Are You Ready to Teach IPv6?

Transcription

1 Are You Ready to Teach IPv6? William Saichek Orange Coast College Karl Dietrich Lansing Community College

2 Giving Credit Where Credit is Due The slides, data and projects in this presentation were used, with permission from their authors and we would like to express our extreme gratitude to them: Dr. Sam Bowne, City College of San Francisco Mohammad Shanehsaz and Mike Qaissaunee, Brookdale Community College, Lincroft, New Jersey

3 Remember to perform a sacrifice to the Demo Gods before beginning your class!

4 IPv4 Exhaustion It s The End of the World!

5 IPv4 Exhaustion Address Space: 32-bits IPv4 address: Four bytes In Binary: ^32 total addresses Over 4 billion in theory but we all know that theoretically the bumble-bee can t fly

6 IPv4 Exhaustion Available pool is 18 "/8 address ranges" Each /8 has 16.8 Million Addresses 203 already allocated 35 Reserved for special uses Data from as of 30-Jul-2011

7 IPv4 Exhaustion

8 IPv4 Exhaustion No Reprieve IANA will not re-purpose class D or E addresses for general use People who ask for IPv4 addresses after exhaustion will not get them Hoarding, scalping, and simple direct sale of used IPv4 addresses will begin soon

9 The Solution IPv6

10 IPv6 Addresses An IPv6 address consists of 128 bits that are divided into eight sections, or groups. It is represented by hexadecimal value of each group separated by colons Example: FEDC:BA98:7654:3210:FEDC:BA98:7654:3210 There is no such thing as a Broadcast in IPv6 instead we have Multicast, Unicast, and a new type called Anycast. The specific type of an IPv6 address is indicated by the leading bits in the address

11 IPv6 Address Format The 128-bit IPv6 addresses use colons to separate entries in a series of 16-bit hexadecimal groups.

12 IPv6 Address Format The 64-bit Interface Identifier (basically the host portion of the address) can be configured in 5 ways: Manual Configuration (static IPv6 addresses) Autoconfiguration (EUI-64 based Interface ID) DHCP v6 Pseudo-random Interface ID Cryptographically generated Interface ID

13 IPv6 Address Format The most common method (but not the most secure or private more on that later) for the Interface Identifier is to use the use the Extended Unique Identifier (EUI-64). Take the NICs MAC address Stick FF FE in the middle

14 IPv6 Representation There are three conventional forms for representing IPv6 addresses as text strings: The preferred form is: xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx where the 'x's are the hexadecimal values of the eight 16-bit pieces of the address. For example: FEDC:BA98:7654:3210:FEDC:BA98:7654:3210

15 IPv6 Representation Compressed Form IPv6 addresses can contain long strings of zero bits. In order to make writing addresses containing zero bits easier a special syntax is available to compress the zeros. You do not have to enter leading zeros in each group Example: 0A4F can be written as A4F The "::" can also be used to compress the multiple sets of zeros within the group (but can only be used once) Example: 1080:0:0:0:8:800:200C:417A becomes 1080::8:800:200C:417A 0:0:0:0:0:0:0:1 or ::1 is the loopback address

16 IPv6 Representation The text representation of IPv6 address prefixes is similar to the way IPv4 addresses prefixes are written in CIDR notation: ipv6-address/prefix-length Text Form 12AB:0000:0000:CD30:0000:0000:0000:0000/60 12AB::CD30:0:0:0:0/60 or 12AB:0:0:CD30::/60 When writing both a node address and a prefix such as 12AB:0:0:CD30:123:4567:89AB:CDEF and its subnet number 12AB:0:0:CD30::/60 the two can combined as follows: 12AB:0:0:CD30:123:4567:89AB:CDEF/60

17 IPv6 Types Unicast: Packets addressed to a Unicast address are delivered to a single interface (for load balancing multiple interfaces can use the same address). There are several forms of Unicast address assignments in IPv6, including the followings: The Global Aggregatable Unicast address The Link-Local address, The Site-Local address, The IPv4-capable host address. The specific type of an IPv6 address is indicated by the leading bits in the address Global Unicast addresses are publicly routable addresses (same as IPv4)

18 Aggregatable Global Address The IPv6 Global Unicast Address allocation uses the range of addresses that start with binary value 001 (2000::/3). The aggregatable global address typically consists of a 45-bit global routing prefix and a 16-bit subnet ID or Site-Level Aggregator (SLA). Aggregatable global addresses are used on links that are aggregated upward through organizations, and eventually to the Internet service providers (ISPs). They are equivilant to public IPv4 addresses

19 Link-Local Unicast Address Link-Local addresses are like Automatic Private IP Addressing (APIPA) in IPv4 in that they are not meant to be routed in the internal router or outside The Link-Local addresses are designed to be used for addressing on a single link for purposes such as auto-address configuration, neighbor discovery, or when no routers are present Routers must not forward any packets with link-local source or destination addresses to other links

20 Site-Local Unicast addresses Site Local addresses are like Link-Local, in that it is a private IPv6 addresses and can not be routed to the internet. However, they can be routed within your organization or company They are equivalent to IPv4 private address They can be assigned either manually or dynamically Routers must not forward any packets with site-local source or destination addresses outside of the site. Always begin with the Hex Address of FEC0::/48

21 IPv4-Compatible IPv6 Address IPv4-compatible IPv6 addresses are assigned to nodes that support both the IPv4 and IPv6 protocol stacks and are used in automatic tunnels. An IPv4-compatible IPv6 address is an IPv6 unicast address that has zeros in the high-order 96 bits of the address and an IPv4 address in the low-order 32 bits of the address. The format of an IPv4-compatible IPv6 address is 0:0:0:0:0:0:A.B.C.D or ::A.B.C.D. The entire 128-bit IPv4-compatible IPv6 address is used as the IPv6 address of a node and the IPv4 address embedded in the low-order 32 bits is used as the IPv4 address of the node.

22 IPv6 Types Multicast Similar to IPv4, IPv6 Multicast packets are addressed to a Multicast Address and are delivered to all interfaces identified by that assigned Multicast Address (one to many addresses)

23 IPv6 Types Anycast Like multicast addresses, an Anycast address identifies multiple interfaces, but there is a big difference: The Anycast packet is delivered to only one address in a Multicast group actually it sends it to the first IPv6 address it finds defined in terms of routing distance. And again this address is special because you can apply a single address to more than one interface (one-to-one-of-many)

24 The specific type of and IPv6 address is indicated by the leading bits in the address IPv6 Addresses

25 IPv6 Packet Header Simplified Fixed length All optional/additional information is encoded into Extension Headers No checksum Uses a Payload Length instead of a Total Length Time to Live field is replaced by Hop Limit

26 IPv6 Packet Header

27 Image from zinyaw.files.wordpress.com So IPv4 is Full

28

29 Methods of IPv6 Migration Ignore IPv6: Stay on IPv4-only Gateways: Devices that convert IPv6 to IPv4 Tunnel: IPv6 over IPv4 Dual-Stack: IPv4 and IPv6 together Nirvana: IPv6-only

30 IPv6 Tunnels Fast and easy to set up Not the best for security or performance Free IPv4-to-IPv6 Tunnel Providers Gogo6.com Sixxs.net Tunnelbroker.com

31 Easiest to use but there are some issues with performance and stability. GoGo6

32 IPv6 and DNS New resource record introduced: AAAA

33 Security and Privacy Issues MAC addresses are globally unique (mostly) Anyone who has your IP address also has your MAC address! Users are mobile, but Even though the network prefix changes, the Interface ID does not Users can be ID d and tracked There is a "Privacy Extensions" technique to avoid this, enabled by default in Vista and Windows 7

34 Security and Privacy Issues ICMPv6 Required for all networks Cannot be blocked Replaces ARP "Neighbor Discovery" is trivial

35 Security and Privacy Issues THC-IPv6 Hacker's Toolkit Runs fine on Ubuntu, even in VMware on Windows 7

36 Other Risks Many security appliances are not ready for IPv6, so it often bypasses them Torrents run over IPv6 Some VPN appliances are not ready, so IPv6 connections must bypass them Packet Amplification Attacks Routing Header Zero Ping-Pong

37 IPv6 Certification If you re teaching Network+, you can easily have your students become IPv6 certified through Hurricane Electric It s Fun It s Realistic It s Free

38 So Why Should We Be Teaching IPv6? Advantages: More efficient address allocation End-to-end addressing (no more NAT) Fragmentation only by the source host Routers do not have to calculate header checksum (faster packet switching) Multicasting instead of broadcasting Built-in security mechanisms Single control protocol (ICMPv6) Auto-Configuration Modular header structure

39 Now Let s Get Our Hands Dirty Demonstration using Packet Tracer with Cisco Routers, WiFi Access Points and PC s