How Feds are Dropping the Ball on IPv6

BobB-NW writes "U.S. federal agencies have six months to meet a deadline to support IPv6, an upgrade to the Internet's main communications protocol known as IPv4. But most agencies are not grabbing hold of the new technology and running with it, industry observers say. Instead, most federal CIOs are doing the bare minimum required by law to meet the IPv6 mandate, and they aren't planning to use the new network protocol for the foreseeable future."

Comments

As things go ...

[foobsr]

Regional registry IPv4 address exhaustion in... 1442 Days, 07 Hours, 42 Minutes, 42 Seconds. ( http://penrose.uk6x.com/ )

So there is plenty time for someone to wake up, wanting it yesterday.

CC.

Re:As things go ...

[anticypher]

Current allocation rate of IPv4 addresses worldwide is the equivalent of one /8 every 4.5 weeks, and accelerating. Last year the rate was one /8 every 5.5 to 6 weeks. Calculations of May 2010 are assuming that the rate doesn't accelerate any more.

When I said ALL big blocks being reclaimed into the available pool, that included all the remaining /8 allocations, including HP's 2x /8, MIT's /8, and all the others. Even with reclaiming all those /8s, it will extend the pool by 23 months at most.

The block allocated for Amateur radio operations was reclaimed a couple years ago, as well as the ones for Interop and other early networking groups. Those allocations are either already gone or back in the free pool.

HP has already announced plans to rent their addresses to customers who buy their big servers with a maintenance/service plan, and put the servers in partner data centres. So, in a few years, all those companies who want to get on the internet and can't wait a year or more for their allocation request to be fulfilled, they can throw a lot of money at HP and be up and running much faster. At least, that's what HP is counting on. If you think HP is going to willingly return any of their allocations when they can make US$10/month per IP address, you must be smoking some strong belly lint.

the AC

No real drive

[Marillion]

I also look at the industry as a whole. I don't see any real drive, a critical mass if you will, for getting off of IPv4. My ISP doesn't offer IPv6. My company doesn't use IPv6. It's little wonder that the government is dragging it's feet.

What is IPv6 compliance?

[Midnight Thunder]

IPv6 isn't that complicated to set up, especially since most recent desktops support IPv6 out of the box, though that doesn't mean that there aren't a few hurdles, including:
    - Upgrading routers, firewalls et al to support IPv6.
    - Some application software still not being fully IPv6 ready.
    - A large number of sites still don't have IPv6 DNS addresses

I think the problem, like many government proposals is not the recommendation, but the lack of research guidelines or instructions on how to make the infrastructure IPv6 compliant or what it means to be IPv6 compliant. For example is simply having a 6to4 gateway considered IPv6 compliance.

All this said and done, has anyone here on /. actually upgraded a network to be IPv6 compliant and what can you tell us about real world experience.

Re:What is IPv6 compliance?

[Tony Hoyle]

IPv6 isn't that complicated to set up

Yes it is.

Desktops are only the start.
Your servers need it (no ipv6 AD support).
No ipv6 network printer support.
No ipv6 VOIP support.
Poor to nonexistant ipv6 router support, and of those that do most of them don't support firewalling it.
Poor to nonexistant connectivity. Try asking the average ISP for an ipv6 address and they'll just look at you funny. It's not just consumer ISPs either - this business park I'm in at the moment has *no idea* what ipv6 is and has no timescale to look at it either.

Then there's the bits and pieces.. Dies Blackberry support ipv6? I know iphone doesn't, and Symbian's implementation is broken (relies on a dhcpv6 server and even then seems to need some kind of proprietary extension to that).

A rough guide as to why...

[jd]

...this is important (beyond the address count issue) for the Feds specifically:

• IPv6 has better security provisions within the protocol itself, making the usual run of D- through to F- on Federal security audits less likely.
• The protocol incorporates many of the features back-engineered into IPv4 as standard, producing a cleaner design with fewer compromises and fewer flaws
• Built-in support for protocol expansion means future updates should have less impact and be adoptable faster
• Automatic configuration means fewer errors and less maintenance
• Alignment of entries in the header means potentially greater throughput
• Skript Kiddies will end up jumping off bridges as they won't know what to do
• Software contracting firms are located in regions in which elections are due, creating excellent opportunities on both sides of the table

Re:A rough guide as to why...

[jandrese]

IPv6 has better security provisions within the protocol itself, making the usual run of D- through to F- on Federal security audits less likely.

This has not been my experience with it. IPv6 is way more complex and poorly understood than IPv4 and as a result it is a lot more likely to have an unexpected security hole when set up by actual human beings than IPv4.

That's a lot of trolls for one article!

[billstewart]

Yes, the IPv6 space is bigger than it could have been - some people thought that 64 bits would be enough, some wanted 80, some wanted 160. But the transition is enough of a pain that it's worth only doing it once, and 128 bits isn't that much more trouble than 64. Also, it's turning out that having more bits of network side will simplify a lot of potential network applications.

There isn't a lot of hoarded Class B space out there - if anything, most of the hoarding is at the /24 level, by companies that need a /24 for dual-carrier routing reasons, but would otherwise need only a /29 or so to handle the external side of their firewalls.

IPv6 had a lot of optimistic goals, some of which (like security and autoconfiguration) have been achieved in other ways (like IPSEC and DHCP), and others (like hierarchical simplification of routing structures) don't look like they'll really happen. But the IPv4 space is going to run out, and we're not going to be able to squeeze much past 2012 - especially if a billion people want data on their cellphones, or if the Chinese economy adds a couple hundred million broadband users, which won't take long, or a couple million businesses, which won't take long either.

The IPv6 address space is very rationally designed, and yes, managing it does take work - but it's big enough that there's room to experiment, unlike IPv4 which ran out of slack well over a decade ago.