HEPiX IPv6 Working Group F2F Meeting RAL Site report HEPiX IPv6 Working Group F2F Meeting 25th Jan – 26th Jan 2018 Rajan Atthi rajan.atthi@stfc.ac.uk

About Me Network Engineer with the Network & Comms group at RAL 3 month work secondment with RAL Tier-1 Working on IPv6 Deployment to meet WLCG Deadline Martin Bly, Catalin Condurache and Kashif Hafeez are continuing with their efforts

Current Status Squid Service has been dual stack since August 2017 FTS Service has been dual stack since October 2017 CVMFS Stratum 1 has been dual stack since October 2017 HA Proxy service dual stack enabled November 2017 Echo - 1 test gateway IPV6

Storage Plans Requirement to have production quality Dual Stack access to storage by April 2018 RAL runs two storage Services : CASTOR disk endpoints are being decommissioned Echo to be made dual stack mid February 2018 GridFTP & XRootD transfers have been validated against test Echo’s dual stack gateway We expect significant traffic to go via IPV6 over the OPN as soon as the production gateways are enabled We need full confidence in the Network … The requirements of WLCF to have Dual Stack production network by April 2018 RAL has Castor –not dual stack and will be decommissions Echo to be made dual stack and current plan is this will happen Mid Feb 2018 We expect to have a significant step up in traffic via IPV6 We need to have full confidence in the network to be able to handle this Castor will not be made IPV6

During initial deployment of IPV6 separate physical links were used, with lower bandwidth. Some of you may have seen parts of this diagram before. I have taken to diagram on the right hand side which is where my main knowledge lies and brought the tier1 network into this and expanded my knowledge of the network here. My main focus is the OPN and in particular Echo Storage

Currently IPV4 = 2 x 40Gb IPV6 = 2 x 10Gb The Current Production FW bypass link is 2 X 40Gbs (Active-Passive) IPV6 is currently 2 x 10Gbs Active-Passive The work to move the IPV6 onto the the 40Gbs links can be done in 2-3 weeks once a formal request has gone into the Central networking department A Snapshot of recent IPV4 traffic shows that 10Gbs is not enough to handle the current load on the Firewall bypass

100G External Links to JANET Upgrade of the external connectivity to JANET/JISC to 100Gb. Target of June 2018 100G External Links to JANET New Site Firewall Tier-1’s connection into the Site core. The current Firewall does not support IPV6 Natively. Target upgrade of April 2018

To do Consolidation of production networks OPNR Firewall bypass (Feb 7th..) Echo Gateways dual stack (Feb 14th) 40Gb into the Site Core New RAL Firewall (IPV6 Native,Target April 2018) RAL 100Gb Links (Target June 2018) Policy going forward  Tier-1 machines are dual stack by default Deployment needs to be automated Work has started to connect RAL to the LHCONE Target is to have part of RAL connected by Q4 of 2018 Best case scenario is the OPNR Firewall Bypass carries IPV4 & IPV6 at 40Gbs And Echo becomes Dual Stack by 14th Feb 2018 RAL 100Gb by June 2018

Worker Nodes HTCondor Batch Farm Running version that supports dual stack Behind Firewall, connect externally to many services on different ports We intend to enable restrictive IP6tables on all machine from the beginning I will be looking at a way to automate this configuration Comments/suggestions welcome Working on ways to do this and bring this automation into other services in future

Any Questions?