© Janice Regan, CMPT 128, CMPT 371 Data Communications and Networking Network Layer NAT, IPv6

© Janice Regan, Private networks  Recall that several blocks of addresses are reserved for local addresses  /8 ( )  /12 ( )  /16 ( )  These addresses can be utilized by using network address translation (NAT)

© Janice Regan, IPv4 local addresses  A local network may use local addresses taken from the blocks on the previous slide  These addresses are non-routable addresses and may be used on within the local network  These addresses are not considered valid addresses on the Internet  These addresses are valid only within the local network  To communicate with the internet one or more routable addresses are needed  Network address translation must occur on the router connecting the local network to the internet

© Janice Regan, Types of NAT implementation  Static NAT  Dynamic NAT  Overloaded NAT (NAPT network address port translation)

© Janice Regan, Static NAT NAT router internet Private network

© Janice Regan, Static NAT  Some machines on the internal network need internet access ( , )  There are several globally valid internet addresses available to the router connected to the local network ( , )  Each of the hosts that need internet access are permanently allocated one of the available globally valid internet addresses  ↔  ↔  All other hosts have no connectivity to the internet

© Janice Regan, Packet transmission through a static NAT (1)  When sends a packet to it is received by the NAT router  The sending host is unaware of the NAT.  The NAT replaces the local source address with the corresponding globally valid address , recalculates the TCP or UDP checksum if necessary (if packet is TCP or UDP) then forwards the packet toward the destination.

© Janice Regan, Packet transmission through a static NAT (2)  The destination host sees the NAT’s replacement address, , as the IP of the source and sends its reply to that IP address  The NAT receives the reply  Removes the destination address (its own address) from the packet  Replaces the destination address with the corresponding internal address,  For UDP or TCP packets recalculates the checksum  Forwards the packet to the internal source

© Janice Regan, Dynamic NAT  Establishes a 1-1 relationship between non- routable internal addresses and the globally valid IP addresses assigned to the NAT.  The non routable address bound to each globally valid address may change over time as communications are initiated and completed

© Janice Regan, Dynamic NAT operation  Similar to Static NAT except  Pool of available globally valid IP addresses  Each time an internal host begins communication with the internet the first packet destined for the internet will reach the NAT enabled router The NAT enabled router will take the next available globally valid IP address from the pool and assign it to the internal host When communications is complete address will be replaced into the pool

© Janice Regan, NAPT (network address port translation)  NAT overloading or NAPT  Again, the local network uses locally valid non-routable IP addresses (not globally valid)  In this configuration the NAT allows more than one local host to use the same globally valid internet address  The NAT has one or more globally valid IP addresses  Communications with different hosts are differentiated by using different port numbers (transport layer)  This is not a use of port numbers that is consistent with the layered design of the protocol stack, port numbers are not part of the network layer addresses, ports are designed for end to end communications not to be changed at each intermediate station  Using ports in this way also causes other problems

© Janice Regan, Overloaded NAT NAT router internet : Private network

© Janice Regan, Overloaded NAT Example Source Computer Source PortNAT IP NAT port

© Janice Regan, NATP example (1)  A host on the local network, say , sends a packet to an external host, through port 555  The NAT enabled router receives the packet from the local host  The NAT enabled router stores the source IP and port number in its address translation table  The NAT enabled router replaces the IP and port number in the packet with those it stores in the address translation table for this connection (for this example and 1201)  The NAT enabled router recalculates the UDP or TCP checksum (for UDP and TCP packets) before forwarding the packet to the destination

© Janice Regan, NATP example (2)  When the destination receives the packet it will appear to have come from the NAT ( ).  Any responses will be sent to , and thus be received by the NAT router  The NAT router will check the destination port in the response packet  By referring to the address translation table the NAT router will find the local non-routable address and port that corresponds.  The NAT router will replace the destination port and IP address with the local non-routable address and the corresponding port, recalculate the checksums as needed, and forward the packet to the original source host

© Janice Regan, Problems with NAPT  Although NAPT is the most commonly used form of NAT it causes some serious difficulties  The most common encryption and authentication mechanisms used in the IP layer do not function when NAPT is used. It requires yet more serious violations of design principles to patch these problems (only some can be patched)  Servers that require connection to a particular port can only be run on one machine (the one that is using that port in the NAPT mapping).  P2P applications require servers run on each peer, therefore P2P applications will break unless extraordinary measures are taken. (connection reversal: connect to a machine outside local net directly, P2P connection goes through that machine, breaks security)

© Janice Regan, Change IP, other solutions?  Address space exhaustion (temporary solution CIDR)  Two level addressing (network and host) results in many unused addresses. Addresses committed even if not used or potentially used for growth of network.  Growth of networks and the Internet  Extended use of TCP/IP  Lack of security and authentication  Temporary solution: IPsec retrofit to IPv4  Requirements for new types of service  temporary solution: differential services replaces TOS  Not able to guarantee real-time transmission of services like video or audio

© Janice Regan, Improvements in IPv6 (1)  Expanded address space: 128 bit addresses  Improved option mechanism: Additional separate optional headers between IPv6 header and transport layer header. Fixed length (40 byte) primary header  Most additional headers are not examined by intermediate routers, improving processing speed at intermediate routers and simplifying router processing.  It is easier to add options by adding more intermediate headers  Address autoconfiguration: Allows dynamic assignment of addresses

© Janice Regan, IPv6 Improvements (2)  Increased addressing flexibility:  Anycast - delivered to one of a set of nodes  Improved scalability of multicast addresses  Support for resource allocation:  Labeling of packets to particular traffic flow  Allows special handling (e.g. Support real time streams for applications such as video )  Replaces type of service  New version of ICMP ICMPv6 (RFC 2463)  Functionality of ICMPv4 and ARP (RFC 2461) in neighbor discovery, and IGMP (RFC ) in the multicast listener discoverer, all combined in one protocol

© Janice Regan, IPv6 packet Structure IPv6header Fragmentheader Hop by Hop header Destination options header Routingheader Authenticationheader DATA EncapsulatingSecurityheader DestinationOptionsheader Transportheader

© Janice Regan, IP v6 Header Figure 33.2 Comer (2000)

© Janice Regan, IP v6 Header Fields (1)  Version (4 bits): 6  Traffic Class (8 bits): Experimental: indicates class or priority of packet. Still undefined, provides way for application to experiment with class  Flow Label (20 bits): Experimental: Indicates that packet belongs to a specific sequence of packets that can be reference by flow number. Used by hosts requesting special handling of such a sequence of packets. Multiple sequences can flow between the same hosts, each packet in a sequence must have identical Hop by Hop and routing headers and IPv6 addresses.

© Janice Regan, IP v6 Header Fields (2)  Payload length (16 bits): Includes all extension headers plus user data.  Next Header (8 bits): Indicates the type of the first extension header or in the absence of extension headers the protocol for the next layer up (same as for IPv4).  Hop Limit (16 bits): maximum number of allowed hops (0-255). When number is exceeded ICMPv6 Time Exceeded message is sent  Source Address (128 bits)  Destination address (128 bits)

© Janice Regan, IPv6 Addresses (1)  128 bits long represented as a hexadecimal number separated by colons.  Divided into 8 16 bit blocks each represented by 4 hexadecimal digits. 1080:0000:0000:0000:0008:08A0:200C:417A  Leading zeros can be omitted, but one zero remains if all 4 hexadecimal digits are zero. 1080:0:0:0:8:8A0:200C:417A  One string of single colon separated zeros can be abbreviated to a :: (Not more than one) 1080::0008:08A0:200C:417A  Uses prefixes: same as CIDR like notation e.g. 21DA:D3:0:2F3B::/64 to denote the network prefix (network address of length 64 is 21DA:D3:0:2F3B)

© Janice Regan, IPv6 Addressing  Three types of address  Unicast to a single interface  Multicast to a set of interfaces Delivered to all interfaces identified Interfaces may be on different network segments Broadcast is treated as a special case of multicast  Anycast Set of interfaces (typically different nodes) Delivered to any one of set (nearest) interface Allocated from aggregable global unicast addresses

© Janice Regan, IPv6 Fragmentation  Fragmentation only allowed at source  No fragmentation at intermediate routers  Node must perform path discovery to find smallest maximum transmission unit (MTU) of intermediate networks or use minimum MTU size of 1280 octets  Source fragments to match MTU  Fragmentation algorithm is the same as IPv6  Reduces load at intermediate hosts/routers

© Janice Regan, Transition IPv4 to IPv6 (1)  During transitions IPv6 hosts will retain a IPv4 protocol stack to use for communication with iPv4 networks. (dual stack approach) YA B C D E  Host A and Host D are both IPv6 enabled but are communicating using IPv4. Want them to use more efficient IPv6 IPv6IPv4 IPv6 IPv4

© Janice Regan, Transition IPv4 to IPv6  When IPv6 hosts communicate through an IPv4 network the IPv6 packets should be encapsulated in IPv4 packets an sent through a tunnel IPv6IPv4 IPv6 IPv4 Tunnel IPv6 packet inside IPv4 packet IPv4 headerIPv6 headerIPv6 data IPv4 data