Internet2 IPv6 Workshop

2. Acknowledgements Larry Blunk Joe Breen Grover Browning Bill Cerveny Bruce Curtis Christine Dorsey Dale Finkelson Michael Lambert Richard Machida Bill Manning Bill Owens Michael Sinatra Chris Spears Rick Summerhill Brent Sweeny

4. V4 Problems? How much IPv4 space do you have and what should you expect to get? Campus X has a /16, a /20 and a /22. What do you have available? Is that enough? Not really � are you relying on RFC 1918 space internally or using NAT anywhere?

5. V4 Problems So why don�t I just get more? There are 26 /8�s left in the world (10/2009) - that is to say, /8�s that IANA had not allocated to one of the RIR�s. Allocated at rate of one to two per month Exhaustion estimated between 11/2010 (Cisco) and 2/2011 (Geoff Huston/APNIC) Reality is, you may never meet your campus's needs with what you can get from ARIN. http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml Widget: http://inetcore.com/project/ipv4ec/

6. V4 Problems But does this really matter? What does the world look like if the pool of unallocated IPv4 addresses is essentially zero (0)? What corner is your network forced into? Maybe new and cool NAT�s just solve all our problems? Do we believe that?

7. V4 Problems Being good capitalists maybe we all believe the market will solve the problem? What would you pay for a /18 from some organization that happened to have one not in use? What would lots of small ISP's pay for lots of /24�s? These proposals are real ARIN has had several proposed �transfer� policies APNIC nearing adoption of liberal transfer policy (prop-050-v003)

8. V4 Problems Lets see there are about 290,000 routes in the default free zone just now (10/2009). Can your edge routers stand up to say 600,000 when you have 2 or 3 feeds because of course you need redundancy. Can you afford routers that can do that?

9. V4 Problems Can you manage a network or diagnose a problem that is 3 layers of NAT deep? Can you envision a routing scheme that allows us to address some of these issues? LISP, HLP, CRIO, etc...

10. Does V6 solve all this? Well of course - he says with a relatively straight face. It does address any issues that you may have in dealing with NAT or private network space issues. As you will see, you will not have a problem with the numbers of addresses.

11. Does V6 solve all this? In fact, it may add to the routing problem. After all there are now lots of address blocks that are up to four times as long that need to be included in the tables. On the other hand if you believe that there are problems around building non-public networks it does not really matter if it solves all our problems.

12. Do we have other motivations? There are over 350 million students in China's education system Do you for a minute believe that IPv4 will scale there? There are IPv6-only networks on the internet Do you have programs with foreign universities? If they move to IPv6, where does that leave you and those students? If your website & services are only accessible via IPv4, will you ever know what opportunities you've missed?

13. Do we have other motivations? We may be able to deal with translators until the day that a researcher needs something that is actually fast and the other end is IPv6 only.

14. IPv6 Addressing

15. Overview of Addressing Historical aspects What are the types of IPv6 addresses? How are IPv6 addresses used? Internet2 recommendations for IPv6 addressing.

16. Historical Aspects of IPv6 IPv4 address space not big enough Can�t get needed addresses (particularly outside the Americas) Routing table issues Resort to private (RFC1918) addresses Competing plans to address problem Some 64-bit, some 128-bit Current scheme unveiled at Toronto IETF (July 1994)

17. IPv4 address space not big enough This led to the development of NAT. Increased use of NAT has had an effect on the uses the Internet may be put to. The loss of transparency has an effect on management and use of the Internet. The use of NAT will lead to an increased bifurcation of the Internet. Application rich Application poor Affects our ability to manage and diagnose the network.

18. Types of IPv6 Addresses Like IPv4� Unicast An identifier for a single interface. A packet sent to a unicast address is delivered to the interface identified by that address. Multicast An identifier for a set of interfaces (typically belonging to different nodes). A packet sent to a multicast address is delivered to all interfaces identified by that address. Anycast: An identifier for a set of interfaces (typically belonging to different nodes). A packet sent to an anycast address is delivered to one of the interfaces identified by that address (the "nearest" one, according to the routing protocols' measure of distance). Specified in the v6 address architecture RFC 4291. Anycast is there -- we�ll use it someday. Current usefulness limited to 6to4Anycast is there -- we�ll use it someday. Current usefulness limited to 6to4

19. What is not in IPv6 Broadcast There is no broadcast in IPv6. This functionality is taken over by multicast. Want to do discussion about NAT -- bill owens to do a few slides on NATWant to do discussion about NAT -- bill owens to do a few slides on NAT

20. How are IPv6 addresses used? Generally they are thought of as having two distinct components. 64-bit field designated as the network portion. 64-bit field designated as the host portion. Not always the case Point-to-point links don't need 64-bits of addressable space Some suggest 112-bit network, 16-bit host Lively debate amongst network operators Not completely different than IPv4, but more thought out and integral to IPv6Not completely different than IPv4, but more thought out and integral to IPv6

21. Host portion Generally called Interface Identifiers The host portion/interface id is guaranteed unique on the subnet Though it could be re-used on the same interface Essentially these are the same as EUI-64 addresses See Appendix A on RFC 4291 These may be used with all forms of unicast addressing.

22. Interface Identifiers EUI-64 address derived from MAC addresses: 00-02-2d-02-82-34 0202:2dff:fe02:8234 The rules are: Insert fffe after the first 3 octets Last 3 octets remain the same Place a �1� in the 7th leftmost bit Universal/local bit A 1 in that place indicates the MAC address is unique. Bill owens to move description about why EUI-64 flipped bitsBill owens to move description about why EUI-64 flipped bits

23. Interface Identifiers Privacy addresses: Some concern was expressed about having one�s MAC address be public - h/w identifier, persistent The response was to standardize privacy addresses (RFC 3041). These use random 64-bit numbers instead of EUI-64. May change for different connections On by default in Windows, off by default in Linux (/proc/sys/net/ipv6/conf/default/use_tempaddr), OSX and BSD (net.inet6.ip6.use_tempaddr)

24. Interface Identifiers IPv6 addresses of all types are assigned to interfaces, not nodes. An IPv6 unicast address refers to a single interface. Since each interface belongs to a single node, any of that node's interfaces' unicast addresses may be used as an identifier for the node.

25. Interface Identifiers A host is required to recognize the following addresses as identifying itself: A link-local address for each interface Any assigned unicast and anycast addresses Loopback address All-nodes multicast addresses Solicited-node multicast address for each of its unicast and anycast addresses Multicast addresses of all other groups to which the node belongs

26. Interface Identifiers A router is required to recognize: All addresses it must recognize as a host, plus The subnet-router anycast addresses for the interfaces it is configured to act as a router on All other anycast addresses with which the router has been configured All-routers multicast addresses

27. Representation of Addresses All addresses are 128 bits Write as sequence of eight groups of four hex digits (16 bits each) separated by colons E.g. 3ffe:3700:0200:00ff:0000:0000:0000:0001 More on this later... Add privacy addressingAdd privacy addressing

28. Types of Unicast Addresses Unspecified address All zeros (::) Used as source address during initialization Also used in representing default Loopback address Low-order one bit (::1) Same as 127.0.0.1 in IPv4

29. Types of Unicast Addresses Link-local address Unique on a subnet Auto configured High-order: FE80::/10 Low-order: interface identifier Routers must not forward any packets with link-local source or destination addresses.

30. Types of Unicast Addresses Unique local addresses RFC 4193 replacing site-local addresses, which were deprecated in RFC 3879 The structure is: fdUU:UUUU:UUUU:<subnet>:<interface id> Here �fdUU:UUUU:UUUU� stands for a network id that is globally unique but used locally. These are /48�s. Not everyone thinks ULAs are a great idea http://www.nanog.org/meetings/nanog40/presentations/ula-nanog.pdf (R.Bush)

31. Types of Unicast Addresses Other address types have been proposed for transition purposes: We will not be using or discussing these. You should be aware of addresses like 2002:815d:f407::815d:f407 2002::/16 reserved for 6to4 tunneling Easily configured on WinXP, Vista, OS X, etc General structure is: 2002:<ipv4 address>:<subnet>:<interface id>

32. Address Deployment There have been many discussions of how to make use of the immense IPv6 address space. Suggestions included: Provider-Independent (PI) Provider-Assigned (PA) Geographical PA addressing was specified in the RFC�s In this case it is important to understand the difference between allocation and assignment. PI is being used by default. Issues around multi-homing initially drove this. Registries are providing address space. Either /48�s or /32�s.

33. Types of Unicast Addresses Aggregatable global unicast address space. Used in production IPv6 networks This is where your address space will come from From range 2000::/3 Some examples are 2001:468::/32 - Internet 2 2607:f320/32 - University of Nebraska 2610:a8::/32 - OARnet Might want to consider removing abbreviations -- concept still there although language is changing.Might want to consider removing abbreviations -- concept still there although language is changing.

34. Internet Registry Hierarchy Regional IR - designated by IANA (ARIN, RIPE, APNIC, AfriNIC, LACNIC) Local IR - ISP, or other network provider RIR -> LIR, LIR -> customer (or smaller provider) Still basically correct, but now giving out /32s at start.Still basically correct, but now giving out /32s at start.

35. Anycast Address Interfaces (I > 1) can have the same address. The low-order bits (typically 64 or more) are zero. A packet sent to that address will be delivered to the topologically-closest instance of the set of hosts having that address. Examples: subnet-router anycast address (RFC 4291) reserved subnet anycast address (RFC 2526) 6to4 relay anycast address (RFC 3068) First bullet needs to be rewritten to be more accurate. Is second statement accurate??First bullet needs to be rewritten to be more accurate. Is second statement accurate??

36. Multicast Address From FF00::/8 1111 1111 | flgs (4) | scope (4) | group id (112)| Flags 000t t=0 means this is a well-known address t=1 means this is a transitory address Low-order 112 bits are group identifier, not interface identifier Scope and Flags are independent of each other Well-known and local is different from well-known and global Emphasize that multicast is more thought out and not just thrown in.Emphasize that multicast is more thought out and not just thrown in.

37. Obtaining Addresses If you are a gigaPoP or a direct connect send a note to the Internet 2 NOC with a request. Will set the wheels in motion If you connect to a gigaPoP you should obtain your address block from that gigaPoP� talk to them first. Remember the minimum you should receive is a /48. More is OK if you can negotiate for a larger block. You could also go directly to ARIN. In that case look to get a /32 Add �contact your gigapop, if appropriateAdd �contact your gigapop, if appropriate

47. Change to Allocation Strategies �Example�Change to Allocation Strategies �Example�

48. Small type bits, large type digitsSmall type bits, large type digits

50. Update draft name and version (4) Update draft name and version (4)

51. Exercise �Exercise �

62. Note that Null0 does not go into the core routerNote that Null0 does not go into the core router

98. Ping-nycm.abilene.ucaid.edu may be invalidPing-nycm.abilene.ucaid.edu may be invalid

101. Remove GPN from headersRemove GPN from headers

102. Michael suggestted having descriptions display when cursor is over field in previous pageMichael suggestted having descriptions display when cursor is over field in previous page

103. Discuss PMTU discovery because it is significantly different than IPv4Discuss PMTU discovery because it is significantly different than IPv4

106. From RFC 2460: �The Routing header is used by an IPv6 source to list one or more intermediate nodes to be "visited" on the way to a packet's destination. This function is very similar to IPv4's Loose Source and Record Route option.�From RFC 2460: �The Routing header is used by an IPv6 source to list one or more intermediate nodes to be "visited" on the way to a packet's destination. This function is very similar to IPv4's Loose Source and Record Route option.�

109. �The Destination Options header is used to carry optional information that need be examined only by a packet's destination node(s).��The Destination Options header is used to carry optional information that need be examined only by a packet's destination node(s).�

111. According to RFC2460, this is only a �recommended� order: �IPv6 nodes must accept and attempt to process extension headers in any order and occurring any number of times in the same packet, except for the Hop-by-Hop Options header which is restricted to appear immediately after an IPv6 header only. Nonetheless, it is strongly advised that sources of IPv6 packets adhere to the above recommended order until and unless subsequent specifications revise that recommendation.�According to RFC2460, this is only a �recommended� order: �IPv6 nodes must accept and attempt to process extension headers in any order and occurring any number of times in the same packet, except for the Hop-by-Hop Options header which is restricted to appear immediately after an IPv6 header only. Nonetheless, it is strongly advised that sources of IPv6 packets adhere to the above recommended order until and unless subsequent specifications revise that recommendation.�

117. Bill Owens will elaborate on multicastBill Owens will elaborate on multicast

122. Add canned IPv6 dumps Perhaps demonstrate live IPv6 dumps with ethereal or show canned dumps with etherealAdd canned IPv6 dumps Perhaps demonstrate live IPv6 dumps with ethereal or show canned dumps with ethereal

131. Neighbor Discovery Solicited-node multicast address multicast group for every IPv6 address on link Substitute last 3-octets of IPv6 address in ff02::1:ff00:0000/104 2001:468:123::ce97:7fce becomes ff02::1:ff97:7fce Map into ethernet frame First two octets are 33-33 MAC address: 33-33-FF-97-7F-CE

138. IP Fields: Source Address MUST be the link-local address assigned to the interface from which this message is sent. Destination Address Typically the Source Address of an invoking Router Solicitation or the all-nodes multicast address. Hop Limit 255 Authentication Header If a Security Association for the IP Authentication Header exists between the sender and the destination address, then the sender SHOULD include this header. Narten, et. al. Standards Track [Page 18] RFC 2461 Neighbor Discovery for IPv6 December 1998 ICMP Fields: Type 134 Code 0 Checksum The ICMP checksum. See [ICMPv6]. Cur Hop Limit 8-bit unsigned integer. The default value that should be placed in the Hop Count field of the IP header for outgoing IP packets. A value of zero means unspecified (by this router). M 1-bit "Managed address configuration" flag. When set, hosts use the administered (stateful) protocol for address autoconfiguration in addition to any addresses autoconfigured using stateless address autoconfiguration. The use of this flag is described in [ADDRCONF]. O 1-bit "Other stateful configuration" flag. When set, hosts use the administered (stateful) protocol for autoconfiguration of other (non-address) information. The use of this flag is described in [ADDRCONF]. Reserved A 6-bit unused field. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. Router Lifetime 16-bit unsigned integer. The lifetime associated with the default router in units of seconds. The maximum value corresponds to 18.2 hours. A Lifetime of 0 indicates that the router is not a default router and SHOULD NOT appear on the default router list. The Router Lifetime applies only to the router's usefulness as a default router; it does not apply to information contained in other message fields or options. Options that need time limits for their information include their own lifetime fields. Reachable Time 32-bit unsigned integer. The time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation. Used by the Neighbor Unreachability Detection algorithm (see Section 7.3). A value of Narten, et. al. Standards Track [Page 19] RFC 2461 Neighbor Discovery for IPv6 December 1998 zero means unspecified (by this router). Retrans Timer 32-bit unsigned integer. The time, in milliseconds, between retransmitted Neighbor Solicitation messages. Used by address resolution and the Neighbor Unreachability Detection algorithm (see Sections 7.2 and 7.3). A value of zero means unspecified (by this router). Possible options: Source link-layer address The link-layer address of the interface from which the Router Advertisement is sent. Only used on link layers that have addresses. A router MAY omit this option in order to enable inbound load sharing across multiple link-layer addresses. MTU SHOULD be sent on links that have a variable MTU (as specified in the document that describes how to run IP over the particular link type). MAY be sent on other links. Prefix Information These options specify the prefixes that are on-link and/or are used for address autoconfiguration. A router SHOULD include all its on-link prefixes (except the link-local prefix) so that multihomed hosts have complete prefix information about on- link destinations for the links to which they attach. If complete information is lacking, a multihomed host may not be able to choose the correct outgoing interface when sending traffic to its neighbors.IP Fields: Source Address MUST be the link-local address assigned to the interface from which this message is sent. Destination Address Typically the Source Address of an invoking Router Solicitation or the all-nodes multicast address. Hop Limit 255 Authentication Header If a Security Association for the IP Authentication Header exists between the sender and the destination address, then the sender SHOULD include this header. Narten, et. al. Standards Track [Page 18] RFC 2461 Neighbor Discovery for IPv6 December 1998 ICMP Fields: Type 134 Code 0 Checksum The ICMP checksum. See [ICMPv6]. Cur Hop Limit 8-bit unsigned integer. The default value that should be placed in the Hop Count field of the IP header for outgoing IP packets. A value of zero means unspecified (by this router). M 1-bit "Managed address configuration" flag. When set, hosts use the administered (stateful) protocol for address autoconfiguration in addition to any addresses autoconfigured using stateless address autoconfiguration. The use of this flag is described in [ADDRCONF]. O 1-bit "Other stateful configuration" flag. When set, hosts use the administered (stateful) protocol for autoconfiguration of other (non-address) information. The use of this flag is described in [ADDRCONF]. Reserved A 6-bit unused field. It MUST be initialized to zero by the sender and MUST be ignored by the receiver. Router Lifetime 16-bit unsigned integer. The lifetime associated with the default router in units of seconds. The maximum value corresponds to 18.2 hours. A Lifetime of 0 indicates that the router is not a default router and SHOULD NOT appear on the default router list. The Router Lifetime applies only to the router's usefulness as a default router; it does not apply to information contained in other message fields or options. Options that need time limits for their information include their own lifetime fields. Reachable Time 32-bit unsigned integer. The time, in milliseconds, that a node assumes a neighbor is reachable after having received a reachability confirmation. Used by the Neighbor Unreachability Detection algorithm (see Section 7.3). A value of Narten, et. al. Standards Track [Page 19] RFC 2461 Neighbor Discovery for IPv6 December 1998 zero means unspecified (by this router). Retrans Timer 32-bit unsigned integer. The time, in milliseconds, between retransmitted Neighbor Solicitation messages. Used by address resolution and the Neighbor Unreachability Detection algorithm (see Sections 7.2 and 7.3). A value of zero means unspecified (by this router). Possible options: Source link-layer address The link-layer address of the interface from which the Router Advertisement is sent. Only used on link layers that have addresses. A router MAY omit this option in order to enable inbound load sharing across multiple link-layer addresses. MTU SHOULD be sent on links that have a variable MTU (as specified in the document that describes how to run IP over the particular link type). MAY be sent on other links. Prefix Information These options specify the prefixes that are on-link and/or are used for address autoconfiguration. A router SHOULD include all its on-link prefixes (except the link-local prefix) so that multihomed hosts have complete prefix information about on- link destinations for the links to which they attach. If complete information is lacking, a multihomed host may not be able to choose the correct outgoing interface when sending traffic to its neighbors.

143. This is essentially a duplicated slide from neighbor solicitation discussionThis is essentially a duplicated slide from neighbor solicitation discussion

146. Cisco SLAAC/ND Options advertisement-interval dad managed-config-flag ns-interval other-config-flag prefix ra-interval ra-lifetime reachable-time suppress-ra Send an advertisement interval option in RA's Duplicate Address Detection Hosts should use DHCP for address config Set advertised NS retransmission interval Hosts should use DHCP for non-address config Configure IPv6 Routing Prefix Advertisement Set IPv6 Router Advertisement Interval Set IPv6 Router Advertisement Lifetime Set advertised reachability time Suppress IPv6 Router Advertisements

148. DHCPv6

149. Overview Development and basic operation Implementation notes (and gotchas) Configuration tips (and gotchas) Lab

150. Development of DHCPv6 Not everyone saw the need Stateless autoconfiguration allows clients to bootstrap IPv6 addresses. Seen as providing same functionality as DHCPv4, so don't need DHCP in IPv6, right? Reasons for DHCP(v6) Provide DNS information: currently no other automated way to do this (RFC 5006 is largely unimplemented).

151. Development of DHCPv6 (cont) Reasons for DHCPv6 (cont) Better control and tracking of IPv6 address usage. Centralized mechanism for DDNS updates. DHCPv6 specified in RFC 3315 Anycast is there -- we�ll use it someday. Current usefulness limited to 6to4Anycast is there -- we�ll use it someday. Current usefulness limited to 6to4

152. DHCPv6 Basics Differences from DHCPv4 Sends solicit (akin to discover) messages to link-local multicast address, not broadcast. Uses autoconfigured link-local address as source (instead of 0.0.0.0) during solicitation. No provision for assigning default router(s)--this must be done via RAs. DHCPv6 server can send messages to clients to trigger a reconfiguration.

153. DHCPv6 Basics Initial interaction (C: Client link-local; S: Server; M: link-local multicast address [FF02::2]) C ? M: SOLICIT S ? C: ADVERTISE C ? S: REQUEST S ? C: REPLY C ? S: CONFIRM A bit chatty, huh? Want to do discussion about NAT -- bill owens to do a few slides on NATWant to do discussion about NAT -- bill owens to do a few slides on NAT

154. DHCPv6 Basics Rapid Commit option: added to SOLICIT messages to indicate that the client is willing to accept a reply from the first server: C ? M: SOLICIT [w/Rapid Commit set] S ? C: REPLY C ? S: CONFIRM This is also used when an information-only request is being made (see next slide). Not completely different than IPv4, but more thought out and integral to IPv6Not completely different than IPv4, but more thought out and integral to IPv6

155. DHCPv6 Requests Options for addressing Included as part of the SOLICIT message. Identity Association (IA): �A collection of addresses assigned to a client.� (RFC 3315, page 10) IA_NA: IA for non-temporary addresses IA_TA: IA for temporary addresses IA_NA is most commonly supported (and used) option for getting addresses from a DHCPv6 server.

156. DHCPv6 Requests INFORMATION-REQUEST: This is sent as a separate message type from REQUEST, and indicates that the client does not wish to receive addresses, but does want other config information: C ? M: INFORMATION REQUEST S ? C: REPLY C ? S: CONFIRM RENEW: Similar to IPv4. Client sends RENEW message to server that assigned address. If no response, client sends a REBIND message to the multicast address, so that a different server can respond. Bill owens to move description about why EUI-64 flipped bitsBill owens to move description about why EUI-64 flipped bits

157. Leases and Stuff Addresses assigned have lifetimes just as in stateless autoconfiguration. Lifetime determines when client will send RENEW message. Leases are still in DHCPv6. Lease refers to all configuration information received by the DHCPv6 server. Server can also make the client get new configuration information by sending a RECONFIGURE message to the client. Talk about what various operating systems doTalk about what various operating systems do

158. Client/Server Identifier Client no longer uses the hardware address to identify itself. Client may have multiple interfaces. Interfaces may move around. Virtual interfaces and VMs may cause duplicate hardware addresses across a large enterprise. DUID Used for both client IDs and server IDs. If multiple interfaces on one client are configured via DHCPv6, use the SAME DUID for each. Add RFC referenceAdd RFC reference

159. Client/Server Identifier DUID types DUID-LLT: Constructed from the link-layer address of one of the client's interface (which is, in turn, constructed from the hardware address), plus a hardware type and a representation of the time that the DUID was first created. This is the most common type for workstations and servers. DUID-EN: Special DUID assigned directly by the vendor of the device. DUID-LL: Constructed from the link-layer address and hardware type only; useful for embedded devices with non-removable interfaces. Add RFC referenceAdd RFC reference

160. Relaying DHCPv6 has provisions for relaying. Relays communicate with servers (or other relays) via RELAY-FORW and RELAY-REPL messages. These encapsulate messages from clients and servers and allow them to be passed on. Relays can send messages directly to servers or send to a site-wide DHCPv6 server multicast address [FF05::1:3]. Add privacy addressingAdd privacy addressing

161. Relay Implementations Support had been spotty; now getting much better. ISC: Relay agent just implemented in DHCP 4.1.0. WIDE/Kame: Relay has been implemented. Cisco: Most software routers can do relaying now; 6500 support for relaying just implemented in IOS 12.2(33)SXI. Juniper: ???

162. Configs: Cisco Set the managed-config flag. This tells the client to use DHCPv6 to get an address: ipv6 nd managed-config-flag Whoops, that's not quite enough. RFC 2462 states: �It should be noted that the stateless and stateful address autoconfiguration fields in Router Advertisements are processed independently of one another, and a host may use both stateful and stateless address autoconfiguration simultaneously.� Note that Null0 does not go into the core routerNote that Null0 does not go into the core router

163. Configs: Cisco RFC 2462 obsoleted by RFC 4862. This language was deleted from the latter, but RFC 4861 contains the following: �For example, routers can specify whether hosts should use DHCPv6 and/or autonomous (stateless) address configuration.� In other words, as long as the �autoconfiguration� flag is set in the Prefix Information option of the Router Advertisement, the host will do autoconfiguration regardless of the presence of the Managed Configuration flag. This behavior is consistently reflected in all of the major operating systems.

164. Configs: Cisco In order to prevent hosts from doing autoconfiguration, you must tell the router to either not advertise the prefix or unset the autoconfiguration bit in the Prefix Information option. (Support for doing either varies across platforms and IOS versions.) ipv6 nd prefix default no-autoconfig ! or ipv6 nd prefix default no-advertise

165. Configs: Cisco With the Managed Config flag set and autoconfiguration turned off, we only need to turn on DHCPv6 relaying: ! format: ipv6 dhcp relay <address of ! server> ipv6 dhcp relay 2001:468:0d00::50

166. Configs: Cisco To recap, here are the commands we added to the interface: interface Ethernet0 ! [�] ipv6 nd managed-config-flag ipv6 nd prefix default no-advertise ipv6 dhcp relay 2001:468:0d00::50 end

167. Configs: DHCP server Since many higher-ed organizations already use the ISC DHCP server, we will configure DHCP subnets on ISC DHCP 4.1.0: subnet6 2607:f140:800:8001::/64 { range6 2607:f140:800:8001:dddd::/96; } If your DHCP server is on its own subnet, you MUST have a subnet declaration for that network, even if it isn't providing DHCP for that subnet. subnet6 2607:f140:ffff:ffff::/64 { }

168. Configs: DHCP server To assign a fixed IPv6 address, you need to know the DUID of the client: host deftones.dyn.v6.berkeley.edu { host-identifier option dhcp6.client-id 00:01:00:01:10:c6:53:b5:00:d0:b7:6f:db:4c; fixed-address6 2607:f140:800:8cdd:dddd:0:dead:beef; }

169. Configs: Client Client Support: Generally improving Windows Vista: Built in; will try DHCP if the managed config flag is set. (Will also autoconfig if the autoconfig flag is not explicitly unset!) Solaris 10 (10/08): Same as Vista. *BSD: Can either use ISC client or WIDE/Kame client. The latter is a bit easier to configure. Linux: dibbler is a lightweight, easy to configure client. MacOS X: None. There are some ports, but there's not a good scalable, supported client. We'll provide examples for ISC, WIDE/Kame, and dibbler. (No need to do so for Vista and Solaris.)

170. Configs: client ISC: send host-name "reznor.dyn.v6.berkeley.edu"; supersede domain-name "net.berkeley.edu berkeley.edu"; send dhcp6.oro 1, 2, 7, 12, 13, 23, 24, 39;

171. Configs: client WIDE/Kame (note that you must include the id-assoc statement): interface em2 { send ia-na 0; }; id-assoc na 0 { };

172. Configs: client dibbler: # client.conf iface eth0 { ia option dns-server }

173. DHCPv6 Lab Configure user net router interface for DHCPv6 relaying. Don't forget to set the proper flags. Configure DHCPv6 server to hand out addresses. (You may want to make the DHCP addresses obvious by placing :dddd: or something similar as one of the hexadectets.) Configure some clients to get DHCPv6 addresses. Windows Vista should �just work.� Others will require one of the client configurations. Configure the DHCPv6 server to hand out a fixed address, preferably ending is something clever like :dead:beef. (Hint: You'll need to find the DUID of the client. This may involve investigating logging options on the server and/or client.)

179. Add that NATs make something breakAdd that NATs make something break

190. Needs to get expanded Need to add discussion about IGP -- you may have more routes in your IGP than you can handle -- IGPs have the concept of areas and you may want to consider doing those. Needs to get expanded Need to add discussion about IGP -- you may have more routes in your IGP than you can handle -- IGPs have the concept of areas and you may want to consider doing those.

191. Add slide that DHCPv6 is comingAdd slide that DHCPv6 is coming

192. Router Software Versions JUNOS 5.1 and up � Line Rate v6, all T, M, MX, & J-series E-series (junosE) have IPv6 licensing IOS � Use Feature Navigator to find a version (generally an �IP Plus� or �Advanced IP Services� release): http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp IOS 12.2T and 12.3(6a)(LD) IOS 12.0(22)S6 and up � GSR only 6500 with IOS 12.2(17a)SX 7600 with SUP720 card 12.2(17d)SXB Mainline starting with 12.2(33)SXI

193. Routing Protocols iBGP and IGP (RIPng/IS-IS) IPv6 iBGP sessions in parallel with IPv4 (multi-protocol BGP or mBGP) Static Routing all the obvious scaling problems, but works OK to get started, especially using a trunked v6 VLAN. OSPFv3 is available in IOS 12.3 and JUNOS. It runs in a ships-in-the-night mode relative to OSPFv2 for IPv4 � neither knows about the other. For all Cisco shops, EIGRP now supports IPv6

196. 1) Explain problem space 2) Why is multihoming really a problem 3) What is the problem you really have -- host -- network -- end-to-end -- symetry 4) Are there solution space -- Drav�s RFC -- �Don�t allow them� -- Routing policy is determined by multihoming decision -- �Current routing technology mandates multiple-connected sites have PI addresses� - Bill Owens ---- while pi addressing would solve problem, no one is endorsing pi addressing ---- �this is the dirty laundry of ipv6�� this is the skeleton in the closet� �If this particular problem isn�t solved, it doesn�t go� - Bill Owens1) Explain problem space 2) Why is multihoming really a problem 3) What is the problem you really have -- host -- network -- end-to-end -- symetry 4) Are there solution space -- Drav�s RFC -- �Don�t allow them� -- Routing policy is determined by multihoming decision -- �Current routing technology mandates multiple-connected sites have PI addresses� - Bill Owens ---- while pi addressing would solve problem, no one is endorsing pi addressing ---- �this is the dirty laundry of ipv6�� this is the skeleton in the closet� �If this particular problem isn�t solved, it doesn�t go� - Bill Owens

199. Problems With Multiple Addresses If the host or app chooses from several global addresses, that choice overrides policy, may conflict with routing intentions and can break connectivity Address selection rules are complex and controversial; see RFC 3484 Other informational RFCs are RFC 3582, RFC 4116, RFC 4218, RFC 4219

201. What To Do? IPv6 can�t be deployed on a large scale without multihoming support � nobody is disputing this. It seems likely that there will be short-term fixes to allow v6 deployment, and long-term solutions. IETF multi6 and shim6 working groups recent IAB workshop http://tools.ietf.org/html/draft-iab-raws-report-02 three mailing lists that are discussing IPv6 multihoming options http://psg.com/lists/rrg https://www1.ietf.org/mailman/listinfo/ram https://www1.ietf.org/mailman/listinfo/architecture-discuss see also http://www3.tools.ietf.org/group/irtf/trac/wiki/RoutingResearchGroup http://www.space.net/~gert/RIPE/ipv6-filters.html

202. Get PI Space The RIRs have revised their rules for allocating PI space; the key is that you must plan to assign 200 /48s within 2 years. This isn�t as hard as it sounds, but it is probably something only gigaPoPs or large university systems can do (exercise in creativity). This breaks when commodity providers start offering IPv6 (unless the gigaPoP aggregates all the commodity providers as well as R&E). Also, ARIN has started providing /48s to end-user organizations. from 2620:0::/23� see http://www.arin.net/policy/nrpm.html#six58

209. Add that NATs make something breakAdd that NATs make something break

214. How to do this in a NAT -- toredo should fix problem, but otherwise can�t be done. Dale is going to reposition this slide as �this is a problem� instead of �you should do this right now�How to do this in a NAT -- toredo should fix problem, but otherwise can�t be done. Dale is going to reposition this slide as �this is a problem� instead of �you should do this right now�

215. S/accessable/accessible/S/accessable/accessible/

216. S/Linux/BSD/S/Linux/BSD/

221. LAN Security Neighbor Discovery ARP-poisoning/spoofing in IPv4 Secure Neighbor Discovery (SEND) RFC 3971 Few working implementations Create & manage certificates (PKI)

222. LAN Security Rogue Router-Advertisements If you are routing IPv6, can hijack hosts Sniff traffic Or, a not-so �graceful� re-addressing of your network If not routing IPv6, can hijack IPv4 hosts with IPv6 enabled RA-Guard? IETF draft, expires 11/2009 Deploy filters to each edge-port?

223. LAN Security Cisco IOS - RA filter ! ipv6 access-list RA-FILTER deny icmp any any router-advertisement ! interface GigabitEthernet1/22 ipv6 traffic-filter RA-FILTER in ! Only supported as port-filter on certain platforms Requires �IP Services� image

224. LAN Security Juniper JUNOS - RA filter [edit firewall family inet6] set filter RA-FILTER term BLOCK-RA from next-header icmpv6 set filter RA-FILTER term BLOCK-RA from icmp-type router-advertisement set filter RA-FILTER term BLOCK-RA then discard set filter RA-FILTER term ACCEPT-ALL then accept [edit interfaces ge-0/0/1] set family inet6 filter input RA-FILTER

225. Backbone Security Router/switch control plane IGP authentication Access-lists and firewall filters uRPF

226. Backbone Security Router/switch control plane Fairly standard here - if you protect for IPv4, then protect for IPv6 SSH/telnet (vty access) If IPv6 transport is available BGP peers SNMP (eventually) Any web-baed configuration utilities Be careful if filtering ICMP

227. Backbone Security IGP Authentication ISIS has simple-authentication (MD5) per-link + level (area) wide OSPFv3 specifies use of IPsec Juniper: configure security-association Cisco AH - 12.3(4)T, 12.4(2)T ESP - 12.4(9)T IOS-XR >= 3.2

228. Backbone Security Access-lists and firewall filters Cisco IPv6 access-lists contain implicit terms to allow neighbor discovery: permit icmp any any nd-na permit icmp any any nd-ns deny ipv6 any any ACL�s cannot be used in vlan access-maps �ipv6 traffic-filters� not supported on all platforms Juniper FW filters have implicit discard Must manually allow neighbor-discovery

229. Backbone Security Watch out for router/application access control lists and various IPv6 address types IPv6 mapped addresses can cause problems if application uses them and you don�t allow them IPv6 multicast groups are necessary for basic network connectivity Routers will use link-local addresses for routing Compressed access-lists Limitations on filtering in 7600/6500 Use middle 16-bits of host-identifier for layer-4 port information Assumes autoconf being used (0xFFFE)

230. Backbone Security Unicast Reverse-Path Forwarding BCP38 still holds Performed in software on many platforms Resource exhaustion Only GSR�s, newish 4500-series had it hardware.. Not just a dCEF issue, but maybe a key-size issue for TCAM lookups Juniper is in siliconOnly GSR�s, newish 4500-series had it hardware.. Not just a dCEF issue, but maybe a key-size issue for TCAM lookups Juniper is in silicon

231. Firewalls Firewalls on both hosts and the network On by default? Permissive by default? Feature parity with IPv4? Network appliances (IDS/IPS) Packeteer (Blue Coat) can�t read layer-4 headers, but can pass-thru IPv6 Only GSR�s, newish 4500-series had it hardware.. Not just a dCEF issue, but maybe a key-size issue for TCAM lookups Juniper is in siliconOnly GSR�s, newish 4500-series had it hardware.. Not just a dCEF issue, but maybe a key-size issue for TCAM lookups Juniper is in silicon

232. Network Services Authentication TACACS, Radius, etc SNMP - both transport and MIBS Monitoring utilities Network device support for: NTP over IPv6 Syslog over IPv6 DNS over IPv6 Only GSR�s, newish 4500-series had it hardware.. Not just a dCEF issue, but maybe a key-size issue for TCAM lookups Juniper is in siliconOnly GSR�s, newish 4500-series had it hardware.. Not just a dCEF issue, but maybe a key-size issue for TCAM lookups Juniper is in silicon

239. IPv6 flow-export destination can be an IPv4 or IPv6 address. Interestingly, one can have up to two Cisco IPv4 flow-export (ip flow-export) destinations and have two additional destinations for IPv6 flow-export.IPv6 flow-export destination can be an IPv4 or IPv6 address. Interestingly, one can have up to two Cisco IPv4 flow-export (ip flow-export) destinations and have two additional destinations for IPv6 flow-export.

242. IPv6 flow-export destination can be an IPv4 or IPv6 address. Interestingly, one can have up to two Cisco IPv4 flow-export (ip flow-export) destinations and have two additional destinations for IPv6 flow-export.IPv6 flow-export destination can be an IPv4 or IPv6 address. Interestingly, one can have up to two Cisco IPv4 flow-export (ip flow-export) destinations and have two additional destinations for IPv6 flow-export.

260. Please fill out the workshop survey online. Thank you!