1 / 60

Tomáš Podermański , tpoder@cis.vutbr.cz

Tomáš Podermański , tpoder@cis.vutbr.cz. the Czech Republic Area: 78 866 Km2 Population: 10 230 060 Capital city : Prague 1989: communist regime collapsed 1999: meber of NATO 2004: member of EU. Brno. NREN – CESNET z.s.p.o. . 26 members Universities & Czech academy

liko
Download Presentation

Tomáš Podermański , tpoder@cis.vutbr.cz

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Tomáš Podermański, tpoder@cis.vutbr.cz

  2. the Czech Republic • Area: 78 866 Km2 • Population: 10 230 060 • Capital city : Prague • 1989: communist regime collapsed • 1999: meber of NATO • 2004: member of EU Brno

  3. NREN – CESNET z.s.p.o. • 26 members • Universities & Czech academy • Many other institutions connected indirectly • Government institutions, hospitals, high schools, research institutions • Network based on DWDM & MPLS technology

  4. Rumors about IPv6 • Do you know that IPv4 address space will be exhausted very soon ? • Really, again? I already heard about it 10 years ago. • We are working on IPv6 transition ! • Do you still use it? • How do you get on with IPv6 ? • Everything is ready. The network is well prepared and all applicationssupport dual stack. There is no problem with IPv6. • Very well, can I see how it works? • Ehh, em, you know…. maybe later • Actual point of view • We know that IPv6 is a real problem, but we don’t have time and money to deal with it. • We’d like to cope with IPv6, but we don’t know how.

  5. Why IPv6 ? Top 10 Features that make IPv6 'greater' than IPv4 • Larger IP address space • Better end-to-end connectivity • Ability for autoconfiguring devices • Simplified header structures • Better security(IPSEC – ESP, AH) • Better quality of services • Better multicast and anycast abilities • Mobility features • Ease of administration • Smooth transition from IPv4 source: http://ipv6.com/

  6. Why IPv6 ? Top 10 Features that make IPv6 'greater' than IPv4 • Larger IP address space • Better end-to-end connectivity • Ability for autoconfiguring devices • Simplified header structures • Better security(IPSEC – ESP, AH) • Better quality of services • Better multicast and anycast abilities • Mobility features • Ease of administration • Smooth transition from IPv4 source: http://ipv6.com/

  7. Ten years ago we had a plan … IPv4 Pool Size IPv6 Deployment Size of the Internet IPv6 Transition using Dual Stack 6 - 10 years 2000 2006-2010 Time Source: http://www.potaroo.net/presentations/

  8. What’s the revised plan? IPv4 Pool Size 100% Size of the Internet ? Today IPv6 Transition IPv6 Deployment 1% 1 year Time 2010 Source: http://www.potaroo.net/presentations/

  9. An Internet Transition Plan • Recommendation based on RFC5211 (07/2008) • Phase I (2008 – 2009) • Backbone network, basic infrastructure • Native connectivity to each location (low speed) • Some public services available on IPv6 (web, ftp) • Phase II(2010/1 - 2011/12) • Stable backbone infrastructure • Hardware routing • Monitoring of applications & hotline support • IPv6 connectivity for end users in selected locations • IPv6 multicast in testing mode • Phase III(2012/1) • IPv6 network in good working order (unicast & multicast) • Native IPv6 connectivity for all users • majority of services available through IPv6

  10. IANA: Allocationof /8 IPv4 prefixes Source: http://www.potaroo.net/tools/ipv4/index.html 2008: Google on IPv6 2008: European commision targets 25% IPv6 availability by 2010 NAT 1996: IPv6 pon Linux 2007: Win Vista, SP1 dulastack Prefered IPv6 1998: RFC 2460 2001: Win XP, SP1 dulastack 1992: The first call

  11. Action plans of deployment IPv6 • EU : ADVANCING THE INTERNET • Action Plan for the deployment of Internet Protocol version 6 (IPv6) in Europe,Brussels, 27.5.2008, COM(2008) 313 final • USA: Transition Planning for Internet Protocol Version 6 (IPv6), to set the US Federal Agencies a hard deadline for compliance to IPv6 on their core IP networks • China: China Next Generation Internet (CNGI) sets outa 5 year plan (2006-2010) for the early adoption of IPv6 • Korea: IPv6 Promotion Plan II which sets avision of deploying IPv6 for the public sector by 2010 • Australia: Preparation Jan 2008-Dec 2009, Transition Jan 2010-Dec 2012, Implementation Jan 2013-Dec 2015

  12. Google: users with IPv6 connectivity Source: http://www.google.com/intl/en/ipv6/statistics/

  13. IPv6 deployment ratio – 12/2010 Source: http://bgpmon.net/blog/?p=340

  14. NREN‘s activities • Backbone infrastructure • IPv6 has been available in each node for many years • Every member can have an IPv6 connectivity • IPv6 workgroup • meetings 3 times a year • a few campuses are usually presented • Usually 20 – 30 participants • good place to • meet specialist from other universities • share experience & knowledge

  15. IPv6 and Czech Universities

  16. Let’s move on to the campus IPv6 status at the Brno University of Technology

  17. the Brno University of Technology • http://www.vutbr.cz • One of the largest universities in the Czech Republic • Founded in 1899, 110th anniversary was recently celebrated • 20,000 students and 2,000 employees • 9 faculties • 6 other organizational units • Dormitory for 6,000 students

  18. VUT FP, FEKT, Kolejní 4 VUT Koleje, Kolejní 2 VUT FCH, FEKT, Purkyňova 118 VUT Koleje, Mánesova 12 VUT FEKT, Technická 8 VUT FIT, Božetechova 2 VUT FSI, Technická 2 AV VFU, Palackého 1/3 VUT TI, Technická 4 VUT Koleje, Purk. MU CESNET , Botanická 68a AV ČR UPT MZLU, Tauferova VUT, Kounicova 67a VUT Koleje , Kounicova 46/48 AV ČR UFM VUT Rektorát, Antonínská 1 VUT FAST, Veveří 95 VUT FaVU, Údolní 19 VUT , Gorkého 13 VUT FEKT Údolní 53 VUT FA, Poříčí 5 MU, Vinařská 5 AV ČR, Rybářská 13 VUT FaVU, Rybářská 13

  19. Milestones 1992-1995 Modems, dedicated connections, bandwidth 32 - 128 Kb/s, first fiber was build, Ethernet 10 Mb/s, PC based routers KA9Q a BSD/386. 1995-1998 connections among locations almost transferred to fiber, the ATM 155 Mb/s was being built, PC based routerswith BSD Unix. 1998-2001 optical connections with multiple fibers, first attempts to build up circuits onGigabit Ethernet, L3 switches Extreme Networks. 2002-2004 All-core-network circuits on backbone converted to Gigabit Ethernet. Gigabit Ethernet was used to connect each location. 2005 First experience with 10 Gbp/s Ethernet. Looking for popper technology to build up new backbone. 2006-2008 Step-by-step converting from Gigabit Ehernet to 10 Gigabit Ethernet. Selected technology: Extreme Networks, Hewlett Packard. 2008 For management and L2 cross connections the backuped L2 circuit has been build. Each location had been connected on 10 Gigabit. 2009-now The IPv6 backbone has been built up. All tunnel-like connections have been converted to native. The OSPFv3 based routing has been turned on. IPv6 connectivity is now ready to be used in all locations.

  20. Layer 3 network • Coreofthe network • Based on 10Gb/s ethernet • Basic L3 services • OSPF and OSPFv3 • multicast - PIM/SM • External connectivity • Two 10Gb/s lines connectingthecore to CESNET (BGP, BGP4+) • Basic filtering (SMTP, NetBios, 445/Microsof DS) • Locality & sub-campuses • Two 10Gb/s lines to thecore • More complexfirewallsconfigurations are dependend on localadministrators

  21. Initial IPv6 topology

  22. IPv6 milestones 2002 Basic tunneled connectivity. Assigned own prefix - 2001:718:802::/48 . 2002-2008 Some experimental services. Possibility to connect locations using IPv6 (VLANs) . Static routing based on FreeBSD PC routers. Native connectivity to NREN 2009 Address plan, prefix divided into organization units. OSPFv3 based routing. PC routers with XORP. 3com 4800 GL devices used as HW routers DNS server moved to the dualstack 2010/I, 2010/II Backuped connectivity to each location Every place/subnet can support native IPv6 connectivity Tests with HP devices (participation on beta testing program) Connectivity to NREN through two 10Gb/s lines – BGP4+ Basic firewall Monitoring of IPv6 services, collecting neighbor caches (NAV) Some services moved to dualstack Participation on HP beta testing program 2010/III, 2010/IV Core of the network moved to the dualstack Ridding off the temporary IPv6 network

  23. IPv6 milestones - future • Firmware with full IPv6 support has been released • Temporary solution on xorp routers can be switched off • IPv6 topology will follow the IPv4 topology • All subnets will have both IPv4 and native IPv6 connectivity • PI IPv6 address range has been assigned • Changing address of all subnets and services. We will move from 2001:718:802::/48 to 2001:67c:1220::/46 • Support for renumbering • Activation of services on dualstack • 90% of services could be moved easily (10% of time) • rest of services (90% of time) • very complicated issue • unpredictable problems

  24. IPv6 problem no. 1Autoconfiguration

  25. Autoconfiguration • Brand new autoconfiguration mechanisms • Router advertisement (doesn’t contain address of DNS servers) • There is an extension RFC 6016 but is not widely implemented yet • DHCPv6 (doesn’t contain default route option) • There is an draft draft-ietf-mif-dhcpv6-route-option-02 but not accepted yet • Privacy extensions • IPv6 addresses are created by hosts randomly • You have to use both mechanisms in real network • DHCPv6 server, Advertises on router • Secure either of them • Failure any of them leads to a network connectivity failure • Different platforms support different techniques • Windows XP - SLAAC • Windows Vista/7 – SLAAC + DHCPv6 • MAC OS, iOS - SLAAC only (expect Lion – released 06/2011) • Linux, BSD, … – depends on distribution

  26. Autoconfiguration IPv4 x IPv6 • IPv4 – DHCP, ARP • IPv6 – DAD, RS/RA, DHCPv6, MLDv2, ND

  27. IPv6 problem no. 2Impact on existing IPv4 infrastructure

  28. IPv4 and IPv6 in a network • More than 50% of PC supports dualstack • Most of them use autoconfiguration (SLAAC) to get IP address (MS Vista/7, Linux, Mac OS, iOS, BSD*) • IPv6 is preferred protocol by default • Steps to make an attack: • Setup attacker’s IP to act as a RA sender • Prepare a DHCPv6 server on the attacker's PC; as DNS servers provide attacker’s addresses • Modify the behavior of DNS server to return A or AAAA records for www.google.com, www.yahoo.com, etc. to your attacker’s address • Transparent proxy service allows attacker to modify content of webpages

  29. IPv6 man in the middle attack • Port security: • MAC address security • DHCP snooping • ARP protection • Dynamic lock down www.vutbr.cz 147.229.2.15

  30. IPv6 man in the middle attack Rouge Router Advertisement with M or O flag enabled Rouge IPv6 Router www.vutbr.cz 147.229.2.15

  31. IPv6 man in the middle attack Rouge DHCPv6 Server www.vutbr.cz 147.229.2.15 DHCPv6 query (via multicast)

  32. IPv6 man in the middle attack DHCPv6 answer DNS servers points to ME Rouge DHCPv6 Server www.vutbr.cz 147.229.2.15

  33. IPv6 man in the middle attack 192.168.1.166 - name server - proxy service www.vutbr.cz 192.168.1.166

  34. # ./flood_router6 eth0

  35. IPv6 problem no. 3First hop security

  36. Autoconfiguration – IPv4 • IPv4 autoconfiguration = DHCP • Protection mechanisms on L2 devices • DHCP snooping • Blocking DHCP responses on access ports • Prevents against fake DHCP servers • Dynamic ARP protection • MAC-IP address database based on DHCP leases • Checking content of ARP packets on client access port • Prevents against ARP spoofing • Dynamic lock down • The MAC-IP database is used for inspection of client source MAC and IP address. • Prevents against source address spoofing

  37. Possible solutions for IPv6 • SeND (RFC 3971, March 2005) • Based on cryptography CGA keys • Requires PKI infrastructure • Can not work with • Manually configured, EUI 64 and Privacy Extension addresses • RA-Guard (RFC 6105, February 2011) • Dropping fake RA messages on access port (RA Snooping) • Cooperation with SeND (send proxy) – learning mode • SAVI (draft-ietf-savi-*, divided into more drafts) • Complex solution solving • Rouge RA, DHCPv4 an DHCPv6

  38. Possible solutions for IPv6 • No support in devices • Only few vendors support some of that features • You probably will have to replace all access switches • There is a easy way how to bypass such protection • CVE-2011-2395 (http://seclists.org/fulldisclosure/2011/May/446) • Using extension headers • ICMPv6/ND Packet fragmentation

  39. IPv6 problem no. 4Impact on existing IPv4 infrastructure II

  40. Impact on existing IPv4 infrastructure • Deploying IPv6 requires changes in the existing infrastructure • Some routers and switches have to be replaced • Some have to be upgraded • There are a lot of bugs in IPv6 code • More often firmware upgrades • New IPv6 related bugs -> CPU overload, Devices crash • IPv6 is another way how to reach nodes inside of the network • Similar policy have to be applied on both protocols • Users (and managers) can see that network is less stable • Both that group can’t see any benefits of that effort

  41. IPv6 problem no. 5IPv6 can’t provide same services as IPv4 does

  42. IPv6 can’t provide same services • Implementations of IPv6 are very immature now • Lack of VRRP (v3 standardized 1 year ago) • DHCPv6 failover is neither standardized nor implemented yet • Issues on VPN • Most of vendors supports only IPv4 over VPN • What happened when user connected via VPN tries to reach some services available on both protocols ? • Implementations do not provide equal features • ACL, OSPFv3, BGP4+, policy routing, … • There are a lot of bugs in implementation • Deploying IPv6 means that you will have to help supplier to solve issues. • Nobody else may have not seen some issues before

  43. IPv6 problem no. 6IPv6 requires brand new techniques to manage networks

  44. New techniques to manage networks • Privacy extension • Addresses are created randomly, a device has multiple address • Collecting ND cache (NAV - http://metanav.uninett.no/) • Netflow data have to be threaten in differed way • Practical IPv6 Monitoring on Campus (http://www.terena.org/activities/campus-bp/bpd.html) • DHCPv6 uses DUID as host identifier • MAC address can’t be used as host identifier • The host can change DUID - OS reinstallation,dualboot systems • Absence of NAT • There are some scenarios where NAT is very useful • RFC 6296 - IPv6-to-IPv6 Network Prefix Translation • Tunnels • An easy way to bypass security policy

  45. IPv6 problem no. 7Deploying IPv6 does not mean that you can switch off IPv4

  46. Switching off IPv4 is not easy • IPv4 and IPv6 are incompatible protocols • Services available on IPv4 can be reached only by IPv4 • Applications not supporting IPv6 still needs IPv4 • Skype, ICQ, MSN, games, … • NAT64 in not solution for that problem today • It is more realistic keep running dual stack network • It means that you have to run • Two routing protocols including routing policy • Two autoconfiguration mechanism • Two security policy • IPv4 does not have extension headers but IPv6 does • IPv6 uses differed messages in ICMPv6 • IPv6 can use multiple addresses • You have to have well trained staff with very good knowledge of both protocols

  47. IPv6 problem no. 8Administrators gets disappointed and frustrated with developing IPv6

More Related