1. HEPiX IPv6 Working Group F2F Meeting
RAL Site report
HEPiX IPv6 Working Group F2F Meeting
25th Jan – 26th Jan 2018
Rajan Atthi

2. About Me Network Engineer with the Network & Comms group at RAL
3 month work secondment with RAL Tier-1
Working on IPv6 Deployment to meet WLCG Deadline
Martin Bly, Catalin Condurache and Kashif Hafeez are continuing with their efforts

3. Current Status Squid Service has been dual stack since August 2017
FTS Service has been dual stack since October 2017
CVMFS Stratum 1 has been dual stack since October 2017
HA Proxy service dual stack enabled November 2017
Echo - 1 test gateway IPV6

4. Storage Plans
Requirement to have production quality Dual Stack access to storage by April 2018
RAL runs two storage Services :
CASTOR disk endpoints are being decommissioned
Echo to be made dual stack mid February 2018
GridFTP & XRootD transfers have been validated against test Echo’s dual stack gateway
We expect significant traffic to go via IPV6 over the OPN as soon as the production gateways are enabled
We need full confidence in the Network …
The requirements of WLCF to have Dual Stack production network by April 2018
RAL has Castor –not dual stack and will be decommissions
Echo to be made dual stack and current plan is this will happen Mid Feb 2018
We expect to have a significant step up in traffic via IPV6
We need to have full confidence in the network to be able to handle this
Castor will not be made IPV6

5. During initial deployment of IPV6 separate physical links were used, with lower bandwidth.
Some of you may have seen parts of this diagram before.
I have taken to diagram on the right hand side which is where my main knowledge lies and brought the tier1 network into this and expanded my knowledge of the network here.
My main focus is the OPN and in particular Echo Storage

6. Currently IPV4 = 2 x 40Gb IPV6 = 2 x 10Gb
The Current Production FW bypass link is 2 X 40Gbs (Active-Passive)
IPV6 is currently 2 x 10Gbs Active-Passive
The work to move the IPV6 onto the the 40Gbs links can be done in 2-3 weeks once a formal request has gone into the Central networking department
A Snapshot of recent IPV4 traffic shows that 10Gbs is not enough to handle the current load on the Firewall bypass

7. 100G External Links to JANET
Upgrade of the external connectivity to JANET/JISC to 100Gb. Target of June 2018
100G External Links to JANET
New Site Firewall
Tier-1’s connection into the Site core.
The current Firewall does not support IPV6 Natively.
Target upgrade of April 2018

8. To do Consolidation of production networks
OPNR Firewall bypass (Feb 7th..)
Echo Gateways dual stack (Feb 14th)
40Gb into the Site Core
New RAL Firewall (IPV6 Native,Target April 2018)
RAL 100Gb Links (Target June 2018)
Policy going forward  Tier-1 machines are dual stack by default
Deployment needs to be automated
Work has started to connect RAL to the LHCONE
Target is to have part of RAL connected by Q4 of 2018
Best case scenario is the OPNR Firewall Bypass carries IPV4 & IPV6 at 40Gbs
And Echo becomes Dual Stack by 14th Feb 2018
RAL 100Gb by June 2018

9. Worker Nodes HTCondor Batch Farm
Running version that supports dual stack
Behind Firewall, connect externally to many services on different ports
We intend to enable restrictive IP6tables on all machine from the beginning
I will be looking at a way to automate this configuration
Comments/suggestions welcome
Working on ways to do this and bring this automation into other services in future

10. Any Questions?