IPv6 Enterprise Planning
•
0 likes•587 views
IPv6 Enterprise Adoption Planning. Opportunities and Challenges. The Evolution of the Internet and what we learn from it IPv6 101 Why should you introduce IPv6 now Is there an IPv6 Killer App Planning and Methodology The 7 most important steps The biggest sumbling blocks - theory and practice
Report
Share
Report
Share
Download to read offline
Recommended
Family history map
The document is a family history map created by Steven Alvarez for a geography class. It traces the paths his mother's and father's families took to immigrate to the United States from Mexico. His mother's family entered through Tijuana from Guadalajara in the early 1970s and settled in San Diego and Los Angeles. His father's family entered through El Paso from Aguascalientes in the late 1970s and went directly to Santa Ana, where they stayed for 10 years before his parents moved to the Inland Empire in the early 1990s.
IPv6 solutions for an easy implementation
This document proposes an easy solution to implement IPv6 using a load balancer and DNS/DHCP services that are IPv6 ready. The solution involves making the load balancer IPv6 ready in the first phase, which allows existing IPv4 infrastructure and servers to be reached over both IPv4 and IPv6. In the second phase, the DNS and DHCP services are also made IPv6 ready, allowing full IPv6 compatibility without changes to the existing infrastructure. The demonstration showed how this could be done in under 5 minutes using an A10 load balancer and Infoblox DDI solution.
Recommended
Family history map
The document is a family history map created by Steven Alvarez for a geography class. It traces the paths his mother's and father's families took to immigrate to the United States from Mexico. His mother's family entered through Tijuana from Guadalajara in the early 1970s and settled in San Diego and Los Angeles. His father's family entered through El Paso from Aguascalientes in the late 1970s and went directly to Santa Ana, where they stayed for 10 years before his parents moved to the Inland Empire in the early 1990s.
IPv6 solutions for an easy implementation
This document proposes an easy solution to implement IPv6 using a load balancer and DNS/DHCP services that are IPv6 ready. The solution involves making the load balancer IPv6 ready in the first phase, which allows existing IPv4 infrastructure and servers to be reached over both IPv4 and IPv6. In the second phase, the DNS and DHCP services are also made IPv6 ready, allowing full IPv6 compatibility without changes to the existing infrastructure. The demonstration showed how this could be done in under 5 minutes using an A10 load balancer and Infoblox DDI solution.
IPv6 Adressvergabe und Adressierung
The document discusses IPv6 addressing fundamentals and policies. It covers how to obtain IPv6 address space from RIPE, including the different allocation and assignment types. It provides guidelines for creating IPv6 addressing plans, with an example addressing plan that encodes information like function and location in the address. The document also discusses IPv6 transition mechanisms and how they allow connectivity to IPv4 networks during the transition period.
Intro Swiss IPv6 Council Event, 24. März 2014
IPv6 Entwicklung
Jim Bound Award
News vom V6 World Kongress in Paris
IPv6 Integration im Datacenter - wie komplex ist es wirklich?
Ein Anlass des Swiss Ipv6 Councils am 24. März 2014, 18 Uhr.
Referent: Ben Mathis, Leiter IT Plattform, Aspectra
Die Neugier von Ingenieuren zur Technologie stand am Anfang des Projekts, IPv6 in die beiden Datacenters der Aspectra AG zu integrieren. Inzwischen ist die erste Integrationsstufe abgeschlossen und die zweite in Arbeit. Rückblickend zeigt uns Ben Mathis, Leiter IT Plattform Aspectra AG, auf, welche Herausforderungen sich stellten und welche Entscheidungen der Schlüssel zur erfolgreichen IPv6 Integration waren. Genügend Zeit für Fragen bleibt selbstverständlich auch.
Inhalt:
- Die Motivation
- Die Strategie
- Die Implementierung
- 5 Do's und 5 Dont's
- Die offenen Punkte
Swisscom: Testing von IPv6 Security Devices
Swiss IPv6 Council Event, 24.02.2014
Neue Anforderungen an Security Devices durch IPv6
Referent: Christoph Weber, Swisscom
Mit der Einführung von IPv6 in die Datacenter und Client-Netzwerke werden neue Anforderungen an Security Devices wie Firewall, IDS/IPS und andere Security Enforcement Points gestellt. Dies erfordert Kenntnis von IPv6-spezifischen Security-Threats. Darauf basierend müssen neue Anforderungen definiert werden, gegen die anzuschaffende Geräte getestet werden müssen. Weiterhin müssen Standards bei bestehenden Geräten diesbezüglich angepasst werden, deren Implementierung validiert und Auditierungen angepasst werden.
In der Präsentation durch Christoph Weber von Swisscom werden die Ansätze, Ideen und Tools anhand von Firewall-Tests aufgezeigt und dargestellt, wie diese praktisch durchgeführt werden können und wie Ergebnisse bewertet werden müssen.
Dual-Stack IPv6 Monitoring bei AWK - Member Anlass Swiss IPv6 Council Nov 2013
● Anfang 2013
„Das Netzwerkmanagement erfolgt zukünftig ausschliesslich über IPv6. Alle
relevanten Netzwerkparameter (IPv4 und IPv6) werden über IPv6 abgefragt.
Konfigurationen der Netzwerkelemente sollen regelmässig automatisiert
gesichert werden. Der Transport erfolgt hier ebenfalls über IPv6“
● November 2013
… nun ja
für das hier vorgestellte Monitoring-Projekt
Erhöhte Anforderungen an das Netzwerk der AWK Group
Redundante Netzwerkkonfigurationen ohne Monitoring machen wenig Sinn
● … für diese Slides
Teilnehmer für Praxis-Versuche motvieren
IPv6 bei PostFinance AG - Erste Erkenntnisse aus der Vorstudie
Inhalt:
Kurz Vorgestellt Die Informatik von PostFinance
IPv6 bei PostFinance Warum wir uns mit IPv6 auseinandersetzen
Standortbestimmung Wo wir heute stehen
Herausforderungen Unsere ersten Erkenntnisse zu IPv6
Wie es weiter geht Rüstung für die Zukunft
IPv6 bei der Post - Step by Step zu IPv6
Inhalt:
Wer sind wir Projektteam, Projekt
Die Post National und international
Post Domain Verwaltung ca. 700 Domains in ca. 70 Ländern
Adresskonzept Unsere ersten Erfahrungen
Dual Stack Sicherheit nicht unterlaufen
Vom User zur Post Wo stehen wir heute
Erfahrungen Hindernisse zu überwinden
Masterplan (Engineering) Unsere Entscheidungsgrundlage
Tools und Prozesse Wie weit sind wir
Intranet und Datacenter Im Lifecycle IPv6 ready werden
SIG IPv6 Provider "IPv6 Ready"
SIG integrated IPv6 into its IP network in 2008 without a business case, seeing it as the natural evolution of its internet product. By 2010, it had achieved native dual-stack mode with IPv4 and IPv6 DNS available for customers. It gained IPv6 ready certification in 2011 and added IPv6 routes to customer networks. SIG's fiber network covers Geneva city and canton, connecting over 110,000 locations and 800 buildings. It offers IPv6 connections for organizations to test or implement within their networks.
Dos And Donts Of IPv6 Transition
The document discusses the benefits of exercise for both physical and mental health. Regular exercise can improve cardiovascular health, reduce symptoms of depression and anxiety, enhance mood, and reduce stress levels. Staying physically active for at least 30 minutes each day can provide significant health benefits.
Members geneva dos and donts of transition silvia hagen
The document discusses the benefits of exercise for both physical and mental health. Regular exercise can improve cardiovascular health, reduce stress and anxiety, and boost mood and cognitive function. Staying physically active for at least 30 minutes each day is recommended for overall health and well-being.
IPv6 Security - Myths and Reality
The document discusses several key differences between IPv4 and IPv6 that relate to security implications:
- IPv6 uses a vastly larger address space (340 trillion trillion trillion addresses vs 4 billion IPv4 addresses), making address scanning much more difficult. However, the large address space was not designed to prevent scanning.
- Techniques like neighbor discovery allow nodes to automatically configure themselves on the network, but this introduces vulnerabilities like denial of service attacks if not secured properly. Cisco technologies like RA Guard help mitigate these risks.
- While IPsec was originally mandated for IPv6, using it for all traffic can introduce scalability issues and impair network services and visibility. It is best reserved for specific high-value targets as with
IPv6 Adoption --- Acceleration
IPv6 adoption is accelerating due to growing challenges with IPv4 addresses and the increasing number of internet devices. Carrier grade NAT (CGN) solutions are being used to share public IPv4 addresses but negatively impact user experience. IPv6 deployment avoids these issues by providing each user with a unique IP address and allows the "full spectrum" internet. Global IPv6 deployment is now doubling every 9 months with some networks seeing 10-15% of users on IPv6. Full deployment is forecast within the next 5 years and will be required to support continued internet growth.
IPv6 Transition
This document discusses IPv6 transition and the state of IPv6 adoption. It notes that while IPv4 address exhaustion is a real issue, users do not care and prefer NAT for security. Transition requires cooperation across users, ISPs, devices and content. Statistics show rapid growth of IPv6 adoption by major networks worldwide in the last two years. Full transition to IPv6 is needed to enable unlimited connectivity for cloud/mobile internet and the internet of things going forward.
IPv6 Security und Hacking
Aspekte von IPv6-Security
• Hackertools & ein paar Angriffsszenarien
• 3 Empfehlungen
q a) Ist IPv6 sicherer als IPv4?
q b) Ist IPv6 unsicherer als IPv4?
q c) Wer ist an allem Schuld?
q d) Wie wirkt sich die Integration von IPv6 in
meine Organisation auf deren IT-Sicherheit aus?
Der Einsatz von Lisp für die IPv6 Migration
Bei der Adressarchitektur von IPv4 beinhaltet eine IP-Adresse zwei Informationen über einen Knoten (genaugenommen ein Interface): erstens die Adresse des Interfaces (Host-ID) und zweitens die Information, wie das Interface mit dem Netzwerk verbunden ist (Subnetz). Dies ändert sich mit IPv6 nicht, ausser dass der Adressraum viel grösser ist. Dies führt zu grösseren Herausforderungen in komplexen Netzwerken, insbesondere wenn Anforderungen an Multi-Homing oder Mobilität vorliegen.
LISP (Locator/ID Separation Protocol) ist eine neue Routingarchitektur mit einer neuen Adressierungsstruktur. Dabei wird die Identität eines Gerätes, auch Endpoint Identifier genannt (EID), von seiner Position im Netzwerk, auch Routing Locator (RLOC) genannt, in zwei separate Adressräume unterteilt.
Die Präsentation geht auf verschiedene Use Cases, insbesondere die Migration von IPv4 auf IPv6 mit LISP ein.
LISP Update
Eine Präsentation über LISP, Routing Architektur und Protokoll-Set. Unter anderem geeignet für IPv6 Einführung. Präsentation stammt von Cisco.
IPv6 at CSCS
IPv6 configuration at CSCS
● Dual Stack approach
● Static addressing for networking equipment and servers
● Dynamic addressing for PC and guest networks
– Auto configuration with SLAAC
● But we still rely on DHCPv4 to distribute DNS
– Tests ongoing for:
● Distributing DNS via RA (RDNSS, RFC6106)
● DHCPv6
IPv6 deployment
5
● Configure the network part and FW/ACLs
– Test
● Configure IPv6 on the systems
– Test
– At this point the system uses IPv6 and IPv4 for outgoing
connections
● Publish the AAAA resource record into the DNS with short TTL
– If test is succesful: set normal TTL for the RR AAAA
– Now the system is fully IPv6 enabled
IPv6 lessons learned
7
● Some network devices send out RA even if they shouldn't
– Impact: machines get IPv6 global address
● Disable SLAAC autoconfiguration on all the servers
● Rogue RA:
– Impact: default gateway changed! No IPv6 connectivity anymore..
● Filter RA messages at the network level
● IPv6 ACL: be careful not to filter NS/ND messages
– Impact: you may break IPv6 connectivity
● On IPv6 ARP is replaced by ICMPv6 NS and ICMPv6 ND messages
● Firewall IPv6 limitations (CLI config needed, WebGUI not ready)
● Services not listening on IPv6. Remember to configure ssh, httpd, etc to
listen also on IPv6
IPv6 strategy for deployment at ETH Switzerland
This document summarizes IPv6 implementation plans at ETH Zurich. It discusses that IPv4 addresses are running out, so IPv6 is needed to connect growing devices. The roadmap is to gain experience with IPv6 in 2013-2014, start dual-stack rollout in 2015, and transition fully from IPv4 by 2020. Key aspects covered include changing to a new IPv6 address range, DHCPv6 implementation challenges, firewall upgrades, and initial projects already using IPv6.
More Related Content
More from Swiss IPv6 Council
IPv6 Adressvergabe und Adressierung
The document discusses IPv6 addressing fundamentals and policies. It covers how to obtain IPv6 address space from RIPE, including the different allocation and assignment types. It provides guidelines for creating IPv6 addressing plans, with an example addressing plan that encodes information like function and location in the address. The document also discusses IPv6 transition mechanisms and how they allow connectivity to IPv4 networks during the transition period.
Intro Swiss IPv6 Council Event, 24. März 2014
IPv6 Entwicklung
Jim Bound Award
News vom V6 World Kongress in Paris
IPv6 Integration im Datacenter - wie komplex ist es wirklich?
Ein Anlass des Swiss Ipv6 Councils am 24. März 2014, 18 Uhr.
Referent: Ben Mathis, Leiter IT Plattform, Aspectra
Die Neugier von Ingenieuren zur Technologie stand am Anfang des Projekts, IPv6 in die beiden Datacenters der Aspectra AG zu integrieren. Inzwischen ist die erste Integrationsstufe abgeschlossen und die zweite in Arbeit. Rückblickend zeigt uns Ben Mathis, Leiter IT Plattform Aspectra AG, auf, welche Herausforderungen sich stellten und welche Entscheidungen der Schlüssel zur erfolgreichen IPv6 Integration waren. Genügend Zeit für Fragen bleibt selbstverständlich auch.
Inhalt:
- Die Motivation
- Die Strategie
- Die Implementierung
- 5 Do's und 5 Dont's
- Die offenen Punkte
Swisscom: Testing von IPv6 Security Devices
Swiss IPv6 Council Event, 24.02.2014
Neue Anforderungen an Security Devices durch IPv6
Referent: Christoph Weber, Swisscom
Mit der Einführung von IPv6 in die Datacenter und Client-Netzwerke werden neue Anforderungen an Security Devices wie Firewall, IDS/IPS und andere Security Enforcement Points gestellt. Dies erfordert Kenntnis von IPv6-spezifischen Security-Threats. Darauf basierend müssen neue Anforderungen definiert werden, gegen die anzuschaffende Geräte getestet werden müssen. Weiterhin müssen Standards bei bestehenden Geräten diesbezüglich angepasst werden, deren Implementierung validiert und Auditierungen angepasst werden.
In der Präsentation durch Christoph Weber von Swisscom werden die Ansätze, Ideen und Tools anhand von Firewall-Tests aufgezeigt und dargestellt, wie diese praktisch durchgeführt werden können und wie Ergebnisse bewertet werden müssen.
Dual-Stack IPv6 Monitoring bei AWK - Member Anlass Swiss IPv6 Council Nov 2013
● Anfang 2013
„Das Netzwerkmanagement erfolgt zukünftig ausschliesslich über IPv6. Alle
relevanten Netzwerkparameter (IPv4 und IPv6) werden über IPv6 abgefragt.
Konfigurationen der Netzwerkelemente sollen regelmässig automatisiert
gesichert werden. Der Transport erfolgt hier ebenfalls über IPv6“
● November 2013
… nun ja
für das hier vorgestellte Monitoring-Projekt
Erhöhte Anforderungen an das Netzwerk der AWK Group
Redundante Netzwerkkonfigurationen ohne Monitoring machen wenig Sinn
● … für diese Slides
Teilnehmer für Praxis-Versuche motvieren
IPv6 bei PostFinance AG - Erste Erkenntnisse aus der Vorstudie
Inhalt:
Kurz Vorgestellt Die Informatik von PostFinance
IPv6 bei PostFinance Warum wir uns mit IPv6 auseinandersetzen
Standortbestimmung Wo wir heute stehen
Herausforderungen Unsere ersten Erkenntnisse zu IPv6
Wie es weiter geht Rüstung für die Zukunft
IPv6 bei der Post - Step by Step zu IPv6
Inhalt:
Wer sind wir Projektteam, Projekt
Die Post National und international
Post Domain Verwaltung ca. 700 Domains in ca. 70 Ländern
Adresskonzept Unsere ersten Erfahrungen
Dual Stack Sicherheit nicht unterlaufen
Vom User zur Post Wo stehen wir heute
Erfahrungen Hindernisse zu überwinden
Masterplan (Engineering) Unsere Entscheidungsgrundlage
Tools und Prozesse Wie weit sind wir
Intranet und Datacenter Im Lifecycle IPv6 ready werden
SIG IPv6 Provider "IPv6 Ready"
SIG integrated IPv6 into its IP network in 2008 without a business case, seeing it as the natural evolution of its internet product. By 2010, it had achieved native dual-stack mode with IPv4 and IPv6 DNS available for customers. It gained IPv6 ready certification in 2011 and added IPv6 routes to customer networks. SIG's fiber network covers Geneva city and canton, connecting over 110,000 locations and 800 buildings. It offers IPv6 connections for organizations to test or implement within their networks.
Dos And Donts Of IPv6 Transition
The document discusses the benefits of exercise for both physical and mental health. Regular exercise can improve cardiovascular health, reduce symptoms of depression and anxiety, enhance mood, and reduce stress levels. Staying physically active for at least 30 minutes each day can provide significant health benefits.
Members geneva dos and donts of transition silvia hagen
The document discusses the benefits of exercise for both physical and mental health. Regular exercise can improve cardiovascular health, reduce stress and anxiety, and boost mood and cognitive function. Staying physically active for at least 30 minutes each day is recommended for overall health and well-being.
IPv6 Security - Myths and Reality
The document discusses several key differences between IPv4 and IPv6 that relate to security implications:
- IPv6 uses a vastly larger address space (340 trillion trillion trillion addresses vs 4 billion IPv4 addresses), making address scanning much more difficult. However, the large address space was not designed to prevent scanning.
- Techniques like neighbor discovery allow nodes to automatically configure themselves on the network, but this introduces vulnerabilities like denial of service attacks if not secured properly. Cisco technologies like RA Guard help mitigate these risks.
- While IPsec was originally mandated for IPv6, using it for all traffic can introduce scalability issues and impair network services and visibility. It is best reserved for specific high-value targets as with
IPv6 Adoption --- Acceleration
IPv6 adoption is accelerating due to growing challenges with IPv4 addresses and the increasing number of internet devices. Carrier grade NAT (CGN) solutions are being used to share public IPv4 addresses but negatively impact user experience. IPv6 deployment avoids these issues by providing each user with a unique IP address and allows the "full spectrum" internet. Global IPv6 deployment is now doubling every 9 months with some networks seeing 10-15% of users on IPv6. Full deployment is forecast within the next 5 years and will be required to support continued internet growth.
IPv6 Transition
This document discusses IPv6 transition and the state of IPv6 adoption. It notes that while IPv4 address exhaustion is a real issue, users do not care and prefer NAT for security. Transition requires cooperation across users, ISPs, devices and content. Statistics show rapid growth of IPv6 adoption by major networks worldwide in the last two years. Full transition to IPv6 is needed to enable unlimited connectivity for cloud/mobile internet and the internet of things going forward.
IPv6 Security und Hacking
Aspekte von IPv6-Security
• Hackertools & ein paar Angriffsszenarien
• 3 Empfehlungen
q a) Ist IPv6 sicherer als IPv4?
q b) Ist IPv6 unsicherer als IPv4?
q c) Wer ist an allem Schuld?
q d) Wie wirkt sich die Integration von IPv6 in
meine Organisation auf deren IT-Sicherheit aus?
Der Einsatz von Lisp für die IPv6 Migration
Bei der Adressarchitektur von IPv4 beinhaltet eine IP-Adresse zwei Informationen über einen Knoten (genaugenommen ein Interface): erstens die Adresse des Interfaces (Host-ID) und zweitens die Information, wie das Interface mit dem Netzwerk verbunden ist (Subnetz). Dies ändert sich mit IPv6 nicht, ausser dass der Adressraum viel grösser ist. Dies führt zu grösseren Herausforderungen in komplexen Netzwerken, insbesondere wenn Anforderungen an Multi-Homing oder Mobilität vorliegen.
LISP (Locator/ID Separation Protocol) ist eine neue Routingarchitektur mit einer neuen Adressierungsstruktur. Dabei wird die Identität eines Gerätes, auch Endpoint Identifier genannt (EID), von seiner Position im Netzwerk, auch Routing Locator (RLOC) genannt, in zwei separate Adressräume unterteilt.
Die Präsentation geht auf verschiedene Use Cases, insbesondere die Migration von IPv4 auf IPv6 mit LISP ein.
LISP Update
Eine Präsentation über LISP, Routing Architektur und Protokoll-Set. Unter anderem geeignet für IPv6 Einführung. Präsentation stammt von Cisco.
IPv6 at CSCS
IPv6 configuration at CSCS
● Dual Stack approach
● Static addressing for networking equipment and servers
● Dynamic addressing for PC and guest networks
– Auto configuration with SLAAC
● But we still rely on DHCPv4 to distribute DNS
– Tests ongoing for:
● Distributing DNS via RA (RDNSS, RFC6106)
● DHCPv6
IPv6 deployment
5
● Configure the network part and FW/ACLs
– Test
● Configure IPv6 on the systems
– Test
– At this point the system uses IPv6 and IPv4 for outgoing
connections
● Publish the AAAA resource record into the DNS with short TTL
– If test is succesful: set normal TTL for the RR AAAA
– Now the system is fully IPv6 enabled
IPv6 lessons learned
7
● Some network devices send out RA even if they shouldn't
– Impact: machines get IPv6 global address
● Disable SLAAC autoconfiguration on all the servers
● Rogue RA:
– Impact: default gateway changed! No IPv6 connectivity anymore..
● Filter RA messages at the network level
● IPv6 ACL: be careful not to filter NS/ND messages
– Impact: you may break IPv6 connectivity
● On IPv6 ARP is replaced by ICMPv6 NS and ICMPv6 ND messages
● Firewall IPv6 limitations (CLI config needed, WebGUI not ready)
● Services not listening on IPv6. Remember to configure ssh, httpd, etc to
listen also on IPv6
IPv6 strategy for deployment at ETH Switzerland
This document summarizes IPv6 implementation plans at ETH Zurich. It discusses that IPv4 addresses are running out, so IPv6 is needed to connect growing devices. The roadmap is to gain experience with IPv6 in 2013-2014, start dual-stack rollout in 2015, and transition fully from IPv4 by 2020. Key aspects covered include changing to a new IPv6 address range, DHCPv6 implementation challenges, firewall upgrades, and initial projects already using IPv6.
More from Swiss IPv6 Council (18)
IPv6 Integration im Datacenter - wie komplex ist es wirklich?
IPv6 Integration im Datacenter - wie komplex ist es wirklich?
Dual-Stack IPv6 Monitoring bei AWK - Member Anlass Swiss IPv6 Council Nov 2013
Dual-Stack IPv6 Monitoring bei AWK - Member Anlass Swiss IPv6 Council Nov 2013
IPv6 bei PostFinance AG - Erste Erkenntnisse aus der Vorstudie
IPv6 bei PostFinance AG - Erste Erkenntnisse aus der Vorstudie
Members geneva dos and donts of transition silvia hagen
Members geneva dos and donts of transition silvia hagen
IPv6 Enterprise Planning
- 14. • • •