Experience Sharing: IPv6 at HKIX Che-Hoo CHENG 鄭志豪 The Chinese University of Hong Kong / Hong Kong Internet Exchange 27 Aug 2008.

Slides:



Advertisements
Similar presentations
Multihoming and Multi-path Routing
Advertisements

IPv4 - IPv6 Integration and Coexistence Strategies Warakorn Sae-Tang Network Specialist Professional Service Department A Subsidiary.
Transitioning to IPv6 April 15,2005 Presented By: Richard Moore PBS Enterprise Technology.
IPv6 Victor T. Norman.
IPv4 Depletion IPv6 Adoption 3 February /8s Remaining.
 Australian Network Operators Group  Community for network operators who work with ISPs, content providers or other areas of the on-line industries.
Managing IP addresses for your private clouds 2013 ASEAN CAS Summit Bangkok, Thailand 7 February 2013 George Kuo Member Services Manager.
Internet Identity For All.my ccTLD IPv6 Update By Lai Heng Choong Head of Application, Database and Security.my DOMAIN REGISTRY APTLD Member Meeting, 1.
17/10/031 Summary Peer to peer applications and IPv6 Microsoft Three-Degrees IPv6 transition mechanisms used by Three- Degrees: 6to4 Teredo.
1/27 Evaluating Potential Routing Diversity for Internet Failure Recovery *Chengchen Hu, + Kai Chen, + Yan Chen, *Bin Liu *Tsinghua University, + Northwestern.
Ethernet and switches selected topics 1. Agenda Scaling ethernet infrastructure VLANs 2.
Structure of the Internet Update for 1 st H/Wk We will start lab next week Paper presentation at the end of the session Next Class MPLS.
Ji-Young Lee IP policy & management team Korea Internet & Security Agency.
© 2006 Cisco Systems, Inc. All rights reserved. Implementing Secure Converged Wide Area Networks (ISCW) Module 4: Frame Mode MPLS Implementation.
MPLS L3 and L2 VPNs Virtual Private Network –Connect sites of a customer over a public infrastructure Requires: –Isolation of traffic Terminology –PE,
Department of Information Engineering 1 What is port number? OK, you know that in order to connect to Internet, each computer must have a unique address.
© 2006 Cisco Systems, Inc. All rights reserved. MPLS v2.2—7-1 Integrating Internet Access with MPLS VPNs Implementing Internet Access as a Separate VPN.
SMUCSE 8344 MPLS Virtual Private Networks (VPNs).
(part 3).  Switches, also known as switching hubs, have become an increasingly important part of our networking today, because when working with hubs,
Agenda Network Infrastructures LCG Architecture Management
Experience Sharing: IPv6 at HKIX Che-Hoo CHENG 鄭志豪 The Chinese University of Hong Kong 06 Aug 2008.
NOC Lessons Learned TEIN2 and CERNET Xing Li
Scaling IXPs Scalable Infrastructure Workshop. Objectives  To explain scaling options within the IXP  To introduce the Internet Routing Registry at.
DNS root server deployments George Michaelson DNS operations SIG APNIC17/APRICOT 2004 Feb KL, Malaysia.
Asia Pacific University Initiatives Co-Location/Exchange Point Service Discussion CSG Fall Meeting September 12 th,
APNIC Status Report RIPE 45 Barcelona May The APNIC Region Ref
1 TWNIC Update Sheng Wei Kuo, TWNIC NIR SIG, APNIC 30.
APNIC Update ARIN XXVI 8 October 2010 Geoff Huston Chief Scientist, APNIC.
KT's IPv6 status and trial service Future Technology Lab Dongjin Kwak, Jaehwa Lee Meeting 2008 at NZ.
1 Taiwan’s IPv6 Status Update Ren-Hung Hwang, TWNIC 33.
Hisham Aboulyazed MEPF, MENOG-12 Dubai, 7 March 2013 An IX by an An IX by an.
APNIC Policy Update 1 st TWNIC Open Policy Meeting 3 December, 2003 Taipei, Taiwan.
1 November 2006 in Dagstuhl, Germany
0 HKIX Hong Kong Internet eXchange Cheng, Che-Hoo Computer Services Center The Chinese University of Hong Kong
AARNet Copyright 2007 AARNet IPv6 Update IPv6 Workshop APAN 24, Xi’An 2007 Bruce Morgan.
Peering Concepts and Definitions Terminology and Related Jargon.
APRICOT 2003, Taipei, 26 February, 2003 Nepal Internet Exchange (NPIX) Gaurab Raj Upadhaya CEO/Tech Chair
Introduce the project Africa IXP (Team 4). Introduce team members.
1 NCM _05_2001_c1 © 2001, Cisco Systems, Inc. All rights reserved. How would you prepare for the technology you need.
Introduction to CNGI-6IX Tsinghua Univ./CERENET
APNIC Security Update APSIRCC 2002 Tokyo, 25 March 2002.
IPv6 Deployment Status Elly Tawhai Senior Internet Resource Analyst/Liaison Officer, Pacific, APNIC 5 th APT Policy Regulation Forum for Pacific
HKIX Sharing at PacNOG 18 Che-Hoo CHENG CUHK/HKIX 30 Nov
W&L Page 1 CCNA CCNA Training 3.4 Describe the technological requirements for running IPv6 in conjunction with IPv4 Jose Luis Flores /
Technical Solution Proposal
IP Addressing and ICT Development in the Pacific Islands Anne Lord and Save Vocea, APNIC ICT Workshop, Fiji, November, 2002.
Securing Future Growth: Getting Ready for IPv6 NOW! ccTLD Workshop, 8 th April 2011 Noumea, New Caledonia Miwa Fujii, Senior IPv6 Program Specialist, APNIC.
1 © 2005 Cisco Systems, Inc. All rights reserved. M. Behringer: Pervasive Core Security To Route Or Not To Route? Michael H. Behringer Dirk Schroetter.
APNIC Status Report RIPE 44 Amsterdam, The Netherlands January 27-31, 2003.
© 2005 Cisco Systems, Inc. All rights reserved. BGP v3.2—3-1 Route Selection Using Policy Controls Using Multihomed BGP Networks.
APNIC Update RIPE November 2010 Rome, Italy Geoff Huston Chief Scientist, APNIC.
APNIC IPv6 Allocation Update IPv6 SIG APNIC 14, Kitakyushu, Japan 4 September 2002.
17/10/031 Euronetlab – Implementation of Teredo
Thoughts on TEIN2 Operation and Collaboration Xing Li
Confidential – © 2014 Equinix Inc. IP Renumbering APRICOT 2016 S Vijayakumar Equinix IX – Peering Platform Updates.
1 IPv6 Allocation and Policy Update Global IPv6 Summit in China 2007 April 12, 2007 Guangliang Pan.
The Benefit and Need of Standard Contribution for IXPs Jan Stumpf System Engineer.
IPv6 Matrix Project - Page 1 IPv6 Matrix Project Tracking IPv6 connectivity Worldwide Dr. Olivier MJ.
AS Numbers - Again Geoff Huston APNIC October 2009
MPLS Virtual Private Networks (VPNs)
WELCOME ALL.
Suva Fiji, July 2017 Arth Paulite
AARNet Network Update IPv6 Workshop APAN 23, Manilla 2007 AARNet.
AARNet Network Update IPv6 Workshop APAN 23, Manilla 2007 AARNet.
IPv6 Allocation Status Report
Lessons Learned TEIN2 and CERNET
IPv6 Deployment and Development in CERNET
IPv6 Policy and Allocation Update
IPv6 Reliability Measurements
When Can We Start Dropping IPv4 on the DNS Root Servers?
Presentation transcript:

Experience Sharing: IPv6 at HKIX Che-Hoo CHENG 鄭志豪 The Chinese University of Hong Kong / Hong Kong Internet Exchange 27 Aug 2008

Introduction of HKIX (1/2) Set up by The Chinese University of Hong Kong (CUHK) in Apr 1995 Set up by The Chinese University of Hong Kong (CUHK) in Apr 1995 MLPA Internet Exchange over Layer 2 Infrastructure with BLPA support MLPA Internet Exchange over Layer 2 Infrastructure with BLPA support MLPA MLPA Mandatory for Hong Kong routes onlyMandatory for Hong Kong routes only HKIX MLPA Router Server: AS4635HKIX MLPA Router Server: AS4635 AS4635 seen in AS Path AS4635 seen in AS Path Route filters implemented strictlyRoute filters implemented strictly By Prefix or by Origin AS By Prefix or by Origin AS But a few trustable participants have no filters except max number of prefixes But a few trustable participants have no filters except max number of prefixes Support BLPA Support BLPA One AS hop less than MLPAOne AS hop less than MLPA May get more routes from your peersMay get more routes from your peers HKIX encourages BLPA over HKIXHKIX encourages BLPA over HKIX 2

Introduction of HKIX (2/2) Port Security (one MAC address per switch port) implemented strictly Port Security (one MAC address per switch port) implemented strictly Still no IX port charge as we are not-for-profit Still no IX port charge as we are not-for-profit But there is charge for 10GE ports or many GE ports if traffic volume is not high enough to justify the resourcesBut there is charge for 10GE ports or many GE ports if traffic volume is not high enough to justify the resources Provide colo space for strategic partners such as root / TLD DNS servers Provide colo space for strategic partners such as root / TLD DNS servers Still located and operated by CUHK Still located and operated by CUHK Considered as Critical Internet Infrastructure in Hong Kong Considered as Critical Internet Infrastructure in Hong Kong 3

4 ISP DISP AISP BISP C Routes of ISP A Routes of All ISPs in HKIX Routes of ISP B Routes of ISP C Routes of ISP D Routes of All ISPs in HKIX MLPA Router Server Routes of All ISPs in HKIX Routes from All ISPs Switched Ethernet HKIX Model — MLPA over Layer 2 (with BLPA support) MLPA traffic exchanged directly over layer 2 without going through MLPA Route Server BLPA over layer 2 without involvement of MLPA Route Server

HKIX2 Announced on 25 Nov 2004 Announced on 25 Nov 2004 HKIX2 site in Central as redundant site of HKIX HKIX2 site in Central as redundant site of HKIX Linked up to HKIX by 2 x 10GE links Linked up to HKIX by 2 x 10GE links It is Layer 3 connectionIt is Layer 3 connection Same AS4635 MLPASame AS4635 MLPA Participants cannot do BLPA across HKIX and HKIX2Participants cannot do BLPA across HKIX and HKIX2 Free of charge for IX ports Free of charge for IX ports IX portion managed by CUHK IX portion managed by CUHK 5

Quick Updates 2 x Cisco Catalyst 6513 at HKIX and 1 x Cisco Catalyst 6513 at HKIX2 2 x Cisco Catalyst 6513 at HKIX and 1 x Cisco Catalyst 6513 at HKIX2 Most connected to HKIX switches without co- located routers Most connected to HKIX switches without co- located routers Cross-border layer 2 Ethernet connections to HKIX possibleCross-border layer 2 Ethernet connections to HKIX possible Ethernet over MPLS or Ethernet over SDH Ethernet over MPLS or Ethernet over SDH Officially allow overseas ISPs to connect now Officially allow overseas ISPs to connect now No co-located router needed in Hong KongNo co-located router needed in Hong Kong Those overseas ISPs may not have Hong Kong routes…Those overseas ISPs may not have Hong Kong routes… > 90 HKIX participants now (>10 on HKIX2 + HKIX) > 90 HKIX participants now (>10 on HKIX2 + HKIX) Some have multiple AS’esSome have multiple AS’es 18,000-26,000 IPv4 prefixes carried by HKIX MLPA router server now 18,000-26,000 IPv4 prefixes carried by HKIX MLPA router server now Peak 5-min traffic >65 Gbps now Peak 5-min traffic >65 Gbps now 6

Some Statistics 7

Help Keep Intra-Asia Traffic within Asia We have participants from Mainland China, Taiwan, Korea, Indonesia and Philippines We have participants from Mainland China, Taiwan, Korea, Indonesia and Philippines MLPA of HKIX MLPA of HKIX 6 AS’es are announcing more than 1,000 prefixes6 AS’es are announcing more than 1,000 prefixes More non-Hong Kong routes than Hong Kong routesMore non-Hong Kong routes than Hong Kong routes BLPA over HKIX BLPA over HKIX Even more non-Hong Kong routesEven more non-Hong Kong routes So, we do help keep intra-Asia traffic within Asia So, we do help keep intra-Asia traffic within Asia In terms of network latency, Hong Kong is a good central location in Asia In terms of network latency, Hong Kong is a good central location in Asia ~50ms to Tokyo~50ms to Tokyo ~30ms to Singapore~30ms to Singapore HKIX is good for intra-Asia traffic HKIX is good for intra-Asia traffic Many overseas and mainland China academic networks have presence in Hong Kong Many overseas and mainland China academic networks have presence in Hong Kong 8

Plan for 2008 Replace one Cisco Catalyst 6513 with a higher-end layer 2 switch Replace one Cisco Catalyst 6513 with a higher-end layer 2 switch To support more 10GE portsTo support more 10GE ports To support Link Aggregation with port securityTo support Link Aggregation with port security Remote participants have to check whether their tail providers can support the configuration with enough transparency Remote participants have to check whether their tail providers can support the configuration with enough transparency sFlowsFlow MLPA: Support daily automatic route filter updates from routing registry database MLPA: Support daily automatic route filter updates from routing registry database MLPA: Support BGP community for easier traffic load balancing MLPA: Support BGP community for easier traffic load balancing We continue to encourage BLPA We continue to encourage BLPA Portal for Participants Portal for Participants Suggestions are welcome Suggestions are welcome 9

10 Submarine Cable Disaster in Dec 2006 Due to Earthquake in South of Taiwan (Luzon Strait) on 26 Dec 2006 Due to Earthquake in South of Taiwan (Luzon Strait) on 26 Dec 2006 Most cable systems going through Luzon Strait were cut then Most cable systems going through Luzon Strait were cut then HK was almost isolated from Global Internet HK was almost isolated from Global Internet Restoration was done slowly and gradually Restoration was done slowly and gradually Cable repair finally complete in late Jan 2007 Cable repair finally complete in late Jan 2007 Lessons learnt: Lessons learnt: Cable route diversity must be observedCable route diversity must be observed Should not rely totally on cables of East routing which all go through Luzon Strait Should not rely totally on cables of East routing which all go through Luzon Strait Should be prepared to pay more for cables of West/North/South routing for better reliability Should be prepared to pay more for cables of West/North/South routing for better reliability DNS infrastructure in HK must be improvedDNS infrastructure in HK must be improved.com,.net and.org TLD servers could not be found on HKIX MLPA route server.com,.net and.org TLD servers could not be found on HKIX MLPA route server HKIX (layer 2 part) could be used for acquiring temporary IP transit services during emergency periodHKIX (layer 2 part) could be used for acquiring temporary IP transit services during emergency period

11 Authoritative TLD Servers at HKIX As important as Root Servers As important as Root Servers Anycast is getting more and more popular at TLD level Anycast is getting more and more popular at TLD level During the disaster, we had Root Server instances F & I connected to HKIX so.hk,.mo and.cn are fine During the disaster, we had Root Server instances F & I connected to HKIX so.hk,.mo and.cn are fine.com/.net/.org were half dead even though IP connectivity among HK, Macau and Mainland China was fine.com/.net/.org were half dead even though IP connectivity among HK, Macau and Mainland China was fine Although UltraDNS had anycast servers in HK serving.org and others, they did not have connectivity to HKIX MLPA so could not help the situation!Although UltraDNS had anycast servers in HK serving.org and others, they did not have connectivity to HKIX MLPA so could not help the situation! Key players at HKIX directly or indirectly now or soon: Key players at HKIX directly or indirectly now or soon: Afilias, APNIC, CommunityDNS, PCH & VerisignAfilias, APNIC, CommunityDNS, PCH & Verisign Root Server instance J added to HKIX in Feb 2008 Root Server instance J added to HKIX in Feb 2008 We will continue to spend effort to encourage set-up of DNS server instances of major TLDs in Hong Kong with connection to HKIX MLPA (plus BLPA over HKIX) to improve DNS performance for the whole Hong Kong and neighbouring economies We will continue to spend effort to encourage set-up of DNS server instances of major TLDs in Hong Kong with connection to HKIX MLPA (plus BLPA over HKIX) to improve DNS performance for the whole Hong Kong and neighbouring economies

IPv6 in Hong Kong (1/2) HK is lagging behind very much HK is lagging behind very much We need to catch upWe need to catch up Only a handful of backbone ISPs provide IPv6 transit service in HK Only a handful of backbone ISPs provide IPv6 transit service in HK Such as NTT Com and Reliance Globalcom/FLAGSuch as NTT Com and Reliance Globalcom/FLAG Only very few retail ISPs provide IPv6 access service but they are not active at all Only very few retail ISPs provide IPv6 access service but they are not active at all Such as NTT-HKNET, Diyixian and CITIC1616 for business customers onlySuch as NTT-HKNET, Diyixian and CITIC1616 for business customers only No residential broadband ISPs provide IPv6 service No residential broadband ISPs provide IPv6 service 12

IPv6 in Hong Kong (2/2) Two mobile phone service providers are testing out IPv6 Two mobile phone service providers are testing out IPv6 CSL/Telstra and China Mobile-PeoplesCSL/Telstra and China Mobile-Peoples No IPv6 Tunnel Broker in HK No IPv6 Tunnel Broker in HK Content providers are not ready for IPv6 Content providers are not ready for IPv6 Government networks do not run IPv6 yet Government networks do not run IPv6 yet HARNET relied on ABILENE mainly so did not have full routes (< 40%) and most overseas IPv6 traffic had to be routed through US HARNET relied on ABILENE mainly so did not have full routes (< 40%) and most overseas IPv6 traffic had to be routed through US 13

IPv6 at HKIX CUHK/HKIX is committed to help Internet development in HK CUHK/HKIX is committed to help Internet development in HK IPv6 supported by HKIX since Mar 2004 IPv6 supported by HKIX since Mar 2004 Dual stackDual stack Today, 16 different AS’es have been assigned addresses at HKIX/HKIX2 and have joined MLPA Today, 16 different AS’es have been assigned addresses at HKIX/HKIX2 and have joined MLPA BLPA allowedBLPA allowed Root server instance F supports IPv6 transport at HKIX Root server instance F supports IPv6 transport at HKIX Dual stack so can’t know for sure how much IPv6 traffic in total Dual stack so can’t know for sure how much IPv6 traffic in total Hopefully with the new switch, we can have more detailed statisticsHopefully with the new switch, we can have more detailed statistics 14

IPv6 Participants at HKIX (1/2) APNIC (AS18366) APNIC (AS18366) ASCC-ASNET (AS9264) ASCC-ASNET (AS9264) China Mobile-Peoples (AS9231; at HKIX2) China Mobile-Peoples (AS9231; at HKIX2) CITIC1616 (AS17554; at HKIX2) CITIC1616 (AS17554; at HKIX2) CNGI-6IX/CERNET/CERNET2 (AS23911/AS4538/AS23910; IPv6 only) CNGI-6IX/CERNET/CERNET2 (AS23911/AS4538/AS23910; IPv6 only) CUHK (AS3661 & AS4641) CUHK (AS3661 & AS4641) Diyixian (AS9584) Diyixian (AS9584) ISC (AS23709) ISC (AS23709) JUCC-HARNET (AS3662) JUCC-HARNET (AS3662) 15

IPv6 Participants at HKIX (2/2) KREONET2 (AS17579) KREONET2 (AS17579) NTT Com (AS2914) NTT Com (AS2914) Reliance Globalcom / FLAG (AS15412) Reliance Globalcom / FLAG (AS15412) Samsung (AS6619) Samsung (AS6619) Telstra-CSL (AS38819) Telstra-CSL (AS38819) TIC (AS1836) TIC (AS1836) Good mix of academic networks and commercial networks Good mix of academic networks and commercial networks Can set up BLPA with them over HKIX Can set up BLPA with them over HKIX 16

Recent IPv6 Work at HKIX Remove route filters for IPv6 at MLPA route server Remove route filters for IPv6 at MLPA route server Still provides minimal protection such as bogus routesStill provides minimal protection such as bogus routes Essentially a transit exchange for IPv6Essentially a transit exchange for IPv6 Total number of routes close to 1,100 nowTotal number of routes close to 1,100 now Add BGP community tagging to distinguish upstream routes (for transit purpose) from downstream routes (for peering purpose) soon Add BGP community tagging to distinguish upstream routes (for transit purpose) from downstream routes (for peering purpose) soon 3-month free IPv6 full transit service provided by NTT Com (AS2914) for HKIX participants 3-month free IPv6 full transit service provided by NTT Com (AS2914) for HKIX participants Announced on 18 Aug 2008: on 18 Aug 2008: Available until 31 Dec 2008Available until 31 Dec

Observations (1/4) Dual Stack seems to be the norm for IX Dual Stack seems to be the norm for IX No need to have separate equipment and connection for IPv6 so easier to justifyNo need to have separate equipment and connection for IPv6 so easier to justify Same AS# for both IPv4 and IPv6 seems to be the normSame AS# for both IPv4 and IPv6 seems to be the norm One exception is Pacnet (AS10026 for IPv4 and AS18084 for IPv6) One exception is Pacnet (AS10026 for IPv4 and AS18084 for IPv6) sFlow should help give ideas of IPv4 traffic volume versus IPv6 traffic volumesFlow should help give ideas of IPv4 traffic volume versus IPv6 traffic volume Using tunneling as IPv6 IX seems not acceptable by community anymore Using tunneling as IPv6 IX seems not acceptable by community anymore 18

Observations (2/4) The first day HKIX removed the route filters, someone from Germany noticed that immediately and warned us The first day HKIX removed the route filters, someone from Germany noticed that immediately and warned us Some people do care about IPv6Some people do care about IPv6 Commercial providers care very much about routing and operations Commercial providers care very much about routing and operations They treat IPv4 and IPv6 the same as much as possibleThey treat IPv4 and IPv6 the same as much as possible Transit versus PeeringTransit versus Peering Customer versus PeerCustomer versus Peer 19

Observations (3/4) HKIX now has /64 in total for HKIX & HKIX2 and use /120 for each HKIX now has /64 in total for HKIX & HKIX2 and use /120 for each Will get /48 and use /64 for eachWill get /48 and use /64 for each Should not blindly prefer routes learnt from HKIX MLPA Should not blindly prefer routes learnt from HKIX MLPA Should add more BGP community tagging controlShould add more BGP community tagging control Cannot help black-holing traffic because HKIX is basically a layer 2 infrastructure Cannot help black-holing traffic because HKIX is basically a layer 2 infrastructure /32 of HARNET split into /35’s and/or /48’s because of various requirements /32 of HARNET split into /35’s and/or /48’s because of various requirements Different sets of routes are being announced to different upstream networks and peer networksDifferent sets of routes are being announced to different upstream networks and peer networks Routing is messyRouting is messy 20

Observations (4/4) MyAPNIC still has not provided the same functionality for IPv6 as IPv4, such as: MyAPNIC still has not provided the same functionality for IPv6 as IPv4, such as: Add reverse DNS domain objectAdd reverse DNS domain object Add route6 objectAdd route6 object Not many people are aware of APNIC’s policy change of IPv6 initial allocation criteria Not many people are aware of APNIC’s policy change of IPv6 initial allocation criteria Need TLD servers to support AAAA glue records and run IPv6 transport in order to have full IPv6 experience Need TLD servers to support AAAA glue records and run IPv6 transport in order to have full IPv6 experience.HK does not AAAA glue records yet!!!.HK does not AAAA glue records yet!!! Still far from universal development in HK, especially in commercial networks Still far from universal development in HK, especially in commercial networks Nobody is pushing and no demandNobody is pushing and no demand IPv6 knowledge is badIPv6 knowledge is bad iPhone 2.0 S/W does not support IPv6 yet!!! iPhone 2.0 S/W does not support IPv6 yet!!! 21

Thank You