Lei Wang - IPv6 - Hvordan starte IPv6-implementering
Download as ppt, pdf1 like1,265 views
IPv6-forum konferanse Oslo 2012-04-25
Lei Wang - IPv6 - Hvordan starte IPv6-implementering
- 1. How to start et IPv6 implementasjonsprosjekt Lei Wang, Lime Networks Eirik Eilertsen, Signal Bredb奪nd IKT Norge IPv6 konferanse Oslo, 24-25 April 2012
- 4. Infrastruktur oversikt og status - I
- 5. Infrastruktur oversikt og status - II Del 1: Oversikt over ISPen sin plan for implementasjon av IPv6 Del 2: Oversikt over ASPen sin plan for implementasjon av IPv6 Del 3: Oversikt over nettverksutstyr og st淡tte for IPv6 Del 4: Oversikt over IT systemer (ink. OSS/BSS) og st淡tte for IPv6 Del 5: Oversikt over endeutstyr-operativsystem og st淡tte for IPv6
- 6. Infrastruktur oversikt og status -III Del 1: Oversikt over ISPens plan for implementasjon av IPv6
- 7. Infrastruktur oversikt og status -III Del 2: Oversikt over ASPens plan for implementasjon av IPv6
- 8. Infrastruktur oversikt og status -IV Del 3: Oversikt over nettverksutstyr og st淡tte for IPv6
- 9. Infrastruktur oversikt og status -V Del 4: Oversikt over IT systemer (ink. OSS/BSS) og st淡tte for IPv6
- 10. Infrastruktur oversikt og status -VI Del 5: Oversikt over endeutstyrs operativsystem og st淡tte for IPv6
- 12. Valg av transition technologies IPv4/IPv6 Dualstack Tunnel metoder NAT metoder Kombinasjonsmetoder: DS-lite Dualstack er foretrukket s奪 lenge du har nok offentlige IPv4 adresser.
- 13. Transition technology: Dual Stack IPv4-only Host: Dual-Stacked Host: web.v4.com Query: 195.98.2.109 web.v4.com? A Resource Record: 195.98.2.109 199.15.23.87 DNS IPv6-only Host: 3ffe:3700:1100:1:210:a4ff:fea0:bc97 web.v6.com 3ffe.2301.1700.1.abcd.1234.dada.1 13
- 14. Transition technology: Dual Stack IPv4-only Host: Dual-Stacked Host: web.v4.com Query: 195.98.2.109 web.v6.com? AAAA Resource Record: 3ffe.2301.1700.1.abcd.1234.dada.1 DNS IPv6-only Host: 199.15.23.87 3ffe:3700:1100:1:210:a4ff:fea0:bc97 web.v6.com 3ffe.2301.1700.1.abcd.1234.dada.1 14
- 15. Transition technology: 6PE/6VPE On an IPv4 backbone network where the MPLS is deployed, the ISP can use the IPv6 Provider Edge (6PE) technology to provide the interconnection capacity for the IPv6 networks of dispersed users. 6PE is the PE with the IPv6 capacity. 15
- 16. Transition technology: DS-Lite Dual Stack Lite (DS-Lite) is a solution that allows IPv4 private network users to access the IPv4 public network by traversing an IPv6 network. To implement DS-Lite, IPv4 over IPv6 tunnels and IPv4 NAT are deployed. 16
- 17. Transition technology: Tunnels The tunnels that are used to connect IPv6 isolated sites on the IPv4 networks are called IPv6 over IPv4 tunnels. To establish IPv6 over IPv4 tunnels, the IPv4/IPv6 dual protocol stack needs to be enabled on the device at the border between the IPv4 network and the IPv6 network. 17
- 18. Transition technology: Configured Tunnel Determine the source and destination IPv4 addresses of the tunnel according to the data configuration Determine the packets to be transferred through a tunnel according to the destination IPv6 addresses of the packets and the routing table. IPv4 Transport Transport IPv6 IPv6 Header Header Layer Data Header Layer Data 鐚 41 鐚 Header Header IPv4 IPv4Network Header 鐚 41 鐚 IPv6 IPv6 Network IPv6 Network Dual-stack Router IPv6 Host IPv6 Host Transport IPv6 IPv4 address: 192.168.30.1 Layer Data IPv4 address: 192.168.99.1 Header Header IPv6 address: 3ffe:b00:c18:1::3 IPv6 address: 3ffe:b00:c18:1::2 18
- 19. Transition technology: 6to4 Tunnel 6to4 Router Recognizes 6to4 Prefixes Local Tunnel Endpoint = 138.14.85.210 Packet Source Address: Remote Tunnel Endpoint = 2002:8a0e:55d2:1:230:65ff:fe2c:9a6 65.114.168.91 Packet Destination Address: 2002:4172:a85b:1:20a:95ff:fe8b:3cba IPv4 Network IPv6 6to4 IPv6 IPv6 6to4 Network Network 6to4 Router 6to4 Router Host2: Host1: 2002:4172:a85b:1:20a:95ff:fe8b:3cba 2002:8a0e:55d2:1:230:65ff:fe2c:9a6 DNS: Host2 = 2002:4172:a85b:20a:95ff:fe8b:3cba 19
- 21. Implementasjon: 10-trinns rakett Steg 1: S淡ke om IPv6 adresser Steg 2: Opprette dual-stack uplink til Internet Steg 3: Tilpasse firewall policy Steg 4: Lage IP-adresseplan Steg 5: Gj淡re DNS server klar for IPv6 Steg 6: IPv6 adresseutdeling Steg 7: Implementere dualstack i nettverksinnfrastrukturen Steg 8: Implementere IPv6 support i NMS milj淡 Steg 9: Sikkerhet IDS/IPS med IPv6 st淡tte Steg 10: Dualstack p奪 hostsystemene
- 22. Implementasjon: Steg 1 - 3 Steg 1: S淡ke om IPv6 adresser Bedrifter f奪r oftest tildelt en eller flere /48 adresseblokker 2001:BD1:234C/48 -> 65536 /64 SP: /32 addresseblokker Store bedrifter: /48 adresseblokker Mellomstore bedrifter: /56 adresseblokker (/64 linknett og /56 p奪 insiden av brannmur/ruter tildelt statisk eller av DHCPv6) SOHO/Subnet i bedrifter: /64 adresseblokker Steg 2: Opprette dual-stack uplink til Internet Annonsere IPv6 blokkene til ISPen ISP annonserer videre Motta IPv6 prefixer evt default rute fra ISPen Steg 3: Tilpass firewall policy Ta Hensyn til IPv6
- 23. Implementasjon: Steg 4 Steg 4: Lage IP-adresseplan
- 24. Implementasjon: Steg 4 Steg 4: Lage IP-adresseplan * Figuren er fra Jeff Doyle Texas IPv6 summit
- 25. Implementasjon: stegene Steg 4: IP-adresse plan Anbefaling: Bruk /64 blokk som standard subnet (m奪 v脱re /64 for SLAAC skal fungere) Om du er tildelt 2001:BD1:234C::/48 betyr at du kan disponere 2001:BD1:234C:0000::/64 to 2001:BD1:234C:ffff::/64
- 26. Implementasjon: stegene Anbefaling: Gi subnett-bitene meninger! Steg4: IP-adresse VLAN, Brukergruppering, plan lokasjoner Men IKKE overdriv antall niv奪er. Retning p奪 filtering: starter med mest signifikant biter i sikkerhetspolicy 2001:BD1:234C G G G 0 L L L 0 0 S S S S S S S ::/64 G: Grupper L: Lokasjoner S:Subnett/VLANer 0000: Ansatter gr1 0000: Oslo 00000001: Subnet/VLAN1 0110: Studenter Intranett 0010: B脱rum 01100010: Subnet/VLAN2 1xx0: Extern 1010: Trondheim 00100011: Subnet/VLAN3 0: Lurt 奪 reservere bits mellom meningsfulle bits for fremtidige behov
- 27. Implementasjon: Steg 5 Steg 5: Gj淡re DNS server klar for IPv6 A-record for IPv4 adresse AAAA-record for IPv6 adresse
- 28. Implementasjon: Steg 6 Steg 6: IPv6 adressetildeling DHCPv6: fungerer p奪 samme m奪te som DHCP for IPv4: Tildele adresse, default-gw, DNS server SLAAC (Stateless address autoconfiguration): Automatisk adressetildeling n奪r IPv6 klient er tilkoplet et IPv6 rutet nettverk. Opprinnelig SLAAC standard mangler opsjon for 奪 f奪 DNS-server oppslag, s奪 en kombinasjon med DHCPv6 er n淡dvendig RFC5006 har foresl奪tt en utvidelse av SLAAC med IPv6 RA opsjon for DNS-server adresse. Sp淡r din leverand淡r om RFC5006 implementasjon og velg (eller vent p奪) en stabil versjon med st淡tte for dette!
- 29. Implementasjon: Steg 7 Steg 7: Implementere dualstack i nettverksinnfrastrukturen - ruting RIPng: IPv6-only, dual stack krever dermed ogs奪 RIP OSPFv3: IPv6-only, dual stack krever dermed ogs奪 OSPF IS-IS: IS-IS er utvidet med ny TLV for 奪 supportere IPv6 Multiprotokoll BGP: St淡tter multi-adressefamilier, beh淡ver dermed kun legge til IPv6 unicast/multicast- adressefamilier i eksisterende BGP instanse
- 30. Implementasjon: Steg 8 Steg 8: Implementere IPv6 support i NMS milj淡 SNMP Telnet/SSH FTP/SCP/TFTP MRTG Netflow Managementplaformer: Tivoli, HP openview, Nagios etc
- 31. Implementasjon: Steg 9 Steg 9: Sikkerhet IDS/IPS med IPv6 add-on
- 32. Implementasjon: Steg 10 Steg 10: Dualstack p奪 hostsystemene: Plan for oppgradering/utskifting for 奪 f奪 100% support for IPv6 i 100% av endeutstyret
- 34. Oppl脱ringsplan IPv6 prosjektet ber淡rer hele organisasjonen, det er viktig med informasjonsflyt slik at folk er forberedt p奪 endringer/problemer som oppst奪r. Oppl脱ringsplan for IT-support personell IPv6 kurs Oppl脱ringsplan for brukere IPv6 FAQ IPv6 h奪ndbok
Editor's Notes
- #16: When the 6PE device receives an IPv6 packet from the CE, it directly labels the packet to translate the packet into an MPLS packet that can be transmitted over the IPv4 backbone network. The MPLS packet is forwarded to the remote 6PE through the LSP. The remote 6PE removes the label and finds the IPv6 routing table according to the destination address in the resulting IPv6 packet header. The remote 6PE then sends the packet to the destination host in the remote IPv6 network through the remote CE.
- #17: If DS-Lite is enabled on a CPE, and an IPv4 private network user needs to access the IPv4 public network by traversing an IPv6 network, the specific implementation is as follows: 1. On the CPE, the tunnel source IP address is statically configured or obtained by means of the BRAS. On the CGN, the tunnel destination IP address is statically configured, or obtained by means of the extended DHCPv4 options. The IPv4 private network address of the IPv4 host is assigned by the CPE. 2. The IPv4 private network address is statically configured or obtained by means of the BRAS 3. An IPv4 public network address pool is configured on the CGN, and the network segment is configured for the tunnel source IP address and tunnel destination IP address. 4. The CPE inserts an IPv6 header to IPv4 private network packets, takes the IPv4 private network packets as the payload of the IPv6 packets, and sends the IPv6 packets to the CGN. The source IP address and destination IP address of the IPv6 packets are respectively the tunnel source IP address and tunnel destination IP address. 5. After receiving the IPv6 packets, the CGN verifies whether the source IP address of the IPv6 packets falls into the network segment of the tunnel source IP address (configured in Step 3). If the source IP address falls into the network segment, the security check is passed. 6. The CGN decapsulates the IPv6 packets that satisfy the security requirement, extracts the IPv4 packets from the IPv6 packets, and translates the IPv4 private network address to the IPv4 public network address. The CGN then creates the forward mapping table and reverse mapping table, and forwards the IPv4 packets to the IPv4 public network. 7. After receiving IPv4 packets in the reverse direction, the CGN checks the mapping table to translate the destination IP address of the IPv4 packets to the private network address, encapsulates an IPv6 header to the IPv4 packets, and sends the IPv6 packets to the CPE. Note: Any IPv4 private network address can be assigned to the IPv4 user, and negotiation is not required during the establishment of the tunnel.
- #19: For the IPv6 over IPv4 tunnel (also known as configured tunnel), the addresses of the two endpoints of the tunnel need be manually configured on the routers on both ends of the tunnel. All tunnels are bidirectional. The manually configured IPv4 addresses are used as the link-layer addresses of the two tunnel endpoints, thus providing an end-to-end virtual link for the IPv6 network layer. The tunnel entrance router determines the packets to be transferred through a tunnel according to the destination IPv6 addresses of the packets and the routing table. It encapsulates the IPv6 packet as the IPv4 packet according to the configuration information about the tunnel interface. It determines the source and destination IPv4 addresses of the tunnel according to the data configuration. Advantages: It can be used by any IPv6 to traverse IPv4. Disadvantages: It need be manually configured.