Basic IPv6 Course - RIPE Network Coordination Centre

Basic IPv6 CourseTraining CourseAugust 2018

Schedule09:00 - 09:30Coffee, Tea11:00 - 11:15Break13:00 - 14:00Lunch15:30 - 15:45Break17:30End!2

Introductions Name Number in the list Experience with IPv6 Goals!3

Overview IPv4? IPv6 Address Basics Getting it Exercise: Making Assignments IPv6 Protocol Basics Exercise: Addressing Plan IPv6 Packets Deploying Exercise: Configuring IPv6 Real Life IPv6 Deployment Tips!4

IPv4?Section 1

Reaching the next billion Around 4,157 billion Internet users now- around 54,4 % of all people in the world Mobile phones are Internet devices The Internet of Things- How will the Internet look like in 5 - 10 years?!6

The Internet of ThingsLibelium Smart Worldhttp://www.libelium.com/top 50 iot sensor applications ranking Libelium Comunicaciones Distribuidas S.L.!7

IANA IPv4 2008200920102011!8

IPv4 Exhaustion“On 14 September 2012, the RIPE NCCran out of their regular pool of IPv4”!9

Network Address Translation Extends the capacity of the IPv4 address spaceby sharing an IPv4 address between clients Fairly common technology, used everywhere Breaks the end to end connectivity model It doesn’t allow communication with IPv6! You are probably going to need it in some form!10

Large Scale NATHome UserNAT44 Boxprivate IPv4Home UserNAT44 Boxprivate IPv4Home UserNAT44 BoxPrivateIPv4IPv4 InternetNAT44 Boxprivate IPv4CUSTOMERPROVIDERINTERNET!11

IPv6 Address BasicsSection 2

How much has been allocated to the RIRs?IP Address DistributionSept 2014Source: https://www.nro.net/statisticsNumber Resource OrganisationInternet Number Resource Report!13

IP Address A AssignmentEnd UserPI Assignment!14

IPv6 Address Basics IPv6 address: 128 bits- 32 bits in IPv4 Every subnet should be a /64 Customer assignments (sites) between:- /64 (1 subnet)- /48 (65,536 subnets) Minimum allocation size /32- 65,536 /48s- 16,777,216 /56s!15

Address 11:0:0:c100:4d1110111100010001!16

IPv6 4 bits interface ID/64/60 16 /64/56 256 /64/52 4096 /64/48 65536 /64/32 65536 /48!17

Multiple address 00::/64n/aLink Localfe80::/10linkGlobal Unicast2000::/3globalUnique Localfc00::/7globalMulticastff00::/8variable!18

IPv6 Address D00:A:B::1002001:67c:2e:1::c1FF05::1:3ff02::1!19

IPv6 Address NotationExercise

IPv6 Notation - RFC 5952 For more information, please read RFC 5952“A Recommendation for IPv6 Address c5952!21

Questions

Getting ItSection 3

Getting an IPv6 allocation To qualify, an organisation must:- Be an LIR- Have a plan for making assignments within two years Minimum allocation size /32- Up to a /29 without additional justification- More if justified by customer numbers and network extension- Additional bits based on hierarchical and geographicalstructure, planned longevity and security levels!24

Customer Assignments Give your customers enough addresses- Minimum /64- Up to /48 More than /48, send in request form- alternatively, make a sub-allocation Every assignment must be registered in theRIPE Database!25

Comparison IPv4 and IPv6 statusIPv4ALLOCATED Group of AssignmentsAGGREGATED-BY-LIRSUB-ALLOCATED PASub-AllocationALLOCATED-BY-LIRASSIGNED PIPI AssignmentASSIGNED PIASSIGNED PA!26

Examples ASSIGNED One single networkAn individual customerYour own infrastructureOne assignment ASSIGNED!27

Using GNED/64 Represents one assignment Minimum assignment size is a /64 For more than a /48, send a request form!28

Using ASSIGNED - Example PE!29

Examples AGGREGATED-BY-LIR Group of customers Same assignment size!30

Using assignment-size: 56/56/56/56/56/36/56 Can be used to group customers- example: residential broadband customers “assignment size:” assignment of each customer!31

Using AGGREGATED-BY-LIR - :35ZRIPE!32

Examples ALLOCATED-BY-LIR Reservation for a large customer Branch office or departmentLarge Customer/48Branch Office/46Reservation/48/48/36Delegation!33

Using SIGNED/52/36ASSIGNED/48 Can be used for customers with potential for growth- or for your own infrastructure- or to delegate address space to a downstream ISP!34

Using ALLOCATED-BY-LIR - -31T08:23:35ZRIPE!35

RASSIGNED/44AGGREGATED-BY-LIRassignment-size: 56/36/48!36

Getting IPv6 PI address space To qualify, an organisation must:- Meet the contractual requirements for provider independentresources- LIRs must demonstrate special routing requirements Minimum assignment size:/48 PI space can not be used for sub-assignments- not even 1 IP address!!37

Unique Local Addresses Prefixes from fc00::/7- Only from the fd00::/8 block Should not be routed on the Internet Generate a random 40-bit Global ID and insert it intofdxx:xxxx:xxxxGlobal ID:Prefix:da24154e1dfdda:2415:4e1d::/48!38

Making AssignmentsExercise

Making Assignments ExerciseSmart Home 6! 20 minutes preparation time 10 minutes discussion!40

Smart Home 6 Network DiagramIPv6 Internet/64LIR / ISP2001:db8::/324Gpo wireint- lesto- spoint/64/64?/64/64/64/64/64/64How much do you assign tothe whole smart home network?!41

Solution RIPE Database art Home 6 -05-31T12:34:01ZRIPE!42

Solution RIPE Database fied:source:2001:db8:1000::/36SMART-HOME-6Smart Home 6 :34:01Z2015-05-31T12:34:01ZRIPE!43

IPv6 Protocol BasicsSection 4

IPv6 Protocol Functions Address Autoconfiguration- Supported by Neighbor Discovery- Stateless - with SLAAC- Stateful - with DHCPv6 Neighbor Discovery Protocol- Replaces ARP from IPv4- Uses ICMPv6 and Multicast- Finds the other IPv6 devices on the link- Keeps track of reachability!45

The Autoconfiguration Process1. Make a Link-Local address2. Check for duplicates on the link3. Search for a router4. Make a Global Unicast address!46

Making a Link-Local Address48 bits - MAC Address Interface ID is madefrom the MAC addressFFfe80:: fe80::FEInterface ID Interface ID Link-Local address for the host!47

Checking for DuplicatesNeighbor SolicitationAHello! Is this IPv6 address in use?Can you tell me your MAC address?ANeighbor AdvertisementBBHello! Yes, I’m using that IPv6 address.My MAC address is 72:D6:0C:2F:FC:01If nobody replies to the Neighbor Solicitation,the host uses the generated link-local address!48

Solicited Node Multicast Address Used in Neighbor Discovery Protocol for obtainingthe layer 2 link-layer (MAC) addressesIPv6 unicast addressPrefixInterface IDLower 24 bitssame bitsSolicited-node multicast addressff0201ffLower 24 bits128 bits!49

Solicited Node Multicast AddressHey! This message is forff02::1:ffd9:aa6fYes! That is for me!!50

Searching for RoutersRouter SolicitationAHello! Is there a router out there?ARouter AdvertisementHello! I’m a router and I have someinformation for you The Router Advertisement gives the host more informationto get an IPv6 address and set up a connection!51

Stateless Address Auto-Configuration The Router Advertisement message tells the host:- Router’s address- Zero or more link prefixes- SLAAC allowed (yes/no)- DHCPv6 options- MTU size (optional)Link PrefixInterface IDGlobal Unicast IPv6 Address!52

Interfaces will have multiple addresses Unicast- Link Localfe80::5a55:caff:fef6:bdbf/64- Global Unicast2001::5a55:caff:fef6:bdbf/64 (multiple) Multicast- All Nodesff02::1 (scope: link)- Solicited Nodeff02::1:fff6:bdbf (scope: link) Routers- All Routersff02::2 (scope: link)!53

Verifying ReachabilityNeighbor SolicitationHello! Are you still out there?Is your MAC address still valid?ANeighbor AdvertisementBHello! Yes, I’m still online.My MAC address is 72:D6:0C:2F:FC:01If the target does not reply to the Neighbor Solicitation,the sender removes the MAC address from the cache!54

RedirectsIPv6 PacketThis packet is for an IPv6 host.ARedirectHello! That destination you wanted?I know a better way to reach it. Hosts can be redirected to a better first-hop routerThey can also be informed that the destination is a neighbor on the link!55

Questions

Addressing PlansSection 5

Why Create an IPv6 Addressing Plan? Mental health during implementation(!) Easier implementation of security policies Efficient addressing plans are scalable More efficient route aggregation!58

IPv6 Address Management Your spreadsheet might not scale- There are 65.536 /64s in a /48- There are 65.536 /48s in a /32- There are 524.288 /48s in a /29- There are 16.777.216 /56s in a /32- There are 134.217.728 /56s in a /29 Find a suitable IPAM solution!59

Addressing PlanExercise

Addressing Plan Exercise Things to consider- administrative ease!- use assignments on 4 bit boundary- 2 possible scenarios for network- 5 possible scenarios for customer assignments 20 minutes preparation time 10 minutes discussion!61

Decide the size of the customer assignmentsFill in the addressing plan accordinglyhings to consider:e most important goal with IPv6 is aggregation.u can assign a /48 per POP without sending a request to the RIPE NCC.r your most important connections/equipment, use the easiest to remember addresses. (loopbacksc.)r administrative ease (DNS and your mind), it is recommended you assign on 4-bit boundaryNetwork Diagram - POPsPOP1POP2mailcolo 1sw netcr2.pop1voipcr2.pop2sw 2colo 2DNSAR2switchlayer 3 switchrouterPoint-to-Pointcustomer 1Point-to-Pointcustomer 2!62

Decide the size of the customer assignmentsFill in the addressing plan accordinglyhings to consider:e most important goal with IPv6 is aggregation.u can assign a /48 per POP without sending a request to the RIPE NCC.r your most important connections/equipment, use the easiest to remember addresses. (loopbacksc.)r administrative ease (DNS and your mind), it is recommended you assign on 4-bit boundaryNetwork Diagram - POP1POP1POP2mailcolo 1sw netcr2.pop1voipcr2.pop2sw 2colo 2DNSAR2switchlayer 3 switchrouterPoint-to-Pointcustomer 1Point-to-Pointcustomer 2!63

Decide the size of the customer assignmentsFill in the addressing plan accordinglyhings to consider:e most important goal with IPv6 is aggregation.u can assign a /48 per POP without sending a request to the RIPE NCC.r your most important connections/equipment, use the easiest to remember addresses. (loopbacksc.)r administrative ease (DNS and your mind), it is recommended you assign on 4-bit boundaryNetwork Diagram - POP2POP1POP2mailcolo 1sw netcr2.pop1voipcr2.pop2sw 2colo 2DNSAR2switchlayer 3 switchrouterPoint-to-Pointcustomer 1Point-to-Pointcustomer 2!64

Addressing plans /64 for each subnet Number of hosts in a /64 is irrelevant Multiple /48s per pop can be used- separate blocks for infrastructure and customers- document address needs for allocation criteria Use one /64 block per site for loopbacks!65

More on Addressing Plans For private networks, consider ULA For servers you want a manual configuration Use port numbers for addresses- pop server 2001:db8:1::110- dns server 2001:db8:1::53- etc !66

Questions

IPv6 PacketsSection 6

IPv6 Header Format Fixed length- Optional headers are daisy-chained IPv6 header is twice as long (40 bytes) asIPv4 header without options (20 bytes)!69

IPv6 HeaderIPv6 HeaderIPv4 HeaderVersionType ofServiceIHLIdentificationTime to LiveTotal LengthFlagsProtocolFragment OffsetVersionTraffic ClassPayload LengthFlow LabelNext HeaderHop LimitHeader ChecksumSource AddressSource AddressDestination AddressOptionsLEGENDPaddingDestination AddressField’s name kept from IPv4 to IPv6Field not kept in IPv6Name and position changed in IPv6New field in IPv6!70

IPv6 Header Optional fields go into extension headersDaisy-chained after the main headerIPv6 HeaderTCP HeaderDataNext Header: TCPIPv6 HeaderRouting HeaderNextHeader:Header:TCPTCPNext Header: Routing NextIPv6 HeaderRouting HeaderNext Header: Routing NextNextHeader:Header:TCPFragmentTCP HeaderFragment HeaderNext Header: TCPDataTCP HeaderData!71

Common Headers Common values of Next Header Fields:- 0Hop-by-hop option (extension)- 6TCP (payload)- 17UDP (payload)- 43Routing (extension)- 44Fragmentation (extension)- 50Encrypted Security Payload (extension)- 58ICMPv6!72

Fragmentation Routers don’t fragment packets with IPv6- More efficient handling of packets in the core- Fragmentation is being done by host If a packet is too big for next hop:- “Packet too big” error message- This is an ICMPv6 message- Filtering ICMPv6 causes problems!73