Adventures in Tech: Taking the plunge into IPv6
Our intrepid reporter does it, but you'll still have to
Ensure Ease of Recovery with Asigra’s Agentless Software
Part 1 The threat from the fast-dwindling supply of mainstream "IPv4" Internet addresses for new users is a bit like Y2K creeping up on us all over again. Almost no one can see beyond the cost of code review, systems change, hardware upgrades and general upheaval into the brave fairly-old world of IPv6 - but putting it off forever isn't really an option either. And like Y2K, if it's handled well, no one will ever notice or thank us "IT professionals" for it: we'll be accused of make-work, scare-mongering and overcharging. What's not to like?
Ultimately IPv6 will do away with the much of the annoyance of NATing, dynamic IP addresses, address rationing, etc, and should make for more efficient and cheaper communications. IPv6 support may soon be necessary to be reachable at all by some users.
IPv6 (or IPng: Next Generation) has been the future of the Internet for a decade and a half, so why the hesitation to get with the programme? It's probably a case of "if it ain't broken" and Y2K backlash, but the existing IPv4 address scheme is now broken and Y2K wasn't a figment of the imagination (I fixed a lot of finance-related bugs around then, trust me).
Anecdotally it seems relatively safe, for example, to implement dual-stack (ie with both IPv4 and IPv6 address) Web sites immediately. See the "heise online" IPv6 experience which was largely positive.
"The small number of flaws was so encouraging that heise online decided to adopt dual-stack for production use as soon as possible ... [users] do occasionally report problems. The majority of these continue to revolve around the flawed IPv6 implementations in Mac OS X, iOS and in the firmware of AirPort base stations. But the number of cases is far smaller than previously feared. Overall, heise online considers the switch a complete success, and would recommend it to any similar site."
8th June this year was "World IPv6 Day" http://www.worldipv6day.org/faq/ which was a global test of the new world order. It mainly worked, and almost no one noticed. In particular, bringing up IPv6 support didn't in practice hurt IPv4 users much or at all.
And just failing to plan for IPv6 at all doesn't just lose traffic and potential customers. It may also undermine your security too. You'd better plan those IPv6 security policies, keep an eye on rogue 6-in-4 tunnels (failing to upgrade your external links doesn't necessarily stop IPv6 getting in and out), and work to minimise the attack surface of already-IPv6-capable services and applications in house.
Netalyzr poised to start looking at my Internets
PREREQUISITES
Let's put aside for the moment the matter of whether you're going to upgrade your client or app or server to support IPv6, what would need consideration if you did?
- Does your host/connection/routing even support IPv6 yet? And don't forget to include your connection, your servers' and your customers'/users' too.
- Do your routers, bridges and switches support IPv6?
- Does your DNS service support IPv6 (eg AAAA records, RFC3596) yet?
- Will your WiFi / IP phone / hot-desk systems work with IPv6?
- What parts of your code/system/logging are likely to break or otherwise need TLC?
- Are you intending to run dual-stack (ie both IPv6 and IPv4) from any/all hosts (servers, workstations, phones, gadgets)?
- How will you deal with IPv6 tunnelling, planned and rogue?
- How will your performance monitoring and user-tracking tools cope? (For example, do you track approximate user location by IPv4 address prefix?)
- Will your anti-DoS/anti-abuse mechanisms based on client address work?
- Have you the expertise to craft watertight IPv6 firewall rules, especially if you no longer use NAT and the protection it provides to internal machines as a side-effect?
- Since one way that hosts can create their own IPv6 addresses is to use their Ethernet MAC address, have you thought about the information leak that this represents, eg for road-warrior mobile users?
Next page: THE WEAKEST LINK IS YOU
COMMENTS
Um...
You mean it would be "the boy who cried wolf", as in the parable, not the Prokofiev Symphony that introduced so many of us to the oboe and the bassoon.
It's hard work...
I've been slowly moving to a fully dual-stack network, but have had nothing but problems. The typical advice being to "turn off IPV6". That's not going to help adoption much...
Example: My primary ISP doesn't provide IPV6, and I suspect there isn't a cat in Hades chance of them doing it before I get my bus pass. Hurricane Electric kindly provide me with an IPV6 /48 via a tunnel, that's 65535 x (IPV4 internet address space)^2 worth of addresses. I set up a router and make it the default IPV6 route and it works!
But... YouTube crawls. Why? Well they advertise IPV6 routes, and that takes priority, so rather than using the fast IPV4 link traffic goes via the tunnelbroker. Switch IPV6 off? That's giving in. Change the default routing policy using a bodge called RFC3484 (gai.conf on Linux)? No good - squid doesn't take any notice of this and carries on merrily sending everything it can over IPV6. Current solution, a hacked version of squid that favours IPV4 except for local IPV6 addresses.
Example: Sometimes we get really slow traffic on some links on virtual machines. Turns out there's a bug in the vmxnet3 network driver that makes it ignore the MTU for IPV6 (how??!!). Turning IPV6 off solves it! Or switch to the trusty e1000 driver and lose some performance.
Example: "IPV6 doesn't do NAT". Actually this seems to be more of a religious point than a technical one. The way to avoid having to change all your internal IPs when changing providers is to allocate multiple IPV6 addresses to each interface. Great idea - I'll use the IPV6 private prefix and give all machines a private and public IPV6 address. Can I find a DHCPv6 server that supports multiple addresses? Nope. So we now have IPV4 addresses handed out with DHCP but IPV6 addresses have to be manually configured.
Example: If consumer-level ISP do start giving out IPV6 addresses, will they give out /48's? No chance - that'll eat up IPV6 address prefix space (which isn't that much larger than IPV4 address space) pdq. A /56? Unlikely. A /64? Maybe, but then how do you do routing without some bodge. Less than a /64? Quite possibly!
Better stop there for now - but the point is, IPV6 is still very immature. Yes, the basics work, but try and do anything more complicated and be prepared to hit bugs and lacking implementation. Give it another 10 years and it might be workable. Unfortunately for most people IPV4+NAT works, IPV6 doesn't.
It's simple
Put all the porn on IPv6 and take it all off IPv4. Changeover in about a month.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Enabling efficient data center monitoring
