IPv6-only hosts in a dual stack environnment

Transcription

1 IPv6-only hosts in a dual stack environnment using Free Software Frédéric Gargula, Grégoire Huet

2 Background on IPv4 and IPv6 usage IPv4 addresses depletion doesn't need to be reminded No straight way exists to migrate from IPv4 to IPv6 Cohabitation phase will last for an unknown time Several technologies are around, for different usages The interconnection between IPv4-only nodes and IPv6-only nodes is a critical capability

3 Lots of proposals For 'networks' 6to4 Dual stack, dual stack lite A+P (based on ports ranges per user)nat-pt/ivi Needs IPv4 CGN (NAT64 large scale) For ISPs 6rd (like 6to4) 6pe And much more! (NAT-PT, 4in6, 6in4, all tunneling techniques...)

4 IPv4 to IPv6 transition is not straight 1 st phase : Most people only have IPv4 connectivity Usage of «artifices» to access IPv6 world 2 nd phase : Dual stack is widely deployed 3 rd phase : Most people only have IPv6 connectivity Usage of «artifices» to access IPv4 world

5 Basics of NAT64 + DNS64 Occurs on «Pure IPv6 network» but with IPv4 gateway Network Address Translation gateway : IPv6 <-> IPv4 Like the one at home, which does NAT44 It talks IPv6 on one leg, IPv4 and IPv6 on the others Tweaked DNS server to rewrite IPv4 DNS data Sorting of wether site is v4 or not made by DNS Translates A record reply to AAAA record reply

6 Basics of NAT64 + DNS64 continued RFC 6146 : «Stateful NAT64» / April 2011 Allows TCP, UDP, ICMP No change required on IPv6 clients or IPv4 servers Compatible with NAT-traversal techniques (ICE : RFC5245) RFC 6052 : «IPv6 Addressing of IPv4/IPv6 Translators» October 2010

7 Stateful vs Stateless NAT64 NAT64 can be stateful or stateless Mapping IPv4 : IPv6 Stateless implies 1:1 Stateful means here 1:N Stateless usefull for IPv4-only hosts to be reachable by the IPv6-only world, on all their ports (IPv6 servers reachable on a dedicated IPv4 address) Stateful is more suitable for end-users stations Stateful is the solution presented here

8 Plateform support for NAT64 / DNS64 OpenBSD 5.1 native pf (May 1 st, 2012) Ecdysis and Nlnet implementation FreeBSD pf coming soon Linux patches (tayga), binaries, Fedora Cisco IOS XE, JunOS Microsoft Bind / totd / Unbound + patch / / /

9 NAT64 & DNS64 Operation Mode I can see it's destined to The IPv4 world Give me IP address of ipv4only.net I want to visit ipv4only.net What's its IP? It's 201:db8:2::102 :304 HTTP GET on 2001:db8:2::102:304 HTTP response to 2001:db8:cafe::2 It's :db8:100::1/ :db8:cafe::1/ HTTP GET on HTTP response to GW 2001:db8:cafe::2/64

10 OpenBSD NAT64+DNS64 configuration pf is already patched on OpenBSD 5.1 Need to install a DNS64 server pf.conf : pass in on $int_if inet6 to 2001:db8:2::/96 af-to inet from ($ext_if) named.conf (Bind 9.8) dns :db8:2::/96 { clients { any; }; }; Routing adjustements Gateways, sysctl for ip-forwarding

11 What is working with NAT64 Everything native IPv6! Applications that DO DNS queries Webbrowsing, (IMAP, POP, SMTP), some instant messaging services, media streaming... Over 80% of applications should work See «draft-chen-v6ops-nat64-experience» at IETF «summarizes some stateful NAT64 deployment scenarios and operational experiences for NAT64-CGN and NAT64-CE»

12 Drawbacks of NAT64 - Technical Traffic has to be symmetric IPv4 address literals don't get resolved No support for Multicast in RFC 6146 Problems with fragmented packets In the current free implementation : No control on port assignation No session timeout control

13 Drawbacks of NAT64 Application Level Skype won't work It will certainly go v6 soon : sign the petition FTP, SIP, DNSSEC, IPSec... Neither MSN, Webex, ICQ, games... Need of ALG : Application Level Gateways Beware of double NAT if already behind a NAT44 Read experiences on RFC 6586

14 NAT64 to help move forward We think the NAT64 + DNS64 solution might be one of the ways to move forward The more it will be implemented, the more IPv6 traffic will flow Suitable for small/medium/large organizations, but showstoppers on the way It's possible to remove these showstoppers : ALG dev. Big organizations, large ISPs will prefer other (very expensive) technologies, such as CGN.

15 Try it now! We have setup such a gateway on the RMLL network Suppress all IPv4 configuration from your computer Join network with SSID : RMLL2012-IPV6 Allow IPv6 RAs (SLAAC) or DHCPv6 (maybe automatic) Ping6 2001:67c:28dc:852::1 to test connectivity DNS server should be 2001:67c:28dc:852::1 should tell you you have v6 connectivity is v4 only! Can you reach it? noc@gva.rmll.info in case of trouble

16 Thank you! Happy RMLL!