IPv6. Alexander Gall, UZH/USE Meeting

Transcription

1 IPv6 Alexander Gall, UZH/USE Meeting Zürich,

2 SWITCH Backbone Layer 1

3 Layer 3 Backbone 100% Dual-Stack

4 Timeline of Sometime in 1996: a Sun Server (Solaris 2.5.1) becomes our first 6bone node. Initial allocation 5F02:2F00:823B::/ : 3FFE:2000::/48 allocated to SWITCH, the first renumbering : allocation of 2001:620::/35 (soon expanded to / 32), second renumbering February 2004: our backbone goes dual-stack with the initial IPv6 support (in software) on Cisco Catalyst 6500/7600 with Sup2, IOS 12.2S Many internal and external services are IPv6-enabled today

5 IPv4 Address Space Exhaustion 3 of the 5 RIRs are below the last /8 barrier, where very strict policies apply (a single /22 per LIR)

6 IPv6 Deployment (1)

7 IPv6 Deployment (2) (based on top Alexa sites)

8 IPv6 Deployment in Switzerland (3) Most notably due to Swisscom 35% of customers have IPv6 enabled 9% of total traffic is IPv6 25% of traffic of IPv6-enabled customers is IPv6

9 IPv6 Deployment (4) AMS-IX Internet Exchange (IPv4 current average ~1.5Tbps)

10 Product Maturity Operating systems: very good Basic networking (routing/switching): good very good Applications: mixed (web/mail very good) Middleboxes (firewalls, load balancers): bad fair/good Good enough to run a stable, secure network

11 IPv6 Essentials Addresses 128 Bits, represented in 8 groups of Hexadecimal digits separated by colons Leading zeros can be suppressed Double-colon rule : adjacent groups of all zeros can be abbreviated (once) by :: Example 2001:0620:0000:0001:0000:0000:0000:0001 o 2001:620:0:1:0:0:0:1 o 2001:620::1:0:0:0:1 o 2001:620:0:1::1 o

12 IPv6 Essentials Every unicast address has a domain of reachability called scope Node-local scope, aka localhost ::1 Link-local scope FE80::/10 Unique within an IP subnet Not forwarded by any router Everything else is global scope (globally unique) Note: original spec included site-local scope (FEC0::/10) similar to RFC1918 space ( /8, /16, /12). Has been deprecated in favor of Unique Local Addresses (ULA): globally unique but not routed (FC00::/7)

13 IPv6 Essentials An interface can have any number of IPv6 addresses (IPv4 only one). Typically one link-local and one global Selection of source address for outgoing packets becomes non-trivial (IPv4/IPv6, multiple IPv6 addresses, transition mechanisms) Specified in RFC6724, uses a policy table Locally configured (/etc/gai.conf on Linux) New DHCPv6 option allows central distribution

14 IPv6 Essentials Hierarchical address allocation like with IPv4 (IANA RIR LIR End User ) Basic rule: End User (e.g. UZH) gets a /48 Subnets get a /64 (required for autoconfiguration) Avoids traditional problem of subnet sizing in IPv4 Assign once, no need to ever change size

15 IPv6 Essentials Packet header Fixed size (40 bytes, IPv4 20 bytes w/o options) Same QoS bits ( traffic class ) No checksum Flow label, should replace 5-tuple (addresses, ports,protocol) for flow classification Options, fragmentation and upper-layer protocols (TCP, UDP, ICMP) are implemented as a chain of extension headers

16 Extension Headers Basic rule: extension headers are only processed by the destination. One exception: hop-by-hop header must be examined by intermediate hops, must be the first option after the IPv6 header. Problem: middleboxes (Firewalls, NATs etc.) violate this rule. Ongoing work in the IETF to adapt to this reality

17 ICMP Additional functionality integrated in ICMPv6 Neighbor Discovery, similar to ARP for IPv4 but includes more Duplicate Address Detection Neighbor Unreachability Detection Address Autoconfiguration (see later) Multicast group manegement (MLD, same as IGMP in IPv4) Integral part of IPv6 must not be filtered in a subnet Some types must not be filtered on the WAN (related to fragmentation/mtu discovery)

18 Stateless Address Autoconfiguration (SLAAC) Novel mechanism to configure global-scope IPv6 Addresses automatically Router sends periodic Router Advertisements (RAs) Subnet prefix (/64) Default router Options, e.g. DNS server Client takes prefix, adds 64-bit Interface Identifier (IID) constructed from its MAC address, creates full 128-bit Address Address gets refreshed by RAs, can expire if router stops sending them Apart from static configuration, RAs are the only source for candidate default routers

19 SLAAC Plug and Play, no administration Not well suited for controlled environments No standardized way to register address in DNS Could be done with dynamic DNS No registered mapping between MAC address and IP address Can be created by scraping neighbor cache on routers Proposed mechanism to have DHCP server register mappings

20 SLAAC Some people felt that embedded MAC addresses violate privacy Same interface identifier wherever you go IPv6 Privacy Extension : randomize IID and change periodically (e.g. once per day) Implemented in most current systems, often enabled by default OK for home network, less so for controlled environments New spec stable privacy addresses (not yet published) generates one random IID per subnet visited by the host

21 DHCPv6 DHCP is the standard way to configure IPv4 networks DHCPv6 is a new, independent protocol, but similar structure to IPv4 DHCP Uses UDP on separate ports (546, 547) More coherent than DHCPv4, designed from scratch (e.g. relay functionality) IPv4 leases based on MAC address IPv6 leases based on Device Unique Identifier (DUID), which may be based on a MAC address, but does not provide a proper MAC-to-IPv6 mapping! MAC address option added recently (December 2013) Still requires Router Advertisements for default router IETF activity to add DHCP default router option died

22 DHCPv6/RA interaction RA contains two flags as hints to the client M ( managed ): use DHCP to obtain address O ( other ): use DHCP to obtain other information (e.g. DNS server, NTP server etc.) SLAAC can be disabled by unsetting the A flag

23 Default Router Redundancy IPv4 HSRP/VRRP provide virtual IP/MAC default router address Default router distributed via DHCP IPv6 HSRP/VRRP also available RAs from virtual address configures default route Alternative: static configuration on the client

24 Deployment Several transition mechanisms available Tunneling (IPv6 packets encapsulated in IPv4) Translation (rewrite IPv6 header to IPv4, NAT64 ) Dual stack, run IPv6 and IPv4 in parralel Dual stack is the only sensible choice for you (tunnels are forbidden by the UZH policy) Q: When should we start? A: Yesterday You'll have to convince the Informatikdienste that IPv6 is important to you :(

25 Deployment Without global connectivity, there is not much you cando Option: use ULA for internal IPv6 communication (address selection will prefer IPv4 for all external connections) Use DHCP Have your ULA prefix advertised by your default router General advice for dual-stack Use IPv6-only wherever possible (internal services) Always chose symmetric configuration when possible