ondrej-caletka-INEX-Deploying_IPv6_mostly.pdf
0 likes24 views
The document discusses the transition from IPv4 to IPv6, highlighting the challenges associated with IPv4 scarcity and the deployment of dual-stack and NAT64 mechanisms to facilitate connectivity. It outlines the advantages and disadvantages of adopting IPv6-only networks, particularly concerning various devices and operating systems, while emphasizing the importance of evolving network configurations, such as DHCP options. Additionally, the document mentions the current state of support for IPv6 features across different platforms and suggests scenarios to consider for transitioning to IPv6-mostly networks.
ondrej-caletka-INEX-Deploying_IPv6_mostly.pdf
- 1. IPv6-only and dual stack in one network Deploying IPv6-mostly access networks OndΕej Caletka | 12 December 2024 | INEX Member Meeting
- 2. OndΕej Caletka | INEX Member Meeting | 12 December 2024 The endless transition to IPv6 β’ IPv6 is slowly being deployed β’ IPv4 is still the protocol of the Internet β’ There are simply not enough IPv4 addresses - repurposing 240/4, 127/8 or 0/8 will not help β’ There are many transition mechanisms, two of which are special: - Dual stack: Running both protocols at the same time - NAT64: Allowing limited access from unmodified IPv6-only hosts to IPv4 resources 2
- 3. OndΕej Caletka | INEX Member Meeting | 12 December 2024 The best transition mechanism β’ IPv4-only and IPv6-only resources directly accessible β’ IPv6 preferred for dual-stack resources β’ Problems with IPv6 masked by Happy Eyeballs algorithm β’ But it does not address IPv4 scarcity 3 Dual Stack IPv6 IPv4
- 4. OndΕej Caletka | INEX Member Meeting | 12 December 2024 NAT64 allows IPv6-only networks β’ IPv6 accessible natively β’ IPv4 is translated into part of IPv6 address space β’ Together with DNS64, everything seems to be accessible over IPv6 β’ But sometimes you run intoβ¦ - IPv4 literals - Legacy software opening IPv4-only sockets - Dual-stack servers with broken IPv6 4 IPv6 Internet NAT64 Box IPv4 Internet DNS64 IPv6-only
- 5. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Mobiles are ready β’ Apple forces all iOS apps to work well on IPv6-only networks with NAT64 β’ There is Happy Eyeballs 2.0 for IPv4 literals or broken IPv6 on dual stack servers β’ Finally CLAT is used for tethering to a computer β’ Android uses just CLAT (464XLAT) - so IPv4 is accessible via two translations 5 IPv6 Internet NAT64 Box IPv4 Internet DNS64 IPv6-only CLAT
- 6. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Desktops suffer on IPv6-only β’ No Happy Eyeballs 2.0 implementation outside Apple - and even on Apple, only high-level APIs support it (eg. Safari, not Firefox) - Chrome has βUse NAT64 translation for IPv4 literalsβ feature β’ No CLAT in Windows, Linux or ChromeOS β’ Well known small problems: - Legacy applications using IPv4-only sockets - IPv4 literals do not work (except Chrome) - Dual-stack servers where IPv6 is broken do not work - Legacy Happy Eyeballs doesnβt help since there's no IPv4 to fall back to - Most corporate VPNs do not work (often just a configuration issue) 6
- 7. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Can my device work on IPv6-only? β’ CLAT is present* β’ Some mobile networks run billions of IPv6-only phones for years already 7 Fully Android iOS macOS Mostly No way! Windows Linux Smart home IoT β’ No CLAT* β’ Applications relying on IPv4 are broken β’ No IPv6 support* β’ Native IPv4 required *) some statements are simpli fi ed
- 8. Can we do IPv6-only? At least for a subset of devices?
- 9. OndΕej Caletka | INEX Member Meeting | 12 December 2024 IPv6-only Preferred option of DHCP 9 DHCP CLIENT DHCP SERVER DISCOVER Parameters requested: GW, DNS, β¦, 108 OFFER IPv4, netmask, GW, DNS, β¦ REQUEST IPv4, netmask, GW, DNS, β¦ ACK Option 108 is ignored by the DHCP server DHCP client is willing to run IPv6-only (RFC 8925)
- 10. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Using DHCP to turn IPv4 off 10 DHCP CLIENT DHCP SERVER DISCOVER Parameters requested: GW, DNS, β¦, 108 OFFER IPv4, netmask, GW, DNS, β¦, 108: 30 minutes DHCP client aborts the transaction and waits 30 minutes DHCP server is con fi gured to prefer IPv6-only operation (RFC 8925)
- 11. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Is DHCP option 108 already deployed? 11 Devices are ready, networks are lagging behind. You bet! Option 108 is requested by recent: 21% 79% Requesting Option 108 Not requesting Unique MAC addresses measured during RIPE 89 Android iOS macOS
- 12. OndΕej Caletka | INEX Member Meeting | 12 December 2024 PREF64 RA Option β’ A Router Advertisement option carrying NAT64 prefix β’ Needed for CLAT configuration, local DNS64 or Happy Eyeballs 2.0 (dealing with IPv4 literals) β’ Shares fate with other configuration parameters - can be trusted a bit more than DNS64 β’ Supported by recent Android, iOS and macOS 12 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length | Scaled Lifetime | PLC | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | + + | Highest 96 bits of the Prefix | + + | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
- 14. OndΕej Caletka | INEX Member Meeting | 12 December 2024 DHCP option 108 is easy β’ Native support in the latest Kea β’ Most DHCP servers support defining custom options - for instance: dnsmasq -O 108,0:0:1:2c - the option value represents duration for which the IPv4 stack should be disabled β’ No special processing on the DHCP server side is required β’ But there have to be free addresses in the IPv4 address pool - Otherwise the DHCP server will not respond 14
- 15. OndΕej Caletka | INEX Member Meeting | 12 December 2024 PREF64 RA option is harder β’ No custom RA option support in routers - We already had this issue with Recursive DNS Server option, now we have it again - Router vendors should really implement custom options similar to DHCP β’ Adoption is slowly increasing: - radvd (merged but unreleased) - odhcpd (used in OpenWRT) - rad (part of OpenBSD) - MikroTik RouterOS v7.8 beta2 - BIRD 2.14 (as a part of custom router advertisement option) 15
- 16. Summary
- 17. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Pros β’ Only one network to join β’ No waste of IPv4 addresses for every single device - Cool if you don't use NAT β’ Lower reliance on DHCP 17 β’ Deployment is still dual-stack β’ NAT64 is needed β’ Problematic interoperability between dual-stack and IPv6- only hosts within the network - Setting up a Chromecast from an Android phone is impossible Cons
- 18. OndΕej Caletka | INEX Member Meeting | 12 December 2024 When to consider IPv6-mostly β’ You don't use NAT and your DHCP pool is filling up β’ You do use NAT but are running out of private addresses β’ There are mostly mobile or Apple devices in your network β’ You already have NAT64 in place and want to gradually undeploy IPv4 18 An RFC draft is being written: draft-ietf-v6ops-6mops-00
- 19. OndΕej Caletka | INEX Member Meeting | 12 December 2024 Phased IPv6 transition 19 IPv4 IPv6 IPv4 IPv6 IPv6 IPv4 NAT64 IPv6 IPv4 NAT64
- 20. OndΕej Caletka | INEX Member Meeting | 12 December 2024 IPv6-only support on other platforms β’ Windows 11 pledged to implement CLAT and DHCP Option 108 β’ Linux has some support for DHCP Option 108 - NetworkManager - systemd-networkd - dhcpcd β’ Proper CLAT for Linux is still missing - Not supported by the kernel itself - eBPF might be the way forward 20