DOCSLIB.ORG

Ipv6 Technology Overview Tutorial- Part I Tutorial- Part I

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

IPv6 Technology Overview Tutorial - Part I Speaker: Byju Pularikkal Customer Solutions Architect, Cisco Systems Inc. 1 Acronyms/Abbreviations DOCSIS = Data-Over-Cable Service Interface RS = Router Solicitation Specification RA = Router Advertisement CMTS = Cable Modem Termination System UDP = User Datagram Protocol DS = Downstream DUID = DHCP Unique Identifier US = Upstream DNS = Domain Name System CM = Cable Modem CPE = Customer Premises Equipment IPv6 = Internet Protocol version 6 ICMPv6 = Internet Control Message Protocol ND = Neighbor Discovery version 6 NS = Neighbor Solicitation DHCPv6 = Dynamic Host Configuration Protocol for HFC = Hybrid Fiber Coaxial IPv6 EUI = Extended Unique Identifier MSO = Multiple Services Operator SMB = Small Business TFTP = Trivial File Transfer Protocol PDA = Personal Digital Assistant ToD = Time of Day NAT = Network Address Translation MDD = Mac Domain Descriptor CIDR = Classless Interdomain Routing APM = Alternative Provisioning Mode DAD = Duplicate Address Detection SNMP = Simple Network Management Protocol SLA = Subnet Level Address ASM = Anysource Multicast VPN = Virtual Private Network SSM = Source Specific Multicast ARP = Address Resolution Protocol SLAAC = Stateless Addres Autoconfiguration eSAFE = Embedded Service/Application Functional Entity MLD = Multicast Listener Discovery . 2 Tutorial-1: Agenda Structure of IPv6 Protocol IPv4 and IPv6 Header Comparison IPv6 Extension Headers IPv6 Addressing Addressing Format Types of IPv6 addresses ICMPv6 and Neighbor Discovery Router Solicitation & Advertisement Neighbor Solicitation & Advertisement Duplicate Address Detection Multicast in IPv6 DHCP & DNS for IPv6 DNS with IPv6 DHCPv6 Overview . 3 Tutorial-2: Agenda Routing in IPv6 RIPng OSPFv3 BGP-4 Extensions for IPv6 Multi-Topology IS-IS Tunneling Automatic 6 to 4 Tunnels ISATAP IPv6 for DOCSIS Overview IPv6 Drivers in Broadband Access Networks CMTS & CM Requirements for IPv6 MSO CPE Address Assignment Strategies . 4 The Structure of IPv6 Protocol 5 IPv4 and IPv6 Header Comparison IPv4 Header IPv6 Header Type of Version IHL Total Length Version Traffic Class Flow Label Service Fragment Identification Flags Payload Length Next Header Hop Limit Offset Time to Live Protocol Header Checksum Source Address Source Address Destination Address Options Padding Legend Destination Address - Field name kept from IPv4 to IPv6 - Fields not kept in IPv6 - Name and position changed in IPv6 - New field in IPv6 . 6 IPv6 Header New Field—Flow Label (RFC 3697) 20-Bit Flow Label Field to Identify Specific Flows Needing Special QoS IPv6 Header Flow classifiers had been based on Version Traffic Class Flow Label 5-tuple: Source/destination address, Next Payload Length Hop Limit protocol type and port numbers of Header transport Some of these fields may be unavailable due to fragmentation, Source Address encryption or locating them past extension headers With flow label, each source chooses its own flow label values; routers use source addr + flow label to identify Destination Address distinct flows Flow label value of 0 used when no special QoS requested (the common case today) . 7 Extension Headers Base header IPv6 Base Header Next Header = 0 st (40 octets) 1 Extension Header 0 or more Next Header… = 43 IPv6 Extension Headers Last Extension Packet Header Next Header = 17 Data Next Header = 17 Ext Hdr Length Ext Hdr Data . 8 Extension Header Order Extension Headers Should Be Constructed in the Following Sequence and Should Be Sequenced in this Order: Hop-by-Hop header (0) Destination options header (w/ routing header) (60) Routing header (43) Fragment header (44) Authentication header (51) ESP header (50) Mobility header (135) Destination options header (60) ICMPv6 (58) No Next header (59) Upper-layer header (Varies— TCP=6, UDP=17) . 9 MTU Issues Minimum link MTU for IPv6 is 1280 octets (vs. 68 octets for IPv4) => on links with MTU < 1280, link-specific fragmentation and reassembly must be used Implementations are expected to perform path MTU discovery to send packets bigger than 1280 Minimal implementation can omit PMTU discovery as long as all packets kept ≤ 1280 octets A hop-by-hop option supports transmission of “jumbograms” with up to 2 32 octets of payload; payload is normally 2 16 . 10 IPv6 Addressing 11 IPv6 Addressing . 12 IPv6 Addressing . 13 Addressing Format Representation 16-bit hexadecimal numbers Numbers are separated by (:) Hex numbers are not case sensitive Abbreviations are possible Leading zeros in contiguous block could be represented by (::) Example: 2001:0db8:0000:130F:0000:0000:087C:140B 2001:0db8:0:130F::87C:140B Double colon only appears once in the address . 14 Addressing Prefix Representation Representation of prefix is just like CIDR In this representation you attach the prefix length Like v4 address: 198.10.0.0/16 V6 address is represented the same way: 2001:db8:12::/48 Only leading zeros are omitted. Trailing zeros are not omitted 2001:0db8:0012::/48 = 2001:db8:12::/48 2001:db8: 1200 ::/48 ≠ 2001:db8:12::/48 . 15 IPv6 Address Representation Loopback address representation 0:0:0:0:0:0:0:1=> ::1 Same as 127.0.0.1 in IPv4 Identifies self Unspecified address representation 0:0:0:0:0:0:0:0=> :: Used as a placeholder when no address available (Initial DHCP request, Duplicate Address Detection DAD) . 16 IPv6—Addressing Model Addresses are assigned to interfaces Change from IPv4 mode: Interface “expected” to have multiple addresses Addresses have scope Link Local Unique Local Global Unique Local Link Local Global Addresses have lifetime Valid and preferred lifetime . 17 Addressing Some Special Addresses Type Binary Hex Aggregatable Global 001 2 or 3 Unicast Address Link Local Unicast 1111 1110 10 FE80::/10 Address FC00::/7 Unique Local Unicast 1111 1100 FC00::/8(registry) Address 1111 1101 FD00::/8 (no registry) Multicast Address 1111 1111 FF00::/8 . 18 Types of IPv6 Addresses Unicast Address of a single interface. One-to-one delivery to single interface Multicast Address of a set of interfaces. One-to-many delivery to all interfaces in the set Anycast Address of a set of interfaces. One-to-one-of-many delivery to a single interface in the set that is closest No more broadcast addresses . 19 Global Unicast Addresses Provider Site Host 3 45 Bits 16 Bits 64 Bits Global Routing Prefix SLA Interface ID 001 (2) 011 (3) Global Unicast Addresses Are: Addresses for generic use of IPv6 Structured as a hierarchy to keep the aggregation . 20 Unique-Local 128 Bits Global ID 40 Bits Interface ID 1111 110 Subnet ID FC00::/7 16 Bits 7 Bits Unique-Local Addresses Used for: Local communications Inter-site VPNs Not routable on the Internet . 21 Link-Local 128 Bits Remaining 54 Bits Interface ID 1111 1110 10 FE80::/10 10 Bits Link-Local Addresses Used for: Mandatory Address for Communication between two IPv6 device (like ARP but at Layer 3) Automatically assigned by Router as soon as IPv6 is enabled Also used for Next-Hop calculation in Routing Protocols Only Link Specific scope Remaining 54 bits could be Zero or any manual configured value . 22 IPv6 Multicast Address IP multicast address has a prefix FF00::/8 (1111 1111); the second octet defines the lifetime and scope of the multicast address 8-bit 4-bit 4-bit 112-bit 1111 1111 Lifetime Scope Group-ID Lifetime Scope 1 0 If Permanent Node 2 Link 1 If Temporary 5 Site 8 Organization E Global . 23 Some Well Known Multicast Addresses Address Scope Meaning FF0 1:: 1 Node-Local All Nodes FF0 2:: 1 Link-Local All Nodes FF0 1:: 2 Node-Local All Routers FF0 2:: 2 Link-Local All Routers FF0 5:: 2 Site-Local All Routers FF0 2:: 1:FFXX:XXXX Link-Local Solicited-Node Note that 02 means that this is a permanent address and has link scope More details at http://www.iana.org/assignments/ipv6-multicast- addresses . 24 Multicast Mapping over Ethernet IPv6 Multicast FF02 0000 0000 0000 0000 0001 FF17 FC0F Address Corresponding 33 33 FF 17 FC 0F Ethernet Address Multicast Prefix for Ethernet Multicast Mapping of IPv6 multicast address to Ethernet address is: 33:33:<last 32 bits of the IPv6 multicast address> . 25 Solicited-Node Multicast Address For each unicast and anycast address configured there is a corresponding solicited-node multicast This is specially used for two purpose, for the replacement of ARP, and DAD Used in neighbor solicitation messages Multicast address with a link-local scope Solicited-node multicast consists of prefix + lower 24 bits from unicast, FF02::1:FF: . 26 Anycast Anycast Address Assignment Anycast allows a source node to transmit IP datagrams to a single destination node out of a group destination nodes with same subnet id based on the routing metrics Only routers should respond to anycast addresses Routers along the path to the destination just process the packets based on network prefix Routers configured to respond to anycast packets will do so when they receive a packet send to the anycast address . 27 Anycast Address Subnet Router Anycast Address (RFC 4291) 128 bits n bits (128-n) bits Prefix 00000 Reserved Subnet Anycast Address (RFC 2526) 128 bits Prefix 111111 X111111… 111 Syntactical the same Anycast ID as a Unicast address 0 If EUI-64 Format X = Is one-to-nearest 1 If Non-EUI-64 Format 7 bits type of address Has a current limited use Use Example: Mobile IPv6 Home-Agent Anycast Address . 28 IPv6 Prefix Allocation Hierarchy and Policy Example IANA 2001::/3 AfriNIC APNIC ARIN LACNIC RIPE NCC ::/12 to::/23 ::/12 to::/23 ::/12 to::/23 ::/12 to::/23 ::/12 to::/23 ISP ISP ISP ISP ISP ISP ISP ISP ISP ISP ISP /32 ISP /32 ISP /32 ISP /32 ISP /32 /32 /32 /32 /32 /32 /32 /32 /32 /32 /32 Site Site Site Site Site Site Site Site Site Site Site /48 Site /48 Site /48 Site /48 Site /48 /48 /48 /48 /48 /48 /48 /48 /48 /48 /48 . 29 IPv6 Address Allocation Process Partition of Allocated IPv6 Address Space .
Recommended publications
  • SIP Software for Avaya 1200 Series IP Deskphones-Administration

    SIP Software for Avaya 1200 Series IP Deskphones-Administration

    SIP Software for Avaya 1200 Series IP Deskphones-Administration Release 4.4 NN43170-601 Issue 06.05 Standard July 2015 © 2015 Avaya Inc. list of Heritage Nortel Products located at http://support.avaya.com/ All Rights Reserved. LicenseInfo under the link “Heritage Nortel Products” or such successor site as designated by Avaya. For Heritage Nortel Notice Software, Avaya grants You a license to use Heritage Nortel While reasonable efforts have been made to ensure that the Software provided hereunder solely to the extent of the authorized information in this document is complete and accurate at the time of activation or authorized usage level, solely for the purpose specified printing, Avaya assumes no liability for any errors. Avaya reserves in the Documentation, and solely as embedded in, for execution on, the right to make changes and corrections to the information in this or for communication with Avaya equipment. Charges for Heritage document without the obligation to notify any person or organization Nortel Software may be based on extent of activation or use of such changes. authorized as specified in an order or invoice. Documentation disclaimer Copyright “Documentation” means information published by Avaya in varying Except where expressly stated otherwise, no use should be made of mediums which may include product information, operating materials on this site, the Documentation, Software, Hosted Service, instructions and performance specifications that Avaya may generally or hardware provided by Avaya. All content on this site, the make available to users of its products and Hosted Services. documentation, Hosted Service, and the product provided by Avaya Documentation does not include marketing materials.
  • Empirical Analysis of the Effects and the Mitigation of Ipv4 Address Exhaustion

    Empirical Analysis of the Effects and the Mitigation of Ipv4 Address Exhaustion

    TECHNISCHE UNIVERSITÄT BERLIN FAKULTÄT FÜR ELEKTROTECHNIK UND INFORMATIK LEHRSTUHL FÜR INTELLIGENTE NETZE UND MANAGEMENT VERTEILTER SYSTEME Empirical Analysis of the Effects and the Mitigation of IPv4 Address Exhaustion vorgelegt von M.Sc. Philipp Richter geboren in Berlin von der Fakultät IV – Elektrotechnik und Informatik der Technischen Universität Berlin zur Erlangung des akademischen Grades DOKTOR DER NATURWISSENSCHAFTEN -DR. RER. NAT.- genehmigte Dissertation Promotionsausschuss: Vorsitzender: Prof. Dr.-Ing. Sebastian Möller, Technische Universität Berlin Gutachterin: Prof. Anja Feldmann, Ph.D., Technische Universität Berlin Gutachter: Prof. Vern Paxson, Ph.D., University of California, Berkeley Gutachter: Prof. Steve Uhlig, Ph.D., Queen Mary University of London Tag der wissenschaftlichen Aussprache: 2. August 2017 Berlin 2017 Abstract IP addresses are essential resources for communication over the Internet. In IP version 4, an address is represented by 32 bits in the IPv4 header; hence there is a finite pool of roughly 4B addresses available. The Internet now faces a fundamental resource scarcity problem: The exhaustion of the available IPv4 address space. In 2011, the Internet Assigned Numbers Authority (IANA) depleted its pool of available IPv4 addresses. IPv4 scarcity is now reality. In the subsequent years, IPv4 address scarcity has started to put substantial economic pressure on the networks that form the Internet. The pools of available IPv4 addresses are mostly depleted and today network operators have to find new ways to satisfy their ongoing demand for IPv4 addresses. Mitigating IPv4 scarcity is not optional, but mandatory: Networks facing address shortage have to take action in order to be able to accommodate additional subscribers and customers. Thus, if not confronted, IPv4 scarcity has the potential to hinder further growth of the Internet.
  • Using PANA for Mobile Ipv6 Bootstrapping Julien Bournelle, Jean-Michel Combes, Maryline Laurent, Sondes Larafa

    Using PANA for Mobile Ipv6 Bootstrapping Julien Bournelle, Jean-Michel Combes, Maryline Laurent, Sondes Larafa

    Using PANA for mobile IPv6 bootstrapping Julien Bournelle, Jean-Michel Combes, Maryline Laurent, Sondes Larafa To cite this version: Julien Bournelle, Jean-Michel Combes, Maryline Laurent, Sondes Larafa. Using PANA for mobile IPv6 bootstrapping. NETWORKING 2007 : 6th international IFIP-TC6 networking conference on ad hoc and sensor networks, wireless networks, next generation Internet, May 2007, Atlanta, United States. pp.345 - 355, 10.1007/978-3-540-72606-7_30. hal-01328113 HAL Id: hal-01328113 https://hal.archives-ouvertes.fr/hal-01328113 Submitted on 7 Jun 2016 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Using PANA for Mobile IPv6 Bootstrapping Julien Bournelle1, Jean-Michel Combes2, Maryline Laurent-Maknavicius1, Sondes Larafa1 1 GET/INT, 9 rue Charles Fourier, 91011 Evry, France 2 France Telecom R&D, 38/40 rue du General Leclerc, 92784 Issy-Les-Moulineaux, France Abstract One of the current challenge of the Mo- 2 Mobile IPv6 Overview bile IPv6 Working Group at the IETF is to dynami- As it stands in [1], an IPv6 Mobile Node (MN) is cally assign to a Mobile Node its Home Agent, Home uniquely identi¯ed by its Home Address (HoA), and Address and to setup necessary security associations.
  • Spirent AION

    Spirent AION

    DATASHEET Spirent AION Spirent TestCenter Broadband Access Standard and Advanced Bundles, Carrier • Enhanced Realism—Spirent Ethernet Bundle TestCenter Access test solution Overview emulates real world broadband subscriber behaviors, Triple Play Spirent AION is a flexible delivery platform that enables users to achieve improved services, and failure scenarios deployment and provisioning for all their cloud and network testing needs. It is designed to deliver ultimate flexibility in how Spirent TestCenter platforms are • Improved Testing Capacity— purchased and utilized. accomplish more in less lab space The extended platform combines a wealth of industry-leading test solutions with a with the highest number of emulated flexible licensing architecture to support a wide range of next-generation solution- subscribers and user planes per port based domain applications. and port density AION offers a centralized management hub to help leverage software and hardware • Reduced Test Time—set up tests functionalities across all lab users and locations for a simplified management and quickly and easily to validate decision-making process: system performance in realistic, unstable environments rather than • Flexible purchasing options available via subscription, consumption-based, and perpetual plans, with the ability to license different bandwidth, scale, and protocol bundles. an environment optimized for pure performance • Flexible deployment options offered include cloud-delivery, on-prem, and laptop-hosted licensing services. • Detailed Analysis—Data
  • Ipv6 AAAA DNS Whitelisting a BROADBAND INTERNET TECHNICAL ADVISORY GROUP TECHNICAL WORKING GROUP REPORT

    Ipv6 AAAA DNS Whitelisting a BROADBAND INTERNET TECHNICAL ADVISORY GROUP TECHNICAL WORKING GROUP REPORT

    IPv6 AAAA DNS Whitelisting A BROADBAND INTERNET TECHNICAL ADVISORY GROUP TECHNICAL WORKING GROUP REPORT A Near-Uniform Agreement Report (100% Consensus Achieved) Issued: September 2011 Copyright / Legal NotiCe Copyright © Broadband Internet Technical Advisory Group, Inc. 2011. All rights reserved. This document may be reproduced and distributed to others so long as such reproduction or distribution complies with Broadband Internet Technical Advisory Group, Inc.’s Intellectual Property Rights Policy, available at www.bitag.org, and any such reproduction contains the above copyright notice and the other notices contained in this section. This document may not be modified in any way without the express written consent of the Broadband Internet Technical Advisory Group, Inc. This document and the information contained herein is provided on an “AS IS” basis and BITAG AND THE CONTRIBUTORS TO THIS REPORT MAKE NO (AND HEREBY EXPRESSLY DISCLAIM ANY) WARRANTIES (EXPRESS, IMPLIED OR OTHERWISE), INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, FITNESS FOR A PARTICULAR PURPOSE, OR TITLE, RELATED TO THIS REPORT, AND THE ENTIRE RISK OF RELYING UPON THIS REPORT OR IMPLEMENTING OR USING THE TECHNOLOGY DESCRIBED IN THIS REPORT IS ASSUMED BY THE USER OR IMPLEMENTER. The information contained in this Report was made available from contributions from various sources, including members of Broadband Internet Technical Advisory Group, Inc.’s Technical Working Group and others. Broadband Internet Technical Advisory Group, Inc. takes no position regarding the validity or scope of any intellectual property rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this Report or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights.
  • LANCOM Datasheet

    LANCOM Datasheet

    LANCOM Operating System (LCOS) 10.40 Top performance and efficiency for your SD-WAN A Next-generation SD-WAN – LANCOM High Scalability VPN (HSVPN) greatly improves efficiency as it requires fewer VPN tunnels A A fresh look & feel – WEBconfig has been completely redesigned for an intuitive and modern appearance A Multicast routing – new possibilities with multimedia applications in LANCOM infrastructures DATASHEET LANCOM Operating System General Feature Overview Firewall IPv4/IPv6 Stateful inspection, IP packet filter with port ranges, object-oriented rule definition. IPv4 Masking (NAT/PAT) of TCP, UDP, ICMP, FTP, PPTP, H.323, Net-Meeting, IRC and IPSec; DNS forwarding. Extended port forwarding and N:N mapping. Support for up to 256 contexts with individual IP networks, VLANs and interfaces, bandwidth management, QoS and VLAN prioritization for VoIP and VoWLAN Operating modes LAN protocols ARP, Proxy ARP, IPv4, ICMP, UDP, TCP, TFTP, RIP-1, RIP-2, DHCP, DNS, SNMP, HTTP, HTTPS, SSH, Telnet and SIP, BOOTP, NTP/SNTP, NetBIOS, RADIUS, TACAS+, LANCAPI, VRRP, STP/RSTP, IGMP, IPv6, DHCPv6, SLAAC, MLD, NDP, ICMPv6 WAN protocols (Ethernet) PPPoE, PPTP (PAC or PNS) and Plain Ethernet (with and without DHCP), RIP-1, RIP-2, IPv6CP, 6to4 Tunnel, 6in4 Tunnel, 6rd Tunnel, DHCPv6, SLAAC, L2TPv3 for Ethernet Pseudowires Multiprotocol router IPv4/IPv6 router, NAT/Reverse NAT (IP- masquerading), DHCPv4/DHCPv6 server, DHCPv4/DHCPv6 client, DHCPv4/DHCPv6 relay server, DNS server, PPPoE client / Multi-PPPoE, ML-PPP, PPTP (PAC and PNS), NetBIOS proxy, DynDNS client,
  • Technical Security Guideline on Deploying Ipv6

    Technical Security Guideline on Deploying Ipv6

    Draft Recommendation ITU-T X.1037 (X.ipv6-secguide) Technical security guideline on deploying IPv6 Summary The Internet protocol version 6 (IPv6) is intended to provide many built-in benefits such as large address space, mobility, and quality of service (QoS), because it is a new protocol and operates in some different ways than Internet protocol version 4 (IPv4), both foreseeable and unforeseeable security issues will arise. Many new functions or requirements of IPv6, i.e., automatic configuration of interfaces, mandatory Internet protocol security (IPSec), mandatory multicast, multiple Internet protocol (IP) addresses and many new rules for routing, can be abused for compromising computer systems or networks. Considering the above circumstances, Recommendation ITU-T X.1037 provides a set of technical security guides for telecommunication organizations to implement and deploy IPv6 environment. The content of this Recommendation focuses on how to securely deploy network facilities for telecommunication organizations and how to ensure security operations for the IPv6 environment. Keywords ???? - 2 - CONTENTS 1 Scope ............................................................................................................................. 3 2 References ..................................................................................................................... 3 3 Definitions .................................................................................................................... 4 3.1 Terms defined elsewhere ...............................................................................
  • Ipv6 – What Is It, Why Is It Important, and Who Is in Charge? … Answers to Common Questions from Policy Makers, Executives and Other Non­Technical Readers

    Ipv6 – What Is It, Why Is It Important, and Who Is in Charge? … Answers to Common Questions from Policy Makers, Executives and Other Non­Technical Readers

    IPv6 – What is it, why is it important, and who is in charge? … answers to common questions from policy makers, executives and other non­technical readers. A factual paper prepared for and endorsed by the Chief Executive Officers of ICANN and all the Regional Internet Registries, October 2009. 1. What is IPv6? “IP” is the Internet Protocol, the set of digital communication codes which underlies the Internet infrastructure. IP allows the flow of packets of data between any pair of points on the network, providing the basic service upon which the entire Internet is built. Without IP, the Internet as we know it would not exist. Currently the Internet makes use of IP version 4, or IPv4, which is now reaching the limits of its capacity to address additional devices. IPv6 is the “next generation” of IP, which provides a vastly expanded address space. Using IPv6, the Internet will be able to grow to millions of times its current size, in terms of the numbers of people, devices and objects connected to it1. 2. Just how big is IPv6? To answer this question, we must compare the IPv6 address architecture with that of IPv4. The IPv4 address has 32 bits, allowing today’s Internet to connect up to around four billion devices. By contrast, IPv6 has an address of 128 bits. Because each additional bit doubles the size of the address space, an extra 96 bits increases the theoretical size of the address space by many trillions of times. For comparison, if IPv4 were represented as a golf ball, then IPv6 would be approaching the size of the Sun.2 IPv6 is certainly not infinite, but it is not going to run out any time soon.
  • Guidelines for the Secure Deployment of Ipv6

    Guidelines for the Secure Deployment of Ipv6

    Special Publication 800-119 Guidelines for the Secure Deployment of IPv6 Recommendations of the National Institute of Standards and Technology Sheila Frankel Richard Graveman John Pearce Mark Rooks NIST Special Publication 800-119 Guidelines for the Secure Deployment of IPv6 Recommendations of the National Institute of Standards and Technology Sheila Frankel Richard Graveman John Pearce Mark Rooks C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 December 2010 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Dr. Patrick D. Gallagher, Director GUIDELINES FOR THE SECURE DEPLOYMENT OF IPV6 Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-119 Natl. Inst. Stand. Technol. Spec. Publ. 800-119, 188 pages (Dec. 2010) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.
  • DOD Memorandum: Department of Defense Implementation of Internet

    DOD Memorandum: Department of Defense Implementation of Internet

    DEPUTY SECRETARY OF DEFENSE 1010 DEFENSE PENTAGON WASHINGTON DC 20301-1010 June 29, 2021 MEMORANDUM FOR SENIOR PENTAGON LEADERSHIP DEFENSE AGENCY AND DOD FIELD ACTIVITY DIRECTORS SUBJECT: Directive-type Memorandum 21-004 – “Department of Defense Implementation of Internet Protocol Version 6” References: See Attachment 1 Purpose. Pursuant to the Federal requirements in Office of Management and Budget (OMB) Memorandum M-21-07, this directive-type memorandum (DTM): • Establishes policy, assigns responsibilities, and prescribes procedures for deploying and using Internet Protocol version 6 (IPv6) in DoD information systems. • Is effective June 29, 2021; it will be converted to a new DoD instruction. This DTM will expire effective 12 months from the date issuance is published on the DoD Issuances Website, June 29, 2022. Applicability. This DTM: • Applies to OSD, the Military Departments (including the Coast Guard at all times, including when it is a Service in the Department of Homeland Security by agreement with that Department), the Office of the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of Inspector General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational entities within DoD (referred to collectively in this issuance as the “DoD Components”). • Does not apply to National Security Systems, as defined by Committee on National Security Systems Instruction 4009. Definitions. See Glossary. Policy. Pursuant to OMB Memorandum M-21-07, all new networked DoD information systems that use internet protocol (IP) technologies will be IPv6-enabled before implementation and operational use by the end of fiscal year (FY) 2023.
  • Ipv4 and Ipv6 Subnetting Demo

    Ipv4 and Ipv6 Subnetting Demo

    IPv4 and IPv6 Subnetting Demo Instructor: Networks rely on the use of IP addresses to allow devices to communicate with each other. These addresses are often obtained as a single large block and are given to the organizations that require them. However, a single block of addresses rarely meets the needs of a network and it needs to be segmented in order to better accommodate the network. An IP address is made up of two parts, the address itself and the subnet mask. The subnet mask helps us determine which part of the address defines the network and which part defines the specific host in the network. This is done by comparing the binary bits of the subnet mask to the address itself. Where there is a one in the subnet mask, we are looking at the network portion of the address; where there is a zero, we are looking at the host portion, or the identifier of the specific machine. The subnet can be represented in "CIDR" notation which includes a slash followed by the number of ones, or network bits, in the subnet. So the subnet mask 255.255.255.0 could be shortened to /24 because there are 24 binary ones. Subnets are an effective way to segment a single large network into a Page 1 of 4 group of smaller ones. In IPv4, this concept is fairly simple. A network will be assigned an address block, let's say 192.168.1.0/24. Then, we determine the amount of subnets we need and how many hosts we need in each subnet.
  • Ipv6 Cheat Sheet

    Ipv6 Cheat Sheet

    Internet Protocol Version 6 (IPv6) Basics Cheat Sheet IPv6 Addresses by Jens Roesen /64 – lan segment, 18,446,744,073,709,551,616 v6 IPs IPv6 quick facts /48 – subscriber site, 65536 /64 lan segments successor of IPv4 • 128-bit long addresses • that's 296 times the IPv4 address space • that's 2128 or 3.4x1038 or over 340 /32 – minimum allocation size, 65536 /48 subscriber sites, allocated to ISPs undecillion IPs overall • customer usually gets a /64 subnet, which yields 4 billion times the Ipv4 address space • no need for network address translation (NAT) any more • no broadcasts any more • no ARP • stateless address 2001:0db8:0f61:a1ff:0000:0000:0000:0080 configuration without DHCP • improved multicast • easy IP renumbering • minimum MTU size 1280 • mobile IPv6 • global routing prefix subnet ID interface ID mandatory IPsec support • fixed IPv6 header size of 40 bytes • extension headers • jumbograms up to 4 GiB subnet prefix /64 IPv6 & ICMPv6 Headers IPv6 addresses are written in hexadecimal and divided into eight pairs of two byte blocks, each containing four hex IPv6 header digits. Addresses can be shortened by skipping leading zeros in each block. This would shorten our example address to 0 8 16 24 32 2001:db8:f61:a1ff:0:0:0:80. Additionally, once per IPv6 IP, we can replace consecutive blocks of zeros with a version traffic class flow label double colon: 2001:db8:f61:a1ff::80. The 64-bit interface ID can/should be in modified EUI-64 format. A MAC 00 03 ba 24 a9 6c payload length next header hop limit 48-bit MAC can be transformed to an 64-bit interface ID by inverting the 7th (universal) bit and inserting a ff and fe byte after rd source IPv6 address the 3 byte.