IPv6 en Windows. Juan Jackson Pablo García

Transcription

1 IPv6 en Windows Ignacio Cattivelli Juan Jackson Pablo García

2 Dual lstack Architecture t Application Layer TCP/UDP TCP/UDP Tcpip6.sys Tcpip.sys IPv6 IPv4 Network Interface Layer In Windows XP and Windows Server 2003 Netsh int ipv6 [install uninstall] (c) Microsoft Corporation slide 2 February 22, 2008

3 Windows XP SP2 IPv6 Capabilities Limited Support: Not on by default, must enable IPv6: netsh int ipv6 install Basic native IPv6 capability, ISATAP, 6to4, Teredo Autoconfiguration & well known DNS IPs (FEC0) Netsh int ipv6 commands required for config ipconfig, route, ping and ping6, tracert, pathping, netstat IE 6.0, IE7.0, telnet client, ftp clients Filesharing via WebDAV only (e.g. over HTTP) Not supported: td DHCPv6 client, PPPv6 client AD client protocols (RPC, LDAP, Kerb) File sharing using IPv6 (SMB, NetBT) IPHLPRAPI IPv6, e.g. can t add IPv6 routes via API (c) Microsoft Corporation slide 3 February 22, 2008

4 Windows Server 2003 SP2 IPv6 Capabilities Limited Support: Windows XP SP2 IPv6 functionality, but also SMB client ce and dserver e using native IPv6 Client won t ping dest first with IPv6 enabled Telnet Server RPC, Simple TCP/IP Services Not supported Ati Active Directory Protocols: LDAP, Kerberos, etc SMB file sharing over IPv6 tunnel interfaces (e.g. ISATAP, 6to4) FTP Server IPHLPAPI IPv6, can t add IPv6 routes via API Many command line tools that show or use explicit IP addresses (c) Microsoft Corporation slide 4 February 22, 2008

5 Install IPv6 protocol for Windows Server 2003: 1L 1.Log on to the computer with a user account that t has privileges to change network configuration. 2.Click Start,, click Control Panel,, and then double click Network Connections. 3.Right click any local area connection, and then click Properties. 4.Click Install. 5.In the Select Network Component Type dialog box, click Protocol, and then click Add. 6.In the Select Network Protocol dialog box, click Microsoft TCP/IP version 6, and then click OK. 7.Click Close to save changes to your network connection.

6 Install IPv6 protocol for Windows XP with SP2: 1L 1.Log on to the computer with a user account that t has privileges iil to change network configuration. 2.Click Start, click Control Panel, and then double click Network Connections. 3.Right click any local area connection, and then click Properties. 4.Click Install. 5.In the Select Network Component Type dialog box, click Protocol, and then click Add. 6.In the SelectNetwork Protocol dialogbox box, click Microsoft TCP/IP version 6, and then click OK. 7.Click Close to save changes to your network connection. Alternately, from the Windows XP desktop, click Start, pointto to Programs, point to Accessories, and then click Command Prompt. At the command prompt, type netsh interface ipv6 install.

7 Dual IP Layer Architecture Traffic Types Application Layer Transport Layer (TCP/UDP) IPv6 IPv4 Network Interface Layer (c) Microsoft Corporation IPv6 IPv6 over IPv4 IPv4 slide 7 February 22, 2008

8 TCP/IP Protocol Architecture re w/ipv6 OSI Model Layers TCP/IP Protocol Architecture Layers TCP/IP Protocol Suite Application Layer Presentation Layer Application Layer Telnet FTP HTTP DNS RIPng SNMP Session Layer Transport Layer Transport Layer TCP UDP Network Layer Internet Layer IPv4/IPv6 ND ICMPv6 MLD Data Link Layer Physical Layer Network Interface Layer Ethernet Token Ring PPP 1394 (c) Microsoft Corporation slide 8 February 22, 2008

9 IPv6 Terminology Neighbors Host Host LAN segment Bridge or Layer 2 Ethernet Switch Intra subnet Router or Layer 3 switch Subnet Router Link, Router Advertisement <prefix>::/64 Subnet, for example a floor <prefix>::/62 has 4 links Additional subnets Network, for example <prefix>::/56 for one building s IPv6 connection to ISP (c) Microsoft Corporation LIR/ISP prefix allocation: /48 or /56 for end site, end user slide 9 February 22, 2008

10 Unicast Types of IPv6 Addresses Address of a single interface Delivery e to single interface Multicast Address ofa set of interfaces Delivery to all interfaces in the set Anycast Address of a set of interfaces Delivery to a single interface in the set No more broadcast addresses

11 Unicast IPv6 Addresses Global addresses Link local addresses Site local addresses

12 Global Addresses Address scope is the entire IPv6 Internet Equivalent to public IPv4 addresses Defined in RFC 3587 Structure Global Routing Prefix Subnet ID Interface ID 45 bits 16 bits 64 bits 001 Global Routing Prefix Subnet ID Interface ID

13 Link Local Local Addresses Address scope is a single link Equivalent to APIPA IPv4 addresses FE80::/64 prefix Used for: Single subnet, routerless configurations Neighbor Discovery processes 10 bits 54 bits 64 bits Interface ID

14 Site Local Addresses Address scope is a single site Equivalent to private IPv4 addresses FEC0::/10 prefix Used for intranets that are not connected to the IPv6 Internet Recently deprecated but supported for current implementations 10 bits 54 bits 64 bits Subnet ID Interface ID

15 Zone IDs for Link Local and Site Local Addresses Link local and site local addresses are ambiguous Multiple links (common) Multiple sites (uncommon) Zone ID is used to identify a specific link or site Link local address Zone ID is typically set to the interface index of the sending interface Site local address Examples: Zone ID is typically 1 unless multiple sites are used ping fe80::2b0:d0ff:fee9:4143%3 tracert fec0::f282:2b0:d0ff:fee9:4143%2

16 Example of IPv6 addresses Tunnel adapter 6to4 Tunneling Pseudo Interface: Connection specific DNS Suffix. : redmond.corp.microsoft.com IP Address : 2002:9d3b:9dd5::9d3b:9dd5 Tunnel adapter Automatic Tunneling Pseudo Interface: Connection specific DNS Suffix. : redmond.corp.microsoft.com IP Address : fec0::f70f:0:5efe: %1 59 IP Address : 3ffe:8311:ffff:f70f:0:5efe: IP Address : fe80::5efe: %2 Default Gateway : fe80::5efe: %2 Link Local Address Site Local Address Global Address

17 Ipconfig /all

18 Ipconfig

19 Automatic Tunneling Technologies 6to4 Allows IPv4/IPv6 hosts to communicate across the IPv4 Internet using public IPv4addresses Teredo (IPv6 NAT Traversal) Allows IPv4/IPv6hosts to communicate across the IPv4 Internet across NATs ISATAP Allows IPv4/IPv6 hosts to communicate across a private IPv4 intranet

20 Práctico, configuración de: 1 Configurar dirección IP 2 DNS 3 DHCP 4 Internet Information Server 5 Herramientas de diagnóstico

21 Dual lip Layer Architecture t Application Layer TCP/UDP Tcpip.sys IPv6 IPv4 Network Interface Layer Next Generation TCP/IP stack in Windows Vista/Server Longhorn (c) Microsoft Corporation slide 21 February 22, 2008

22 IPv6 Security Considerations: Transition Technologies (ISATAP) ISATAP: Intra Site Automatic Tunnel Addressing Protocol Easy IPv6 deployment within a site* without upgrading routers Encapsulates IPv6 packets in IPv4 (protocol 41) Without explicit i ISATAP server deployment Only link local ISATAP addresses configured Reach ability limited to that of only the underlying IPv4 address ISATAP addresses are not registered in DNS Does not trigger AAAA DNS queries ISATAP address derived completely from IPv4 address No more info exposed than already exposed by underlying IPv4 address Contained within ihi a site completely l by blocking IPv4 protocol 41 at the edge firewall or router ISATAP can be safely fl lf left ON on Windows Vista *Site refers to a network that may be protected for access from outside by edge firew mechanisms but has homogenous security/management implementation inside

23 IPv6 Security Considerations: Transition 6to4 Technologies (6to4) Enables two sites and/or hosts connected by global routeable IPv4 Internet to communicate using IPv6 Encapsulates IPv6 traffic in protocol 41 IPv4 Without explicit 6to4 router deployment For hosts without public IPv4 addresses, disabled by default For hosts with public IPv4 addresses, enabled but 6to4 address completely derived from underlying IPv4 address No additional information exposed that is not already exposed by the underlying IPv4 address Contained within a site completely by blocking IPv4 protocol 41 at the edge firewall or router 6to4 can be safely left ON on Windows Vista

24 IPv6 Security Considerations: Transition Technologies (Teredo) Teredo Enables two hosts behind NATs to communicate using IPv6 Encapsulates IPv6 packets in UDP/IPv4 packets Primarily a consumer technology Teredo does not pose security risks for enterprises For domain joined machines, disabled by default For non domain joined machines, completely blocked by Blocking IPv4 traffic with source or destination UDP port of 3544 at the edge IPv4 firewall or Blocking DNS queries to teredo.ipv6.microsoft.com Not discoverable by DNS, neither causes AAAA queries to be issued