IP EDGE DEVICES A solution for the Internet Migration Patrick Cocquet, 6WIND CEO, IPv6 Forum VP Dubai IPv6 Forum Summit – February 2001

SUMMARY 6WIND, the IPv6 company ! 6WIND Positioning IP Edge Device in the Network Architecture IP Edge Device, main features Conclusion

6WIND The IPv6 start-up company –Spin-outing of the Thomson-CSF IP Network development activities –Starting day : 1 st September 2000 –Team : 20 engineers + subcontractors –Experience : 5 years of IP R&D activities –Member of the IPv6 Forum Board (VP)

6WIND POSITIONING To develop IP access devices to provide the user with new IP services : –All features in one box : QoS, security, IPv4/v6 migration, mobility, routing –Significant step in terms of Network Services To develop expertise around the introduction of the IPv6 technology Markets (1st step) : –Enterprises and Branch Offices –Direct sales (ISPs) and Indirect sales (Integrators) Markets (future steps) : –Soho (wireless + zero conf IP networks) –Home Networks

IP service configuration MANAGEMENT CENTER ARCHITECTURE Qos management (DiffServ) IP Security IPv4 /v6 migration features Mobility (mobile IP) Multicast Routing 6WIND IP Edge Device 6WIND IP Edge Device 6WIND IP Edge Device Internet or Intranet (IPv4 or IPv6) End

QoS MANAGEMENT Issue : Resource guarantee for time sensitive flows ConfigArchQoS

QoS MANAGEMENT DiffServ IPv6 or IPv4 backbone or Intranet Classification Policing and shaping Scheduling  EF and AF DiffServ IETF standard ConfigArchQoS

QoS MANAGEMENT Scheduling per Class of Service ClassificationShaping and policing Non classified IP flows Classified IP packets In excess packets Minimal bandwidth reserved for each class ConfigArchQoS

CLASS OF SERVICE 1) Define a class ConfigArchQoS

FLOW DEFINITION 2) Define an IPv4 or IPv6 flow ConfigArchQoS

QOS MONITORING 3) Monitor the classes ArchQoS

IP SECURITY IPv4 or IPv6 non secure backbone IPv4 or IPv6 non secure backbone Questions New device authentication Security Association definition Data transfers ConfigArch

Certification Authority DEVICE AUTHENTICATION IPv4 or IPv6 non secure backbone IPv4 or IPv6 non secure backbone Key Pair Generation RSA algorithm Certificate request

Certification Authority DEVICE AUTHENTICATION IPv4 or IPv6 non secure backbone IPv4 or IPv6 non secure backbone Certificate generation Pre-shared keys can also be used Certificate delivery ConfigArchSec

SECURITY ASSOCIATION IPv4 or IPv6 non secure backbone IPv4 or IPv6 non secure backbone IPSec SA statically configured in each device Addresses Algorithms Session keys

SECURITY ASSOCIATION IPv4 or IPv6 non secure backbone IPv4 or IPv6 non secure backbone IKE negotiation phases IPSec SA dynamically configured Addresses Algorithms Session keys Lifetime ConfigArchSec

DATA EXCHANGE IPv4 or IPv6 non secure backbone IPv4 or IPv6 non secure backbone Secure traffic between protected zones via IPSec tunnels Policies : Discard Clear Apply AH and/or ESP ConfigArchSec

VPN CONFIGURATION 1) Name the VPN ConfigArchSec

VPN CONFIGURATION 2) Define the end point addresses ConfigArchSec

VPN CONFIGURATION Pre defined templates ease the configuration process 3) Choose your security level ConfigArchSec

VPN CONFIGURATION 4) Choose the certificate or the key ConfigArchSec

IPSec TUNNEL CONFIGURATION 1) Define the zones to be protected ConfigArchSec

IPSec TUNNEL CONFIGURATION 2) Apply a policy ArchSec

IPv4/v6 MIGRATION MECHANISMS IPv4 or IPv6 non secure backbone IPv6 cloud Mechanisms Automatic tunnels Configured v6 in v4 tunnels 6to4 Configured v4 in v6 tunnels IPv6 cloud IPv4 backbone ConfigArch

AUTOMATIC TUNNEL IPv4 or IPv6 non secure backbone IPv6 cloud IPv4 backbone IPv6 packet IPv4-compatible = No configuration IPv6 packet IPv4 encapsulation src dst From :: to :: Dest :: ConfigArchMig

CONFIGURED IPv6 in IPv4 TUNNEL IPv4 or IPv6 non secure backbone IPv6 cloud IPv4 backbone IPv6 packet End Point = + Tunnel configuration IPv6 packet IPv4 encapsulation with end point addresses ConfigArchMig

6to4 IPv4 or IPv6 non secure backbone IPv6 cloud IPv4 backbone IPv6 packet 6to4 prefix per site = Hides an IPv6 network behind a single IPv4 address IPv6 packet IPv4 encapsulation with IPv4 addresses ConfigArchMig

CONFIGURED IPv4 in IPv6 TUNNEL IPv4 or IPv6 non secure backbone IPv4 cloud IPv6 backbone IPv4 packet End Point = + Tunnel configuration IPv4 packet IPv6 encapsulation with end point addresses ConfigArchMig

IPv4/v6 MIGRATION CONFIGURATION (CTU) Name the tunnel and define the IPv4 and IPv6 end point addresses Ret

IPv6 MOBILITY Home agent Correspondent Node Mobile (Home address)

IPv6 MOBILITY Home agent Correspondent Node Mobile (Home address)

Home agent Correspondent Node Mobile (Care of address) Address binding IPv6 MOBILITY Mobile (Home address)

Home agent Correspondent Node Mobile (Care of address) Address binding IP in IP encapsulation IPv6 MOBILITY Proxy Mobile (Home address)

Home agent Correspondent Node Mobile (Care of address) Address binding IPv6 MOBILITY Notification IP in IP encapsulation Proxy Mobile (Home address)

Home agent Correspondent Node Mobile (Care of address) Address binding Shortcut IPv6 MOBILITY Notification Proxy Mobile (Home address) Arch

IP SERVICE CONFIGURATION Several management levels for dynamic service configuration : –Command Line Interface –SNMP Agent –NMS tool based on an SNMP platform integrating 6WIND configuration toolsNMS tool Open to other management frameworks Secure configuration through SSH Arch

NMS TOOL

6WIND CONFIGURATION TOOLS 1) Click on a device, choose your menu Ret

6WIND First set of Products 6200 series

PRODUCT FEATURES (HW) 2 products : –6WIND 6211 : Three Fast Ethernet : Private, Public, Optional Able to deliver a 20 Mbps 3DES encrypted traffic 2000 tunnels and 2000 QoS flows –6WIND 6221 : Same as 6211 with an E1/T1 public interface Next : –ATM interface

PRODUCT FEATURES (SW) QoS : EF, AF for IPv4 and IPv6 Security : IPSEC, IKE, IP Filter for IPv4 and IPv6, X509 certificates IPv6 / IPv4 : Both stacks 6to4, v6 into v4 tunnels (automatic and configured) RIP v6 Management : SNMP agent with standard and IPv6 MIB CLI Management tool integrated in a SNMP framework

CONCLUSION 6WIND Edge Devices enable new service deployment : –Better multi-media performance by implementing Diffserv –Security by using IPSec and IKE –Efficient management –Nomadism of users by using MobileIP(2 nd release) –Multicasting (3 rd release) Allowing v4 to v6 migration of networks and v4/v6 interoperability

Questions ? Web sites – – – – THE END