IPv6 adoption

[Opendium_Steve]

I've been watching ARIN's IPv4 inventory dwindling over the past few weeks...

https://www.arin.net/resources/request/ipv4_countdown.html

 

ARIN services North America and RIPE NCC (which services Europe) ran out of IPv4 addresses 3 years ago. None of this is going to directly affect any end-users right now, but ARIN running out of addresses will mark yet another step towards a move away from IPv4. I'm in the middle of writing a blog article to discuss this, so I'm wondering how many of you have thought about IPv6 support on your networks?

[FN-GM]

They need to get some sort of IPv4 to IPv6 NAT. Its stupid that the IPv6 addressed you use on your end devices will be assigned to you by your ISP. If you change your provider you will need to change your "internal IP range", you will need to change the IP of every device on the network! That will be a nightmare!

 

I don't think the industry is preparing enough either. I have just taken a CCNA and doing a CCNP at the moment and I have hardly done anything on IPv6 and never had an exam question about it.

Edited September 21, 2015 by FN-GM

[Opendium_Steve]

They need to get some sort of IPv4 to IPv6 NAT. Its stupid that the IPv6 addressed you use on your end devices will be assigned to you by your ISP. If you change your provider you will need to change your "internal IP range", you will need to change the IP of every device on the network! That will be a nightmare!

 

IPv6 NAT does exist... but it's a terrible idea for all the same reasons IPv4 NAT is a terrible idea.

 

So we have 4 types of NAT:

NAT44

NAT46

NAT64

NAT66

 

NAT44 is normal IPv4 NAT - you translate an IPv4 address to another IPv4 address. e.g. rewriting the source address so you can have multiple machines appearing to share a single address when connecting to the internet, or rewriting the destination address to create a port forward. The whole reason NAT44 exists is because there aren't many IPv4 addresses, so if you can hide a bunch of machines behind a few addresses then you can conserve them.

 

With NAT46 you translate an IPv4 address to an IPv6 address so that an IPv4-only machine can connect to an IPv6-only machine. This can't be used to allow an IPv4 machine to talk to the IPv6 internet at large, since that machine has no way to tell anything what IPv6 it wants to connect to, but you can use it to map a specific IPv4 destination address to a specific IPv6 destination address. To be honest, it's really not that useful.

 

NAT64 is the opposite of NAT46 - you can use it to allow an IPv6-only machine to connect to an IPv4-only machine. Generally you would route an entire /96 IPv6 prefix at your translator and encode the 32 bit IPv4 address you want to connect to in the last 32 bits of the IPv6 address. Not *that* useful since you're probably far better off dual-stacking your network and giving all your machines both v4 and v6 addresses.

 

NAT66 is basically the IPv6 version of NAT44. You can either use it to hide a bunch of machines behind a single IP address, or more usually you'd use it to translate the prefix whilst leaving the right-hand-side of the addresses alone. Prefix translation is useful as a stop-gap measure for the "I've just changed ISP" situation, and for load balancing between independent connections.

 

The problem with NAT (in any form), is that it causes a lot of problems for peer-to-peer systems, such as VoIP phones, etc. Through my whole professional career, my experience has always been to avoid NAT wherever possible - it may solve some short term problems, but it often comes back to bite you repeatedly.

 

Prefix renumbering when you change ISP shouldn't be a _big_ problem, so long as you do address autoconfiguration wherever possible rather than manually addressing everything.

 

I don't think the industry is preparing enough either. I have just taken a CCNA and doing a CCNP at the moment and I have hardly done anything on IPv6 and never had an exam question about it.

 

I'd agree with that - I think the networking industry has had a head-in-sand approach on all sides. As you've mentioned, training isn't up to scratch; device manufacturers have been very slow to introduce support (often citing "well no ISPs offer IPv6" as an excuse); ISPs have been very slow (often citing "well no network devices support IPv6") and there's a general lack of awareness. I think my concern isn't so much that people aren't rolling out IPv6 capable networks at the moment, it's that people are still buying equipment that doesn't have any support without any consideration for whether they might need to migrate within the expected life of the equipment.

 

The fun is going to start when some killer IPv6-only application that everyone wants appears and all the network admins have to drop everything to make it happen to please the bosses who demand it.

[SchoolsBroadband]

you might also want to take a very good look at your firewall / UTM vendors.

 

Does your device offer the same throughput of IPv4 as IPv6? I know a lot of vendors devices that don't and people will be in for a nasty shock, particularly those with big bandwidths.

[Opendium_Steve]

you might also want to take a very good look at your firewall / UTM vendors.

 

Does your device offer the same throughput of IPv4 as IPv6? I know a lot of vendors devices that don't and people will be in for a nasty shock, particularly those with big bandwidths.

 

That's a good point that I hadn't considered - less of an issue for internet-facing firewalls, which don't have to deal with vast bandwidths anyway, but certainly something to think about with respect to layer 3 switches that are handling 10Gbps links. High bandwidth routers have dedicated hardware for doing IPv4, but some (usually older) devices do software routing for IPv6, which will be significantly slower. Servers also have similar problems, although to a lesser extent - network cards often have dedicated hardware for handling IPv4, but might not for IPv6.

[mavhc]

surely you'd just use 1 to 1 NAT, change the isp allocated section of the address to an internal section, and run your firewall rules as usual, block everything incoming unless otherwise required.

[FN-GM]

I have just been looking and struggling to find a firewall that will support IPv6 NAT.

[Opendium_Steve]

I have just been looking and struggling to find a firewall that will support IPv6 NAT.

 

Linux supports IPv6 NAT these days. Not sure if there are any friendly UIs to drive it though.

[Michael]

So out of curiosity, is it possible to have an IPv6 external IP, but maintain an IPv4 internal range, whatever that may be? Or is that essentially what NAT64 is?

[Quackers]

I have just been looking and struggling to find a firewall that will support IPv6 NAT.

 

Fortinet Fortigate Firewalls do. Its what we have. Just waiting on Zen to start dishing IPv6 addresses out....

[localzuk]

For a small organisation, what are the advantages of using IPv6? As it stands, the majority of the world is still IPv4, with many bits of kit not supporting v6 at all. To support IPv6 internally right now would mean increasing complexity of our networks, and having to run 2 systems at once - both IPv4 and IPv6.

 

Realistically, there is nothing I can see that would drive schools towards IPv6 at the moment.

[CyberNerd]

There's no point to even think about if we can NAT at the gateway. Our internal network will be ipv4 for the foreseeable future.

[Opendium_Steve]

So out of curiosity, is it possible to have an IPv6 external IP, but maintain an IPv4 internal range, whatever that may be? Or is that essentially what NAT64 is?

 

Typically you would have IPv6 and IPv4 running at the same time on the same network - all the machines would have both an IPv4 and an IPv6 address (this is known as a "dual stack" setup).

 

For a small organisation, what are the advantages of using IPv6? As it stands, the majority of the world is still IPv4, with many bits of kit not supporting v6 at all. To support IPv6 internally right now would mean increasing complexity of our networks, and having to run 2 systems at once - both IPv4 and IPv6.

 

Realistically, there is nothing I can see that would drive schools towards IPv6 at the moment.

 

You need IPv6 to access IPv6-only services on the internet. At the moment there are very few in the West (quite a lot in Asia though), but with IPv4 addresses getting scarce they will become more commonplace - how long that takes is anyone's guess.

 

I agree that there's no immediate pressure for schools to adopt IPv6, but it's probably a good idea for new kit to be "IPv6 ready" lest you end up having to upgrade lots of stuff if the pressure appears earlier than you expect.

[Arthur]

From early next year Apple will mandate IPv6 support in all iOS apps. Hopefully that will speed up adoption?

 

https://developer.apple.com/news/?id=08282015a

 

iOS 9 now supports IPv6-only mobile networks (like T-Mobile USA).

Edited September 24, 2015 by Arthur

[localzuk]

You need IPv6 to access IPv6-only services on the internet. At the moment there are very few in the West (quite a lot in Asia though), but with IPv4 addresses getting scarce they will become more commonplace - how long that takes is anyone's guess.

 

I agree that there's no immediate pressure for schools to adopt IPv6, but it's probably a good idea for new kit to be "IPv6 ready" lest you end up having to upgrade lots of stuff if the pressure appears earlier than you expect.

 

Until such a point where those services become numerous or even a majority, the benefit of running IPv6 internally is pretty limited. Sticking NAT in between would serve for those few services until that point, and in most cases this would simply be an update to existing edge NAT software or equipment that is already in place.

[Geoff]

I find it amusing people in wider tech circles than Edugeek are sticking their head in the sand and ignoring this issue. We are going to run out of publicly addressable IPv4 space. You will have to be able to speak to an IPv6 only Internet host at some time in the future. Our internal network understands IPv6 and has done for some time. It was simply a case of making sure any kit we bought understood IPv6 when it was up for renewal.

 

The whole IPv6 NAT thing is a red herring. There's no need for it on the IPv6 Internet. You simply have an IPv6 enabled firewall and use acls to control what traffic goes where. 6to4 tunnelling I can understand ofc, there will be a need for ISP customers who only get a IPv6 IP (due to IPv4 address exhaustion) to access the legacy IPv4 Internet.

[localzuk]

I find it amusing people in wider tech circles than Edugeek are sticking their head in the sand and ignoring this issue. We are going to run out of publicly addressable IPv4 space. You will have to be able to speak to an IPv6 only Internet host at some time in the future. Our internal network understands IPv6 and has done for some time. It was simply a case of making sure any kit we bought understood IPv6 when it was up for renewal.

 

The whole IPv6 NAT thing is a red herring. There's no need for it on the IPv6 Internet. You simply have an IPv6 enabled firewall and use acls to control what traffic goes where. 6to4 tunnelling I can understand ofc, there will be a need for ISP customers who only get a IPv6 IP (due to IPv4 address exhaustion) to access the legacy IPv4 Internet.

 

That is an over-simplistic analysis to say the least. There is a lot more to IPv6 support than simply having kit that supports it. It includes DNS changes, firewall changes, routing changes, ensuring equipment supports it, even down to simply understanding how IPv6 addresses work - things like what the different scopes are for example. It also then needs, in our case, multiple upstream providers to then support IPv6, else we end up with another NAT situation - which we could've done anyway when IPv6 becomes an issue in the future!

[Geoff]

As long as you are using a currently supported OS you should be fine. Granted yes, you have to roll out DNS and probably DHCP6 too. I would hope everyone reading this had a thorough grasp of IPv6 already, as IPv6 is probably running on your network to some degree already.

 

Both my ISPs talk IPv6. I have an issue with our current firewall and IPv6, but that is getting replaced this side of Crimbo.

[Michael]

IPv6 has been supported since Windows XP (however you need to enable it), but on by default since Windows Vista and later.

 

I guess IPv6 does put more of a need on DNS as remembering an IPv6 address is extremely impractical. I suspect this is one of the reasons why it hasn't been adopted maybe as much as it should be.

[localzuk]

As long as you are using a currently supported OS you should be fine. Granted yes, you have to roll out DNS and probably DHCP6 too. I would hope everyone reading this had a thorough grasp of IPv6 already, as IPv6 is probably running on your network to some degree already.

 

Nope, no IPv6 on this network. Things support it, but it isn't enabled anywhere.

 

Both my ISPs talk IPv6. I have an issue with our current firewall and IPv6, but that is getting replaced this side of Crimbo.

 

Neither my home ISP or my work ISP support IPv6. I think you're in a minority there I think!

[Michael]

Rather appropriate to add to the discussion: BT sets date for IPv6 network conversion

[FN-GM]

North America has run out of IPv4 addresses.

 

https://learningnetwork.cisco.com/blogs/community_cafe/2015/09/30/north-american-ipv4-addresses-have-run-out?utm_source=sm&utm_medium=fb&utm_campaign=LNBlog

[Opendium_Steve]

North America has run out of IPv4 addresses.

 

https://learningnetwork.cisco.com/blogs/community_cafe/2015/09/30/north-american-ipv4-addresses-have-run-out?utm_source=sm&utm_medium=fb&utm_campaign=LNBlog

 

Happened a week ago

We published an analysis at the time: America Runs out of Internet Addresses | www.opendium.com

[FN-GM]

Fortinet Fortigate Firewalls do. Its what we have. Just waiting on Zen to start dishing IPv6 addresses out....

@Quackers I have had word today that ZEN will be dishing iPv6 out soon! I have started to look at Dual Stacking IPv6 and IPv4 on our network. Smoothwall will be a bit of an issue. Its not something that is going away, its going to take time to get everything IPv6 compliant, might was well get cracking!

[SchoolsBroadband]

@Quackers I have had word today that ZEN will be dishing iPv6 out soon! I have started to look at Dual Stacking IPv6 and IPv4 on our network. Smoothwall will be a bit of an issue. Its not something that is going away, its going to take time to get everything IPv6 compliant, might was well get cracking!

 

beware of and Fortinet using a C, B or A series chip set. To allow the use of IPv6 all processing of packets is done in software and on the normal chipsets (not ASIC drive). This will affect the performance of UTM functionality in particular. D series Fortigate firewalls are ok as IPv6 acceleration is supported in the latest ASIC chipset.

 

Thanks

 

Dave