ipv6 – the future of the internet redbrick networking conference 26 march 2003 dave wilson
DESCRIPTION
IPv6 – The Future Of The Internet Redbrick Networking Conference 26 March 2003 Dave Wilson [email protected] DW238-RIPE. What's in store. Why bother The transition Doing it NOW (yes, RIGHT NOW!) Where to go from here. Disclaimers. My opinions, not necessarily those of my employer - PowerPoint PPT PresentationTRANSCRIPT
IPv6 – The Future Of The Internet
Redbrick Networking Conference26 March 2003
Dave [email protected]
DW238-RIPE
What's in store
● Why bother
● The transition
● Doing it NOW (yes, RIGHT NOW!)
● Where to go from here
Disclaimers
● My opinions, not necessarily those of my employer
● Use at your own risk● No warranty express or implied● I may be misguided, misinformed or
misunderstood● or on crack, for that matter● Best Before June 19100● etc● etc● etc
“But why would I want to use it?”
Why a new protocol?
Conservation of addresses(is a hassle)
Why a new protocol?
Restore the end-to-end(and die, NAT, die)
Why a new protocol?
Stateless autoconfiguration(and take the effort out of the
host)
Why a new protocol?
Simplify address allocation(and take the effort out of the
network)
What IPv6 won't fix
It won't slow down routing table growth
It won't fix QoS, rate-limiting, bandwidth allocation
It won't stop spam (or solve security)
It won't solve world peace,global warming, etc
Addressing and Routing
The good old days
193.1.219.94/25
● 32 bits● Variable subnet size● Allocation depends on need
The new world order
193.1.219.94/252001:770:18:2:260:cfff:fe20:f45c/64
● 128 bits● Variable subnet size● IETF mandates /64 for every LAN● "::" means "pad with zeros"
Routing in IPv6
● IP is still IP● Class A, B, C long gone● Get your addresses from your ISP● Can do everything the old way, but...
Routing in IPv6
● IP is still IP● Class A, B, C long gone● Get your addresses from your ISP● Can do everything the old way, but...
The killer app:Neighbour Discovery
Reaching the host
IPv4 uses A recordsIPv6 uses AAAA records
athene IN A 193.1.219.94
athene IN AAAA 2001:770:18:2:260:cfff:fe20:f45c
Client attempts IPv6 first (AAAA record)and if that fails, IPv4 (A record)
“So we turn off IPv4 when, exactly?”
Transition technologies
Automatic tunnels (::1.2.3.4) IPv4-compatible addresses (::1.2.3.4)
● Dual stack
● Configured tunnels
● 6to4
● NAT-PT
Dual stacking
● Each host gets an IPv4 and IPv6 address
● Server software binds to both addresses
● DNS contains both records
● v4 clients will use the old path
● v6 clients will use the new one,and failover to v4
Dual stacking
Use this when
● You already have global v4 address space
● You have native connectivity
● You have a tunnel + neighbour discovery on your LAN
Configured tunnels
● IPv6 connection in an IPv4 path
● Set up by agreement between you and someone on the 6bone
● Saves dual-stacking your router
First v6 hop may be an inefficient path
Uses CPU on the endpoint
Configured tunnels
Use these when
● It's your first IPv6 connection
● Your ISP doesn't support native v6 (ask!!)
● You want to connect one or a few machines
6to4
You have an IPv4 address
193.1.219.117/32
6to4
You have an IPv4 address
193.1.219.117/32
You've been reserved an IPv6 subnet
2002:c101:dbd9::/48
6to4
You have an IPv4 address
c1.01. db. d9/32
You've been reserved an IPv6 subnet
2002:c101:dbd9::/48
6to4
● Set your default route to the 6to4 anycast relay router
● Your host tunnels traffic to that router
● Return traffic is tunnelled to the encoded IPv4 address
6to4
Use this when
● You've no native connectivity● You can't have (or don't want)
a configured tunnel● You have a static global IPv4 address
(or don't mind it changing)
Really fast, easy, no messing setup The route might suck
“But when is it going to get here?”
How to get connectivity
Ask your ISP!
Enabling IPv6 on the host
● Linux 2.4.* (2.2 with effort)● Red Hat 7.2+,● Debian Stable● Solaris 8● Tru64 V5.1● FreeBSD 4.3● Windows XP (or 2000 with research stack)
● Some sort of global IPv4 address- protocol 41 unfirewalled
Compile the Kernel
● Not needed for Red Hat 7.2
● Turn on experimental options
● Turn on IPv6 under networking options
● Optionally, IPv6 firewalling
On Red Hat 7.2+
[/etc/sysconfig/network] NETWORKING_IPV6=yes
...and restart networking (or reboot)
Native connections
eth0 Link encap:Ethernet HWaddr 00:50:04:EA:43:64
inet addr:193.1.219.136 Bcast:193.1.219.255 Mask:255.255.255.128
inet6 addr: fe80::250:4ff:feea:4364/10 Scope:Link
inet6 addr: 2001:770:18:1:250:4ff:feea:4364/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9821540 errors:0 dropped:0 overruns:0 frame:0
TX packets:3651133 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:204455702 (194.9 Mb) TX bytes:1439984168 (1373.2 Mb)
Interrupt:10 Base address:0xe400
Native connections
eth0 Link encap:Ethernet HWaddr 00:50:04:EA:43:64
inet addr:193.1.219.136 Bcast:193.1.219.255 Mask:255.255.255.128
inet6 addr: fe80::250:4ff:feea:4364/10 Scope:Link
inet6 addr: 2001:770:18:1:250:4ff:feea:4364/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:9821540 errors:0 dropped:0 overruns:0 frame:0
TX packets:3651133 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:204455702 (194.9 Mb) TX bytes:1439984168 (1373.2 Mb)
Interrupt:10 Base address:0xe400
6to4 – Red Hat 7.2+
[/etc/sysconfig/network-scripts/ifcfg-eth0][/etc/sysconfig/network-scripts/ifcfg-ppp0]
IPV6INIT=yes
IPV6_AUTOCONF=no
IPV6FORWARDING=no
IPV6TO4INIT=yes
IPV6TO4_RELAY="192.88.99.1"
IPV6TO4_ROUTING="eth0-:f101::0/64 eth1-:f102::0/64"
Tunnel vs. 6to4
www.sixxs.net
So “ping” works. Where next?
Your [n+1]th machine
● No need to statically configure address, tunnel, anything
● Run radvd on your nominated router
● Address assigned using EUI-64
Security
●Get rid of NAT●Get rid of NAT●Get rid of NAT●Get rid of NAT●Get rid of NAT●Get rid of NAT
●Get rid of NAT●Get rid of NAT●Get rid of NAT●Get rid of NAT●Get rid of NAT●Get rid of NAT
Security
Globally addressable
does not mean
Globally reachable
Common services
● Cisco● 12.2T for 2500-7500● 12.0(23)S for 12000● 12000 requires Engine III line cards for
line rate forwarding
● Juniper● All recent versions of JUNOS● Line rate forwarding
Common services
● SMTP Sendmail, Exim● POP, IMAP Courier● LISTSERV via mail+web server● DNS Bind 9● SSH OpenSSH
● Web server Apache 2● News server Diablo● Web cache Squid+patches
Where next?
IPv6-HOWTO at http://www.tldp.org/
http://www.ipv6.heanet.ie/docs/v6linux/
http://www.6bone.net/
http://www.freenet6.net/
http://www.hs247.com/
This slide intentionally left blank