IPV6 Overview.pdf. The University of Akron. From the SelectedWorks of Douglas Huber. Douglas Huber, University of Akron. Fall October 24, 2011

Transcription

1 The University of Akron From the SelectedWorks of Douglas Huber Fall October 24, 2011 IPV6 Overview.pdf Douglas Huber, University of Akron Available at:

2 IPv6 in an IPv4 World Understanding IPv6 and the Migration from IPv4 1

3 IPv4 Issues - NAT The deployment of NAT broke the original IP architectural goal of transparency, true end-to-end connectivity. The use of Application Layer Gateways to fix what NAT breaks adds complexity and more lack of transparency. 2

4 IPv6 Addresses New Needs Requirement Large number hosts Many edge devices offering services Large number of routed segments Devices are mobile at layer-3 Unmanaged networks Security; network is untrusted Feature Impact IP efficiency in configuration, automatic host configuration IP Reachability with a large address space Automated routing and router configuration with network prefix delegation IP mobility/mobile routing Automated network deployment Security built into the protocol (with footnotes) 3

5 IPv6 Features Feature Implementation Notes Large Address Space Levels of Hierarchy 128 bit address Address architecture Scoping Specific bits in the address Used for filtering boundaries Simple/Fixed Architecture /48 for sites and /64 for links NO SUBNETS Privacy Addresses Specific bits in the address IP Addresses cannot be tracked Multi-addressed interfaces New IPv6 stack Hosts auto-configuration Router advertisements Uses MAC addresses/dhcp6 Reduce risk of duplicate addresses New IPv6 stack Uses MAC addresses/dhcp6 Default Gateway Detection Router advertisements Fault tolerant, always nearest to host Multicast address scoping Specific bits in the address Scope rather than TTL as in IPv4 Simpler IP Header 64 bit aligned, no checksum, less fields Faster forwarding performance/hardware Extension Headers Processing options/future expansion Routers can skip extension headers Mandatory security IPSec native All stacks must support it/needs key infrastructure Source routing Extension headers Key feature in mobile routing Labeling Flows Flow label in IPv6 header Improved QoS and overhead 4

6 IPv6 Features Feature Implementation Notes Multi-homing Multiple prefix support on same link/ interface Lower link overhead Neighbor discovery/scoped Non-ARP; ICMP implementation Multicast neighbor discovery No broadcasts Scoped multicast replace broadcasts Mobility Mobile IPv6 Integrated into header extensions Private unique address Unique local address space (scope) No need for NAT, local address is unique 5

7 How About IPv5? This version of IP was not a predecessor of v6 Was an experimental Stream Protocol IPv6 was originally known as IPng, then became v6 For the Curious IP Version What is it 7 CATNIP, a deprecated replacement for SIP 8 PIP, was merged with the current SIP protocol 9 TUBA, a deprecated replacement for SIP Not Assigned 6

8 IPv6 Header Field Size Explanation Version Traffic Class Flow Label Flow Label Version 4 bits Value = 6 Payload Length Next Header Hop Limit Traffic Class 1 byte Renamed TOS Flow Label 20 bits Per flow ID Source Address Payload 2 bytes Was Total Length Destination Address Next Header 1 byte Renamed Protocol or Extension Hdr Hop Limit 1 byte Renamed TTL Extension Headers... 7

9 What Happen To: IPv4 Field Fragment ID Flags Fragment Offset Checksum Header Length Disposition Moved to the optional fragment Extension Header Moved to the optional fragment Extension Header Moved to the optional fragment Extension Header Removed (was redundant) Removed 8

10 Flow Label: The Only New Field The Flow Label is the only new field in the header Routers in IPv4 needed classifications rules to identify flows of packets to be treated via QoS policies -- i.e. High overhead Now, in an INTSERV-like tradition, these flows can be identified at the source making it easier for routers to apply the needed QoS polices 9

11 Extension Headers Optional and are chained together between the IPv6 header and the transport header Like the header they are 64 bit aligned for fast hardware handling Each extension header type is identified by the NEXT_HEADER field The last extension identifies the transport header in the NEXT_HEADER field 10

12 Extension Header Types Order Type Value Description Notes 0 Hop-By-Hop Option Every router must process datagram (ex: RSVP), or be advise it is a jumbo datagram that exceeds the payload field length 43 Routing Header Similar to source routing and handling Mobil IP routing 44 Fragment Header Only source and destination hosts handle fragments. Intermediate nodes (routers) don t fragment. 50 Encapsulation Security Payload (IPSEC) IPSEC tunnel and transport modes the same as IPv4. Processed by the destination node 51 Authentication Header (IPSEC) IPSEC tunnel and transport modes the same as IPv4. Processed by the destination node 59 No Next Header Packet contains no payload. Only the extension headers are present. Used when only control messages are the reason for the packet. 60 Destination Options Information for the destination node. Major use in Mobile IP 11

13 MTU Size Minimum MTU in IPv6 is 1280 bytes, efficient size is 1500; IPv4 was 68 bytes, default is 576 (Arcnet) Intermediate nodes do not fragment, so MTU Path Discovery is imperative in IPv6 Datagrams that at too large are dropped and an ICMP message returned 12

14 MTU Path Discovery If the IPv6 stack does not support Discovery then it sends only 1280 byte packets MTU is discovered by starting with the originating link s MTU size; if an ICMP is returned the packet is reduced in size until it can transit the path. (RFC1981) Retesting to see if the path MTU has changed is allowed at infrequent intervals not less than 5 minutes after adjustment. 13

15 A Word About the Checksum The header checksum has been removed, to reduce router overhead Link-layer and transport-layer checksums fulfill this need This means that in IPv6: mandates a UDP checksum Checksum required for all transport protocols 14

16 Upper Layer Protocols IPv6 does not impact the upper layer protocols (transport and application layers) directly May have indirect impact on those applications that handle IP addresses Thus some applications need to be IPv6 ready (example: SIP) 15

17 IPv6 Address Space 128 bits which provides for 3.4 x x per person on Earth 6.6 x per square meter on Earth 13% of the space is assigned for Internet use, or 2.3 x subnets 86% of the space is unassigned and unallocated 16

18 IPv6 Notation Colon hexadecimal rather than dotted decimal as in IPv4 Example: 2002:0000:1234:0000:0000:D3C5:A0B1:1234 Rules: Case insensitive Leading zeros are optional Successive zeros can be suppressed with :: once Importance of DNS 17

19 Notation Examples Full Address Compact Format 2005:0000:3344:0000:0000:A3B4:D3E6: :0:3344::A3B4:D3E6:1234 3fff:0c00:0000:0000:0001:0000:0000:000a efff:c00::1:0:0:a ff01:0000:0000:0000:0000:0000:0000:0001 ff01::1 0000:0000:0000:0000:0000:0000:0000:0001 ::1 0000:0000:0000:0000:0000:0000:0000:0000 :: 18

20 Prefix Notation Like IPv4, prefixes in IPv6 represent ranges of addresses; summaries There are no classes of addresses Follows the format of address/prefix Example: 3fff:b00:c28:1::1/64 represents 64 bits of the network portion of the address 19

21 IPv6 in URL Specifications When using an address, rather than a domain name, and a port specification (i.e. the colon format conflicts with IPv6 notation Use brackets: ftp://[::1] 20

22 Global Unicast Addresses Host addresses to be used on the Internet All global unicast addresses have a prefix of /64; fixed length subnet mask Always assigned by an upstream provider RFC3513 defines this as 2000::/3 or :: through 3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff 21

23 Global Unicast Structure Provider Prefix 48 Bits Site SubNets 16 Bits Host Portion 64 Bits Provider specifies the first 48 bits Site can generate 2 16 subnets Rightmost 64 bits are host addresses, typically auto generated from the device s MAC address 22

24 Scoped Addresses Link-Local - restricted to the link, are used to connect two nodes (point-to-point serial); defined as fe80::<interface-id> Unique Local Address Space - unicast addresses for use within a site: fdxx:xxxx:xxxx:<16 bit subnet>:<interface-id>; x is the site-id; private version of the provider address; replaces the site local address space 23

25 Scoped Addresses 6-to-4 Addresses - auto generated addressing for IPv6 in IPv4 Tunnels: 2002:<ipv4 address>:<subnet>:<interface-id> IPv4 Mapped Address - used only within an application to specify an IPv4 address in a IPv6 format: 0:0:0:0:ffff:<ipv4-address> 24

26 Scoped Addresses Loopback address - in IPv4 this is , in IPv6 it is 0:0:0:0:0:0:0:1 or ::1 25

27 Multicast Addresses Contain bits that specify the lifetime (L) and scope (S) L (4 bits) 0=Permanent / 1=Temporary S (4 bits) 1=Interface / 2=Link / 3=SubNet Local / 4=Admin / 5=Site / 8=Organization / E=Global (Site has been deprecated) Address is generically constructed as: ff<l><s>:<multicast-group-id> Example: Ping all nodes on a link: ping6 ff02::1 Note: No broadcast function IPv6 multicast addresses are mapped to Ethernet MAC addresses as: xx-xx-xx-xx (rightmost 32 bits of the IP address to the corresponding MAC bits) (IPv4 was E-xx-xx-xx) 26

28 Some Key Multicast Addresses Address Scope Group Description FF01::1 1=interface 1=All Nodes With the node FF02::1 2=link 1=All Nodes Nodes on the link FF01::2 1=interface 2=All Routers All routers within the interface FF02::2 2=link 2=All Routers All routers on the link FF05::2 5=site 2=All Routers All routers in the site 27

29 Anycasting Used to find available services on a network Provides redundancy to the closest node that offers a service (ex: Closest DNS server) All routers join the all-routers-in-the-subnet anycast group automatically MobileIPv6 uses anycasting to find the home agent Can only be used as a destination address Looks like a unicast address with the host portion being the anycast group-id 28

30 Address Structure Summary Type Unicast Global Provider Prefix Subnet Interface-id Link-Local fe80 0 Interface-id Unique-Local fc00 0 Subnet Interface-id Unique-Local fd00 0 Subnet Interface-id IPv4 Mapped 0 ffff IPv4 Addr 6-To-4 Tunnels 2002 IPv4 Address Subnet Interface-id Loopback Multicast ff<ls> Multicast Group-ID 29

31 Assigning Addresses Host addresses can be: Auto generated DHCP6 assigned Static Assignment Interfaces have multiple addresses Private Site address Global Address Local link address Multicast memberships 30

32 Auto Generated Addresses Known as IEEE EUI-64 addresses Start with the 48 bit MAC address Insert fffe in the middle to build a 64 bit address Flip the second bit of the leftmost byte to 1 indicating it is unique (non-locally administered MAC); the meaning is inverted too These 64 bits are the interface-id to make up the 128 bit address with the assigned 64 bit prefix (obtained by listening for routers multicasts) 31

33 Neighbor Discovery Router announce their presence via an ICMP multicast known as Neighbor Discovery and can include the MTU size Every 5 minutes to all nodes on the link (FF02::1) The lifetime field in the ND message, if 0 means not to use as the default router, if >0 then it can be the default router, and the time is in seconds If multiple router advertisement use different prefix then the host creates an address for each prefix During host boot up, rather than wait, the host can send a router solicitation to speed up the generation of an address 32

34 Neighbor Discovery Has 3 functions: Neighbor solicitation/advertisements Router solicitation/advertisements Route redirection Always has a hop count of 255 to thwart spoofing attacks since these are link-local in scope 33

35 Finding Your Neighbor ARP has been replaced by the Solicited-Node Multicast Address Active process to Neighbor Discovery Solicited node address is: ff02:0:0:0:0:1:ff00/104 coupled with the rightmost 24 bits of the target IPv6 address (only a subset of nodes have to process it Host must listen for the solicited node multicast address on all it its unicast and anycast addresses Uses ICMPv6, so this is now independent of layer-2, unlike ARP 34

36 Neighbor Cache The ARP cache is replaced with the Neighbor Cache which tracks neighbor states: incomplete, reachable, stale, delay, probe NUD - neighbor unreachability detection - unicast solicitation to track neighbor availability - great for multiple gateway situations (what is the impact on HSRP, VRRP, GLBP) 35

37 Help for Renumbering When renumbering (ex: changing providers) the lifetime and preferred flag in the router advertisement can smooth the migration to a new address space The address is no longer valid with the lifetime expires, and is deprecated with the valid timer expires 36

38 DHCP6 Initially, IPv6 felt the auto generated addresses would replace the need for DHCP But, there is the need for other information to be sent (DNS resolvers, TFTP load hosts, time servers etc...) so DHCP was migrated to DHCP6 Preferred and valid lifetimes exist also in DHCP6 37

39 Example CISCO Configuration Ipv6 unicast-routing Interface Fa0/0 Description Static Address! Ipv6 address 3ffe:b00:3450:1::2/64 Interface Fa0/1 Description Auto Generated EUI-64 Address! Ipv6 address 3ffe:b00:3450:1::/64 eui-64 Interface Fa0/2 Description Link Local Address Ipv6 address fe80::1/64 link-local By default the router advertises the Prefix, but can be specified and configured with the interface command: Ipv6 nd prefix-advertisement 38

40 CISCO and IPv6 Use ipv6 where normal ip commands would be used when working with IPv6: Ping ipv6 ::1 Show ipv6 traffic Debug ipv6 packet Show ipv6 interface fa0/0 39

41 Special Solicited Node Use Duplicate Address Detection (DAD) is mandatory in IPv6 (was optional via ARP in IPv4) Every address before it is used, is queried in a solicited node request; if a node already has this address a neighbor advertisement is sent in response 40

42 Impact on DNS IPv6 address record is AAAA rather than A in IPv4 Reverse lookup records are identified by the label and written in reverse in dotted format, as in IPv4 Example: in-addr.arpa PTR host1.org.com ( ) b.0.e.f.f.3.ip6.arpa PTR host1.org.com (effe:b00:0:1::1) 41

43 ICMP Name Extension Ad hoc networks using link-local addresses can query neighbors for names without the need for DNS ICMP can query name corresponding to IPv4 or IPv6 addresses ICMP can query for an IP address corresponding to a node name Accomplished as a multicast ff02:0:0:0:0:2::/96 42

44 Impact on Routing/Routers The default route is the ::/0 network ipv6 route ::/0 E0/0 fe80::2 Example: Static route s next-hop address should be a link-local address Updated routing protocols: RIPng OSPFv3 IS-IS EIGRPv6 MBGP 43

45 Impact on Routing/Routers When supporting IPv4 and IPv6, the underlying network topologies must match. Use OSPFv2 for IPv4 when supporting both Router renumbering protocol, a special ICMP message allows for router interfaces to be readdressed dynamically -- There are concerns 44

46 Multihoming Techniques Can be the same as IPv4, but by IETF policy, provider independent address space is not allowed (ARIN is issuing some independent addresses) Router renumbering might be a new option Cross-site tunnels Multiple prefixes No absolutely good answers 45

47 Migration and Coexistence Coexistence strategies Tunnel IPv6 within IPv4 Parallel/separate network Coexistence - dual stack DNS guides which to use, depending upon the address that is returned and the application supportability 46

48 Coexistence via Translation DSTM - Dual Stack Transition Mechanism Carries the original IPv4 address in the low order 32 bits of the IPv6 address Assumes you have a IPv6 infrastructure and doesn t have the shortcomings of NAT; and thus has gained some popularity 47

49 Using DSTM IPv6 only infrastructure Dual stack client needing IPv4 connectivity DSTM server DHCPv6 relay or TSP (Tunnel Set Protocol) server Pool of IPv4 addresses DSTM capable border router 48

50 A Word About NAT-PT A proxy-like translation point between IPv6 and IPv4, would seem to be a good migration tool The IETF recommends not to use it; it breaks much of IPv6 and limits the ability to migrate to IPv6 49

51 NAT-PT Shortcomings End-to-end security fails Single point of failure and bottleneck Protocols with embedded addressing break Protocols without port numbers cannot be overloaded/ multiplexed A number of non-esp features of IPSEC break Injects a number of security vulnerabilities, particularly DoS style 50

52 How About... TRT Another translator technology is TRT (Transport Relay Translator) A proxy firewall tools that only handles TCP and UDP transport segments Similar limitations and security issue as with NAT- PT 51

53 But Maybe... BIS Yet another translation technique is a application layer gateway often known as a Bump In the Stack Or BUMP with is an API based translation approach Or Socksv5 for firewall ALG implementations 52

54 Go Native The best approach is to use native coexistence strategies, such as dual stacks or transit tunnels Translation should have limited use perhaps with applications which cannot be migrated to IPv6 Or for temporary support during migration Consider DSTM for temporary support, plus requires you to make the complete leap to IPv6 53

55 What are the Tunnels Used for IPv4 infrastructures that need to support areas of IPv6 Can be part of a dual-stack approach Used with translation techniques Or a transition mechanism of its own 54

56 Tunneling Considerations When IPv4 directly carries and IPv6 packet it uses protocol number 41, can also use GRE and IPSEC to carry IPv6 packets IPv6 packets can be 6 gigabytes, while IPv4 is limited to 64k, so IPv4 fragmentation may be needed 55

57 Tunneling Techniques 6over4 - host to router tunnel; IPv4 multicast tunneling; automatic tunnels for use within a site 6to4/6rd (rapid deployment) - router to router tunnels; for temporary site to site connectivity ISATAP - intra-site tunnels; for isolated IPv6 hosts in an IPv4 world; relies on dual stacking the host; automatic tunnels; uses protocol 41 TEREDO - UDP tunnels designed to pass through NAT points Tunnel Brokers - servers that support automatic Tunnels DSTM - Dual Stack Transition Mechanism CGN - Carrier-Grade NAT 56

58 Security Concerns IPv6 Tunnels can allow for rogue networks to be developed and gain access through firewalls/routers Rogue IPv6 routers can build networks that will trigger the autoconfiguration of IPv6 enabled devices to gain unseen access IPv6 packets can control the route and perform DoS attacks Hidden Traffic on IPv4 only networks Tunnel techniques bring their own lists of security vulnerabilities Hackers likely know more about the nuances of IPv6 than you do 57

59 Getting Started Something you can do in your existing network Use the Freenet6 service which is a Tunnel Setup Protocol (TSP) broker ( Install TSP client (gogoclient) IPv4 Internet IPv6 Internet TSP Client NAT Freenet6 IPv6 Host 58

60 Looking for an IPv6 ISP Most of the large providers are IPv6 enabled Hurricane Electric ( has specialized in IPv6 backbone provisioning and has an international presence Check the IPv6 Forum ( for up-to-date lists and information Global Crossing is one of the few (if only) Tier 1 carriers that is native IPv6 59

61 Sources This presentation was based upon these primary sources Blanchet, Marc, Migrating to IPv6. England: John Wiley & Sons Ltd., April 2008 Huitema, Christian, IPv6 The New Internet Protocol. USA: Prentice-Hall, Inc, 1996 Hogg, Scott and Vyncke, Etic, IPv6 Security. Cisco Press, December 2008 Guidelines for Secure Deployment of IPv6 (Draft). Sheila Frankel, Richard Graveman, John Pearce, Special Publication , National Institute of Standards and Technology, US Department of Commerce < The IPv6 Forum: The New Internet < Hurricane Electric Internet Services < Global Crossing 60

62 Sources This presentation was based upon these primary sources <gcn.com> GCN: Government Computer News, The online authority for government IT professionals RFC 4193 Unique Local IPv6 Unicast Addresses, Hinden R. and Haberman B., published by the Internet Society 2005 RFC 3879 Deprecating Site Local Addresses, Huitema C., Carpenter B., published by the Internet Society

63 Douglas Huber Lorain County Community College University of Akron - Summit College 62