BRKRST-3304.Pdf
Total Page:16
File Type:pdf, Size:1020Kb
#CLUS Hitchhikers Guide to Ipv6 Nicole Wajer – Chief Stroopwafel Officer BRKRST-3304 #CLUS Cisco Webex Teams Questions? Use Cisco Webex Teams (formerly Cisco Spark) to chat with the speaker after the session How 1 Find this session in the Cisco Events App 2 Click “Join the Discussion” 3 Install Webex Teams or go directly to the team space 4 Enter messages/questions in the team space Webex Teams will be moderated cs.co/ciscolivebot#BRKRST-3304 by the speaker until June 18, 2018. #CLUS © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 3 Nicole Nicole Wajer Technical Solutions Architect @vlinder_nl #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 4 “Space,” it says, “is big. Really big. You just won’t believe how vastly hugely mindboggingly big it is. I mean you may think it’s a long way down the road to the chemist, but that’s just peanuts to space. Listen …” and so on. The Hitchhiker's Guide to the Galaxy #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 5 This Session…. #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 6 This Session…. #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 7 Don’t Panic #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 8 Encyclopaedia Galactica • Easy to miss – Warm up your brain • Neighbor And Router Discovery • Addressing • IPv4 Coexistence And Transition • IPv6-centric Deployments #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 9 Easy-to-miss configuration knobs EIGRP IPv6 needs “no shutdown” ipv6 router eigrp 1 router-id 192.0.2.1 no shutdown #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 11 VRRPv3: default is VRRPv2 => no IPv6 support R1#conf t Enter configuration commands, one per line. End with CNTL/Z. R1(config)#int e0/1 R1(config-if)# ipv6 address 2001:DB8:CAFE::1/64 R1(config-if)#vrrp 101 ? authentication Authentication description Group specific description ip Enable Virtual Router Redundancy Protocol (VRRP) for IP preempt Enable preemption of lower priority Master priority Priority of this VRRP group shutdown Disable VRRP Configuration timers Set the VRRP timers track Event Tracking R1(config-if)#vrrp 101 #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 12 VRRPv3: enabling it + successful configuration fhrp version vrrp v3 interface Ethernet0/1 no ip address ipv6 address 2001:DB8:CAFE::1/64 vrrp 101 address-family ipv6 address FE80::1 primary exit-vrrp ! #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 13 Encyclopaedia Galactica • Easy to miss – Warm up your brain • Neighbor And Router Discovery • Addressing • IPv4 Coexistence And Transition • IPv6-centric Deployments #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 14 Neighbor Discovery: Solicited Node Multicatscast Solicited node multicast groups: FF02::1:FF00:0000 /104 FF02::1:FF FF02::1:FF 00:0001 00:0002 FF02::1:FFAA:AAAA FF02::1:FFBB:BBBB FF02::1:FFCC:CCCC 2001:db8::0000:0002 2001:db8::0000:0001 #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 15 Nexus7000 not passing IPv6 traffic http://tinyurl.com/mld-nexus7K • On M1, M2 and M3 modules, you must disable IGMP optimized multicast flooding (OMF) on all VLANs that require IPv6 multicast packet forwarding. • On F2 modules, you must disable IGMP optimized multicast flooding (OMF) on all VLANs that require IPv6 packet forwarding (unicast or multicast). IPv6 neighbor discovery only functions in a VLAN with the OMF feature disabled. no ip igmp snooping optimise-multicast-flood http://www.cisco.com/en/US/docs/switches/datacenter/sw/nx- os/multicast/configuration/guide/b_multicast_chapter_0100.html#concept_4401AA5D7477469E9208FCE766906395 #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 16 ACL Beware the ACL “tightening” ipv6 access-list ingress permit tcp host 2001:db8::1 eq 80 any deny ipv6 any any log permit icmp any any nd-ns implicit permit icmp any any nd-na deny ipv6 any any implicit #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 18 IPv6 ACL Implicit Rules • IPv6 ACLs configure like “extended named” • Matching, SRC, DST, next header • Applying the ACL uses ipv6 traffic-filter command • IPv6 ACLs have multiple implicit rules • Similar to deny ip any any ipv6 access-list IOS permit icmp any any nd-na • IOS has 3 implicit IPv6 ACL rules permit icmp any any nd-ns deny ipv6 any any • NXOS has 5 implicit IPv6 ACL rules ipv6 access-list NXOS • IOS-XE has no implicit IPv6 ACL rules permit icmp any any nd-na permit icmp any any nd-ns interface GigabitEthernet 0/2 permit icmp any any router-advertise ipv6 address 2001:db8:50:31::1/64 permit icmp any any router-solicitation ipv6 traffic-filter BLOCK-BAD in deny ipv6 any any #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 19 NIST guidelines for secure IPv6 deployment; RFC4890 http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf http://www.ietf.org/rfc/rfc4890.txt See BRKSEC-2003 #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 20 Ducks in a Row • Code paths of requests/replies may differ • Multicast and Unicast processing can differ • Neighbor Solicitation contains Link-Layer address • May populate the cache without explicit request • Beware of defaults #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 21 Neighbor Cache State Machine • Incomplete – Pending address resolution, NS message outstanding • Reachable – Recently used mapping, Can be refreshed by ULP • Stale – Not currently communicating, waiting for next queued packet • Delay –Using stale binding, awaiting (ULP) return traffic • Probe – Sending Unicast NS to node (after Delay timer, 3x1 sec) NS No Entry Incomplete NA time expired Reachable NA ULP send packet Stale Delay Probe #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 22 ReachableTime: How Long Is It ? • BASE_REACHABLE_TIME • Sent in RA or taken from default • Value in milliseconds • Random(0.5 .. 1.5) * BASE_REACHABLE_TIME BASE_REACHABLE_TIME • Chosen every few hours or when BASE… default: 30000 msec changes BASE_REACHABLE_TIME BASE_REACHABLE_TIME RANDOM (0.5x .. 1.5x) 0.5x 1.5x milliseconds ReachableTime #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 23 Neighbor Table Maintenance Active Standby #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 24 Neighbor Table Maintenance Can Burden The CPU Standby Newly active Active #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 25 DC ND Tuning TEST ! BASE_REAC • If FHRP is present or single gateway: increase reachable time HABLE_TIME ipv6 nd reachable-time 600000 ! 10 minutes • Pre-populate and maintain the neighbor table Expiry ipv6 nd cache expire 14400 refresh ipv6 nd na glean • Rate-limit the address resolution traffic Burst mls rate-limit unicast cef glean 1000 10 size • Start with this configuration and adjust depending on the site • Wrong values can impact the neighbor resolution times! PPS #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 26 IOS XR ND implementation details • New neighbor resolution: timeout 10 sec, not 3 sec. Total 3 retries • REACHABLE_TIME = 180000 ms (25% jitter), not 30000 ms (50% jitter) • DELAY is only 5 sec wait, no integration with TCP • Steady state probing (“PROBE”): • MAX_UNICAST_SOLICIT = 5, not 3 • timeout: 60 sec •RP/0/0/CPU0:ios(Configuration configto revert)#int behaviorgigabitEthernet to RFC0/1/0/0 values: RP/0/0/CPU0:ios(config-if)#ipv6 nd nud-conform RP/0/0/CPU0:ios(config-if)#commit #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 27 Ducks in a Row • ND has more states than ARP • Having “STALE” Neighbor Entry is ok! • Even in a connected Nespresso machine • Reachable interval is in milliseconds • Remember when adjusting • Adjust the Reachable timer up #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 28 Anatomy Of A Router Advertisement #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 29 Router Solicitations • Valid Options: Source link-layer address • The link-layer address of the sender, if known. MUST NOT be included if the Source Address is the unspecified address. Otherwise, it SHOULD be included on link layers that have addresses. #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 30 Router Solicitations and Neighbor Cache • If no Source Link Layer Address present • No effect • If Source Link Layer Address present • Installs/updates the entry and puts into “STALE” state • Consider for different ways of propagation of NS vs. RS • Host may get initial connectivity but not after clearing neighbor cache #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 31 Default ACLs and Router Solicitations • None of the platform contain “default permit” for Router Solicitations • Delay with obtaining addresses • Mostly an issue with dynamic clients • Servers are less volatile #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 32 Router Advertisements and Battery Life The model of measurements • Three levels: • Device – level behavior • Network-wide behavior • Traffic on the network • Power consumption ~ F(number of hosts on segment, network volatility) • Two main sources of multicast traffic • IPv6 Neighbor Discovery protocol • Service Advertisements • More information on the power consumption model from the author directly: • http://tools.ietf.org/html/draft-desmouceaux-ipv6-mcast-wifi-power-usage-01 • Disclaimer: use this model as a guidance/basis only, verify your network telemetry! #CLUS BRKRST-3304 © 2018 Cisco and/or its affiliates.