IPv6 Readiness Report

MythoBeast writes "In the latest episode of the Intellectual Icebergs podcast, Brett Thorson of Ravenwing provides a very good review of how ready our industry is for IPv6. He also provides a pretty good implementation guide for those who want to set up IPv6 at home."

Comments

By the time IPv6 is ready

[Anonymous Coward]

We'll need IPv8.

NAT provides a firewall

[tepples]

Umm, [adding more devices is] precisely why [NAT is] used.

Apart from that, NAT is also useful because of an inherent side effect, namely that a basic firewall comes "free" once your router has implemented NAT.

Re:IPv6 isnt really wanted

[jamesh]

I'm right now struggling with the various implementations of NAT-T (IPSEC NAT Traversal) and the fact that they won't play nice together. Wouldn't be necessary with IPv6.

Ever tried to set up a VPN between two sites which both use 10.0.0.0/24 as their network range?

Ever wished you could just ssh direct to your desktop machine from home without futzing around with vpns?

So you may not want it or see the need for it, but if you understood the amount of work that has gone into making NAT the 'solution' it is today you might appreciate it a little more :p

Why IPV6 will be accepted

[techno-vampire]

IPV6 will finally get accepted when it's discovered that it's the only way to play a network game of Duke Nukem Forever.

Re:Like Y2K?

[vux984]

Seems like a market then exists where you could on-sell your IP addresses for $$$. Prices go up too high, market forces then result in IPv6 implementation. What's the problem?

The way ipv4 addressing is structured. 209.112.155.123 and 209.112.155.124 are in the same block. They don't have to be next door neighbours in the real world, but they do have to be 'close' to each other from the networks point of view. That will mean they belong to the same ISP, in the same city, and quite probably a fairly small chunk of that city.

IP addresses, by virtue of the numbers that make them up have to be hooked up to the network in a specific place in order for packets to find them. They exist in 'blocks' for convenient routing. The "routing tables" that you hear about describe where to send traffic addressed to a specific block should go. For example a backbone router A might know that traffic destined for 209.x.x.x goes "thatta way"... and and another router B further down the line might know that 209.112.x.x goes "through that pipe there"... and so forth, until it finally reaches a router C that says hey that destination block is right on the LAN here!

If 209.112.115.122 were suddenly "sold" to a guy in another city all his packets would would still end up at Router C, where they would be undeliverable because the owner isn't connected directly to that router.

As a rough analagy it would be like "selling your home address", but not your home. Even if you transfer the address to a guy in china all the mail is going to end up at your door step. Sure you could make special arrangements to have it forwarded back to china (and you can do this with ip too)... but that has two repurcussions:

1) The guy in china still needs a chinese address for the forwarded mail to arrive at so he's accomplished nothing!

2) Any mail addressed to him, even from his next door neighbour is going to be shipped around the world because it won't know its supposed stay in china until it arrives at your place. The chinese post office will see the Dutch (or whatever) address on the evelope and ship it off for a round trip through Holland...

IPv6 isn't just addressing.

[jd]

IPv6 includes the following features that either don't exist in IPv4 or you need to install bunches of other stuff to get it to work:

• Zero configuration of the IP stack. It's self-configuring, completely.
  
• Privacy. IPv6 mandates IPSec and I believe all IPv6 stacks out there provide that.
  
• Speed. IPv6 addressing is heirarchical and the headers are simpler and stacked, so much less information needs to be processed even though the headers are technically longer.
  
• Mobility. IPv6 supports Mobile IP - indeed, that was a design consideration - with fully optimized routing. It's only available under IPv4 as a hacked implementation of a workaround.
  
• Routing. Native IPv6 routing (as opposed to RIP-ng and OSPFv6) is designed from first principles, as opposed to being something that has evolved over time to be sub-optimal but backwards-compatiable.
  
• Multicast. IPv6 mandates multicast, which will reduce bandwidth consumption on broadcasts drastically.
  
• Anycast. This allows you to find a service by querying the network rather than some moron in technical support.
  
• MTU feedback. Your computer won't send what the network can't carry. This means you don't get packet fragmentation, which is great for firewalls and users on networks with restricted packet size. This will become more significant as jumbo packets increase in popularity.
  

Tell me again why you don't need IPv6. Only, this time, say how you're going to meet these criteria whilst you're at it.

Business case for IPv6

[jd]

This one's easy. Firewalls don't like fragmented packets, because you can't verify subsequent parts. This means that firewalls either offer limited protection (ie: let the remaining fragments through) or re-assemble the packets themselves (which is slow).

IPv6 doesn't support fragmented packets. It forces both sides to restrict the MTU of that connection to the smallest MTU of any intermediate network component. In consequence, firewalls don't need to check for fragmentation and don't need to reserve any space for extra state information.

The practical upshot is that your bottleneck (the firewall) can handle far more connections with far lower latencies, which means B2B (business-to-business) and e-commerce network traffic can run much more smoothly and the system can manage much higher numbers of connections.

More connections with lower latencies, more business transactions. More transactions, more profit.

QED.

PKI and IPsec in IPv6

[netrangerrr]

I listened to the audiocast and picked up an important point- the commentator said IPsec (an integral part of IPv6) has historically proven undeployable except in small networks and would not enhance security.

He is probably unaware that just a few weeks ago, the IETF released a series of updates to IPsec [RFCs 4301 - 4309] and a new automated key exchange (IKEv2) [RFC 4306] to update IPsec to simplify and standardize implementations and automate key exchange. Also, many a few large organizations (DoD, MIT, pharmaceutical companies, etc...) have extensive public Key Infrastructures (PKIs) ready for IPv6 IPsec. A new deployment guide on updated IPsec and IPv6 will be published shortly by the IPv6 Forum.