You may have hoped to retire before IPv6 became a reality, but unfortunately the IPv4 address exhaustion came too fast. For the rest of us, we’re going to bite off a small piece of the 15-year old IPv6 pie and talk about how to get started! • Address format refresher • IPv4 and IPv6 protocol comparison • IPv6 neighbor discovery and auto-configuration • Current migration and coexistence strategies • ICMPv6, DHCPv6, and DNSv6 • How to get started at home

1. A toe-dip into the volatile world of IPv6 transitions Getting Started with IPv6 Tanner 04.29.2011

2. Goals and Status GOAL Get IPv6 dual-stack running on a lab/home network and connect to the IPv6 internet. STATUS IPv4 Exhaustion Timeline IPv6 Today Google, Microsoft, Apple, Netflix, Cisco, Facebook, Gov’t Agencies Service Provider Plan Enterprise Plan

3. IPv4 Exhaustion Schedule 3

4. Advantages Lots of Addresses Automatic IP Address Configuration Duplicate Address Detection (DAD) Only available option post-IPv4 Still disagreements on implementation / transition methods Immature device / OS / application support Remembering long addresses IPv6 Mechanics Disadvantages

5. Interface Addressing Manual SLAAC DHCPv6 Link Local DNS Increased reliance due to lengthy addresses AAAA (“Quad A”) Records IPv6 Building Blocks Routable 2002:d82a:3bcc:deff:baca:3f97:872d:d00d/64 ICMPv6 Neighbor Discovery Routing EIGRPv6, OSPFv3

6. IPv6 Addressing 2002:adb8:85a3:af90:b8b8:8a2e:1773:ff31/64 8 x 16-bits separated by a :(colon) Prefix length in CIDR format NOT255.255.255.255.255.255.255.255.0.0.0.0.0.0.0.0 Each interface has a: Link local address Routable address [Modified] EUI-64 Auto w/privacy extensions Manual Neighbor Discovery Heavy use of ICMP and Multicast

7. IPv6 Subnetting # of bits Host portion 16 4 8 2001:0DB8:0800:3333:AAAA:BBBB:CCCC:DDDD /16 Network/Subnet portion /48 /64 /120 /128 CIDR

8. Key Prefixes

9. Prefix Sizes 1Assumes using the “standard” allocation of /64 for all links and segments

10. Comparison Table

11. Dual stack NAT NAT64 & DNS64 / NAT46 / NAT44 / NAT66 / NAT-PT / CGNAT / NAT444 / NAT464 / DS-Lite Tunnels 6to4 (RFC 3056) 6in4 ISATAP (RFC 5214) GRE/IPv6 over DMVPN 6rd LISP Reverse Proxy/Load Balancers Transition Technologies

12. Current FinalState

13. Transitional Transitional

14. Make sure there are no DNS AAAA records Alternate: Disable IPv6 on all devices Enable IPv6 in core, then firewall, then internet router Enable select DMZ servers / inside clients Dual Stack Transition Plan

15. DNSv6 and DNS64 Name Resolution IPv4 set type=a www.comcast6.net Address: 68.87.29.36 IPv6 set type=aaaa www.comcast6.net Address: 2001:558:1002:4:68:87:29:36 DNS64 IPv6 client makes DNS AAAA query, DNS64 gateway translates IPv4 response to AAAA format

16. Client detects presence of routers on the link using Router Solicitation Uses link-local address as the source IP No gateway needed. Learned from RA’s. DHCPv6

17. IPv6 Attacks IPv6 NDP Exhaustion Configuring /64’s per subnet is akin to configuring an IPv4 /8 on a LAN Allocate /64, Configure a /120 Breaks SLAAC Ping/Ping or Ping/Pong attack ND vulnerabilities ICMP must be open to inside hosts Dual Stack Hosts – IPv6 may not be locked down

18. Additional Resources Books Deploying IPv6 in WAN/Branch Networks Cisco Deploying IPv6 Networks Cisco Global IPv6 Strategies ARIN IPv6 Wiki Measuring IPv6 Adoption www.cisco.com/go/ipv6 Cisco IOS IPv6 Configuration Guide http://ipv6.he.net/certification/index.php http://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml http://www.potaroo.net/ispcol/2011-02/transtools-part1.html http://www.potaroo.net/ispcol/2011-03/transtools-part2.html http://www.openwall.com/presentations/IPv6/index.html http://blogs.cisco.com/security/ipv6-whats-new/ http://www.openwall.com/presentations/IPv6/index.html http://owend.corp.he.net/ipv6/ http://www.infoblox.com/ipv6wp http://test-ipv6.com http://www.deepspace6.net/projects/ipv6calc.html ipv6forum.com

19. APPENDIX A Device Configuration Examples

20. Dual Stack ISP Request dual stack support from ISP or IPv6 Tunnel Broker Sign up for free IPv6 tunnel broker service (tunnelbroker.net from Hurricane Electric) IPv6 Internet Access Step 1

22. IP Protocol 41is reserved for IPv6 encapsulationIP will change depending on IPv6 broker endpoint used

23. Cisco Router Configuration (IP) Step 3 ipv6 unicast-routing ipv6 cef interface Tu0 description IPv6 Internet ipv6 enable ipv6 address 2001:DB8:F::2/64 tunnel source F4 tunnel destination 216.218.226.238 tunnel mode ipv6ip interface G0 description LAN Segment ipv6 address 2001:DB8:1::1/64 ipv6 address 2001:DB8:1::/64 EUI-64 ipv6 enable ipv6 route ::/0 Tu0 Assigned from HE Internet Interface IPv6 Broker Endpoint IPv6 Encapsulated in IPv4 IP from /48 allocation IPv6 default route

24. Cisco Router IP Autoconfig IPV6-Router# shipv6 int GigabitEthernet0 is up, line protocol is up [Hardware is PQII_PRO_UEC, address is 68EF.BD61.4D13] IPv6 is enabled, link-local address is FE80::6AEF:BDFF:FE61:4D13 No Virtual link-local address(es): Stateless address autoconfig enabled Global unicast address(es): 2001:DB8:1:0:6AEF:BDFF:FE61:4D13, subnet is 2001:DB8:1::/64[EUI/CAL/PRE] valid lifetime 2591835 preferred lifetime 604635 Joined group address(es): FF02::1 FF02::1:FF61:4D13 MTU is 1500 bytes … ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds (using 30000) Default router is FE80::215:C6FF:FE53:9EC8 on GigabitEthernet0 Interface MAC EUI-64 Insertion U/L bit flip Learned via ND from upstream router All IPv6 nodes, link local Solicited node addr for replies Link local addr used for next hop

25. Cisco Router Security (IPv6) Step 4 Access List IOS Firewall (CBAC) ipv6 access-list ACL-IPV6-IN remark --- Block AfriNIC/APNIC deny ipv6 2001:4200::/23 any deny ipv6 2C00:0000::/12 any deny ipv6 2001:0200::/23 any deny ipv6 2001:0C00::/23 any deny ipv6 2001:0E00::/23 any deny ipv6 2001:4400::/23 any deny ipv6 2001:8000::/19 any deny ipv6 2001:A000::/20 any deny ipv6 2001:B000::/20 any deny ipv6 2400:0000::/12 any remark --- Allow Neighbor Discovery permit icmp any anynd-na permit icmp any anynd-ns remark --- Block everything else deny ipv6 any any log interface Tunnel0 ipv6 traffic-filter ACL-IPV6-IN in ipv6 inspect alert-off ipv6 inspect routing-header ipv6 inspect max-incomplete low 100 ipv6 inspect max-incomplete high 200 ipv6 inspect one-minute low 100 ipv6 inspect one-minute high 200 ipv6 inspect udp idle-time 15 ipv6 inspect tcp idle-time 1800 ipv6 inspect tcpfinwait-time 1 ipv6 inspect tcpsynwait-time 15 ipv6 inspect tcp max-incomplete host 500 block-time 0 ipv6 inspect name FW1 ftp ipv6 inspect name FW1 tcp ipv6 inspect name FW1 udp ipv6 inspect name FW1 icmp interface G0 ipv6 inspect FW1 in ipv6 inspect FW1 out

26. Windows Server Configuration Step 5a Manually Configure Server IP Address DHCPv6 scope created with local fc00 addressing (ULA) (Optional) View of DNS A and AAAA Record

27. Windows 7 Configuration Step 5b Enable IPv6 Disable IPv6 tunnels (6to4, isatap, teredo) Prefer IPv4 over IPv6 during transition (KB929852) LAN Network Connection: Physical Address. . . . . . . . . : 00-22-68-1A-E1-4C DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv6 Address. . . . . . . . . . . : 2001:db8:1::222:68ff:fe1a:e14c(Preferred) Temporary IPv6 Address. . . . . . : 2001:db8:1::a1fd:f339:f800:f7ff(Preferred) Link-local IPv6 Address . . . . . : fe80::688f:1818:28fc:f11e%12(Preferred) IPv4 Address. . . . . . . . . . . : 172.16.0.122(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 172.16.0.1 DHCP Server . . . . . . . . . . . : 172.16.0.10 DHCPv6 IAID . . . . . . . . . . . : 218112349 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-C0-65-37-00-23-54-66-DF-67 DNS Servers . . . . . . . . . . . : 2001:db8:1::10 172.16.0.10

28. Mac OS X Step 5c

29. OS Support Comparison 1Feature supported in IOS 12.4(24)T and later. 2EUI-64 capability disabled by default. Privacy extensions must be disabled to use. 3Privacy extensions disabled by default.

30. Test Connectivity Step 6 Ping Test c:gt; ping ipv6.google.com Pinging ipv6.l.google.com [2001:4860:800d::63] with 32 bytes of data: Reply from 2001:4860:800d::63: time=45ms Reply from 2001:4860:800d::63: time=42ms Web Test

31. APPENDIX B Restrictions, Caveats, Considerations, and Tools

32. Does your L3 switch support hardware-based forwarding for IPv6? Platform Limitations

33. Do log parsing applications recognize IPv6? Syslog, etc. IP address calculation formulas in spreadsheets IP-enabled A/V equipment Network Video Recording software Application Compatibility

34. 3560/3750 sdm prefer dual-ipv4-and-ipv6 default Others: ipv6 mld snooping IPv6 CEF disabled by default IPv6 will use resources from the IPv4 pool Cisco Notes

35. Tools stealthyb@nms2:~$ sudo aptitude install sipcalc stealthyb@nms2:~$ sipcalc2001:db8:1::/48 -[ipv6 : 2001:db8:1::/48] - 0 [IPV6 INFO] Expanded Address - 2001:0db8:0001:0000:0000:0000:0000:0000 Compressed address - 2001:db8:1:: Subnet prefix (masked) - 2001:db8:1:0:0:0:0:0/48 Address ID (masked) - 0:0:0:0:0:0:0:0/48 Prefix address - ffff:ffff:ffff:0:0:0:0:0 Prefix length - 48 Address type - Aggregatable Global Unicast Addresses Network range - 2001:0db8:0001:0000:0000:0000:0000:0000 - 2001:0db8:0001:ffff:ffff:ffff:ffff:ffff

36. Q: How do I specify a port in an IPv6 URL? A: http://[2001:db8::dade:55]:8080/ Q: What are the group of addresses called in between each : (colon)? A: Depending on your source, they can be called “fields”, “groups”, “quads”, “hextets”, or “hexadecatet”. Q&A