Opendium_Steve Posted September 21, 2015 Posted September 21, 2015 I've been watching ARIN's IPv4 inventory dwindling over the past few weeks... https://www.arin.net/resources/request/ipv4_countdown.html ARIN services North America and RIPE NCC (which services Europe) ran out of IPv4 addresses 3 years ago. None of this is going to directly affect any end-users right now, but ARIN running out of addresses will mark yet another step towards a move away from IPv4. I'm in the middle of writing a blog article to discuss this, so I'm wondering how many of you have thought about IPv6 support on your networks?
FN-GM Posted September 21, 2015 Posted September 21, 2015 (edited) They need to get some sort of IPv4 to IPv6 NAT. Its stupid that the IPv6 addressed you use on your end devices will be assigned to you by your ISP. If you change your provider you will need to change your "internal IP range", you will need to change the IP of every device on the network! That will be a nightmare! I don't think the industry is preparing enough either. I have just taken a CCNA and doing a CCNP at the moment and I have hardly done anything on IPv6 and never had an exam question about it. Edited September 21, 2015 by FN-GM
Opendium_Steve Posted September 21, 2015 Author Posted September 21, 2015 They need to get some sort of IPv4 to IPv6 NAT. Its stupid that the IPv6 addressed you use on your end devices will be assigned to you by your ISP. If you change your provider you will need to change your "internal IP range", you will need to change the IP of every device on the network! That will be a nightmare! IPv6 NAT does exist... but it's a terrible idea for all the same reasons IPv4 NAT is a terrible idea. So we have 4 types of NAT: NAT44 NAT46 NAT64 NAT66 NAT44 is normal IPv4 NAT - you translate an IPv4 address to another IPv4 address. e.g. rewriting the source address so you can have multiple machines appearing to share a single address when connecting to the internet, or rewriting the destination address to create a port forward. The whole reason NAT44 exists is because there aren't many IPv4 addresses, so if you can hide a bunch of machines behind a few addresses then you can conserve them. With NAT46 you translate an IPv4 address to an IPv6 address so that an IPv4-only machine can connect to an IPv6-only machine. This can't be used to allow an IPv4 machine to talk to the IPv6 internet at large, since that machine has no way to tell anything what IPv6 it wants to connect to, but you can use it to map a specific IPv4 destination address to a specific IPv6 destination address. To be honest, it's really not that useful. NAT64 is the opposite of NAT46 - you can use it to allow an IPv6-only machine to connect to an IPv4-only machine. Generally you would route an entire /96 IPv6 prefix at your translator and encode the 32 bit IPv4 address you want to connect to in the last 32 bits of the IPv6 address. Not *that* useful since you're probably far better off dual-stacking your network and giving all your machines both v4 and v6 addresses. NAT66 is basically the IPv6 version of NAT44. You can either use it to hide a bunch of machines behind a single IP address, or more usually you'd use it to translate the prefix whilst leaving the right-hand-side of the addresses alone. Prefix translation is useful as a stop-gap measure for the "I've just changed ISP" situation, and for load balancing between independent connections. The problem with NAT (in any form), is that it causes a lot of problems for peer-to-peer systems, such as VoIP phones, etc. Through my whole professional career, my experience has always been to avoid NAT wherever possible - it may solve some short term problems, but it often comes back to bite you repeatedly. Prefix renumbering when you change ISP shouldn't be a _big_ problem, so long as you do address autoconfiguration wherever possible rather than manually addressing everything. I don't think the industry is preparing enough either. I have just taken a CCNA and doing a CCNP at the moment and I have hardly done anything on IPv6 and never had an exam question about it. I'd agree with that - I think the networking industry has had a head-in-sand approach on all sides. As you've mentioned, training isn't up to scratch; device manufacturers have been very slow to introduce support (often citing "well no ISPs offer IPv6" as an excuse); ISPs have been very slow (often citing "well no network devices support IPv6") and there's a general lack of awareness. I think my concern isn't so much that people aren't rolling out IPv6 capable networks at the moment, it's that people are still buying equipment that doesn't have any support without any consideration for whether they might need to migrate within the expected life of the equipment. The fun is going to start when some killer IPv6-only application that everyone wants appears and all the network admins have to drop everything to make it happen to please the bosses who demand it.
SchoolsBroadband Posted September 22, 2015 Posted September 22, 2015 you might also want to take a very good look at your firewall / UTM vendors. Does your device offer the same throughput of IPv4 as IPv6? I know a lot of vendors devices that don't and people will be in for a nasty shock, particularly those with big bandwidths. 1
Opendium_Steve Posted September 22, 2015 Author Posted September 22, 2015 you might also want to take a very good look at your firewall / UTM vendors. Does your device offer the same throughput of IPv4 as IPv6? I know a lot of vendors devices that don't and people will be in for a nasty shock, particularly those with big bandwidths. That's a good point that I hadn't considered - less of an issue for internet-facing firewalls, which don't have to deal with vast bandwidths anyway, but certainly something to think about with respect to layer 3 switches that are handling 10Gbps links. High bandwidth routers have dedicated hardware for doing IPv4, but some (usually older) devices do software routing for IPv6, which will be significantly slower. Servers also have similar problems, although to a lesser extent - network cards often have dedicated hardware for handling IPv4, but might not for IPv6.
mavhc Posted September 22, 2015 Posted September 22, 2015 surely you'd just use 1 to 1 NAT, change the isp allocated section of the address to an internal section, and run your firewall rules as usual, block everything incoming unless otherwise required.
FN-GM Posted September 22, 2015 Posted September 22, 2015 I have just been looking and struggling to find a firewall that will support IPv6 NAT.
Opendium_Steve Posted September 22, 2015 Author Posted September 22, 2015 I have just been looking and struggling to find a firewall that will support IPv6 NAT. Linux supports IPv6 NAT these days. Not sure if there are any friendly UIs to drive it though.
Michael Posted September 22, 2015 Posted September 22, 2015 So out of curiosity, is it possible to have an IPv6 external IP, but maintain an IPv4 internal range, whatever that may be? Or is that essentially what NAT64 is?
Quackers Posted September 23, 2015 Posted September 23, 2015 I have just been looking and struggling to find a firewall that will support IPv6 NAT. Fortinet Fortigate Firewalls do. Its what we have. Just waiting on Zen to start dishing IPv6 addresses out....
localzuk Posted September 23, 2015 Posted September 23, 2015 For a small organisation, what are the advantages of using IPv6? As it stands, the majority of the world is still IPv4, with many bits of kit not supporting v6 at all. To support IPv6 internally right now would mean increasing complexity of our networks, and having to run 2 systems at once - both IPv4 and IPv6. Realistically, there is nothing I can see that would drive schools towards IPv6 at the moment.
CyberNerd Posted September 23, 2015 Posted September 23, 2015 There's no point to even think about if we can NAT at the gateway. Our internal network will be ipv4 for the foreseeable future.
Opendium_Steve Posted September 23, 2015 Author Posted September 23, 2015 So out of curiosity, is it possible to have an IPv6 external IP, but maintain an IPv4 internal range, whatever that may be? Or is that essentially what NAT64 is? Typically you would have IPv6 and IPv4 running at the same time on the same network - all the machines would have both an IPv4 and an IPv6 address (this is known as a "dual stack" setup). For a small organisation, what are the advantages of using IPv6? As it stands, the majority of the world is still IPv4, with many bits of kit not supporting v6 at all. To support IPv6 internally right now would mean increasing complexity of our networks, and having to run 2 systems at once - both IPv4 and IPv6. Realistically, there is nothing I can see that would drive schools towards IPv6 at the moment. You need IPv6 to access IPv6-only services on the internet. At the moment there are very few in the West (quite a lot in Asia though), but with IPv4 addresses getting scarce they will become more commonplace - how long that takes is anyone's guess. I agree that there's no immediate pressure for schools to adopt IPv6, but it's probably a good idea for new kit to be "IPv6 ready" lest you end up having to upgrade lots of stuff if the pressure appears earlier than you expect.
Arthur Posted September 24, 2015 Posted September 24, 2015 (edited) From early next year Apple will mandate IPv6 support in all iOS apps. Hopefully that will speed up adoption? https://developer.apple.com/news/?id=08282015a iOS 9 now supports IPv6-only mobile networks (like T-Mobile USA). Edited September 24, 2015 by Arthur
localzuk Posted September 24, 2015 Posted September 24, 2015 You need IPv6 to access IPv6-only services on the internet. At the moment there are very few in the West (quite a lot in Asia though), but with IPv4 addresses getting scarce they will become more commonplace - how long that takes is anyone's guess. I agree that there's no immediate pressure for schools to adopt IPv6, but it's probably a good idea for new kit to be "IPv6 ready" lest you end up having to upgrade lots of stuff if the pressure appears earlier than you expect. Until such a point where those services become numerous or even a majority, the benefit of running IPv6 internally is pretty limited. Sticking NAT in between would serve for those few services until that point, and in most cases this would simply be an update to existing edge NAT software or equipment that is already in place.
Geoff Posted September 24, 2015 Posted September 24, 2015 I find it amusing people in wider tech circles than Edugeek are sticking their head in the sand and ignoring this issue. We are going to run out of publicly addressable IPv4 space. You will have to be able to speak to an IPv6 only Internet host at some time in the future. Our internal network understands IPv6 and has done for some time. It was simply a case of making sure any kit we bought understood IPv6 when it was up for renewal. The whole IPv6 NAT thing is a red herring. There's no need for it on the IPv6 Internet. You simply have an IPv6 enabled firewall and use acls to control what traffic goes where. 6to4 tunnelling I can understand ofc, there will be a need for ISP customers who only get a IPv6 IP (due to IPv4 address exhaustion) to access the legacy IPv4 Internet.
localzuk Posted September 24, 2015 Posted September 24, 2015 I find it amusing people in wider tech circles than Edugeek are sticking their head in the sand and ignoring this issue. We are going to run out of publicly addressable IPv4 space. You will have to be able to speak to an IPv6 only Internet host at some time in the future. Our internal network understands IPv6 and has done for some time. It was simply a case of making sure any kit we bought understood IPv6 when it was up for renewal. The whole IPv6 NAT thing is a red herring. There's no need for it on the IPv6 Internet. You simply have an IPv6 enabled firewall and use acls to control what traffic goes where. 6to4 tunnelling I can understand ofc, there will be a need for ISP customers who only get a IPv6 IP (due to IPv4 address exhaustion) to access the legacy IPv4 Internet. That is an over-simplistic analysis to say the least. There is a lot more to IPv6 support than simply having kit that supports it. It includes DNS changes, firewall changes, routing changes, ensuring equipment supports it, even down to simply understanding how IPv6 addresses work - things like what the different scopes are for example. It also then needs, in our case, multiple upstream providers to then support IPv6, else we end up with another NAT situation - which we could've done anyway when IPv6 becomes an issue in the future!
Geoff Posted September 24, 2015 Posted September 24, 2015 As long as you are using a currently supported OS you should be fine. Granted yes, you have to roll out DNS and probably DHCP6 too. I would hope everyone reading this had a thorough grasp of IPv6 already, as IPv6 is probably running on your network to some degree already. Both my ISPs talk IPv6. I have an issue with our current firewall and IPv6, but that is getting replaced this side of Crimbo.
Michael Posted September 24, 2015 Posted September 24, 2015 IPv6 has been supported since Windows XP (however you need to enable it), but on by default since Windows Vista and later. I guess IPv6 does put more of a need on DNS as remembering an IPv6 address is extremely impractical. I suspect this is one of the reasons why it hasn't been adopted maybe as much as it should be.
localzuk Posted September 24, 2015 Posted September 24, 2015 As long as you are using a currently supported OS you should be fine. Granted yes, you have to roll out DNS and probably DHCP6 too. I would hope everyone reading this had a thorough grasp of IPv6 already, as IPv6 is probably running on your network to some degree already. Nope, no IPv6 on this network. Things support it, but it isn't enabled anywhere. Both my ISPs talk IPv6. I have an issue with our current firewall and IPv6, but that is getting replaced this side of Crimbo. Neither my home ISP or my work ISP support IPv6. I think you're in a minority there I think!
Michael Posted September 24, 2015 Posted September 24, 2015 Rather appropriate to add to the discussion: BT sets date for IPv6 network conversion
FN-GM Posted October 1, 2015 Posted October 1, 2015 North America has run out of IPv4 addresses. https://learningnetwork.cisco.com/blogs/community_cafe/2015/09/30/north-american-ipv4-addresses-have-run-out?utm_source=sm&utm_medium=fb&utm_campaign=LNBlog
Opendium_Steve Posted October 1, 2015 Author Posted October 1, 2015 North America has run out of IPv4 addresses. https://learningnetwork.cisco.com/blogs/community_cafe/2015/09/30/north-american-ipv4-addresses-have-run-out?utm_source=sm&utm_medium=fb&utm_campaign=LNBlog Happened a week ago We published an analysis at the time: America Runs out of Internet Addresses | www.opendium.com
FN-GM Posted October 22, 2015 Posted October 22, 2015 Fortinet Fortigate Firewalls do. Its what we have. Just waiting on Zen to start dishing IPv6 addresses out.... @Quackers I have had word today that ZEN will be dishing iPv6 out soon! I have started to look at Dual Stacking IPv6 and IPv4 on our network. Smoothwall will be a bit of an issue. Its not something that is going away, its going to take time to get everything IPv6 compliant, might was well get cracking! 1
SchoolsBroadband Posted October 23, 2015 Posted October 23, 2015 @Quackers I have had word today that ZEN will be dishing iPv6 out soon! I have started to look at Dual Stacking IPv6 and IPv4 on our network. Smoothwall will be a bit of an issue. Its not something that is going away, its going to take time to get everything IPv6 compliant, might was well get cracking! beware of and Fortinet using a C, B or A series chip set. To allow the use of IPv6 all processing of packets is done in software and on the normal chipsets (not ASIC drive). This will affect the performance of UTM functionality in particular. D series Fortigate firewalls are ok as IPv6 acceleration is supported in the latest ASIC chipset. Thanks Dave
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now