1. aarnet Australia's Academic and Research Network Glen Turner 2011-07-14 IPv6 birds of a feather meeting QUESTnet 2011 IPv6 — the elevator pitch

2. IPv6: fixes the bugs in IPv4 ● Better addressing – Bigger, 32b → 128b, /64 in every subnet – Better, Multiple addresses per interface – No special cases like broadcast addresses ● Automated configuration – Not manual, no special servers – Multiple routers, with automatic failover – Zero configuration access to local services ● Secure communications – IPSec ● Class of service – Differentiated Services

3. IPv4: address exhaustion ● There are no IPv4 addresses left – This has been the case for ages, and is why each ADSL customer gets a /32 rather than a /24 ● NAT is the answer 150.101.30.44/32 192.168.1.0/24 ISP Site

4. IPv4 address exhaustion ● Increasingly not enough IPv4 addresses for a /32 for each customer – Price is currently over $10 per IP address ● Again, “carrier class” NAT is the answer 10.0.0.1/32 192.168.1.0/24 ISP Site Global addressing Local addressing

5. How does NAT work? ● Inspect outgoing traffic – Collect (src_addr, src_port, dst_addr, dst_port) ● Re-write src_addr to my exterior interface, find an unused source port on my exterior interface and re-write src_port to that ● Record these addresses and ports in the expectation table (10.1.1.1, 10000, 202.158.201.38, 80) (150.101.30.33, 20000, 202.158.201.38, 80) (150.101.30.33, 20000, 10.1.1.1, 10000, 202.158.201.38, 80)

6. How does NAT work? ● Inspect incoming traffic ● Is the incoming (src_addr, src_port, dst_addr, dst_port) in the expectation table? ● Re-write the dst_addr and dst_port to the original values in the table (202.158.201.38, 80 10.1.1.1, 10000) (202.158.201.33, 80 150.101.30.33, 20000) (150.101.30.33, 20000, 10.1.1.1, 10000, 202.158.201.38, 80)

7. NAT has benefits ● Deep packet inspection – A necessary part of NAT – But a DPI firewall can also work without altering the data passing through it, and is more robust when doing so ● Address re-numbering – The disconnect between exterior and interior address allows easy change of exterior address – IPv6 is designed for convenient renumbering – Most universities here should approach APNIC for provider-independent addressing

8. NAT is not a good answer ● The owner of the NAT chooses the helper modules – I am a phone company too, do I really want to assist H.323 and SIP users? ● No global visibility at all – Everyone is a client, because no-one can run a server – How do new services get developed in the first place?

9. IPv6 restores the Internet as it was ● End-to-end visibility of addresses ● Plenty of addresses – Every home can have a /64

10. Global IPv4 addresses are precious ● Financially – A /16 has a considerable financial value – And thus open to fraud, especially where registry records are not up-to-date ● For evil – A globally-visible address is a rendevous point for behind-NAT services that need to find each other – So insecure machines on global IPv4 addresses are a high-priority target

11. You might be running IPv6 now ● 6to4 and Teredo tunnels are automatically started by some operating systems ● Terminate these tunnels before they pass through your firewall, then firewall sees the real traffic IPv6 in IPv4 IPv 6 IPv6 in IPv4 IPv 6

12. Deployment strategies ● Need to be tailored to your network and organisation ● General approach is “core out” – Connect network core to IPv6 – Basic network services, such as stateless DHCP – Monitoring – Firewall – Teredo and 6to4 tunnel providers ● Then – Public services: web, SMTP ● Then – Declare victory

13. Deployment strategies, con'd ● Dual IPv6/IPv4 to the average client takes a little more work – Performance of negative caching of DNS AAAA records – Acceptance testing – Education and training of technical support staff ● But the experience seems to be that this part is less work than expected

14. Challenges to IPv6 deployment ● Stateless autoconfiguration – IP addresses have been dynamic for a long time, but a lot of sites have forgone dynamic addressing to retain accounting systems ● Lack of deep support in middle-boxes – Most firewalls now claim IPv6 support – But few have feature-for-feature IPv4-IPv6 support ● eg: few support OSPFv3 ● Lack of comprehensive acceptance testing and monitoring – Fear of breakage when deploying IPv6 on SOE – Lack of alerts when breakage occurs

15. aarnet Australia's Academic and Research Network Glen Turner 2011-07-14 IPv6 birds of a feather meeting QUESTnet 2011 IPv6 — the elevator pitch