Ipv6 Basics

(1)

Session Number

Basic IPv6

Luc De Ghein

(2)

(3)

Short History of IPv6

1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2001

Prediction of the exhaustion of IPv4 Class B by 1994.

ROAD group formed to address routing.

Prediction of the exhaustion of IPv4 Class B by 1994.

IPng Proposals solicitation (RFC 1550).

CATNIP, SIPP, TUBA analyzed. SIPP+ chosen. IPng wg started.

First specification: RFC 1883.

First attempt for provider-based address format.

First IPv6 exchange: 6tap.

Registries assign IPv6 prefixes. IPv6Forum formed.

Vendor Support in Main Product Lines

(4)

Why IPv6?

(Current Business Reasons)

• Demand from particular regions

Asia, EU

Technical, geo-political, and business reasons

Demand is now

• Demand for particular services

Cellular wireless (especially 3GPP[2] standards)

Internet gaming (e.g., Sony Playstation 2)

Use is >= 1.5 years away (but testbeds needed now)

• Potential move to IPv6 by Microsoft?

IPv6 included in Windows XP, but not enabled by default

To be enabled by default in next major Windows release

Use is >= 1.5 years away

(5)

Why IPv6?

(Theoretical Reasons)

Only compelling reason:

more IP addresses!

• For billions of new users

(Japan, China, India,…)

• For billions of new devices

(mobile phones, cars, appliances,…)

• For always-on access

(cable, xDSL, ethernet-to-the-home,…)

• For applications that are difficult, expensive, or

impossible to operate through NATs

(IP telephony, peer-to-peer gaming, home servers,…)

• To phase out NATs to improve robustness, security,

performance, and manageability of the Internet

(6)

Disadvantages of NAT

• performance hit -> rewriting src addresses,

recalculating transport checksums, searching for and

rewriting application layer addresses (eg. FTP)

• end - 2 - end significance of IP address is lost

• doesn’t work if higher layer protocol is carrying

encrypted address(es)

• inhibits using more than 1 site entry/exit point

• complicates problem diagnosis ( where is a pkt

going to / coming from)

(7)

Why a New IP?

only compelling reason:

more addresses!

• for billions of new devices,

e.g., cell phones, PDAs, appliances, cars, etc.

for billions of new users,

e.g., in China, India, etc.

for “always-on” access technologies,

(8)

But Isn’t There Still Lots of

• ~ half the IPv4 space is unallocated

if size of Internet is doubling each year,

does this mean only one year’s worth?!

• no, because today we deny unique IPv4

addresses to most new hosts

we make them use methods like NAT, PPP, etc. to

share addresses

• but new types of applications and new types

of access need unique addresses!

(9)

IP Address Allocation History

1981 - IPv4 protocol published

1985 ~ 1/16 of total space

1990 ~ 1/8 of total space

1995 ~ 1/4 of total space

2000 ~ 1/2 of total space

• This despite increasingly intense conservation efforts

PPP / DHCP address sharing

CIDR (classless inter-domain routing)

NAT (network address translation)

plus some address reclamation

• Theoretical limit of 32-bit space: ~4 billion devices

Practical limit of 32-bit space: ~250 million devices

(10)

Incidental Benefits of

Bigger Addresses

• easy address auto-configuration

• easier address management/delegation

• room for more levels of hierarchy,

for route aggregation

• ability to do end-to-end IPsec

(11)

Incidental Benefits of

New Deployment

• chance to eliminate some complexity,

e.g., in IP header

• chance to upgrade functionality,

e.g., multicast, QoS, mobility

• chance to include new enabling features,

(12)

Summary of Main IPv6 Benefits

• expanded addressing capabilities

• server-less autoconfiguration (“plug-n-play”)

and reconfiguration

• more efficient and robust mobility mechanisms

• built-in, strong IP-layer encryption and

authentication

• streamlined header format and flow identification

(13)

Other Benefits of IPv6

• Server-less plug-and-play possible

• End-to-end, IP-layer authentication & encryption

possible

• Elimination of “triangle routing” for mobile IP

• Other minor improvements

NON-

Benefits:

• Quality-of-service (same QoS capabilities as IPv4)

Flow label field in IPv6 header may enable more efficient

flow classification by routers, but adds no new capability

• Routing (same routing protocols as IPv4)

except larger address allows more levels of hierarchy

except customer multihoming is defeating hierarchy

(14)

Why Was 128 Bits Chosen

some wanted fixed-length, 64-bit addresses

easily good for 10

12

_{sites, 10}

15

_{nodes, at .0001 allocation}

efficiency (3 orders of mag. more than IPng requirement)

minimizes growth of per-packet header overhead

efficient for software processing

some wanted variable-length, up to 160 bits

compatible with OSI NSAP addressing plans

big enough for autoconfiguration using IEEE 802 addresses

could start with addresses shorter than 64 bits & grow later

settled on fixed-length, 128-bit addresses

(340,282,366,920,938,463,463,374,607,431,768,211,456 in all!)

(15)

What Ever Happened to IPv5?

0–3

unassigned

4 IPv4

(today’s widespread version of IP)

5 ST

(Stream Protocol, not a new IP)

6 IPv6

(formerly SIP, SIPP)

7 CATNIP

(formerly IPv7, TP/IX; deprecated)

8 Pip

(deprecated)

9 TUBA

(deprecated)

(16)

(17)

The IPv6 Header

Version

Traffic Class

Flow Label

Payload Length

Next Header

Hop Limit

Source Address

Destination Address

(18)

The IPv4 Header

shaded fields are absent from IPv6 header

Version

Total Length

Identification

32 bits

Hdr Len Prec

TOS

Fragment Offset

Flags

Time to Live

Protocol

Header Checksum

Source Address

Destination Address

Padding

Options

(19)

IPv6 Header

compared to

IPv4 Header

Ver. Time to Live Source Address Total Length Type of Service Hdr Len Identification Fragment Offset Flg Protocol Header Checksum Destination Address Options... Ver. Traffic Class Source Address Payload Length Next

Header Hop Limit Destination Address Hdr Len Identification Fragment Offset Flg Header Checksum Options...

shaded fields have no equivalent in the other version

IPv6 header is twice as long (40 bytes) as IPv4 header without options (20 bytes) Flow Label

(20)

Summary of Header Changes from

IPv4

• addresses increased from 32 to 128 bits

• fragmentation fields moved out of base header

• IP options moved out of base header

• Header Checksum eliminated

• Header Length field eliminated

• Flow Label field added

• Time to Live —> Hop Limit

• Protocol —> Next Header

• Precedence & TOS —> Traffic Class

• Length field excludes IPv6 header

(21)

TCP Header + Data IPv6 Header Next Header = Routing Routing Header Next Header = TCP

IPv6 Header Options (RFC 2460)

TCP Header + Data IPv6 Header Next Header = TCP IPv6 Header Next Header = Routing Routing Header Next Header = Fragment Fragment Header Next Header = TCP Fragment of TCP Header + Data

• Processed only by node identified in IPv6 Destination Address field => much

lower overhead than IPv4 options

exception: Hop-by-Hop Options header

• Eliminated IPv4’s 40-octet limit on options

(22)

Routing Header

Address[1]

Reserved

Address[0]

Next Header

Hdr Ext Len

Routing Type

Segments Left

•

(23)

S

A

B

D

(24)

S

A

B

D

(25)

S

A

B

D

(26)

S

A

B

D

(27)

Extension Headers (cont.)

• processed only by node identified in IPv6

Destination Address field => much lower

overhead than IPv4 options

exception: Hop-by-Hop Options header

• eliminated IPv4’s 40-byte limit on options

in IPv6, limit is total packet size,

or Path MTU in some cases

• currently defined extension headers:

Hop-by-Hop Options, Routing, Fragment,

(28)

Hop-by-Hop Options Header

are containers for variable-length options:

Next Header

Hdr Ext Len

Options

Option Type

Option Data Len

Option Data

(29)

Option Type Encoding

AIU — action if unrecognized:

00 — skip over option

01 — discard packet

10 — discard packet &

send ICMP Unrecognized Type to source

11 — discard packet &

send ICMP Unrecognized Type to source

only if destination was not multicast

C — set if Option Data changes en-route

(Hop-by-Hop Options only)

(30)

Option Alignment and Padding

two padding options:

• used to align options so multi-byte data

fields fall on natural boundaries

• used to pad out containing header to an

integer multiple of 8 bytes

1 N - 2

N-2 zero octets...

PadN

0

(31)

IP Service

IPv4 Solution

IPv6 Solution

Mobile IP with Direct

Routing

Mobile IP

with Direct

Routing

DHCP, ZeroConf

Mobile IP

IGMP/PIM/Multicast

BGP

IGMP/PIM/Multicast

BGP

IP Multicast

MLD/PIM/Multicast BGP,

Scope Identifier

MLD/PIM/Multicast BGP,

Scope Identifier

Mobility

Autoconfiguration

Serverless, ZeroConf,

Reconfiguration, DHCP

Serverless

, ZeroConf,

Reconfiguration

, DHCP

IPv6 Technology Scope

32-bit, Network

Address Translation

32-bit, Network

Address Translation

128-bit,

128-bit, NAT-PT

NAT-PT

Addressing Range

Quality-of-Service

Differentiated Service,

Integrated Service

Differentiated Service,

Integrated Service

Differentiated Service,

Integrated Service

Differentiated Service,

Integrated Service

Security

IPSec Mandated,

works End-to-End

IPSec Mandated,

works End-to-End

IPSec

(32)

(33)

IPv6 @ Cisco

• Co-chair of IETF IPv6 Working Group and

NGtrans Working Group

• Well Known Cisco 6Bone router

~ 70 tunnels with other companies

acts as 6to4 Relay

Official Cisco IPv6 prefix registered to ARIN (2001:0420::/35)

• ‘Founding Member’ of the IPv6 Forum

• Official CCO IPv6 page is www.cisco.com/ipv6

Cisco IPv6 Statement of Direction published last June

Cisco IOS IPv6 EFT available for free over 3 years

~around 500 sites running Worldwide

• Cisco IOS 12.2(2)T offers official IPv6 support

(34)

IPv4-IPv6 Transition / Co-Existence

A wide range of techniques have been identified

and implemented, basically falling into three

categories:

(1)

Dual-stack

techniques, to allow IPv4 and IPv6 to

co-exist in the same devices and networks

(2)

Tunneling

techniques, to avoid order dependencies

when upgrading hosts, routers, or regions

(3)

Translation

techniques, to allow IPv6-only devices

to communicate with IPv4-only devices

(35)

Deployment

• Experimental infrastructure:

the 6bone

for testing and debugging IPv6 protocols and

operations

(see www.6bone.net)

• Production infrastructure in support of

education and research:

the 6ren

CAIRN, Canarie, CERNET, Chunahwa Telecom, Dante,

ESnet, Internet 2, IPFNET, NTT, Renater, Singren,

Sprint, SURFnet, vBNS, WIDE,…

(see www.6ren.net, www.6tap.net)

• Commercial infrastructure

a few ISPs (IIJ, NTT,…) are providing commercial IPv6

service today, others are conducting trials

(36)

Deployment

(cont.)

• IPv6 address allocation

6bone procedure for test address space

Regional IP address registries (APNIC, ARIN,

RIPE-NCC) for production address space

• Deployment advocacy

(a.k.a. marketing)

(37)

IPv6 Timeline

(A pragmatic projection)

Q 1 Q2 Q3 Q4 2007 Q 1 Q2 Q3 Q4 2004 Q 1 Q2 Q3 Q4 2003 Q 1 Q2 Q3 Q4 2000 Q 1 Q2 Q3 Q4 2001 Q 1 Q2 Q3 Q4 2002 Q 1 Q2 Q3 Q4 2005 Q 1 Q2 Q3 Q4 2006

•Consumer adoption <= Duration 5+ years =>

•Early adopter

•Application porting <= Duration 3+ years=>

•Enterprise adoption <= Duration 3+ years => =>

adoption <= Duration 3+ years

(38)

IPv6 Timeline

(A pragmatic projection)

• Consumer adoption <= Duration 5+ years =>

• Application porting <= Duration 3+ years=>

• Enterprise adoption <= Duration 3+ years => =>

• ISP

Asia

(39)

IPv6 Timeline

(A pragmatic projection)

•Consumer adoption <= Duration 5+ yrs =>

•Enterprise adoption <= Duration 3+ years => =>

• ISP

Europe

(40)

IPv6 Timeline

(A pragmatic projection)

• Consumer adoption <= Duration 5+ years=>

• Enterprise adoption<= Duration 3+ years => =>

• ISP

Americas

(41)

Phase III

CY 2002

Phase III

CY 2002

Phase II

H2 CY 2001

Phase II

H2 CY 2001

Phase I

IOS 12.2(2)T Done

Phase I

IOS 12.2(2)T

Done

Early Adopter Deployment

Production Backbone

Deployment

Production Backbone

Deployment

Enhanced IPv6 Services

Market Target

IOS Release

Cisco IOS IPv6 Roadmap

IOS upgrade

= Free IPv6

(42)

Phase III

CY 2002

Phase III

CY 2002

Phase II

H2 CY2001

Phase II

H2 CY2001

Phase I

IOS 12.2(2)T Done

Phase I

IOS 12.2(2)T Done

Basic IPv6 specifications support

Multi-protocol Extensions for BGP4, RIPv6

Manual, Automatic & 6to4 Tunnel Support

Tools such as Ping, Traceroute,etc

Basic IPv6 specifications support

Multi-protocol Extensions for BGP4, RIPv6

Manual, Automatic & 6to4 Tunnel Support

Tools such as Ping, Traceroute,etc

Enhanced Performance (CEFv6/dCEFv6),

Link State IGP (I/IS-ISv6), IPv6 Edge router

(6PE) over MPLS, Dial, NAT-PT, Enhanced

tools (SSH, DNS client, MIB, etc)

Enhanced Performance (CEFv6/dCEFv6),

Link State IGP (I/IS-ISv6), IPv6 Edge router

(6PE) over MPLS, Dial, NAT-PT, Enhanced

tools (SSH, DNS client, MIB, etc)

Hardware Acceleration, OSPFv3, Mobility,

Multicast, Security, QoS…

Hardware Acceleration, OSPFv3, Mobility,

Multicast, Security, QoS…

IPv6 Features Supported

IOS Release

Cisco IOS IPv6 Roadmap

IOS upgrade

= Free IPv6

(43)

Session Number

IPv6

(44)

Some Terminology

node

a protocol module that implements IPv6

router

a node that forwards IPv6 packets not explicitly

addressed to itself

host

any node that is not a router

link

a communication facility or medium over which

nodes can communicate at the link layer,

i.e., the layer immediately below IPv6

neighbors

nodes attached to the same link

interface

a node’s attachment to a link

address

an IPv6-layer identifier for an interface or a set

of interfaces

(45)

Text Representation of Addresses

“preferred” form:

1080:0:FF:0:8:800:200C:417A

compressed form:

FF01:0:0:0:0:0:0:43

becomes FF01::43

IPv4-compatible:

0:0:0:0:0:0:13.1.68.3

(46)

IPv6 - Addressing Model

Link-Local

Site-Local

Global

Ø

Addresses are assigned to interfaces

No change from IPv4 Model

Ø

Interface ‘expected’ to have multiple addresses

Ø

Addresses have scope

Link Local

Site Local

Global

Ø

Addresses have lifetime

(47)

Address Types

unicast (one-to-one)

-

global

- link-local

- site-local

- IPv4-compatible

multicast (one-to-many)

Address of a set of interfaces

Delivery to all interfaces in the set

anycast (one-to-nearest)

Unicast Address of a set of interfaces

Subnet router anycast address : subnet prefix::/n Delivery to a single interface in the set

Reserved

(48)

Address Type Prefixes

address type

binary prefix

IPv4-compatible

0000...0 (96 zero bits)

global unicast

001 link-local unicast

1111 1110 10

site-local unicast

1111 1110 11

multicast

1111 1111

• all other prefixes reserved (approx. 7/8ths of total)

(49)

Global Unicast Addresses (RFC 2374)

• TLA = Top-Level Aggregator

**NLA* = Next-Level Aggregator(s)**

**SLA* = Site-Level Aggregator(s)**

• All subfields variable-length, non-self-encoding

(like CIDR)

• TLAs may be assigned to Providers or Exchanges

site

topology

(16 bits)

interface

identifier

(64 bits)

public

topology

(45 bits)

interface ID

SLA*

NLA*

TLA

001

(50)

Global Unicast Addresses

for the 6Bone

• 6Bone: experimental IPv6 network used for testing only

• TLA 1FFE (hex) assigned to the 6Bone

thus, 6Bone addresses start with 3FFE:

(binary 001 + 1 1111 1111 1110)

• next 12 bits hold a “pseudo-TLA” (pTLA)

thus, each 6Bone pseudo-ISP gets a /28 prefix

• not to be used for production IPv6 service

16 64 bits

12 interface ID

SLA*

pTLA

TLA

001 NLA*

20

13

(51)

6Bone Addressing

• The 6Bone uses the 3ffe::/16 range:

A pTLA receives a /28 prefix

A site receives a /48 prefix

A LAN receives a /64 prefix

3ffe

pTLA prefix

site prefix

LAN prefix

(52)

Initial Address Allocation

• The allocation process is:

IANA allocates 2001::/16 to registries

Each registry gets a /23 prefix from IANA

Registry allocates a /35 prefix to a new IPv6 ISP

Policy is that an ISP allocates a /48 prefix to each customer

2001

0410

ISP prefix

Site prefix

LAN prefix

/35

/48

/64

Registry

/23

(53)

Hierarchical Addressing & Aggregation

Larger address space enables:

Aggregation of prefixes announced in the global routing

table.

Efficient and scalable routing.

But current Multi-Homing schemes break the model

ISP

2001:0410::/35

Customer

no 2

IPv6 Internet

2001::/16

2001:0410:0002:/48

2001:0410:0001:/48

Customer

no 1

Only

announces

the /35

prefix

(54)

16 64 bits

13 Global Unicast Addresses for

Production Service

• ISPs start with less space than a TLA; must demonstrate

need before getting a TLA (“slow-start” procedure)

• TLA 1 assigned for slow-start allocations

thus, initial production addresses start with 2001:

(binary 001 + 0 0000 0000 0001)

• next 13 bits hold a subTLA

thus, each new ISP gets a /29 prefix

(or even longer, depending on registry policy)

19 interface ID

SLA*

subTLA

TLA

001 NLA*

13

(55)

Address Allocation – New Proposal

2001

0410

Immediate need

Site prefix

LAN prefix

/36

/48

/64

Initial LIR

/32

Grow on HD ratio

IXP prefix (not announced to peering ISPs)

HD Ratio =

Log (Number of allocated objects)

Log (Max number of allocatable objects)

(56)

link-local addresses for use during

auto-configuration and when no routers are

present:

site-local addresses for independence from

**changes of TLA / NLA*:**

Link-Local & Site-Local Unicast

Addresses

1111111010

₀

_{interface ID}

(57)

Interface IDs

the lowest-order 64-bit field of unicast

addresses may be assigned in several

different ways:

– auto-configured from a 48-bit MAC address (e.g.,

Ethernet address), expanded into a 64-bit EUI-64

– assigned via DHCP

– manually configured

– auto-generated pseudo-random number

(to counter some privacy concerns)

(58)

Some Special-Purpose Unicast

Addresses

• the unspecified address, used as a placeholder

when no address is available:

0:0:0:0:0:0:0:0

• the loopback address, for sending packets to

self:

(59)

Routing

• uses same “longest-prefix match” routing as

IPv4 CIDR

• straightforward changes to existing IPv4 routing

protocols to handle bigger addresses

unicast: OSPF, RIP-II, IS-IS, BGP4+, …

multicast: MOSPF, PIM, …

• can use Routing header with anycast addresses

to route packets through particular regions

(60)

Interface Address set

• Loopback

(only assigned to a single virtual interface per node)

• Link local

• Site local

• Auto-configured 6to4

(if IPv4 public is address available)

• Auto-configured IPv4 compatible

(operationally discouraged)

• Solicited node Multicast

• All node multicast

• Global anonymous

(61)

Interface IDs

Lowest-order 64-bit field of unicast address may

be assigned in several different ways:

– auto-configured from a 64-bit EUI-64, or expanded from a

48-bit MAC address (e.g., Ethernet address)

– auto-generated pseudo-random number

(to address privacy concerns)

– assigned via DHCP

– manually configured

(62)

00

90

27

00

90

27

00

90

27

02

90

27

17 FC

0F

17 FC

0F

17 FC

0F

17 FC

0F

FF

FE

FF

FE

FF

FE

Eui-64

• Eui-64 address is formed by inserting "FFFE" and

ORing a bit identifying the uniqueness of the MAC

address.

-> appendix A : draft-ietf-ipngwg-addr-arch-v3-11.txt

000000X0

where X=

1 = unique

0 = not unique

X = 1

Ethernet MAC address

(48 bits)

64 bits version

Uniqueness of the MAC

(63)

Multicast Address Format

• flag field

T=0 indicates permanently-assigned (by IANA) group

(=well-known group)

T=1 indicates a transient group

(three other flags reserved)

• scope field:

1 – interface-local

8 - organization-local

2 - link-local

E - global

5 - site-local

• map IPv6 multicast addresses directly into low

order 32 bits of the IEEE 802 MAC

• Multicast address is never source address

FP (8bits) Flags (4bits) Scope (4bits) Group ID (32bits)

11111111 000T Lcl/Sit/Gbl Locally administered

RESERVED (80bits)

(64)

Pre-defined Multicast Addresses

• FF01:0:0:0:0:0:0:1 : all IPv6 nodes; interface-local

• FF02:0:0:0:0:0:0:1 : all IPv6 nodes; link-local

• FF01:0:0:0:0:0:0:2 : all IPv6 routers; interface-local

• FF02:0:0:0:0:0:0:2 : all IPv6 routers; link-local

(65)

Solicited-Node Multicast Address

• A solicited node multicast address is a:

Multicast address with a link-local scope.

Formed by this prefix and the rightmost 24 bits of the

unicast/anycast address.

Subnet is /104

Lower 24

0 128 bits

FF02

0001

FF

Interface ID

Prefix

24 bits

Unicast/anycast Address

(66)

Required Addresses

• Node :

–Link-local address

–All configured unicast/anycast addresses

–Loopback address

–All-nodes multicast address

–Sollicited-node multicast addresses (one for each

unicast/anycast address)

–Multicast addresses for all other groups for this node

• Router :

–Subnet-router anycast addresses for all interfaces

–All other anycast addresses

(67)

Multicast Listener Discover – MLD

• MLD is equivalent to IGMP in IPv4

• MLD messages are transported over ICMPv6

• Version number trouble

MLDv1 corresponds to IGMPv2

See RFC 2710

MLDv2 corresponds to IGMPv3, needed for SSM

See draft-vida-mld-v2-01.txt

• MLD and IGMP are now standardized in the IETF

MAGMA working group

(68)

IPv6 Multicast Routing

• PIM, SSM, MBGP cover IPv4 and IPv6

draft-ietf-pim-sm-v2-new-04.txt,

draft-ietf-ssm-overview-02.txt (SSM needs MLDv2)

RFC 2858

• Bidir PIM also applicable

• Currently no MSDP work for IPv6

• Strong doubts that BGMP will ever make it as

Inter-Domain protocol

• For the time being, it is assumed that SSM solves

(69)

Neighbor Discovery - Neighbor

Solicitation

ICMP type = 135

Src = A

Dst = Solicited-node multicast of B

Data = link-layer address of A

Query = what is your link address?

A

B

ICMP type = 136

Src = B

Dst = A

Data = link-layer address of B

A and B can now exchange

(70)

Stateless autoconfiguration

• Router solicitation are sent by booting nodes to

request RAs for configuring the interfaces.

1. RS:

ICMP Type = 133

Src = ::

Dst = All-Routers multicast

Address

query= please send RA

2. RA

1. RS

2. RA:

ICMP Type = 134

Src = Router Link-local Address

Dst = All-nodes multicast address

Data= options, prefix, lifetime,

autoconfig flag

(71)

Session Number

(72)

Minimum MTU

• definitions:

link MTU

a link’s maximum transmission unit,

i.e., the max IP packet size that can

be transmitted over the link

path MTU

the minimum MTU of all the links in a

path between a source and a destination

• minimum link MTU for IPv6 is 1280 octets

(versus 68 octets for IPv4)

• on links with MTU < 1280, link-specific

(73)

Path MTU Discovery

• implementations are expected to perform path

MTU discovery to send packets bigger than 1280

octets:

for each dest., start by assuming MTU of first-hop link

if a packet reaches a link in which it cannot fit, will invoke

ICMP “packet too big” message to source, reporting the link’s

MTU; MTU is cached by source for specific destination

occasionally discard cached MTU to detect possible increase

• minimal implementation can omit path MTU

discovery as long as all packets kept = 1280

octets

(74)

Fragment Header

• though discouraged, can use IPv6 Fragment

header to support upper layers that do not (yet)

do path MTU discovery

• IPv6 frag. & reasm. is an end-to-end function;

routers do not fragment packets en-route if too

big—they send ICMP “packet too big” instead

Next Header

Original Packet Identifier

(75)

Maximum Packet Size

• base IPv6 header supports payloads of up to

65,535 bytes (not including 40 byte IPv6

header)

• bigger payloads can be carried by setting

IPv6 Payload Length field to zero, and adding

the “jumbogram” hop-by-hop option:

• cannot use Fragment header with

jumbograms

Option Type=194 Opt Data Len=4

Payload Length

(76)

(77)

IPv6 Security

• all implementations expected to support

authentication and encryption headers (“IPsec”)

• authentication separate from encryption for use

in situations where encryption is prohibited or

prohibitively expensive

• key distribution protocols are under

development (independent of IP v4/v6)

(78)

Authentication Header

• Destination Address + SPI identifies security

association state (key, lifetime, algorithm, etc.)

• provides authentication and data integrity for

all fields of IPv6 packet that do not change

en-route

• default algorithms is (was?) Keyed MD5

Next Header

Hdr Ext Len

Security Parameters Index (SPI)

Reserved

Sequence Number

Authentication Data

(79)

Encapsulating Security Payload (ESP)

Payload

Next Header

Security Parameters Index (SPI)

Sequence Number

Authentication Data

Padding Length

Padding

(80)

Transport Mode ESP

(End-to-End)

IPv6 header

[+ ext. headers]

ESP header

data

ESP trailer

n

o

d

e

1 n

o

d

e

2 e2e ext. headers

(81)

Tunnel Mode ESP

(End to Security Gateway)

n

o

d

e

1 n

o

d

e

2 IPv6 header

[+ ext. headers]

transport header

data

g

a

t

e

w

a

y

IPv6 header

[+ ext. headers]

ESP header

transport header

data

ESP trailer

IPv6 header

[+ ext. headers]

(82)

Tunnel Mode ESP

(Gateway to Gateway)

n

o

d

e

1 n

o

d

e

2 IPv6 header

[+ ext. headers]

transport header

data

g

a

t

e

w

a

y

IPv6 header

[+ ext. headers]

ESP header

transport header

data

ESP trailer

IPv6 header

[+ ext. headers]

IPv6 header

[+ ext. headers]

transport header

data

g

a

t

e

w

a

y

(83)

What does IPv6 do for:

• Security

Nothing IP4 doesn’t do - IPSec runs in both

but IPv6 mandates IPSec

• QoS

Nothing IP4 doesn’t do

-Differentiated and Integrated Services run in both

So far, Flow label has no real use

(84)

(85)

IP Quality of Service Approaches

two basic approaches developed by IETF:

• “Integrated Service” (int-serv)

fine-grain (per-flow), quantitative promises

(e.g., x bits per second), uses RSVP signalling

• “Differentiated Service” (diff-serv)

coarse-grain (per-class), qualitative promises

(e.g., higher priority), no explicit signalling

(86)

IPv6 Support for Int-Serv

20-bit Flow Label field to identify specific flows

needing special QoS

each source chooses its own Flow Label values;

routers use Source Addr + Flow Label to identify

distinct flows

Flow Label value of 0 used when no special QoS

requested (the common case today)

this part of IPv6 is not standardized yet, and may well

change semantics in the future

(87)

IPv6 Support for Diff-Serv

8-bit Traffic Class field to identify specific

classes of packets needing special QoS

same as new definition of IPv4 Type-of-Service

byte

may be initialized by source or by router

enroute; may be rewritten by routers enroute

traffic Class value of 0 used when no special

(88)

(89)

IPv6 Mobility

• a mobile host has one or more home address(es)

relatively stable; associated with host name in DNS

• when it discovers it is in a foreign subnet (i.e.,

not its home subnet), it acquires a foreign

address

uses auto-confgiguration to get the address

registers the foreign address with a home agent,

i.e, a router on its home subnet

• packets sent to the mobile’s home address(es)

are intercepted by home agent and forwarded to

the foreign address, using encapsulation

(90)

Mobile IP (v4 version)

home agent

home location of mobile host

foreign agent

mobile host

correspondent

host

(91)

Mobile IP (v4 version)

home agent

home location of mobile host

foreign agent

mobile host

correspondent

host

(92)

Mobile IP (v4 version)

home agent

home location of mobile host

foreign agent

mobile host

correspondent

host

(93)

Mobile IP (v4 version)

home agent

home location of mobile host

foreign agent

mobile host

correspondent

host

(94)

Mobile IP (v6 version)

home agent

home location of mobile host

mobile host

correspondent

host

(95)

Mobile IP (v6 version)

home agent

home location of mobile host

mobile host

correspondent

host

(96)

Mobile IP (v6 version)

home agent

home location of mobile host

mobile host

correspondent

host

(97)

Mobile IP (v6 version)

home agent

home location of mobile host

mobile host

correspondent

host

(98)

Mobile IP (v6 version)

home agent

home location of mobile host

mobile host

correspondent

host

(99)

Session Number

(100)

ICMP Error Messages

common format:

As much of the invoking packet

as will fit without the ICMP packet

exceeding 1280 ocets

(code and parameter are type-specific)

Type

Code

Checksum

(101)

ICMP Error Message Types

• destination unreachable

no route

administratively prohibited

address unreachable

port unreachable

• packet too big

• time exceeded

• parameter problem

erroneous header field

unrecognized next header type

unrecognized option

(102)

ICMP Informational Messages

• echo request & reply (same as IPv4)

• multicast listener discovery messages:

query, report, done (like IGMP for IPv4):

Type

Code

Checksum

Maximum Response Delay

Reserved

(103)

Neighbor Discovery

ICMP message types:

router solicitation

router advertisement

neighbor solicitation

neighbor advertisement

redirect

functions performed:

router discovery

prefix discovery

autoconfiguration of address & other parameters

duplicate address detection (DAD)

neighbor unreachability detection (NUD)

link-layer address resolution

(104)

Router Advertisements

• periodically multicast by router to all-nodes multicast

address (link scope)

• “I am a router” (implied)

list of:

lifetime as default (1 sec – 18 hr)

» prefix

“get addresses from DHCP” flag

» prefix length

“get other stuff from DHCP” flag

» valid lifetime

router’s link-layer address

» preferred lifetime

link MTU

» on-link flag

suggested hop limit

» autoconfig OK flag

(105)

Other Neighbor Discovery Messages

• router solicitations

sent only at host start-up, to solicit immediate router advert.

sent to all-routers multicast address (link scope)

• neighbor solicitations

for address resolution: sent to “solicited node” multicast addr.

for unreachability detection: sent to neighbor’s unicast addr.

• neighbor advertisements

for address resolution: sent to unicast address of solicitor

for link-layer address change: sent to all-nodes multicast addr.

usable for proxy responses (detectable)

(106)

Serverless Autoconfiguration

(“Plug-n-Play”)

• hosts can construct their own addresses:

subnet prefix(es) learned from periodic multicast advertisements

from neighboring router(s)

interface IDs generated locally, e.g., using MAC addresses

• other IP-layer parameters also learned from router adverts

(e.g.,

router addresses, recommended hop limit, etc.)

• higher-layer info

(e.g., DNS server and NTP server addresses)

discovered by multicast / anycast-based service-location

protocol

[details still to be decided]

(107)

Session Number

(108)

So Much for the Modularity of

Layering!

• changes TCP/UDP checksum “pseudo-header”

• affects anything that reads/writes/stores/passes IP

addresses (just about every higher protocol)

• packet lifetime no longer limited by IP layer

(it never was, anyway!)

• bigger IP header must be taken into account when

computing max payload sizes

• new DNS record type: AAAA and (new) A6

(109)

Session Number

(110)

Transition / Co-Existence Techniques

a wide range of techniques have been identified and

implemented, basically falling into three categories:

(1)

dual-stack

techniques, to allow IPv4 and IPv6 to co-exist

in the same devices and networks

(2)

tunneling

techniques, to avoid order dependencies

when upgrading hosts, routers, or regions

(3)

translation

techniques, to allow IPv6-only devices to

communicate with IPv4-only devices

(111)

IPv6 Transition – Tasks & Methods

• Connect IPv6 Islands/Nodes over existing

Infrastructure with IPv6 Nodes

Tunneling: Manually or automagically configured –

6to4, ISATAP, ...

IPv6 over dedicated Link-Layer: ATM/FR/SDH/WDM or

AToM/L2TPv3

Dual-Stacked Network

IPv6 over MPLS: 6PE

(112)

Tunnels to Get Through

IPv6-Ignorant Routers

• encapsulate IPv6 packets inside IPv4 packets

(or MPLS frames)

• many methods exist for establishing tunnels:

manual configuration

“tunnel brokers” (using web-based service to create a tunnel)

“6-over-4” (intra-domain, using IPv4 multicast as virtual LAN)

“6-to-4” (inter-domain, using IPv4 addr as IPv6 site prefix)

• can view this as:

IPv6 using IPv4 as a virtual link-layer, or

an IPv6 VPN (virtual public network), over the IPv4 Internet

(becoming “less virtual” over time, we hope)

(113)

Overview

• Configured tunnels

• 6to4 tunnels

• Automatic tunnels

• BGP tunnels

• (6over4, NAT-PT)

• 6PE

(114)

IPv6 Header

IPv4 Header

IPv6 Header

IPv6 Header Transport

Header

Transport

Header DataData

Data Data Transport Header Transport Header

IPv6 over IPv4 Tunnels

• Several Tunnelling mechanisms defined by IETF

GRE, Configured Tunnels, Automatic Tunnels using

IPv4 compatible IPv6 Address, 6to4

All of the above are supported on Cisco IOS 12.2T

• Apply to ISP and Enterprise WAN networks

• Leverages 6Bone experience

• No impact on Core infrastructure

(115)

Service

Provider

IPv4

backbone

IPv6 over IPv4 Tunnels IPv6 Site A IPv6 Site B U N I V E R S I T Y U N I V E R S I T Y

6Bone

IPv6 IX

IPv6 over IPv4 Tunnels

Case Study

ISP scenario

Configured Tunnels between

IPv6 Core Routers

Configured Tunnels to IPv6

Customers

MP-BGP4 Peering with other

6Bone users

Connection to an IPv6 IX

6to4 tunnels to IPv6 Customers

6to4 relay service

Enterprise scenario

6to4 tunnels between sites

Configured tunnels between

sites or to 6Bone users

(116)

Configured tunnels

IPv4

IPv6

3ffe:c00:1::/48 3ffe:c00:2::/48 130.67.0.1 _148.122.0.1 ---|IPv4 header|IPv6 header IPv6 payload| ---IPv4 protocol type = 41

(117)

Configured Tunnel

• Configured tunnels require:

Dual stack end points

Both IPv4 and IPv6 addresses configured at each end

IPv4

IPv6

Network

IPv6

Network

Dual-Stack

Router

Dual-Stack

Router

IPv4: 192.168.99.1

IPv6: 3ffe:b00:c18:1::3

IPv4: 192.168.30.1

IPv6: 3ffe:b00:c18:1::2

(118)

Configured tunnels II

No keepalive mechanism, interface is always up

Real addresses

Inefficient traffic patterns Multicast

Has to be configured and managed

As point to point links

Cons

Pros

(119)

Configured tunnels III

interface Tunnel0

description ACME networks

ipv6 address 3FFE:C00:E:0:1::C/64 tunnel source Fddi0

tunnel destination 199.185.115.246 tunnel mode ipv6ip

!

interface Fddi0

ip address 192.31.7.104 255.255.255.224 !

show ipv6 route

L 3FFE:C00:E:0:1::C/128 [0/0] via ::, Tunnel61, 5d12h/never C 3FFE:C00:E:0:1::C/64 [0/0]

(120)

Configured tunnels IV

ipv6-router#sh ipv6 int tunnel0 Tunnel0 is up, line protocol is up

IPv6 is enabled, link-local address is FE80::C01F:768 Description: ACME networks

Global unicast address(es):

3FFE:C00:E:0:1::C, subnet is 3FFE:C00:E:0:1::C/64 Joined group address(es):

FF02::1 FF02::2 FF02::1:FF70:47 FF02::1:FF00:C FF02::1:FF1F:768 MTU is 1480 bytes

ICMP error messages limited to one every 500 milliseconds ND reachable time is 30000 milliseconds

Hosts use stateless autoconfig for addresses. ipv6-router#

(121)

6to4 tunnels

IPv4

IPv6

6to4 prefix is 2002::/16 + IPv4 address.

2002:a.b.c.d::/48

IPv6 Internet

6to4 relay 2002:B00:1::1

Announces 2002::/16 to the IPv6 Internet

130.67.0.1 148.122.0.1

11.0.0.1 2002:8243:1::/48

(122)

6to4 Tunnel

• 6to4 Tunnel:

Is an automatic tunnel method

Gives a prefix to the attached IPv6 network

IPv4

IPv6

Network

IPv6

Network

6to4 Router

192.168.99.1

192.168.30.1 Network prefix:

2002:c0a8:6301::/48

Network prefix:

2002:c0a8:1e01::/48

=

(123)

6to4 Tunnel (Cont.)

192.168.30.1 IPv6

IPv4

IPv6

Network

IPv6

Network

6to4

Router

6to4

Router

2002:c0a8:1e01::1

IPv6

Type: native IPv6

Dst: 2002:c0a8:1e01::1

IPv4

IPv6

Type: IPv6 in IPv4

Dst: 192.168.30.1

(124)

6to4 Relay

• 6to4 relay:

Is a gateway to the rest of the IPv6 Internet

Default router

IPv4

IPv6

Network

IPv6 site

Network

6to4

Relay

6to4

Router1

192.168.99.1

192.168.30.1 Network prefix:

2002:c0a8:6301::/48

Network prefix:

2002:c0a8:1e01::/48

=

IPv6

Internet

(125)

6to4 tunnels II

Has to use 6to4 addresses, not native.

Requires relay router to reach native IPv6 Internet

Only site border router needs to know about 6to4

All issues that NMBA networks have.

Minimal configuration

Cons

Pros

NB: there is a draft describing how to use IPv4 anycast to reach the relay router.

(This is already supported, by our implementation...)

(126)

6to4 tunnels III

relay

interface Tunnel2002 no ip address

ipv6 address 2002:C01F:768::1/128 tunnel source Fddi0

tunnel mode ipv6ip 6to4 !

ipv6 route 2002::/16 Tunnel2002 end

ipv6-router#sh ipv6 route

IPv6 Routing Table - 416 entries

Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP Timers: Uptime/Expires

LC 2002:C01F:768::1/128 [0/0] via ::, Tunnel2002, 4w3d/never S 2002::/16 [1/0]