Ipv4 Exhaustion: NAT and Transition to Ipv6 for Service Providers
Total Page:16
File Type:pdf, Size:1020Kb
IPv4 Exhaustion: NAT and Transition to IPv6 for Service Providers Rajiv Asati, Distinguished Engineer, Cisco BRKSPG-2602 Cisco Spark Questions? Use Cisco Spark to chat with the speaker after the session How 1. Find this session in the Cisco Live Mobile App 2. Click “Join the Discussion” 3. Install Spark or go directly to the space 4. Enter messages/questions in the space Cisco Spark spaces will be cs.co/ciscolivebot#BRKSPG-2602 available until July 3, 2017. © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Hmmm…….. CGNAT issue or something else ? IPv4 – Classic But spare parts have run out BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 5 IPv6 – Next Gen Getting to full parity and end-end use takes time Caution: New road may be needed BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 6 Transition Technologies Driving your classic IPv4 (or next gen IPv6) around BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 Abstract • Any service provider that has exhausted its IPv4 address pool, will not only have to deploy/offer IPv6, but also employ IPv4 sharing. This is because chunk of content may be reachable only via IPv4 internet, even though majority is available via IPv6 internet. • This session discusses few mechanisms such as MAP-T/E, 464XLAT, DS-Lite and CGN 64/44 etc. that facilitate IPv4 sharing with and without IPv6. It contrasts stateful and stateless translation techniques as well. • 6rd is included for reference as well. • This session is intended for Service Providers. BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 Agenda • Goal of Transition Technologies • Overview of Transition Technologies • Dual Stack – Impact ( & Happy Eyeballs) • IPv4 Address Sharing - Impact • CGN 44, DS-Lite, 6rd, MAP • CGN 64 for IPv6-only • Conclusion Recommended Approach for IPv6 Dual-Stack Deployment (per IETF RFC 4213) IPv4+IPv6 Hosts (Dual Stack) • Dual-Stack all the way to the hosts * • Hosts: Windows, OSX, iOS, Android, Linux etc. • Routers: IOS etc. IPv4+IPv6 Network • But note… • IPv4 exhaustion is underway • Every host can NOT be assigned an IPv4 address • Two protocol stacks to be managed in network IPv4 and/or IPv6 Destinations * RFC7755 suggests Single-stack IPv6 for DC BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 Recommended Approach for IPv6 Dual-Stack Deployment (per IETF RFC 4213), since 2005 • Dual-Stack to the “hosts” (= consumption devices) • ~90% of Desktop hosts and ~99% of Mobile hosts support it (..go away WinXP ) Source – Mobile Operating System, Statistica, Jan 2017 Source – Desktop Operating System, Netmarketshare, Jan’14-Dec’16 BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 IPv4 Address Depletion Causes Impact differently • The ISP Impact: • Lack of IPv4 addresses for users • Harder to grow the business • The User Impact (explicit or implicit): • IP reputation (more on this later) • IPv4 address sharing • Breaks applications • Complicates operating servers • Limits UDP/TCP ports per user • IPv6 enabled services are catching up BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 Transition Technologies • How do we migrate from IPv4 to IPv6? • Short term1: can’t enable IPv6 immediately, need more IPv4 (or share IPv4) • Short term2: enable IPv6 immediately, need more IPv4 (or share IPv4) • Long term: simple network, single protocol – IPv6 • What does this really mean? • IPv6 to co-exist with IPv4 • IPv4 address sharing to become wide-spread • IPv6 to interoperate with IPv4 Transition technologies pave the way to move from IPv4 to IPv6 BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 Agenda • Goal of Transition Technologies • Overview of Transition Technologies • Dual Stack – Impact ( & Happy Eyeballs) • IPv4 Address Sharing - Impact • CGN 44, DS-Lite, 6rd, MAP • CGN 64 for IPv6-only • Conclusion Towards IPv6 …with or without IPv4 Transition Technologies in One Slide This is Obtain More IPv4 Addresses This is where IPv4 Share IPv4 Addresses where we are: we CGN DualDual CGN CGN CGN CGN have to Stack Stack 44 44 44* 64 be: Mostly ? MAP IPv4 & + + + + 6rd IPv6 Dual (Dual- DS- Single Address Stack Stack) Lite -Stack Mostly Run-out IPv6; 1. CGN = Carrier Grade NAT - Stateful 2. Modified to support DS-Lite BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 Towards IPv6 …with or without IPv4 . This is Obtain More IPv4 Addresses This is where IPv4 Share IPv4 Addresses where we are: we CGNCGN DualDual CGN 44 CGN CGN have to StackStack 44 * 64 Mostly + MAP be: + + + IPv4 & 6rd 6rd IPv6 Dual (Dual- DS- Single Address Stack Stack) Lite -Stack Mostly Run-out IPv6; 1. CGN = Carrier Grade NAT - Stateful 2. Modified to support DS-Lite BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 Towards IPv6 …with or without IPv4 Transition Technologies in One Slide Options Arbitrary IP CPE LAN CPE WAN Tunnel or In-network Extra CPE addressing of IPv4 or IPv6 IPv4 or IPv6 Translate? “State”? features? CPE? 0 Single-Stack IPv4 IPv4 -NA- -NA- Yes No 1 Dual-Stack IPv4 + IPv6 IPv4+IPv6 -NA- -NA- Yes No** 2 Single-Stack IPv4 IPv4 Translate Yes (CGN44) Yes No 3 Dual-Stack IPv4 + IPv6 IPv4+IPv6 Translate Yes (CGN44) Yes No** 4 DS-Lite IPv4 + IPv6 IPv6 Both Yes (CGN44) Yes Yes 5 6rd IPv4 + IPv6 IPv4 Tunnel No No Yes 6 6rd + CGN IPv4 + IPv6 IPv4 Both Yes (CGN44) No Yes 7 MAP IPv4 + IPv6 IPv6 Either No Yes* Yes 8 Single-Stack IPv6 IPv6 Translate Yes (CGN64) Yes Yes|No * Allows both arbitrary and algorithmic mapping ** Changes needed if IPv6 is not supported by existing CPE BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Agenda • Goal of Transition Technologies • Overview of Transition Technologies • Single-Stack IPv4 – Obtain more IPv4 • Dual Stack – Impact ( & Happy Eyeballs) • IPv4 Address Sharing - Impact • CGN 44, DS-Lite, 6rd, MAP • Single-Stack IPv6 & CGN 64 • Conclusion 0. Obtain IPv4 Addresses Host/CPE gets just IPv4 prefixes This is Obtain More IPv4 Addresses This is where IPv4 Share IPv4 Addresses where we are: we CGNCGN Dual CGN 44 CGN CGN have to Stack 44 * 64 Mostly + MAP be: + + + IPv4 & 6rd Dual (Dual6rd- DS- Single Address Stack Stack) Lite -Stack Mostly Run-out IPv6; 1. CGN = Carrier Grade NAT - Stateful 2. Modified to support DS-Lite BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 0. Obtain IPv4 Addresses • Obtain IPv4 addresses from Regional Internet Registry (RIRs) or open market • RIR: May Not have any left. • Open market: USD $10-$15 per IPv4 address • IPv6, well, is optional • ADVANTAGES: • No CGN, no address sharing, no operational changes • No need to press for IPv6 deployment • DISADVANTAGES : • If business growing, delaying the inevitable • Geo-location needs to be updated (mileage varies) • No IPv6 deployed • Reputation might be bad BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Agenda • Goal of Transition Technologies • Overview of Transition Technologies • Single-Stack IPv4 – Obtain more IPv4 • Dual Stack – Impact ( & Happy Eyeballs) • IPv4 Address Sharing - Impact • CGN 44, DS-Lite, 6rd, MAP • Single-Stack IPv6 & CGN 64 • Conclusion 1. Dual-Stack Host/CPE gets both IPv4 and IPv6 prefixes This is Obtain More IPv4 Addresses This is where IPv4 Share IPv4 Addresses where we are: we CGNCGN DualDual CGN 44 CGN CGN have to Stack Stack 44 * 64 Mostly + MAP be: + + + IPv4 & 6rd 6rd IPv6 Dual (Dual- DS- Single Address Stack Stack) Lite -Stack Mostly Run-out IPv6; 1. CGN = Carrier Grade NAT - Stateful 2. Modified to support DS-Lite BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 1. Dual Stack The Reality • Reality: More and more IPv4 address sharing (NAT, MAP) • Covered in co-existence section later on. • Hosts should prefer IPv6 to IPv4 • Generally necessary • Without this preference, IPv4 would persist until IPv4 is turned off IPv6 Road • But what if IPv6 is broken? Overloaded??? • IPv6 peering is down ... • Tunnel is down ... • (Microsoft IPv6 NCSI is down....) BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 27 1. Dual Stack Do I use IPv6 or IPv4 ? • Dual-stack client connecting to dual-stack server • IPv6 is preferred by default (RFC6724) • If IPv6 is slower, then users blame IPv6 and may disable IPv6! • IPv6 better not be slower than IPv4 • Who can guarantee that ! • What if IPv6 is broken altogether? • What if IPv6 is broken to few websites? BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 1. Dual Stack Problem: IPv6 is Broken to a certain website? BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 1. Dual Stack Solution – Happy Eyeballs (RFC6555) Note: Slight Preference is given to IPv6 connection BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 30 1. Dual Stack Solution – Happy Eyeballs Optimization (RFC6555) BRKSPG-2602 © 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public 31 1. Dual-Stack Happy Eyeballs (RFC6555) • Users are happy • Aimed initially at web browsing • Web browsing is the most common application • Fast response even if IPv6 (or IPv4) path is down • Network administrators are happy • Users no longer trying to disable IPv6 • Reduces IPv4 usage (reduces load on CGN) • Content providers are happy Source: http://seclists.org/nanog/2016/Jun/809 • Improved geolocation and DoS visibility with IPv6 BRKSPG-2602 © 2017 Cisco and/or its affiliates.