1. Introduction, inc. Addressing and Autoconfiguration IPv6 workshop Krakow May 2012 Carlos Friaças, FCCN cfriacas@fccn.pt Luc De Ghein, CISCO ldeghein@cisco.com

2. Contents Introduction to IPv6 IPv6 Protocol (headers & options) IPv6 Addressing IPv6 Associated Protocols Autoconfiguration

3. Copyrights This slideset is the ownership of the 6DEPLOY project via its partners The Powerpoint version of this material may be reused and modified only with written authorization Using any part of this material is allowed if credit is given to 6DEPLOY The PDF files are available from www.6deploy.eu Looking for a contact ? Mail to: martin.potts@martel-consulting.ch Or: bernard.tuy@renater.fr

4. Contribs & updates Bernard Tuy, RENATER Alvaro Vives, Consulintel Laurent Toutain, Telecom B. Bernard Tuy, RENATER Alvaro Vives, Consulintel Bernard Tuy, RENATER Carlos Friaças, FCCN 05/2008 06/2008 09/2008 11/2008 03/2009 04/2009 04/2012 4

5. Introduction to IPv6 IPv6 workshop Krakow May 2012

6. Why a new version for IP ? Historical facts IPv4 address space status From Emergency measures … … to IPv6

7. Historical facts 1983 : Research network for ~ 100 computers 1992 : Internet is open to the commercial sector : Exponential growth IETF urged to work on an IP next generation protocol 1993 : Exhaustion of the class B address space Forecast of network collapse for 1994 ! RFC 1519 (CIDR) published Updated by RFC 4632 in 2006 1995 : RFC 1883 (IPv6 specs) published First RFC about IPv6

8. Hierarchical & Regional How does address distribution work?

9. Source: http://www.nro.net/wp-content/uploads/nro_stats_2011_q2.ppt IPv4 address space status

10. Source: http://www.nro.net/statistics IPv4 Regional Allocations

11. The last /8 (~16.7 million addresses) will be distributed according to a different and more restrictive policy Exhaustion at the RIPENCC Service Region

12. RIR Allocation Policies AfriNIC: http://www.afrinic.net/IPv6/index.htm http://www.afrinic.net/docs/policies/afpol-v6200407-000.htm * APNIC: http://www.apnic.org/docs/index.html http://www.apnic.org/policy/ipv6-address-policy.html * ARIN: http://www.arin.net/policy/index.html http://www.arin.net/policy/nrpm.html#ipv6 * LACNIC: http://lacnic.net/sp/politicas/ http://lacnic.net/sp/politicas/ipv6.html * RIPE-NCC: http://www.ripe.net/ripe/docs/ipv6.html http://www.ripe.net/ripe/docs/ipv6policy.html * *describes policies for the allocation and assignment of globally unique IPv6 address space

13. RIR Allocation Statistics AfriNIC: http://www.afrinic.net/statistics/index.htm APNIC: http://www.apnic.org/info/reports/index.html ARIN: http://www.arin.net/statistics/index.html LACNIC: http://lacnic.org/sp/est.html RIPE-NCC: http://www.ripe.net/info/stats/index.html

14. Emergency measures … CIDR Private addresses NAT

15. CIDR … Allocate former “class B” addresses exceptionally known as /16 prefixes since then Re-use “class C” address space Without any more address classes CIDR (Classless Internet Domain Routing) RFC 1519 updated by RFC 4632 network address = {prefix/prefix length} Classes abandon = less address waste allows aggregation => reduces routing table size

16. Allow private addressing plans Addresses are used internally Similar to security architecture with firewall Use of proxies or NAT to go outside RFC 2663, 2993 and 3022 Private addresses (RFC 1918)

17. NAT (continued) Advantages: Reduce the need of official (public) addresses Ease the internal addressing plan Transparent to some applications “Security” vs obscurity Netadmins/sysadmin Disadvantages : Translation sometimes complex (e.g. FTP) Apps using dynamic ports Does not scale Introduce states inside the network:  Multihomed networks Breaks the end-to-end paradigm Security with IPsec => Should be reserved for small sites in Client/Server mode

18. Emergency Measures These emergency measures provided time to develop a new version of IP, named IPv6 IPv6 keeps principles that have made the success of IP Open architecture CIDR usage Corrects what was wrong with the current version (v4) Header simplification BUT are emergency measures enough?

19. From emergency to IPv6 IPv6 is already there … Internet v6 is there today : NRENs in EU, North America, Asia … are interconnected in IPv6 Lots of IXP are offering IPv6 connectivity Several transit providers already have IPv6 at their services portfolio Several content providers have deployed it, and are actively promoting IPv6 ISPs and Telcos exchange IPv6 routes Vista and Windows 2008 (servers) are IPv6 enabled by default Around 5400 ASNs already visible (source: CIDR report) Then the question is not “if” but “when?” and “how?”

20. IPv6 Protocol (headers & options) IPv6 workshop Krakow May 2012

21. IPv6 Header Comparison with IPv4 IPv6 optional headers (extensions) Processing IPv6 headers Comparison with IPv4

22. IPv6 Header The IPv6 header is designed To minimize header overhead and reduce the header process for most of the packets Less important information and option fields are moved to extension headers  IPv6 & IPv4 headers are not interoperable

23. IPv4 Header Ver. fragmentIdentifier Total Length flags 20 Bytes 32 bits ToS Options IHL TTLProtocol Checksum Source Address Destination Address 32 bits

24. Ver. Hop LimitPayload length Flow label Next Header Source Address Destination Address 40 Bytes 32 bits Traffic Class (Extensions) Data IPv6 Header simplification 128 bits

25. IPv6: optional Extensions New “mechanism” replacing IPv4 options An IPv6 extension : Every extension has its own message format Is a n x 8-byte datagram Starts with a 1-byte ‘Next Header’ field  Pointing to either another extension or a L-4 protocol Hop-by-hop (jumbogram, router alert) Always the first extension Analyzed by every router.

26. IPv6: optional Extensions Destination Routing (loose source routing) Fragmentation Security Authentication (AH) Encapsulating Security Payload (ESP) : confidentiality

27. IPv4 header options processing IPv4 options : processed in each router slow down packets A B A -> R1 B A -> BR1 R1

28. IPv6 ext. header processing IPv6 extensions (except Hop-by-Hop) are processed only by the destination. A B A -> R1 B A -> BR1 R1

29. Conclusion Main changes in IPv6 protocol are within address format and datagram headers A lot of fields in the IPv6 header have disappeared  More efficient processing in the (intermediate) routers Optional extensions allow more functionalities (source routing, authentication, …) Optional header mechanism allows new options introduction without modifying the protocol

30. IPv6 Addressing IPv6 workshop Krakow May 2012

31. IPv6 Addressing Scheme Types Formats Type Prefixes Space Production Addressing Scheme Plans

32. IPv6 Addressing Scheme Defined in RFC 4291 (2006) Updated by RFC5952 and RFC6052 (2010) Several previous versions Oldest is from 1995 (RFC1884) 128 bits Addresses (hierarchy & flexibility) Hexadecimal representation (0 to F) 1 Interface can have several IPv6 addresses

33. IPv6 Addressing Scheme There is no broadcast nor network address Global Unicast IPv6 addresses format defined in RFC 3587 CIDR principles usage: Prefix / Prefix length (or mask) 2001:660:3003::/48 2001:660:3003:2:a00:20ff:fe18:964c/64 Aggregation reduces routing table size

34. IPv6 Address Types Unicast (one-to-one) global link-local site-local (deprecated) Unique Local (ULA) IPv4-compatible (deprecated) IPv6-mapped Multicast (one-to-many) Anycast (one-to-nearest) Reserved Source: http://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml

35. Basic Format ( Global, 16 bytes/128 bits) : Compact Format Literal Format [2001:0DB8:3003:0001:0000:0000:6543:210F] 2001:0DB8:3003:0001:0000:0000:6543:210F 2001:0660:3003:0001:0000:0000:6543:210F 2001:660:3003:1:0:0:6543:210F 2001:DB8:3003:1::6543:210F IPv6 Addressing Formats

36. IPv6 Address Type Prefixes Global Unicast assigments actually use 2000::/3 (001 prefix) Anycast addresses allocated from unicast prefixes Address TypeBinary PrefixIPv6 Notation Unspecified00…0 (128 bits)::/128 Loopback00…1 (128 bits)::1/128 Multicast1111 FF00::/8 Link-Local Unicast1111 1110 10FE80::/10 ULA1111 110FC00::/7 Global Unicast(everything else) IPv4-mapped00…0:1111 1111:IPv4::FFFF:IPv4/128 Site-Local Unicast (deprecated)1111 1110 11FEC0::/10 IPv4-compatible (deprecated)00…0 (96 bits)::IPv4/128

37. IPv6 Address Space Aggregatable Global Unicast Addresses (001): 1/8 Unique Local Unicast addresses (1111 1110 00): 1/128 Link-Local Unicast Addresses (1111 1110 10): 1/1024 Multicast Addresses (1111 1111): 1/256 More info: http://www.iana.org/assignments/ipv6-address-space For FutureUse In Use 1/21/41/81/8

38. Production Addressing Scheme (1)

39. Production Addressing Scheme (2) LIRs receive by default /32 Production addresses today are from prefixes 2001, 2003, 2400, etc. Can request for more if justified /48 used only within the LIR network, with some exceptions for critical infrastructures /48 to /128 is delegated to end users Recommendations following RFC6177 (2011) and current policies /48 general case, /47 if justified for bigger networks /64 if one and only one network is required /128 if it is sure that one and only one device is going to be connected Subnet ID (16 bits ) Interface Identifier (64 bits) interface ID 001 subnet IDGlob. Rout. prefix Global Routable Prefix (45 bits)

40. Production Addressing Scheme (3) Source: http://www.iana.org/assignments/ipv6-unicast-address-assignments IPv6 Global Unicast Address Assignments [0] [last updated 2008-05-13] Global Unicast Prefix Assignment Date Note --------------------- ---------- ------ ---- 2001:0000::/23 IANA 01 Jul 99 [1] 2001:0200::/23 APNIC 01 Jul 99 2001:0400::/23 ARIN 01 Jul 99 2001:0600::/23 RIPE NCC 01 Jul 99 2001:0800::/23 RIPE NCC 01 May 02 2001:0A00::/23 RIPE NCC 02 Nov 02 2001:0C00::/23 APNIC 01 May 02 [2] 2001:0E00::/23 APNIC 01 Jan 03 2001:1200::/23 LACNIC 01 Nov 02

41. Production Addressing Scheme (4) 31664 bits Fixed Prefix IANA/RIR/LIR End User Interface ID Public topology /48 Network portion /64 Host portion /64 45 Site topology /80

42. Preparing an IPv6 addressing plan is not a trivial task Needs timely planning – All remote network points and existing topologies need to be remembered Keep in mind: Aggregation = YES Conservation = NO Addressing Plans

43. Do we perform reservations? If yes, which size? All departments have the same relevance/status? And the same networking needs? Where to start performing assignments? Where to assign the “2 nd block”? Which block is to be used on infrastructure? Which network masks are we going to use for plain point-to-point connections? Decisions

44. Visualization

45. Address is defined with: Embedded MAC Address or Fixed The automatic address obtained through autoconfiguration, when the NIC is changed, forces: – A DNS AAAA record update – Check services’ configs – Update scripts which use the address in a static way LANs – last 64 bits?

46. IPv6 Associated Protocols IPv6 workshop Krakow May 2012

47. IPv6 Associated Protocols New Protocols Neighbor Discovery (NDP) Address Resolution Path MTU Discovery

48. New features are specified in IPv6 Protocol -RFC 2460 DS Neighbor Discovery (NDP) -RFC 4861 DS Updated by RFC 5942 Auto-configuration : Stateless Address Auto-configuration -RFC 4862 DS DHCPv6: Dynamic Host Configuration Protocol for IPv6 -RFC 4361 PS (updated by RFC 5494) Path MTU discovery (pMTU) -RFC1981 DS New Protocols (1)

49. MLD (Multicast Listener Discovery) –RFC 2710 PS Updated by RFC 3590 and RFC 3810 Multicast group management over an IPv6 link Based on IGMPv2 MLDv2 (equivalent to IGMPv3 in IPv4) ICMPv6 (RFC 4443 DS): Updated by RFC 4884 Covers ICMP (v4) features (Error control, Administration, …) Transports ND messages Transports MLD messages (Queries, Reports, …) New Protocols (2)

50. IPv6 nodes (hosts and routers) on the same physical medium (link) use Neighbor Discovery (NDP) to: discover their mutual presence determine link-layer addresses of their neighbors find neighboring routers that are willing to forward packets on their behalf maintain neighbors’ reachability information (NUD) not directly applicable to NBMA (Non Broadcast Multi Access) networks  NDP uses link-layer multicast for some of its services. Neighbor Discovery for IPv6 (1)

51. Protocol features : Router Discovery Prefix(es) Discovery Parameters Discovery (link MTU, Max Hop Limit,...) Address Autoconfiguration Address Resolution Next Hop Determination Neighbor Unreachability Detection Duplicate Address Detection Redirect NDP for IPv6 (2)

52. The IPv6 Neighbor Discovery protocol corresponds to a combination of the IPv4 protocols: Address Resolution Protocol (ARP) ICMP Router Discovery (RDISC) ICMP Redirect (ICMPv4) Improvements over the IPv4 set of protocols: Router Discovery is part of the base protocol set Router Advertisements carry link-layer addresses and prefixes for a link, and enable Address Autoconfiguration Multiple prefixes can be associated with the same link. Neighbor Unreachability Detection is part of the base protocol set Detects half-link failures and avoids sending traffic to neighbors with which two-way connectivity is absent By setting the Hop Limit to 255, Neighbor Discovery is immune to off- link senders that accidentally or intentionally send ND messages. NDP (3) : comparison with IPv4

53. NDP specifies 5 types of ICMP packets : Router Advertisement (RA) :  ICMP type = 134, code 0  periodic advertisement or response to RS message (of the availability of a router) which contains: –list of prefixes used on the link (autoconf) –Flags for address configuration mechanism (M & O) –a possible value for Max Hop Limit (TTL of IPv4) –value of MTU Router Solicitation (RS) :  the host needs RA immediately (at boot time) NDP (4)

54. Neighbor Solicitation (NS):  to determine the link-layer @ of a neighbor  or to check a neighbor is still reachable via a cached L2 @  also used to detect duplicate addresses (DAD) Neighbor Advertisement (NA):  answer to a NS message  to advertise the change of physical address Redirect :  Used by routers to inform hosts of a better first hop for a destination NDP (5)

55. Address resolution is the process through which a node determines the link-layer address of a neighbor given only its IP address. Find the mapping: Dst IP @  Link-Layer (MAC) @ Recalling IPv4 & ARP ARP Request is broadcasted  e.g. ethernet @: FF-FF-FF-FF-FF-FF  Btw, it contains the Src’s LL @ ARP Reply is sent in unicast to the Src  It contains the Dst’s LL @ Address resolution

56. At boot time, every IPv6 node has to join 2 special multicast groups for each network interface:  All-nodes multicast group: ff02::1  Solicited-node multicast group: ff02::1:ffxx:xxxx –derived from the lower 24 bits of the node’s address H1: IP1, MAC1 H2: IP2, MAC2 H A : IP A, MAC A H B : IP B, MAC B NS ? D2 ( MAC B )D3= Multi(IP B )) S2 = MAC A S3 = IP A NA D2 = MAC A D3 = IP A S2 = MAC B S3 = IP B Address resolution (2) with NDP

57. Derived from RFC1191 ( IPv4 version of the protocol) Path = set of links followed by an IPv6 packet between source and destination Link MTU = maximum packet length (bytes) that can be transmitted on a given link without fragmentation Path MTU (or pMTU) = min { link MTUs } for a given path Path MTU Discovery = automatic pMTU discovery for a given path Path MTU discovery (RFC 1981)

58. Protocol operation makes assumption that pMTU = link MTU to reach a neighbor (first hop) if there is an intermediate router such that  link MTU < pMTU  it sends an ICMPv6 message: "Packet size Too Large" source reduces pMTU by using information found in the ICMPv6 message … => Intermediate network element aren’t allowed to perform packet fragmentation Path MTU discovery (2)

59. Autoconfiguration IPv6 workshop Krakow May 2012

60. Agenda Stateless Autoconfiguration Stateful Autoconfiguration (DHCPv6) Conclusions

61. Stateless Autoconfiguration Provides plug & play networking for hosts On network initialisation a node can obtain: IPv6 prefix(es) Default router address(es) Hop limit (link local) MTU validity lifetime DNS server addresses are not normally supplied RFC6106 (2010) - IPv6 Router Advertisement Options for DNS Configuration  Though not yet available in any OS

62. Stateless Autoconfiguration Hosts can automatically get an IPv6 address Only routers have to be manually configured Or can use the Prefix Delegation option (RFC 3633) Servers should be manually configured Link-local (as opposed to Global) addresses are usually autoconfigured on all nodes

63. Stateless Autoconfiguration IPv6 Stateless Address Autoconfiguration Defined in RFC 4862 Hosts listen for Router Advertisements (RA) messages Periodically sent out by routers on the local link, or requested by the host using an RA using a solicitation message RA messages provide information to allow for automatic configuration Hosts can create a Global unicast IPv6 address by combining: Its interface’s EUI-64 (based on MAC) address or random ID Link Prefix (obtained via Router Advertisement) Global Address = Link Prefix + EUI-64 address

64. Stateless Autoconfiguration Usually, the router sending the RA messages is the default router If the RA doesn’t carry a prefix The hosts don’t configure (automatically) any global IPv6 address (but may configure the default gateway address) RA messages contain two flags Indicate what type of stateful autoconfiguration (if any) should be performed IPv6 addresses usually based on NIC MAC address Though hosts can use Privacy Extensions (RFC4941) E.g. Vista uses random EUI-64 as default

65. Internet Router Advertisement 2001:690:1:1 Router Solicitation Dest. FF02::2 FF02::2 (All routers) 1. Create the link local address2. Do a Duplicate Address Detection MAC address is 00:0E:0C:31:C8:1F EUI-64 address is 20E:0CFF:FE31:C81F FE80::20E:0CFF:FE31:C81F 3. Send Router Solicitation4. Create global address5. Do a DAD6. Set Default Router 2001:690:1:1::20E:0CFF:FE31:C81F FE80::20F:23FF:FEF0:551A FE80::20F:23FF:FEf0:551A ::/0 And the DNS Server Address ?! Packets flowing

66. Dynamic Host Configuration Protocol for IPv6 Defined in RFC 3315 (2003) Updated by RFC 4361, RFC 5494, RFC 6221, RFC 6422 Stateful counterpart to IPv6 Stateless Address Autoconfiguration. According to RFC 3315 DHCPv6 is used when: No router is found Or if Router Advertisement message enables use of DHCP  Using ManagedFlag and OtherConfigFlag There is also ‘stateless DHCPv6’ (RFC3736) Used by clients that already have an address Based upon standard DHCPv6 Stateful Autoconfiguration DHCPv6

67. DHCPv6 works in a client / server model Server  Responds to requests from clients  Optionally provides the client with: – IPv6 addresses –Other configuration parameters (DNS servers…)  Listens on the following multicast addresses: –All_DHCP_Relay_Agents_and_Servers (FF02::1:2) –All_DHCP_Servers (FF05::1:3)  Provides means for securing access control to network resources  Usually storing client’s state, though ‘stateless operation’ is also possible (the usual method used for IPv4 today) Stateful Autoconfiguration DHCPv6 (2)

68. Client  Initiates requests on a link to obtain configuration parameters  Uses its link local address to connect the server  Sends requests to FF02::1:2 multicast address (All_DHCP_Relay_Agents_and_Servers) Relay agent  A node that acts as an intermediary to deliver DHCP messages between clients and servers  On the same link as the client  Listens on multicast address: –All_DHCP_Relay_Agents_and_Servers (FF02::1:2) Statefull Autoconfiguration DHCPv6 (3)

69. Internet Reply-message DNS 2001:690:5:0::10 Information-Request (DNS Server ’ s address?) 2. Host execute an DHCPv6 Client3. Client will send an Information-Request1. What’s the DNS servers’ Address4. Server responds with a Reply Message5. Host configures the DNS server Example: in /etc/resolve.conf file FF02::1:2 ( All_DHCP_Relay_Agents_and_Servers) DHCPv6 Server Packets flowing

70. The two types of configuration are complementary In dual-stack networks we can obtain IPv4 DNS server addresses from DHCPv4 DHCPv6 clients not shipped in all Operating Systems Vista/Windows7 contains DHCPv6 client Third party clients are availble for all Oses  E.g. Dibbler, ISC DHCP, Red Hat DHCPv6 Conclusion

71. Questions 71