Slashdot Mirror
IETF Mulls Working Group For IPv6 Home Networking
alphadogg writes "The Internet Engineering Task Force is considering establishing a working group to smooth some of the impending issues around setting up and maintaining IPv6-based Internet connections in homes. 'A collection of protocols needs to be agreed upon, so vendors of equipment used in home networks will have an interoperable suite of protocols available,' said Ralph Droms, a distinguished engineer for Cisco and among those who want to form the IETF working group. Home networking is a fairly new area for the IETF. Many of its standards were designed for large-scale organizational networks, rather than home use."
Having read the article, I remain uninformed about exactly what it is they're talking about standardizing. Also, why does a publication called "Network World" assume that I know zero about networking?
I thought the end of IPv4 rapture was meant to have happened already but there have been no end of the world style articles recently....
IPv6 has a section for private use.
FD00::/8
So the home router manufacturers could have the exact same configs as today (with IPv4) with IPv6. With all the same benefits and problems that we have today. And that people are familiar with. And familiarity is the important thing here.
Beyond that, it's just a matter of phrasing. The techs designing the home routers/firewalls know what the technology can do. The issue is phrasing that in a way that the home user can make an informed choice on what options they want to enable for which of their machines (connecting to which machines on the Internet).
"Home networking is a fairly new area for the IETF." -- this statement does not inspire confidence. The majority of the networks in the world are small NAT based networks. Small businesses based abound a NAT firewall are indistinguishable from these home networks. And now they say they are just getting around to thinking about the vast majority of networks?
Why not maintain the IPv4 for the home scale devices (5 port routers) with a IPv6 WAN side connection?
It seems very overkill to push IPv6 to the home level even with "network light bulbs" how many can one house have? 20 - 30 would be a lot of lights and even if everything in your house came with built in WiFi I don't think you could fill up 255 addresses on 99% of homes out there.
Also for a tech perspective can you imagine the support calls with customers rattling of IPv6 addresses all the time?
my $0.02 anyways.
They kinda taste like tasty wheat . . . . kinda . . .
I'm no networking expert, which is probably why I don't know this, but why do I need to support IPv6 in my home? As long as my modem gets an IPv6 address, if it can assign IPv4 addresses on the internal side of the network after that point, who cares if my router still assigns IPv4 addresses to my laptops, phones, and PCs? I'm not going to go over however many billion addresses in my own home. Since nobody else can directly access my internal network devices via the internet without going through that one final IPv6 address at the modem, why would anyone bother to convert all their home equipment?
hardware needs updates for IPV6 and software as well.
lot's of routers can't do IPV6 and others say we are working on IPV6 updates.
I've run Cisco SOHO devices such as RV042, RV082, RV016, RVS400, RVL200, and WRV210. In my experience setting up VPNs and firewalls on these devices, they often have interoperability issues between themselves. Also, I've worked with a SRW208 whose web management interface requires you to use IE to manage the device. Based upon these experiences, I'd suggest that Cisco needs to work on interoperability between their own devices before they can provide guidance to others on how to make interoperable devices for home users.
Show me packet captures and log entires, or it never happened.
Get the ISPs to provide IPv6 to their customers.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Just a guess. :)
Assume that you get an IPv6 address assigned to your router. Assume that a computer on your LAN wants to talk to a internet host with IPv6. The NAT box can translate replies from the internet host to IPv4. But how are you going to talk to the IPv6 host? How can you send a packet to an IPv6 address if all you got is IPv4 on your LAN?
I suppose the NAT box could run DNS and make a look-up table mapping IPv6 internet addresses to IPv4 for your home computer to use. This seems a bit of a kludge and it doesn't help you with raw IPv6 addresses.
Clearly, we are stuck with IPv4 for legacy devices for at least 10 years (estimate based on time for floppy to die after it became somewhat useless). Assuming IPv6 does come (I am not certain we won't be living with some awful kludge instead), you will want to also do IPv6 within your LAN.
Yoghurt
That would be the 'very expensive' part of the upgrade process.
Since only about 1/2 of one percent of the world's network traffic is using IPv6 yet, Why not just admit that after 18 years IPv6 is a dismal failure, and go on to IPv8?
This time, you can insure success by 1) Making it interoperable with IPv4, 2) Including an authentication layer instead of an encryption layer, 3) Add capability for isochronous delivery so voice and video will finally work well, and 4) Add the capability for deterministic bandwidth allocation so telco's can assign channels with fixed bandwidth to virtual circuits.
And that is how you build a protocol that will actually get more widely used than the Esperanto language.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Some people seem to live in la-la-land. I don't care about the difference between SPI and NAT, but some people do, all in the interest of "end-to-end connectivity". Some of their suggestions are totally brain-dead. E.g. http://tools.ietf.org/html/draft-ietf-v6ops-cpe-simple-security-09
> In managed, enterprise networks, virtual private networking tunnels
> are typically regarded as an additional attack surface. and they are
> often restricted or prohibited from traversing firewalls for that
> reason. However, it would be inappropriate to restrict virtual
> private networking tunnels by default in unmanaged, residential
> network usage scenarios.
Hello?!?! WTF should my home network be any less secure than a network at an office???
> Therefore, this document recommends the DEFAULT operating
> mode for residential IPv6 simple security is to permit all virtual
> private networking tunnel protocols to pass through the stateful
> filtering function. These include IPsec transport and tunnel modes
> as well as other IP-in-IP protocols.
WTF?!?! So when some manufacturer makes a bunch of fridges or toasters or washer/dryers that respond to default UserIDs and passwords over a VPN, they'll accessable to the outside world *BY DEFAULT*.
It gets worse. http://tools.ietf.org/html/draft-vyncke-advanced-ipv6-security-01 says...
>The intention is to provide an example of a security model which allows most traffic,
> including incoming unsolicited packets and connections, to traverse the CPE...
Ex-bleeping-scuse me. This SPI "security" is a joke. You'll pry NAT out of my cold dead fingers.
> ...unless the CPE identifies the traffic as potentially harmful based on
> a set of signatures (and other correlation data and heuristics)
IDIOTS!!! One of the basic rules of internet security is to enumerate good, *NOT* to enumerate evil. There are new exploits being created all the time. You simply can't keep up with a list of exploits. You're a lot better off deciding what minimal stuff to allow through.
> that are kept up to date on a regular basis.
Oh boy. My ISP's router/modem will come with a 90-day trial subscription to Macafee/Norton/whatever. And when I'm watching a movie on Netflix, or whatever, I'll get get a popup warning me that the free anti-virus subscription expires tomorrow and that I *MUST SIGN UP NOW*. And the router/modem will have a quad-core processor, but still be dog slow, because it'll be continuous ly scanning packets, and looking through a list of a gazillion exploits. And just like craplets on new PCs, it'll be almost impossible to uninstall. Like I said, you'll pry NAT out of my cold dead fingers.
I haven't been a NAT fanboi, but if the internet hippies at IETF get their way, NAT will indeed be the safest way to go.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
I work for a sizeable (> 50K people) distributed organisation. On World IPv6 Day we disabled IPv6 on everything where it could be disabled (which in some cases required re-imaging machines where there was no way to turn it off completely), and disconnected/shut down anything where IPv6 couldn't be disabled. We had absolutely zero problems or incidents during the entire IPv6 day.
It's so simple when you think about it. I really don't understand what all the fuss is about.
IPv6 has a section for private use.
FD00::/8
So the home router manufacturers could have the exact same configs as today (with IPv4) with IPv6. With all the same benefits and problems that we have today. And that people are familiar with. And familiarity is the important thing here.
Beyond that, it's just a matter of phrasing. The techs designing the home routers/firewalls know what the technology can do. The issue is phrasing that in a way that the home user can make an informed choice on what options they want to enable for which of their machines (connecting to which machines on the Internet).
Make that FC00::/7, as per the IETF definition for unique local unicast
But in IPv6, a device can have multiple IPv6 addresses from different networks (unlike in IPv4). One from the ISP, but then if the consumer happens to have his own /64, he has IPs for say his own website, cellphone, IPAD, and so on. Let's say he's trying to connect to his work VPN - he'd get an address from there as well. So he'll have a bunch of addresses, and anyone from within any of those networks should be able to access him, so long as he's online.
So if he's doing a home networking, getting private addresses here may be redundant. As for the routers, I can see them being more like site-local addresses (think of a gateway address in IPv4). So the address of a wireless router would be something like ff05::2, as a router on the site. Natting wouldn't be done here, since that would disrupt the peer to peer paradigm which is why one would want it in the first place. But these addresses are automatically assigned - you have
0 reserved
1 interface-local scope
2 link-local scope
3 reserved
4 admin-local scope
5 site-local scope
8 organization-local scope
E global scope
F reserved
and multicast groups
1 node
2 router
5 OSPF IGP router
6 OSPF IGP Designated router
9 RIP router
a EIGRP router
b mobile agent
109
d PIM router
16 MLDv2 capable router
fb DNS server
101 NTP server
108 NIS+ server
1:2 DHCPv6 relay agent or server
1:3 DHCPv6 server (but not relay agent)
As a result, one would have multicast addresses like
ff02::1 All nodes on the local link
ff05::1 All nodes in the organization
ff02::2 All routers on the local link
ff05::2 All routers in the site
ff02::fb All DNS servers on the local link
ff08::fb All DNS servers in the organization
Note that all these addresses are automatically created when an IPv6 address is created - the node doesn't have just one IP. All this alone would allow the devices to work within that local network.
No, since one can have multiple IP addresses, there are the concepts of provider assigned and provider independent addresses - particularly handy for an organization that will need an ISP independent network.
Let's say you get a /64 block from your ISP, and they need to redo their prefixes, or whatever. However, you can also yourself directly get a host of addresses, say /48, from ARIN (or your local RIR). The way you do it is set up your network, w/ your addressing schemes, using the addresses that you bought, and let it remain constant regardless of who your ISP is, or what they're doing. You can do this using a combination of SLAAC and DHCPv6.
However, w/ the ISP's addresses, just do a stateless autoconfiguration for every device you want on that network, which also has its corresponding equivalents in the network you just defined. In other words, don't spend much time on them, except getting them 'live'. That way, they are only used for connecting to the internet via the ISP, but other than that, for everything going through your network, you use the network that you picked.
Dynamic addresses do have their advantages however - changing the addresses and not having static ones reduces one's threats, and that can be arranged by DHCP. IPv6 includes DAD - Duplicate Address Detection - which also assigns addresses one of 5 states - Tentative, Preferred, Duplicated, Deprecated and Invalid. Unlike in IPv4, one can't just assign an IP address w/o ND performing a DAD and determining its validity.
Yeah. The issue ain't the number of private addresses one can have on one's home network - it's also having all the networks follow the same protocol. As it is, it's impossible to come up w/ an IPv4 compatible protocol that solves the address issue, which is why we're w/ IPv6. But then, the LAN, and the home networks all have to work w/ IPv6: you don't want to do any NAT46 or NAT64.
As it is, one gets site-local, organizational and other IPv6 addresses, which one can use in the home/local network.
Given that DHCPv6 is a totally different animal from DHCPv4, the idea of a box did occur to me as well, but w/ the following functionality:
Given a particular network prefix - /32, /48, /40, etc, the box should be able to generate subnets and addresses, depending on definitions like max #subnets, #devices, etc.
The box should configure the network by assigning the gateway address, the various host addresses and ranges, and assign the initial static and dynamic addresses
The box should then optionally record stateless addresses obtained by various devices if asked.
The box should also have something like an alias listing, maybe of things like virtual hosts, DNS entires and so on
The box should then enable some of the devices on the network obtain stateless IP addresses, but using random interface IDs, not EUI-64 addresses. Such addresses should also be noted in the DHCP server, so that they can be used, say, as website addresses
The box can act as a dual stack router, which I can use w/ an ISP's native v4 or v6 service. Whenever the service becomes v6, what I'll have will be dual-stack lite. Prefer not to do tunneling if I can avoid it. Translation a definite no-no.
If needed, the box can be a NAT64/46 b/w an IPv4 LAN and an IPv6 WAN, if someone likes the 'security' provided by NAT.
The box can also inventory each of the IP addresses on every device on the network - PA, PI, local-link, site, organization, etc
The box can also include a list of gateways of each of the networks that the devices on this network belong to. In other words, be a central repository for all that info
WiFi should have been IPv6 from the get-go; there's no excuse for not having written that into the standard back in '99 to use at least locally routeable IPv6, and to have tunneled IPv4 over it.
It would have been a very natural fit, but the fact that they didn't do this has totally messed up IPv6 migration, as well as caused difficulties for WiFi itself (IPv6 has built-in encryption, so they probably wouldn't have required all the WPA nonsense.)
let's have Cisco at the table, even if only to act as a moral compass.