Configure DHCP features benefits Differences BOOTP DHCP operation configuring verifying troubleshooting Configure N AT NAT features operation

Transcription

1 Accessing the WAN Chapter 7

2 Objectives 2 Configure DHCP in an Enterprise branch network. DHCP features and benefits Differences between BOOTP and DHCP DHCP operation: and configuring, verifying, and troubleshooting DHCP. Configure NAT on a Cisco router. Key features and operation of NAT and NAT Overload Advantages and disadvantages of NAT Configuring i NAT and NAT Overload to conserve IP address space in a network Configuring port forwarding, and verifying and troubleshooting NAT configurations. Configure new generation RIP (RIPng) to use IPv6. How IPv6 solves any problem of IP address depletion How to assign IPv6 addresses, describing transition i strategies for implementing IPv6 Configuring, verifying and troubleshooting RIPng for IPv6.

3 What is DHCP? Every device that connects to a network needs an IP address. Network administrators assign static (manually) IP addresses to routers, servers, and other devices whose locations are not likely to change. Static addresses enable remote manage of those devices. Desktop clients do not require a static address. Instead, a workstation can use any address within a range (within an IP subnet) of addresses. Other items such as the subnet mask, default gateway, and DNS server are common value inside that subnet. DHCP makes the process of assigning i new IP addresses almost transparent. Assigns IP addresses configuration information dynamically. Extremely useful and timesaving (RFC 2131). 3 Scalable and relatively easy to manage. In a small branch or SOHO location, a Cisco router can be configured to provide DHCP services without the need for a dedicated server. A Cisco IOS feature set called Easy IP offers an optional, full-featured DHCP server.

4 DHCP Operation DHCP includes three different address allocation mechanisms to provide flexibility when assigning IP addresses: Manual Allocation The administrator assigns a pre-allocated IP address to the client and DHCP only communicates the IP address to the device. Automatic Allocation DHCP automatically assigns a static IP address permanently to a device, selecting it from a pool of available addresses. There is no lease and dthe address is permanently assigned dto a device. Dynamic Allocation 4 DHCP automatically dynamically assigns, or leases, an IP address from a pool of addresses for a limited period of time. Or until the client tells to server that it no longer needs the address. We will focus on dynamic allocation.

5 DHCP Operation DHCP works in a client/server mode. When a PC connects to a DHCP server, the server assigns or leases an IP to the PC connects to the network with that leased IP address until expires. The host must contact the DHCP server periodically to extend the lease. This lease mechanism ensures that hosts that move or power off do not hold onto addresses that they do not need. The server returns these addresses to the address pool. 5

6 BOOTP and DHCP 6 The Bootstrap Protocol (BOOTP: RFC 951), is the predecessor of DHCP. BOOTP download address and boot configurations for diskless workstations. Both DHCP and BOOTP are client/server based UDP ports 67 and 68, the BOOTP ports. DHCP and BOOTP have two components. The server allocates, distributes, and manages IP data assignments. Each allocation is stored on the server in a data set called a binding. The client is any device using DHCP as a method for obtaining IP addressing or supporting configuration information. To understand the functional differences between BOOTP and DHCP,, consider the four basic IP parameters needed to join a network: IP address Gateway address Subnet mask DNS server address

7 BOOTP and DHCP Differences 7 There are three primary differences between DHCP and BOOTP: The main difference is that BOOTP asign manual pre-configuration of the host information in a server database, while DHCP allows for dynamic allocation of network addresses and configurations. BOOTP server searches a predefined table for an entry that matches the MAC address for the client. DHCP allows for recovery and reallocation of network addresses through a leasing mechanism. BOOTP does not use leases. Its clients have reserved IP address which cannot be assigned to any other host. BOOTP provides a limited amount of information to a host. DHCP provides additional IP configuration parameters, such as WINS and domain name.

8 DHCP Message Format The developers of DHCP needed to maintain compatibility with BOOTP and consequently used the same BOOTP message format. However, because DHCP has more functionality than BOOTP, the DHCP options field was added. The fields are as follows: 8 Operation Code (OP) - Specifies the general type of message. 1 indicates a request message; 2 is a reply message.

9 DHCP Message Format 9 Hardware Type - Identifies the type of hardware used in the network. 1 is Ethernet, 15 is Frame Relay, and 20 is a serial line. These are the same codes used in ARP messages. Hardware Address length - 8 bits to specify the length of the address. Hops - Set to 0 by a client before transmitting a request and used by relay agents to control the forwarding of DHCP messages. Transaction Identifier - 32-bit identification generated by the client to allow it to match up the request with replies from DHCP servers. Seconds time elapsed since a client began attempting to acquire or renew a lease. Used by a busy DHCP servers to prioritize replies. Flags - Only one of the 16 bits is used, which is the broadcast flag. A client that does not know its IP address when it sends a request, sets the flag to 1.

10 DHCP Message Format 10 Client IP Address -The client puts its own IP address if and only if it has a valid IP address while in the bound state; otherwise, it sets the field to 0. Your IP Address - IP address that the server assigns to the client. Server IP Address - Address of the server that the client should use for the next step in the bootstrap process. Gateway IP Address - Routes DHCP messages when DHCP relay agents are involved (when client and a server are on different subnets). Client Hardware Address - Specifies the Physical layer of the client. Server Name - The server sending a DHCPOFFER or DHCPACK message may optionally put its name in this field. Boot Filename - Optionally used by a client to request a particular type of boot file in a DHCPDISCOVER message. Used by a server in a DHCPOFFER to fully specify a boot file directory and filename. Options - Holds DHCP options, including several parameters required for basic DHCP operation. This field is variable in length. Both client and server may use this field.

11 DHCP Discover Because the client has no way of knowing the subnet to which it belongs, the DHCPDISCOVER is an IP broadcast (destination IP address ). The client does not have a configured IP address, so the source IP address of is used. 11

12 DHCP Offer This message contains initial configuration information for the client, including the MAC address of the client, followed by the IP address that the server is offering, the subnet mask,, the lease duration, and the IP address of the DHCP server making the offer. The DHCPOFFER message can be configured to include other information, such as the lease renewal time,, domain name server,, and NetBIOS Name Service (Microsoft Windows Internet Name Service [Microsoft WINS]). 12

13 Configuring a DHCP Server Cisco routers provide full support for a router to act as a DHCP server. The Cisco IOS DHCP server assigns and manages IP addresses from specified address pools within the router to DHCP clients. Steps to configure a router as a DHCP server: 1. Define a range of addresses that DHCP is not to allocate. These are usually static addresses reserved dfor the router interface, switch management IP address, servers, and local network printers. 2. Create the DHCP pool using the ip dhcp pool command. 3. Configure the specifics of the pool. A best practice is to configure excluded addresses in global configuration mode before creating the DHCP pool. 13 This ensures that DHCP does not assign reserved addresses accidentally.

14 Configuring a DHCP Server Configuring a DHCP server involves defining a pool of addresses to assign. The ip dhcp pool command creates a pool with the specified name and puts the router in DHCP configuration mode ((dhcp-config)# config)# prompt). 14 You must configure the available addresses and specify the subnet network number and mask of the DHCP address pool. Use the network statement to dfi define the range of available addresses. You should also define the default gateway or router for the clients to use with the default-router command. The next DHCP pool commands are considered optional. Configure the IP address of the DNS server available to a DHCP client using the dns-server command.

15 Configuring a DHCP Server 15 The DHCP service is enabled by default. To disable the service, use the no service dhcp command. Use the service dhcp global configuration command to re-enable. Enabling the service has no effect if the parameters are not configured.

16 DHCP Configuration Example Router R1 has been configured with the following commands: ip dhcp excluded-address ip dhcp excluded-address ip dhcp pool LAN-POOL-1 network default-router domain-name span.com 16 To verify the operation of DHCP, use the show ip dhcp binding command. This command displays a list of all IP address to MAC address bindings that have been provided by the DHCP service. To verify that messages are being received or sent by the router, use the show ip dhcp server statistics i command. This command displays count information regarding the number of DHCP messages that have been sent and received.

17 DHCP Configuration Example 17 So how does PC2 receive an IP address? : ip dhcp excluded-address ip dhcp excluded-address ip dhcp pool LAN-POOL-2 network default-router domain-name span.com

18 Configuring a DHCP Client Typically, small broadband routers for home use, can be configured to connect to an ISP. In most cases, are set to acquire an IP address automatically. This means that when the router is connected to a cable modem, it is a DHCP client and requests an IP address from the ISP. Sometimes, Cisco routers in SOHO and branch sites have to be configured in a similar manner. The method used depends on the ISP. The Ethernet interface is used to connect to a cable modem. To configure an interface as a DHCP client,theipthe ip address dhcp command must be configured. 18

19 DHCP Relay 19 In a complex hierarchical network, enterprise servers are usually contained in a server farm. These servers may provide DHCP, DNS, FTP services for the clients. The problem is that the network clients typically are not on the same subnet as those servers. Therefore, the clients must locate the servers to receive services and often these services are located using broadcast messages. A solution to this problem could be to add DHCP servers on all the subnets. However, running these services on several computers creates both cost and administrative overhead. A simpler solution is to configure the Cisco IOS ip helper-address feature on intervening i routers and switches. This enables routers to forward DHCP broadcasts to the DHCP servers. When a router forwards address assignment/parameter requests, it is acting as a DHCP relay agent.

20 DHCP Relay DHCP is not the only service that the router can be configured to relay. By default, the ip helper-address command forwards eight UDP services. To specify additional ports, use the ip forward-protocol command to specify exactly which types of broadcast packets to forward. 20

21 21 DHCP Relay

22 22 Configuring a DHCP Server Using SDM

23 Troubleshooting DHCP Configuration 23 DHCP problems can arise for a multitude of reasons, such as software defects in OSs, NIC drivers, or DHCP/BOOTP relay agents, but the most common are configuration fg issues. Because of the number of potentially problematic areas, a systematic approach to troubleshooting is required. Troubleshooting Task 1: Resolve IP Address Conflicts The show ip dhcp conflict command displays all address conflicts recorded by the DHCP server. The server uses the ping command to detect conflicts. If an address conflict is detected, the address is removed from the pool and not assigned until an administrator resolves the conflict. Troubleshooting Task 2: Verify Physical lconnectivity it First, use the show interface interface command to confirm that the router interface acting as the default gateway for the client is operational. If the state of the interface is anything other than up, the port does not pass traffic, including DHCP client requests.

24 Troubleshooting DHCP Configuration 24 Troubleshooting Task 3: Test Network Connectivity by Configuring a Client Workstation with a Static IP Address When troubleshooting any DHCP issue, verify network connectivity by configuring a static IP address on a client workstation. Try to reach network resources, if not, the root cause of the problem is not DHCP. At this point, network connectivity troubleshooting is required. Troubleshooting Task 4: Verify Switch Port Configuration (STP Portfast and Other Commands) If the DHCP client is unable to obtain an IP address from the DHCP server on startup, attempt to obtain an IP address from the DHCP server by manually forcing the client to send a DHCP request. If there is a switch between the client and the DHCP server, verify that the port has STP PortFast enabled and trunking/channeling disabled. The default configuration is PortFast t disabled d and trunking/channeling /h auto, if applicable.

25 Troubleshooting DHCP Configuration Troubleshooting Task 5: Distinguishing Whether DHCP Clients Obtain IP Address on the Same Subnet or VLAN as DHCP Server It is important to distinguish whether DHCP is functioning correctly when the client is on the same subnet or VLAN as the DHCP server. If the DHCP is working correctly, the problem may be the DHCP/BOOTP relay agent. If the problem persists even with testing DHCP on the same subnet or VLAN as the DHCP server, the problem may actually be with the DHCP server. 25

26 Verify Router DHCP Relay Configuration 26 When the DHCP server is located on a separate LAN from the client, the router interface facing the client must be configured to relay DHCP requests. This is accomplished by configuring the IP helper address. If it is not configured properly, client DHCP requests are not forwarded to the DHCP server. Follow these steps to verify the router configuration: 1. Verify that the ip helper-address command is configured on the correct interface. It must be present on the inbound interface of the LAN containing the DHCP client workstations and Must tbe directedd to the correct DHCP server. 2. Verify that the global configuration command no service dhcp has not been configured. This command disables all DHCP server and relay functionality on the router.

27 27 Verify that the Router is Receiving DHCP Requests q On routers configured as DHCP servers, the DHCP process fails if the router is not receiving requests from the client. As a troubleshooting task, verify that the router is receiving the DHCP request from the client. Configure an ACL for debugging output. The debug ACL is not intrusive to the router. access-list 100 permit ip host host Start debugging by using ACL 100 as the defining parameter. debug ip packet detail 100 A useful command for troubleshooting DHCP operation is the debug ip dhcp server events command. This command reports server events, like address assignments and database updates.

28 Verify that the Router is Receiving DHCP Requests q The source IP address is because the client does not yet have an IP address. The destination is because the DHCP discovery message from the client is a broadcast. The UDP source and destination ports, 68 and 67, for DHCP. 28

29

30 Private and Public Addressing All public Internet addresses must be registered with a Regional Internet Registry (RIR). Organizations can lease public addresses from an ISP. There are reserved private Internet addresses, for internal network use only. Are referred to as non-routable addresses. RFC 1918 provides details. Unlike public IP addresses, private IP addresses are a reserved dblock of numbers that can be used by anyone. Because you cannot route private addresses over the Internet, and there are not enough public addresses, networks need a mechanism to translate private addresses to public addresses at the edge of their network. Network Address Translation (NAT) provides this mechanism. 30

31 31 Private and Public Addressing

32 What is NAT? 32 NAT-enabled routers retain one or many valid Internet IP addresses outside of the network. When the client sends packets out of the network, NAT translates the internal IP address of the client to an external address. To outside users, all traffic coming to and going from the network has the same IP address or is from the same pool of addresses. NAT has many uses, but its key use is to save IP addresses by allowing networks to use private IP addresses. NAT translates non-routable, private addresses into routable, public ones. NAT has an added benefit of adding a degree of privacy and security to a network because it hides internal IP addresses from outside networks. A NAT-enabled device typically operates at tthe border of a stub network. In NAT terminology: The inside network is the set of networks that are subject to translation. The outside network refers to all other addresses.

33 33 What is NAT?

34 NAT Terminology Inside local address The IP address assigned to a host on the inside network. Usually not an IP address assigned by the (NIC) or service provider. This address are private address. Inside global address A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP addresses to the outside world. Outside local address The IP address of an outside host as it known to the hosts in the inside network. Outside global address The IP address assigned to a host on the outside network. The owner of the host assigns this address. 34

35 35 How NAT Works?

36 Dynamic and Static Mapping 36 There are two types of NAT translation: dynamic and static. Dynamic NAT uses a pool of public addresses and assigns them on a first-come come, first-served served basis. When a host requests access to the Internet, dynamic NAT chooses an IP address from the pool that is not already in use by another host. Static NAT uses a one-to-one mapping of local and global addresses, and these mappings remain constant. Is particularly useful for web servers or hosts that must have a consistent address that is accessible from the Internet. These internal hosts may be enterprise servers or networking devices. Both static and dynamic NAT require that enough public addresses are available to satisfy the total number of simultaneous user sessions.

37 NAT Overload 37 NAT overloading (Port Address Translation or PAT) maps multiple private IP addresses to a single public IP address or a few addresses. Multiple addresses can be mapped to one or to a few addresses because each private address is also tracked by a port number. When a client opens a TCP/IP session, the NAT router assigns a port number to its source address. NAT overload ensures that clients use a different TCP port number for each client session with a server on the Internet. It also validates that the incoming packets were requested, thus adding a degree of security to the session. The port number is encoded in 16 bits ( 65,536 ports per IP address). Practically, ports per single IP address is around 4,000. PAT will attempt to preserve the original source port. If this source port is already used, PAT will assign the first available port number. When there are no more portsavailable, PAT moves to thenextt IP address to try to allocate the original source port again, until saturate.

38 38 NAT Overload

39 NAT Benefits and NAT Drawbacks 39 NAT Benefits Conserves the legally registered addressing scheme Increases the flexibility of connections to the public network Provides consistency for internal network addressing schemes. Provides network security However, NAT does not replace firewalls. NAT Drawbacks Performance is degraded End-to-end functionality is degraded End-to-end IP traceability is lost Tunneling is more complicated Initiating TCP connections can be disrupted Services that require the initiation of TCP connections from the outside tid network, or stateless ttl protocols such as those using UDP. Architectures need to be rebuilt to accommodate changes

40 40 Configuring Static NAT

41 41 Configuring Static NAT

42 42 Configuring Dynamic NAT

43 43 Configuring Dynamic NAT

44 Configuring NAT Overload for a Pool of Public IP Addresses 44 The primary difference between this configuration and the configuration for dynamic,, one-to-one NAT is that the overload keyword is used. Remember that the overload keyword enables port address translation.

45 45 Configuring NAT Overload for a Pool of Public IP Addresses

46 Configuring NAT Overload for a Single Public IP Address 46 The configuration is similar to dynamic NAT, except that instead of a pool of addresses, the interface keyword is used to identify the outside IP address. Therefore, no NAT pool is defined. The overload keyword enables the addition of the port number to the translation.

47 47 Configuring NAT Overload for a Single Public IP Address

48 Port Forwarding 48 Port forwarding (tunneling) is the act of forwarding a network port from one network node to another. This technique can allow an external user to reach a port on a private IP address (inside a LAN) from the outside through a NAT-enabled router. Typically, peer-to-peer file-sharing programs and key operations, such as web serving and outgoing FTP, require that router ports be forwarded or opened to allow these applications to work. Because NAT hides internal addresses, peer-to-peer only works from the inside out where NAT can map register outgoing requests against incoming replies. The problem is that NAT does not allow requests initiated from the outside. This situation can be resolved with manual intervention. Port forwarding allows you to identify specific ports that can be forwarded to inside hosts. Different applications use different ports. (Telnet=23, FTP=20 and 21, etc.). This makes it predictable for applications and routers to identify network services.

49 49 Port Forwarding

50 50 Verifying NAT and NAT Overload

51 Clearing NAT Translations It is sometimes useful to clear the dynamic entries sooner than the default. This is especially true when testing the NAT. You can be very specific about which translation to clear, or you can clear all translations from the table using the clear ip nat translation * global command. Only the dynamic translations are cleared from the table. Static translations cannot be cleared from the translation table. 51

52 Troubleshooting NAT and NAT Overload Configuration g When you have IP connectivity problems in a NAT environment, it is often difficult to determine the cause of the problem. The first step in solving your problem is to rule out NAT as the cause Follow these steps to verify that NAT is operating as expected: Step 1. Based on the configuration, clearly define what NAT is supposed to achieve. This may reveal a problem with the configuration. Step 2. Verify that correct translations exist in the translation table using the show ip nat translations command. Step 3. Use the clear and debug commands to verify that t NAT is operating as expected. Check to see if dynamic entries are recreated after they are cleared. 52 Step 4. Review in detail what is happening to the packet, and verify that routers have the correct routing information to move the packet.

53 Troubleshooting NAT and NAT Overload Configuration g Use the debug ip nat command to verify the operation of the NAT by displaying information about every packet that is translated by the router. The debug ip nat detailed command generates a description of each packet considered for translation. This command also outputs information about certain errors or exception conditions, such as the failure to allocate a global address. 53

54

55 Reasons for Using IPv6 Why We Need More Address Space To comprehend the IP addressing issues today, consider that the IPv4 address space provides 4,294,967,296 unique addresses. Of these, only 3.7 billion addresses are assignable because the IPv4 addressing system separates the addresses into classes and Reservesaddressesfor multicasting, testing, and other specific uses. January 2007: about 2.4 billion of the available IPv4 addresses are already assigned to end users or ISPs, 1.3 billion addresses still available. Despite this seemingly large number, IPv4 address space is running out. 55

56 Reasons for Using IPv6 56 The pool of numbers is shrinking for the following reasons: Population growth 2005 Internet population: approximately 973 million users. This number has doubled since then. In addition, users stay on longer, reserving IP addresses for longer periods and are contacting more and more peers daily. Mobile users - Industry has delivered more than one billion mobile phones. More than 20 million IP-enabled mobile devices, including PDAs, pen tablets, notepads, and barcode readers, have been delivered. Transportation - There will be more than one billion automobiles by Newer models are IP-enabled to allow remote monitoring to provide timely maintenance and support. Lufthansa already provides Internet connectivity on their flights. More carriers, including ships at sea, will provide similar services. Consumer electronics - The newest home appliances allow remote monitoring i using IP technology. DVRs: download and update program guides from the Internet.

57 Reasons for Using IPv6 The pool of numbers is shrinking for the following reasons: 57

58 Reasons for Using IPv6 58 Movement to change from IPv4 to IPv6 has already begun, particularly in Europe, Japan, and the Asia-Pacific region. These areas are exhausting their allotted IPv4 addresses, which makes IPv6 all the more attractive and necessary. The ability to scale networks for future demands requires a limitless supply of IP addresses and improved mobility that DHCP and NAT can meet. IPv6 satisfies the increasingly complex requirements of hierarchical addressing that IPv4 does not provide. Given the huge installed base of IPv4 in the world, it is not difficult to appreciate that transitioning to IPv6 from IPv4 deployments is a challenge. There are, however, a variety of techniques, including an auto-configuration fg option, to make the transition easier. The transition mechanism you use depends on the needs of your network. An IPv6 address is a 128-bit binary value, which can be displayed as 32 hexadecimal digits.

59 Reasons for Using IPv6 IPv6 should provide sufficient addresses for future Internet growth needs for many years to come. There are enough IPv6 addresses to allocate more than the entire IPv4 Internet address space to everyone on the planet. 59

60 Reasons for Using IPv6 60 Enhanced IP addressing: Global reachability and flexibility Aggregation Multihoming Autoconfiguration Plug-and-play End-to-end without NAT Renumbering Mobility and security: Mobile IP RFC-compliant IPsec mandatory (or native) for IPv6 Simple header: Routing efficiency Performance and forwarding rate scalability No broadcasts No checksums Extension headers Flow labels Transition richness: Dual-stack 6to4 and manual tunnels Translation

61 IPv6 Address Representation bit IPv6 addresses need a different representation because of their size. IPv6 addresses use colons to separate entries in a series of 16-bit hexadecimal. Consider the address 2031:0000:130F:0000:0000:09C0:876A:130B. IPv6 does not require explicit address string notation. To shorten the address by applying the following guidelines: Leading zeros in a field are optional. For example, the field 09C0 equals 9C0, and the field 0000 equals :0000:130F:0000:0000:09C0:876A:130B can be written as 2031:0:130F:0000:0000:9C0:876A:130B. Successive fields of zeros can be represented as two colons "::". However, this shorthand method can only be used once in an address. For example 2031:0:130F:0000:0000:9C0:876A:130B can be written as 2031:0:130F::9C0:876A:130B. Cannot be represented as 2031::130f::9c0:876a:130b

62 IPv6 Address Representation An unspecified address is written as "::" because it contains only zeros. Using the "::" notation greatly reduces the size of most addresses as shown. An address parser identifies the number of missing zeros by separating any two parts of an address and entering 0s until the 128 bits are complete. FF01:0000:0000:0000:0000:0000:0000:0001 becomes FF01:0:0:0:0:0:0:1 becomes FF01::1 0:0:0:0:0:0:0:1 becomes ::1 0:0:0:0:0:0:0:0 becomes :: 62 E3D7:0000:0000:0000:51F4:00C8:C0A8:6420 becomes E3D7::51F4:C8:C0A8:6420 3FFE:0501:0008:0000:0260:97FF:FE40:EFAB becomes 3FFE:501:8:0:260:97FF:FE40:EFAB becomes 3FFE:501:8::260:97FF:FE40:EFAB

63 IPv6 Global Unicast Address IPv6 has a format that enables aggregation upward eventually to the ISP. Global unicast addresses typically consists of a 48-bit global routing prefix and a 16-bit subnet ID. Individual organizations can use a 16-bit subnet field to create their own local addressing hierarchy. This field allows an organization to use up to 65, individual subnets. RFC 3587, IPv6 Global l Unicast Address Format Additional hierarchy can be added to the 48-bit global routing prefix with 63 the registry prefix, ISP Prefix, and site prefix. The current global unicast address that is assigned by the IANA uses the range of addresses that start with binary value 001 (2000::/3), which is 1/8 of the total IPv6 address space and is the largest block of assigned addresses. The IANA is allocating the IPv6 address space in the ranges of 2001::/16 to the five RIR registries (ARIN, RIPE, APNIC, LACNIC, and AfriNIC).

64 Reserved Addresses The IETF reserves a portion of the IPv6 address space for various uses, both present and future. Reserved addresses represent 1/256th of the total IPv6 address space. Some of the other types of IPv6 addresses come from this block. 64

65 Private Addresses A block of IPv6 addresses just as is done in IPv4. Private addresses are local only to a particular link or site, and are therefore never routed outside of a particular company network. Private addresses have a first octet value of "FE" in hexadecimal notation, with the next hexadecimal digit being a value from 8 to F. These addresses are further divided into two types, based upon their scope. Site-local addresses. Are addresses similar to the RFC 1918 Address Allocation for Private Internets t in IPv4 today. The scope of these addresses is an entire site or organization. However, the use of site-local addresses is problematic and is being 65 deprecated as of 2003 by RFC In hexadecimal, site-local addresses begin with "FE" and then "C" to "F" for the third hexadecimal digit. So, these addresses begin with "FEC", "FED", "FEE", or "FEF".

66 Private Addresses 66 Link-local addresses Are new to the concept of addressing with IP in the Network layer. These addresses have a smaller scope than site-local addresses; they refer only to a particular physical link (physical network). Routers do not forward datagrams using link-local addresses at all, not even within the organization. Only for local communication on a particular physical network. They are used for link communications such as automatic address configuration, i neighbor discovery, and router discovery. Many IPv6 routing protocols also use link-local addresses. Link-local addresses begin with "FE" and then have a value from "8" to "B" for the third hexadecimal digit. it So, these addresses start with "FE8", "FE9", "FEA", or "FEB".

67 Loopback Address Just as in IPv4, there is a special loopback IPv6 address for testing. Datagrams sent to this address "loop back" to the sending device. However, in IPv6 there is just one address, not a whole block, for this function. The loopback address is 0:0:0:0:0:0:0:1, which is normally expressed using zero compression as ::1. 67

68 Unspecified Address In IPv4, an IP address of all zeroes has a special meaning; it refers to the host itself, and is used when a device does not know its own address. In IPv6, this concept has been formalized, and the all-zeroes address (0:0:0:0:0:0:0:0) is named the "unspecified" address. It is typically used in the source field of a datagram that is sent by a device that seeks to have its IP address configured. You can apply address compression to this address; because the address is all zeroes, the address becomes just "::". 68

69 IPv6 Address Management 69 IPv6 addresses use interface identifiers to identify interfaces on a link. Think of them as the host portion of an IPv6 address. Interface identifiers are required to be unique on a specific link. Interface identifiers are always 64 bits and can be dynamically derived from a Layer 2 address (MAC). You can assign an IPv6 address ID statically: Static assignment using a manual interface ID Static assignment using an EUI-64 interface ID Or dynamically: Stateless autoconfiguration DHCP for IPv6 (DHCPv6)

70 Static Interface ID Assignment 70 Manual Interface ID Assignment Manually assign both the prefix (network) and interface ID (host) portion of the IPv6 address. To configure an IPv6 address on a Cisco router interface, use the ipv6 address ipv6-address/prefix-length interface command. RTX(config-if)#ipv6 if)#ipv6 address 2001:DB8:2222:7272::72/64 EUI-64 Interface ID Assignment Manually configure the prefix (network) portion of the IPv6 address and derive the interface ID (host) portion from the Layer 2 MAC address of the device (EUI-64 interface ID). The EUI-64 standard explains how to stretch IEEE 802 MAC addresses from 48 to 64 bits by inserting the 16-bit 0xFFFE in the middle at the 24 th. To configure an IPv6 address on a router interface and enable IPv6 processing using EUI-64 on that interface, use the interface command: ipv6 address ipv6-prefix/prefix-lengthprefix/prefix eui-64. RTX(config-if)#ipv6 address 2001:DB8:2222:7272::/64 eui-64

71 Static Interface ID Assignment EUI-64 Interface ID Assignment RTX(config-if)#ipv6 address 2001:DB8:2222:7272::/64 eui-64 71

72 Dynamic Interface ID Assignment 72 Stateless Autoconfiguration Autoconfigures automatically the IPv6 address. In IPv6, it is assumed that non-pc devices, as well as computer terminals, will be connected to the network. The autoconfiguration mechanism was introduced to enable plug-and-play play networking of these devices to help reduce administration overhead. DHCPv6 (Stateful) DHCPv6 enables DHCP servers to pass configuration parameters, such as IPv6 network addresses, to IPv6 nodes. It offers the capability of automatic allocation of reusable network addresses and additional configuration flexibility. This protocol is a stateful counterpart to IPv6 stateless address autoconfiguration (RFC 2462), Can be used separately or concurrently with IPv6 stateless address autoconfiguration to obtain configuration parameters.

73 IPv6 Transition Strategies The transition from IPv4 does not require upgrades on all nodes at the same time. Many transition mechanisms enable smooth integration of IPv4 and IPv6. Other mechanisms that allow IPv4 nodes to communicate with IPv6 nodes are available. Different situations demand different strategies. Different transition mechanisms are available: Dual stack Manual tunnel 6to4 tunnel ISATAP tunnel 73 Teredo tunnel Different compatibility mechanisms: Proxying and translation (NAT-PT) "Dual stack where you can, tunnel where you must." The two most common methods to transition from IPv4 to IPv6

74 Most Common Transition Methods 74 Dual Stacking Is an integration method in which a node has implementation and connectivity to both an IPv4 and IPv6 network. This is the recommended option and involves running IPv4 and IPv6 at the same time. Router and switches are configured to support both protocols, with IPv6 being the preferred protocol. Tunneling The second major transition i technique is tunneling. There are several tunneling techniques available, including: Manual IPv6-over-IPv4 tunneling -An IPv6 packet is encapsulated within ihi the IPv4 protocol. This method requires dual-stack routers. Dynamic 6to4 tunneling - Automatically establishes the connection of IPv6 islands through an IPv4 network, typically the Internet.

75 NAT-Protocol Translation (NAT-PT) Cisco IOS Release 12.3(2)T and later (with the appropriate feature set) also include NAT-PT between IPv6 and IPv4. This translation allows direct communication between hosts that use different versions of the IP protocol. These translations are more complex than IPv4 NAT. At this time, this translation technique is the least favorable option and should be used as a last resort. 75

76 Cisco IOS Dual Stack Dual stacking is an integration method that allows a node to have connectivity to an IPv4 and IPv6 network simultaneously. Each node has two protocol stacks with the configuration on the same interface or on multiple interfaces. A dual-stack node chooses which stack to use based on the destination address of the packet. A dual-stack node should prefer IPv6 when it is available. Old IPv4-only applications continue to work as before. New and modified dapplications take advantage of fboth thip layers. A new application programming interface (API) has been defined to support IPv4 and IPv6 addresses and DNS requests. 76 An API facilitates the exchange of messages or data between two or more different software applications. The API is built into software applications to translate IPv4 into IPv6, and vice versa using the IP conversion mechanism.

77 Cisco IOS Dual Stack Experience in porting IPv4 applications to IPv6 suggests that for most applications, there is a minimal change in some localized places inside the source code. This technique is well known and has been applied in the past for other protocol transitions. It enables gradual application upgrades, one by one, to IPv6. 77

78 Configuring IPv6 Interface Cisco IOS Release 12.2(2)T and later (with the appropriate feature set) are IPv6-ready. As soon as you configure basic IPv4 and IPv6 on the interface, the interface is dual-stacked and forwards IPv4 and IPv6 traffic on that interface. Note that an IPv4 and an IPv6 address have been configured. Using IPv6 on a Cisco IOS router requires that you use the global configuration command ipv6 unicast-routing. This command enables the forwarding of IPv6 datagrams. You must configure all interfaces that t forward IPv6 traffic with an IPv6 address using the ipv6 address IPv6-address [/prefix length] interface command. 78

79 IPv6 Tunneling 79 Tunneling is an integration method where an IPv6 packet is encapsulated within another protocol, such as IPv4. This method enables the connection of IPv6 islands without needing to convert the intermediary networks to IPv6. When IPv4 is used to encapsulate the IPv6 packet, a protocol type of 41 is specified in the IPv4 header, and the packet includes a 20-byte IPv4 header with no options and an IPv6 header and payload. It also requires dual-stack routers. Tunneling presents these two issues. The MTU is effectively decreased by 20 octets if the IPv4 header does not contain any optional fields. In addition, a tunneled ldnetwork kis often difficult to troubleshoot. Tunneling is an intermediate integration and transition technique and should not be considered as a final solution. A native IPv6 architecture should be the ultimate goal.

80 80 IPv6 Tunneling

81 Manually Configured IPv6 Tunnel Is equivalent to a permanent link between two IPv6 domains over an IPv4 backbone. The end routers must be dual stacked,, and the configuration fg cannot change dynamically as network and routing needs change. Administrators manually configure a static IPv6 address on a tunnel interface, and assign manually configured static IPv4 addresses to the tunnel source and the tunnel destination. The host or router at each end of a configured tunnel must support both the IPv4 and IPv6 protocol stacks. Manually configured tunnels can be configured between border routers or between a border router and a host. 81

82 Routing Configurations with IPv6 Like IPv4 CIDR, IPv6 uses longest prefix match routing. IPv6 uses modified versions of most of the common routing protocols to handle longer IPv6 addresses and different header structures. Larger address spaces make room for large address allocations to ISPs and organizations. An ISP aggregates all of the prefixes of its customers into a single prefix and announces the single prefix to the IPv6 Internet. The increased address space is sufficient to allow organizations to define a single prefix for their entire network. But how does this affect router performance? Conceptually, a router has three functional areas: 82 The control plane The data plane Enhanced services Packet filtering, quality of service (QoS), encryption, translation, and accounting.

83 83 Routing Configurations with IPv6

84 IPv6 Control Plane 84 Protocol characteristics shape the performance of these processes and the amount of resources necessary to operate them: IPv6 address size - Address size affects the information-processing functions of a router. Systems using a 64-bit CPU, bus, or memory structure can pass both the IPv4 source and destination address in a single processing cycle. For IPv6, the source and destination addresses require four cycles. Slower than when in an IPv4 environment. Multiple IPv6 node addresses - Because IPv6 nodes can use several IPv6 unicast addresses, memory consumption of the Neighbor Discovery cache may be affected. IPv6 routing gprotocols - IPv6 routing gprotocols are similar to their IPv4 counterparts, but since an IPv6 prefix is four times larger than an IPv4 prefix, routing updates have to carry more information. Routing table Size -Increased IPv6 address space leads to larger networks and a much larger Internet. This implies larger routing tables and higher memory requirements to support them.

85 IPv6 Data Plane 85 The data plane forwards IP packets based on the decisions made by the control plane. The forwarding engine e parses the relevant eva IP packet information and does a lookup to match the parsed information against the forwarding policies defined by the control plane. IPv6 affects the performance of parsing and lookup pfunctions: Parsing IPv6 extension headers - Applications, including mobile IPv6, often use IPv6 address information in extension headers, thus increasing their size. These additional fields require additional processing. IPv6 address lookup - IPv6 performs a lookup on packets entering the router to find the correct output interface. In IPv4, the eforwarding decision process parses a 32-bit destination address. In IPv6, the forwarding decision could conceivably require parsing a 128-bit address. Most routers perform lookups using an ASIC with a fixed configuration that performs the functions for which it was originally designed - IPv4. Again, this could result in punting packets into slower software processing, or dropping them all together.

86 RIPNg Routing Protocol 86 IPv6 routes use the same protocols and techniques as IPv4. Although the addresses are longer, the protocols used in routing IPv6 are simply logical extensions of the protocols used in IPv4. RFC 2080 defines Routing Information Protocol next generation (RIPng) as a simple routing protocol based on RIP. RIPng is no more or less powerful than RIP, however, it provides a simple way to bring up an IPv6 network without having to build a new routing protocol. RIPng is a distance vector routing protocol with a limit of 15 hops that uses split horizon and poison reverse updates to prevent routing loops. Its simplicity comes from the fact that it does not require any global knowledge of the network. Only neighboring routers exchange local messages.

87 RIPNg Routing Protocol RIPng includes the following features: Based on IPv4 RIP version 2 (RIPv2) and is similar to RIPv2 Uses IPv6 for transport Includes the IPv6 prefix and next-hop IPv6 address Uses the multicast group FF02::9 as the destination address for RIP updates (hi (this is similar il to the broadcast function performed dby RIPin IPv4) Sends updates on UDP port 521 Is supported by Cisco IOS Release 12.2(2)T and later In dual-stacked deployments, both RIP and RIPng are required. 87

88 Enabling IPv6 on Cisco Routers There are two basic steps to activate IPv6 on a router. 1. Activate IPv6 traffic-forwarding on the router. 2. Configure each interface that requires IPv6. By default, IPv6 traffic-forwarding is disabled on a Cisco router. To activate it between interfaces, you must configure the global command ipv6 unicast-routing. i The ipv6 address command can configure a global IPv6 address. The link-local address is automatically configured when an address is assigned to the interface. You must specify the entire 128-bit IPv6 address or specify to use the 64-bit prefix by using the eui-64 option. 88

89 Cisco IOS IPv6 Name Resolution There are two ways to perform name resolution from the Cisco IOS software process: Define a static name for an IPv6 address using the command ipv6 host name [port] ipv6-addr1 [ipv6-addr2...ipv6-addr4]. You can define up to four IPv6 addresses for one hostname. The port option: : Telnet port to be used for the associated host. Specify the DNS server used by the router with the command ip name-server address. The address can be an IPv4 or IPv6 address. You can specify up to six DNS servers with this command. 89

90 IPv6 Address Configuration Example You can completely specify the IPv6 address or compute the host identifier (rightmost 64 bits) from the EUI-64 identifier of the interface. ipv6 address ipv6-address/prefix-length. Configuring an IPv6 address on an interface automatically configures the link-local address for that interface. 90

91 Configure RIPng with IPv6 91 When configuring supported routing protocols in IPv6, you must: Create the routing process Enable the routing process on interfaces, and Customize the routing protocol for your particular network. Before configuring the router to run IPv6 RIP, globally enable IPv6 using the ipv6 unicast-routing global configuration command, and enable IPv6 on any interfaces on which IPv6 RIP is to be enabled. To enable RIPng routing on the router, use the ipv6 router rip name global configuration command. The name parameter identifies the RIP process, which is used later when configuring RIPng on participating interfaces. For RIPng, instead of using the network command to identify which interfaces should run RIPng, you use the interface command ipv6 rip name enable to enable RIPng on an interface. The name parameter must match the name parameter in the ipv6 router rip command. Enabling RIP on an interface dynamically creates a "router rip" process if necessary.

92 92 Configure RIPng with IPv6

93 Verifying Troubleshooting RIPng for IPv6 After configuring RIPng, verification is required. This is a list of the various show commands you can use. 93

94 Summary 94 Dynamic Host Control Protocol (DHCP) This is a means of assigning IP address and other configuration information automatically. DHCP operation 3 different allocation methods Manuall Automatic Dynamic Steps to configure DHCP Define range of addresses Create DHCP pool Configure DHCP pool specifics

95 Summary DHCP Relay Concept of using a router configured to listen for DHCP messages from DHCP clients and then forwards those messages to servers on different subnets Troubleshooting DHCP Most problems arise due to configuration errors Commands to aid troubleshooting Show ip dhcp Show run debug 95

96 Summary 96 Private IP addresses Class A = 10.x.x.x Class B = x.x 16 x x.x x Class C = x.x Network Address Translation (NAT) A means of translating private IP addresses to public IP addresses Type s of NAT Static Dynamic Some commands used for troubleshooting Show ip nat translations Show ip nat statistics Debug ip nat

97 Summary 97 IPv6 A 128 bit address that uses colons to separate entries Normally written as 8 groups of 4 hexadecimal digits Cisco IOS Dual Stack A way of permitting a node to have connectivity to an IPv4 & IP v6 network simultaneously l IPv6 Tunneling An IPV6 packet is encapsulated within another protocol Configuring RIPng with IPv6 1 st globally enable IPv6 2 nd enable IPv6 on interfaces on which IPv6 is to be enabled 3 rd enable RIPng using either ipv6 router rip name ipv6 router name enable

98 98