenta)on 2001:0DB8::/32 23

24 Special addresses ::/128 Ø Unspecified address Ø Equivalent to in IPv4 ::/0 Ø default route ::1/128 Ø Loopback address Ø Equivalent to /8 in IPv4 24

25 Stateless autoconfigura)on 1. RS 2. RA 2. RA 1. RS: ICMP Type = 133 Src = :: Dst = All-Routers multicast Address query= please send RA 2. RA: ICMP Type = 134 Src = Router Link-local Address Dst = All-nodes multicast address Data= options, prefix(es), lifetime, autoconfig flag (no managed flag) Router solicitations are sent by booting nodes to request RAs RS = Router Solicita)on, RA = Router Adver)sement 25

26 IPv6 Address assignment Manually configured Assigned via DHCP IPv4 & IPv6 1 RS 3 4 DHCPv6 Request DHCPv6 Reply 2 RA IPv6 Only Stateless configuration 1 2 Router Solicitation Router Announcement (/64 prefix, timers, etc ) Auto-generated pseudo-random number (RFC 4941) 1 2 Router Solicitation Router Announcement Ulg evyncke IPv6 Security IPv6 Address = /64 prefix + EUI64 (e.g. MAC address) IPv6 Address = /64 prefix + Random 64 bits (rfc3041) 2016 Cisco Systems, Inc. All rights reserved. Cisco Public 18 26

27 IPv4 IPv6 coexistence IPv6 Co-existence Techniques Dual Stack IPv4 IPv6 Recommended Enterprise Co-existence strategy Tunneling Services IPv4 over IPv6 IPv6 over IPv4 Connect Islands of IPv6 or IPv4 Translation Services IPv6 Business Partners Government Agencies International Sites IPv4 Remote Workers Internet consumers Ulg evyncke IPv6 Security Source Cisco Systems Connect to the IPv6 community 2016 Cisco Systems, Inc. All rights reserved. Cisco Public 20 27

28 IPv6: 6in4 and 6to4 6in4 Ø Aver seung a 6in4 tunnel, you just need to add a new route to indicate that a given IPv6 network can be reached through the tunnel device Ø You will need one tunnel per very next IPv6 island 6to4 Ø Aver seung a 6to4 tunnel, you will need to a add one route entry per next IPv6 island to reach Ø The 6to4 tunnel must be configured with an IPv6 address prefixed with 2002:xxxx:xxxx::/16, where the x characters represent the IPv4 address of the outgoing device * ipv4=" "; prinz "2002:%02x%02x:%02x%02x::1\n" `echo $ipv4 tr "." " "` Ø The route entry to reach a remote IPv6 island must indicate as a gateway, the IPv6 address of the remote 6to4 tunnel device * ip - 6 route add default via :: dev tun6to4 metric 1 28

29 IPv6 - Some useful Linux commands Add an IPv6 address Ø ip - 6 addr add 2001:db8::1/64 dev eth0 Add a route Ø ip - 6 route add 2001:db8:2::/64 via 2001:db8:1::1 dev eth0 Enable IPv6 forwarding Ø sysctl net.ipv6.conf.all.forwarding=1 Create a 6in4 or 6to4 tunnel Ø Create a sit mode tunnel Ø For a 6in4 tunnel, specify the remote IPv4 address Ø For a 6to4, you do not specify the remote IPv4 address. Use any instead Ø ip tunnel add tun6in4 mode sit remote local <l 64 Show the IPv6 rou)ng table Ø route - 6 Show the neighbors table Ø ip - 6 neigh show 29