Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
Transition!Mechanisms !
After this section, you should be able to:
! ! ! ! Describe the need for transition technologies. Understand and congure manual 6in4 tunnels. Understand and congure automatic 6to4 tunneling. Identify and describe the options for v6-v4 translation.
Transition Mechanisms !
IPv6-only network
IPv4-only network
! How do we connect v6 networks over non-v6 capable links? ! How do we get v6 only networks talking to v4 only networks?
www.afrinic.net | slide 3
Transition Mechanisms !
Translation
www.afrinic.net | slide 4
Tunneling
Dual Stack
cisco.com
Your hardware, software, security systems run both v4 and v6. !! Hosts (desktops, servers, mobile devices, sensors etc) !! Load balancers !! Switches (think DHCP & IGMP snooping, etc ) !! Routers (intra-domain and inter-domain routing protocols) !! Firewalls, intrusion detection and prevention systems
www.afrinic.net | slide 5
TCP
UDP
IPv4
IPv6
www.afrinic.net | slide 6
Transition Mechanisms !
!! http://[2000:100::7]/index.html vs http://192.0.2.1.html !! ping 2001:db8::a vs ping 192.0.2.1 !! v4-only application queries, get an A entry and uses v4 !! v6-only application queries, gets an AAAA record and uses v6 !! Dual-stacked application queries, gets both A & AAAA and
prefers v6 (or very rarely v4). !! DNS responses are independent of the L3 protocol ie a host can query over v4 and get AAAA response.
www.afrinic.net | slide 7
Transition Mechanisms !
Transition Mechanisms !
! Increased complexity
Security policies for both v4 and v6 Two IGP routing protocols & multiple BGP address families Some things work differently in each of the protocols Applications must communicate over both protocols ! Increased support costs ! Higher resource requirements !! Extra memory for routing database and tables for v6 !! BGP tables for v4 (300K+) AND a growing v6 BGP table
!! !! !! !!
www.afrinic.net | slide 9
Tunneling !
cisco.com
Transition Mechanisms !
"! Encapsulate IPv6 within IPv4 packets (v4 protocol number 41). "! Source and destination elds are set to the v4 addresses of the tunnel
endpoints. "! Tunnel endpoints are either manually congured or derived from transition addresses.
www.afrinic.net | slide 10
Types of Tunnels !
Transition Mechanisms !
"! Manual
!! Requires manual conguration at both ends. !! Pre-agreement for addresses to use at both endpoints. !! Remote end is auto-congured, other is manual !! Router-to-router or host-to-router
"! Automatic
Manual Tunnels !
Pre-requisites
Transition Mechanisms !
! Dual-stacked router [DSR] (or host) at both ends. ! IPv4 reachability between both ends. ! Public IPv4 addresses on each of the tunnel endpoints. How it works ! DSR gets a v6 packet on its native v6 interface and routing directs it out the tunnel interface. ! DSR encapsulates the v6 packet inside a v4 packet and sends it to the v4 address of the tunnel endpoint. (in the v4 header, v6 is identied by protocol no. 41) ! End DSR decapsulates the v4 packet, sees a v6 packet and sends it out its v6 interface according to normal v6 routing table. Potential issues ! Firewalls in transit might block protocol no. 41. ! Full cooperation of the tunnel endpoint routers admin is required. ! MTU issues in the path.
www.afrinic.net | slide 12
2001:db8:1000::/64
2001:db8:2000::/64
R1# interface Loopback 0 ip address 192.0.2.1 255.255.255.0 interface Tunnel0 no ip address ipv6 2001:db8:12::1/64 tunnel source Loopback0 tunnel destination 198.51.100.1 tunnel mode ipv6ip tunnel path-mtu-discovery
R2# interface Loopback 0 ip address 198.51.100.1 255.255.255.0 interface Tunnel0 no ip address ipv6 2001:db8:12::2/64 tunnel source Loopback0 tunnel destination 192.0.2.1 tunnel mode ipv6ip tunnel path-mtu-discovery ipv6 route 2001:db8:1000::/64 Tunnel0
www.afrinic.net | slide 13
Transition Mechanisms !
! Dual-stacked router [DSR] (or host) at both ends. ! IPv4 reachability between both ends using public IPv4 addresses. How it works ! DSR routes packets on its native v6 interface out the tunnel interface. ! DSR automatically determines the tunnel endpoint (the v4 address that comes after 2002::/16) ! DSR encapsulates the v6 packet inside a v4 packet and sends it onwards. ! End DSR decapsulates the v4 packet, sees a v6 packet and sends it out its v6 interface according to normal v6 routing table. Potential issues ! Relays are subject to abuse (DOS & v6 address spoong) ! Indiscriminately connecting to any endpoint poses security risks. ! Asymmetric: different endsites may use different relays. ! MTU issues in the path.
www.afrinic.net | slide 14
Transition Mechanisms !
! A 6to4 relay router connected to native v6 and also to v4 using a 6to4 interface and advertising 2002::/16 to its neighbours ! Default gateway on the 6to4 routers or host must be the 6to4 relay address of 192.88.99.1 [2002:c058:6301::/48] Packets from 6to4 site to native v6 Internet. ! 6to4 router sends the packets to 2002:c058:6301::/48 (which will get to the nearest relay) ! The relay decapsulates the packet and routes normally it out its native v6 interface. Routing packets from native v6 Internet to 6to4 site ! Packets follow normal v6 routing and get to native v6 interface of 6to4 relay. ! Seeing that the destination is in the 2002::/16 range, the relay extracts the v4 address and creates a tunnel and forwards it over v4 interface.
www.afrinic.net | slide 16
Transition Mechanisms !
2002:C633:6401::/48
8.5 1.1 00 .1/
R1
Site A IPv6 network
19
2.0
24
R2
Site B IPv6 network
.2.
1/2
2002:C000:201::/48
R1# interface Loopback 0 ip address 192.0.2.1 255.255.255.0 interface Tunnel0 no ip address ipv6 enable tunnel source Loopback0 tunnel mode ipv6ip 6to4 tunnel path-mtu-discovery ipv6 route 2002::/16 Tunnel0 ipv6 route ::/0 2002:C058:6301::
R2# interface Loopback 0 ip address 198.51.100.1 255.255.255.0 interface Tunnel0 no ip address ipv6 enable tunnel source Loopback0 tunnel mode ipv6ip 6to4 tunnel path-mtu-discovery ipv6 route 2002::/16 Tunnel0 ipv6 route ::/0 2002:C058:6301::
www.afrinic.net | slide 18
Transition Mechanisms !
"! 6rd = IPv6 Rapid Deployment (RFC 5969) "! Plug-n-play ease of 6to4 without the drawbacks. "! Uses an ISPs v6 prex rather than 2002::/16 thus limiting the
CE router
www.afrinic.net | slide 20
www.afrinic.net | slide 21
Transition Mechanisms !
IPv6 Traffic over ISPs Access Network Tunneled within v4, follows v4 routing Tunneled within v4, follows v4 routing
www.afrinic.net | slide 22
x bits
y bits
128 - (x + y) bits
"! X typically ranges from 12 32 bits "! Y typically ranges from 8 32 bits "! Try to ensure that:
!! (x + y) < 64 so client can still have subnets !! Prex lifetimes on LAN <=WANv4 address lease time
www.afrinic.net | slide 23
Transition Mechanisms !
www.afrinic.net | slide 24
"! Install a default route to the 6rd BR "! Install a black hole route to the auto-delegated prex "! Install routes for any advertise LAN-side prexes
www.afrinic.net | slide 25
Advantages of 6rd !
Transition Mechanisms !
! Allows SP provide v6 over v4-only access network ! SP can start building v6 experience while migrating rest of the
www.afrinic.net | slide 26
Transition Mechanisms !
"! An XMS object retrieved after v4 connectivity is established "! A DNS record "! SMIv3 MIB "! PPP IPCP "! Manually by the administrator "! DHCPv4 OPTION_6RD (212)
www.afrinic.net | slide 28
Transition Mechanisms !
Transition Mechanisms !
Transition Mechanisms !
(cong)#interface tunnel tunnel-number 2 | Specify the tunnel source (cong-if)tunnel source {interface type-number | a.b.c.d} 3 | Specify the tunnel destination (manual tunnels only) (cong-if)tunnel destination a.b.c.d | hostname 4 | Assign and IPv6 address to the tunnel (cong)#ipv6 address address/prex-length 5 | Specify the type of the tunnel (cong)#tunnel mode mode
www.afrinic.net | slide 31
Conguration Parameter Type Tunnel Mode Manual GRE/IPv4 6to4 6rd ISATAP ipv6ip gre ip ipv6ip 6to4 Ipv6ip 6rd ipv6ip isatap
www.afrinic.net | slide 32
Tunnel Source
An IPv4 address or a reference to an interface on which an IPv4 address has been congured.
IPv4 address
!! Stateful - one to many v4 address mapping !! Stateless - one to one address mapping with only IP & ICMP
header translation) "! Current Implementations !! Ecdysis (free and Open Source) !! MS Forefront UAG DirectAccess !! Cisco CGv6
www.afrinic.net | slide 33
Transition Mechanisms !
2
A A A A ? w w w w w 64 w.e .e :ff xa xa 9b m m pl ::c ple e. 00 .c co o 0: m m 20 = 6
A? www.examp le.com
m = 192.0.2.6
Regular DNS
5 DNS64
3 www.example.co
v6 Host 2001:db8::2
Inside: 2001:db8::1 Outside: 192.0.2.1 s rc:19 7 2.0.2 6 0 2 : d 0 .1 s 0 t :192 :c0 : NAT64 b . 0 9 f .2.6 :64:f t s 2 s r : c : d : 8 1 | 92.0 9 1:db 8::2 0 .2.6 b 0 d d 2 : s : t 1 c : r 0 1 s 9 0 2 | .0.2. 8 10 6 src:2 206 : 1 0 0 0 c : : b 4:f f9 6 [ : c sr
www.afrinic.net | slide 36
IPv6!Business!Readiness!!Class!Discussion !
After this section, you should be able to:
! ! ! ! Describe the various roadblocks holding back IPv6. Brainstorm solutions to the above problems. Identify the key messages to use in selling IPv6 to management Brainstorm a generic IPv6 deployment framework and tailor it to your own organisation.
Discussion Points !
IPv6 Business Readiness !
! Challenges you anticipate in your move to IPv6 ! Addressing plan ideas ! What kind of help do you need? ! Suggestions for over-coming the challenges.
www.afrinic.net | slide 38
! Raise awareness ! Training ! Network equipment and application audit ! Modify all RFPs to make IPv6 support mandatory ! Plan to replace all non-v6 devices/applications with v6-capable versions. ! Get your IPv6 allocation ! Enable both IPv6 and IPv4 on your network ! If ISP doesnt support v6 transit, consider using tunnels
www.afrinic.net | slide 39
"! On return, gather your colleagues and teach them what you have
learnt. "! Subscribe to afripv6-discuss@afrinic.net and share experiences/ learn. "! Make IPv6 support mandatory in all your equipment and software purchases. "! Get rid of all non-v6 capable operating systems in your network. "! Set up a small lab and start experimenting with v6.
www.afrinic.net | slide 40
Thank U | Questions ? !
www.afrinic.net