IPv6 – The Future Of The Internet Redbrick Networking Conference 26 March 2003 Dave Wilson DW238-RIPE

What's in store ●Why bother ●The transition ●Doing it NOW (yes, RIGHT NOW!) ●Where to go from here

Disclaimers ●My opinions, not necessarily those of my employer ●Use at your own risk ●No warranty express or implied ●I may be misguided, misinformed or misunderstood ●or on crack, for that matter ●Best Before June ●etc

“But why would I want to use it?”

Why a new protocol? Conservation of addresses (is a hassle)

Why a new protocol? Restore the end-to-end (and die, NAT, die)

Why a new protocol? Stateless autoconfiguration (and take the effort out of the host)

Why a new protocol? Simplify address allocation (and take the effort out of the network)

What IPv6 won't fix  It won't slow down routing table growth  It won't fix QoS, rate-limiting, bandwidth allocation  It won't stop spam (or solve security)  It won't solve world peace, global warming, etc

Addressing and Routing

The good old days /25 ●32 bits ●Variable subnet size ●Allocation depends on need

The new world order / :770:18:2:260:cfff:fe20:f45c/64 ●128 bits ●Variable subnet size ●IETF mandates /64 for every LAN ●"::" means "pad with zeros"

Routing in IPv6 ●IP is still IP ●Class A, B, C long gone ●Get your addresses from your ISP ●Can do everything the old way, but...

Routing in IPv6 ●IP is still IP ●Class A, B, C long gone ●Get your addresses from your ISP ●Can do everything the old way, but... The killer app: Neighbour Discovery

Reaching the host IPv4 uses A records IPv6 uses AAAA records athene IN A athene IN AAAA 2001:770:18:2:260:cfff:fe20:f45c Client attempts IPv6 first (AAAA record) and if that fails, IPv4 (A record)

“So we turn off IPv4 when, exactly?”

Transition technologies  Automatic tunnels (:: )  IPv4-compatible addresses (:: ) ●Dual stack ●Configured tunnels ●6to4 ●NAT-PT

Dual stacking ●Each host gets an IPv4 and IPv6 address ●Server software binds to both addresses ●DNS contains both records ●v4 clients will use the old path ●v6 clients will use the new one, and failover to v4

Dual stacking Use this when ●You already have global v4 address space ●You have native connectivity ●You have a tunnel + neighbour discovery on your LAN

Configured tunnels ●IPv6 connection in an IPv4 path ●Set up by agreement between you and someone on the 6bone ●Saves dual-stacking your router  First v6 hop may be an inefficient path  Uses CPU on the endpoint

Configured tunnels Use these when ●It's your first IPv6 connection ●Your ISP doesn't support native v6 (ask!!) ●You want to connect one or a few machines

6to4 You have an IPv4 address /32

6to4 You have an IPv4 address /32 You've been reserved an IPv6 subnet 2002:c101:dbd9::/48

6to4 You have an IPv4 address c1.01. db. d9/32 You've been reserved an IPv6 subnet 2002:c101:dbd9::/48

6to4 ●Set your default route to the 6to4 anycast relay router ●Your host tunnels traffic to that router ●Return traffic is tunnelled to the encoded IPv4 address

6to4 Use this when ●You've no native connectivity ●You can't have (or don't want) a configured tunnel ●You have a static global IPv4 address (or don't mind it changing) Really fast, easy, no messing setup  The route might suck

“But when is it going to get here?”

How to get connectivity Ask your ISP!

Enabling IPv6 on the host ●Linux 2.4.* (2.2 with effort) ●Red Hat 7.2+, ●Debian Stable ●Solaris 8 ●Tru64 V5.1 ●FreeBSD 4.3 ●Windows XP (or 2000 with research stack) ●Some sort of global IPv4 address - protocol 41 unfirewalled

Compile the Kernel ●Not needed for Red Hat  7.2 ●Turn on experimental options ●Turn on IPv6 under networking options ●Optionally, IPv6 firewalling

On Red Hat 7.2+ [/etc/sysconfig/network] NETWORKING_IPV6=yes...and restart networking (or reboot)

Native connections eth0 Link encap:Ethernet HWaddr 00:50:04:EA:43:64 inet addr: Bcast: Mask: inet6 addr: fe80::250:4ff:feea:4364/10 Scope:Link inet6 addr: 2001:770:18:1:250:4ff:feea:4364/64 Scope:Global UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets: errors:0 dropped:0 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes: (194.9 Mb) TX bytes: ( Mb) Interrupt:10 Base address:0xe400

Native connections eth0 Link encap:Ethernet HWaddr 00:50:04:EA:43:64 inet addr: Bcast: Mask: inet6 addr: fe80::250:4ff:feea:4364/10 Scope:Link inet6 addr: 2001:770:18:1:250:4ff:feea:4364/64 Scope:Global UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets: errors:0 dropped:0 overruns:0 frame:0 TX packets: errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes: (194.9 Mb) TX bytes: ( Mb) Interrupt:10 Base address:0xe400

6to4 – Red Hat 7.2+ [/etc/sysconfig/network-scripts/ifcfg-eth0] [/etc/sysconfig/network-scripts/ifcfg-ppp0] IPV6INIT=yes IPV6_AUTOCONF=no IPV6FORWARDING=no IPV6TO4INIT=yes IPV6TO4_RELAY=" " IPV6TO4_ROUTING="eth0-:f101::0/64 eth1-:f102::0/64"

Tunnel vs. 6to4

So “ping” works. Where next?

Your [n+1]th machine ●No need to statically configure address, tunnel, anything ●Run radvd on your nominated router ●Address assigned using EUI-64

Security ●Get rid of NAT

Security Globally addressable does not mean Globally reachable

Common services ●Cisco ●12.2T for ●12.0(23)S for ●12000 requires Engine III line cards for line rate forwarding ●Juniper ●All recent versions of JUNOS ●Line rate forwarding

Common services ●SMTPSendmail, Exim ●POP, IMAPCourier ●LISTSERVvia mail+web server ●DNSBind 9 ●SSHOpenSSH ●Web serverApache 2 ●News serverDiablo ●Web cacheSquid+patches

Where next? IPv6-HOWTO at

This slide intentionally left blank