aarnet Australia's Academic and Research Network IPv6 network day 1. Agenda The previous two days training have investigated the IPv6 protocol and its configuration on Cisco Systems© IOS. Today this knowledge is put to use to construct a test network. 2. Test network 2.1 Topology The test network is a sample university network. ISP Border Firewall Core Switch Figure 1. Sample university network. To save time we will not configure a firewall, but will configure the network as if an OSPFv3-speaking firewall is in place. 2.2 Addressing Each sample university is allocated an address range. From that you must develop an addressing plan which includes: 2.2.1 Host subnet addresses These will be EUI-64 subnets. In a real network these addresses would be allocated in blocks which can be aggregated at each site edge. Our sample network is too small for this. 2.2.2 Link addresses for router-router links These will be /64 subnets. ::1 is used for the upstream, ::2 for the downstream. Router addresses are often replicated throughout router Ð 1 Ð configurations, so using a /64 is more maintainable than the dynamic interface addresses of EUI-64. 2.2.3 Control and administrative addresses for routers Most networking equipment assigns the router an interface in the control plane. Cisco IOS typically uses ªLoopback0º. This is a /128 address. Some routers treat higher addresses as administrative domain addresses by default, so reserve the highest /64 for loopback addresses. The DNS entry for control plane addresses usually contains the name of the router. A typical naming scheme is function-count- location.net.example.edu.au, although variations are plentiful. Unfortunately some monitoring systems only record the left-hand-side of the device name, leading to all the necessary information needing to be packing into that part of the name. Some routers distinguish control plane addresses from administrative plane addresses. For example, JunOS has ªlo0º in the control plane and ªfxp0º in the administrative plane. Most administrative plane networks are unrouted. Depending upon your security stance this network may use private addresses or use a /64 with a gateway controlling access from the routed network. 2.3 Addresses available Address prefix Preliminary allocation 2001:388:3004::/48 University of Queensland 2001:388:3008::/48 CSIRO, Qld 2001:388:300C::/48 Queensland University of Technology 2001:388:3010::/48 University of Southern Queensland 2001:388:3014::/48 QMI 2001:388:3018::/48 Griffith University 2001:388:301C::/48 Central Queensland University 2001:388:3020::/48 Southern Cross University 2001:388:3024::/48 James Cook University 2001:388:3028::/48 Australian Catholic University, Qld For the exercise we will need some temporary AS number allocations which do not duplicate any used in production networks. These AS numbers should not be used outside of this day. Ð 2 Ð Address allocation AS number for exercise 2001:388:3004::/48 64750 2001:388:3008::/48 64751 2001:388:300C::/48 64752 2001:388:3010::/48 64753 2001:388:3014::/48 64754 2001:388:3018::/48 64755 2001:388:301C::/48 64756 2001:388:3020::/48 64757 2001:388:3024::/48 64758 2001:388:3028::/48 64759 Exercise 1 Each group will pretend to be one of the above institutions and develop an IPv6 addressing plan. 3. Configure a host network 3.1 Activate IPv6 On routers, unlike hosts, IPv6 support is not usually activated by default. ipv6 unicast routing ipv6 cef ipv6 multicast-routing 3.2 Configure control plane address interface Null0 no ip unreachables interface Loopback0 description core-1-riverside.net.example.edu.au ip address 1.2.3.1 255.255.255.255 ipv6 enable ipv6 address 2001:388:302b:ffff::1/128 no ip redirects no ipv6 redirects no ip proxy-arp ip rsvp bandwidth no cdp enable service-policy input LOOPBACK0-IN-POLICY service-policy output LOOPBACK0-OUT-POLICY ip access-group LOOPBACK0-IN-LIST4 in ip access-group LOOPBACK0-OUT-LIST4 out ipv6 access-group LOOPBACK0-IN-LIST6 in Ð 3 Ð ipv6 access-group LOOPBACK0-OUT-LIST6 out ip sap listen ip pim sparse-mode ipv6 ospf 64000 area 0 ip ftp source-interface Loopback0 ip telnet source-interface Loopback0 ip tftp source-interface Loopback0 ip flow-export source Loopback0 logging source-interface Loopback0 snmp-server trap-source Loopback0 ntp source Loopback0 3.3 EUI-64 EUI-64 interfaces are used on host-facing subnets. interface GigabitEthernet0 description gig0.core-1-riverside.net.example.edu.au ipv6 enable ipv6 address 2001:388:1:201E::/64 eui-64 ipv6 verify unicast source reachable-via rx ipv6 access-group GIG0-IN-LIST6 in ipv6 access-group GIG0-OUT-LIST6 out ip access-group GIG0-IN-LIST4 in ip access-group GIG0-OUT-LIST4 out service-policy input GIG0-IN-POLICY service-policy output GIG0-OUT-POLICY ip flow ingress no ip proxy-arp ip pim sparse-mode ip igmp version 3 ip igmp query-interval 125 ip verify unicast source reachable-via rx no cdp enable ip rsvp bandwidth mpls traffic-eng tunnels ip ospf authentication message-digest ip ospf message-digest-key 1 md5 asdfjhaxs ipv6 ospf 64000 area 1.2.3.0 ipv6 ospf priority 1 3.4 Explicit /64 Subnets with explicit addressing are used for links between routers. This allows interfaces to be replaced without altering the router configuration. interface GigabitEthernet1 ipv6 enable ipv6 address 2001:388:302b:fffc:1::1/64 Ð 4 Ð no ip proxy-arp no ip redirects no ipv6 redirects service-policy input GIG1-IN-POLICY service-policy output GIG1-OUT-POLICY ip pim sparse-mode ip igmp version 3 ip igmp query-interval 125 ip rsvp bandwidth mpls traffic-eng tunnels ip ospf authentication message-digest ip ospf message-digest-key 1 md5 asdfjhaxs ipv6 ospf 64000 area 0 3.5 Access lists IOS implicitly address implicitly adds this to the end of IPv6 access control lists permit icmp any any nd-na permit icmp any any nd-ns deny ipv6 any any Otherwise access lists work as you may expect. They use the most recent ACL syntax. ipv6 access-list VTY-LIST6 remark Administrative subnet permit ipv6 2001:388:1:2000::/64 any service tcp-keepalives-in service tcp-keepalives-out service nagle no service pad service linenumber line vty 0 4 location Network transport preferred none transport input ssh transport output ssh telnet access-class VTY-LIST4 in ipv6 access-class VTY-LIST6 in password sadkfjks Use access lists to limit packets passing through the forwarding and management planes. Use prefix lists to limit routes passing through the routing plane. Ð 5 Ð Exercise 2: Interfaces Configure Loopback, Gig0 and Gig1 interfaces. Gig0 is an upstream interface to another router. Gig1 is a host interface to a switch. Configure an access list. 4. Configure interior routing IPv4 and IPv6 can use differing routing protocols: operating as ªships in the nightº they do not exchange routing information. OSPFv3 is the recommended protocol: it is simpler than IS-IS to configure, but unlike RIP or EIGRP is complex enough for university-scale networks. 4.1 OSPF design pattern for IPv4 and IPv6 There are two types of subnets: those between routers, and those between routers and hosts. There are no subnets between routers and between hosts, as these mixed-purpose subnets cause difficulty with QoS admission, source address checking, and so on. Subnets between routers which interconnect sites go into the backbone area, area 0. Subnets between routers within a site go into that site©s stub area. Each site is configured as a stub area. Subnets with hosts go into the site©s stub area. At the edge between the stub area and the backbone the area©s IP addresses are aggregated. This limits visibility of flapping interfaces to the one site. The site©s stub area is named after the major aggregated IPv4 network at that site. Interfaces which face hosts are configured with OSPF as ªpassiveº; that is, not sending or receiving OSPF packets. This prevents hosts from injecting false routing information. Note that marking an interface passive still allows the interface©s network to be advertised out non-passive interfaces. The network core routers closest to the Internet links inject static routes which covers the address space allocation. Firewalls and other middleboxes on the path to the Internet link run OSPF. The border router to the Internet link uses the received OSPF route for the address space allocation to generate the BGP route to the ISP for the address space allocation. This design withdraws the BGP route if there is a failure in the border router, middleboxes or core router, thus allowing traffic to flow down any backup link. Ð 6 Ð The border router injects a OSPF default route, using the OSPF ªexternal networkº route type. These ªexternalº routes cannot be compared to ªinternalº routes, so all internal traffic will flow to the external default route, no matter what the internal metrics. This OSPF default route is withdrawn if there is a failure in the border router, middleboxes or core router, thus allowing traffic to flow towards any backup link. For planned maintenance, the BGP MED and the OSPF external route metric can be altered between the primary and backup router, which will swap the sense of primary and backup. On Cisco IOS some clever coding can make this a two-line change of the BGP import and export route-maps, making the router configuration change at the start of planned maintenance a low risk. 4.2 OSPF and IPv6 OSPFv2 uses fixed-length fields in an attempt to be more efficient than the competing protocol IS-IS which uses TLV fields.