650 likes | 1.06k Views
Notes for IPv6. Terrance Lee. Transition Mechanisms for IPv6 Hosts and Routers (RFC 2893). Purpose and Approaches. Interoperation of an IPv4/IPv6 node with another IPv4/IPv6 node or an IPv4-only node Dual Stacks Configured Tunneling Host-to-Router, Router-to-Router Automatic Tunneling
E N D
Notes for IPv6 Terrance Lee
Purpose and Approaches • Interoperation of an IPv4/IPv6 node with another IPv4/IPv6 node or an IPv4-only node • Dual Stacks • Configured Tunneling Host-to-Router, Router-to-Router • Automatic Tunneling IPv4-Compatible IPv6 Addr. (::v4addr) Host-to-Host, Router-to-Host
Techniques Used in Transition • Configured Tunneling IPv4 tunnel endpoint addr is determined by configuration information • Automatic Tunneling IPv4 tunnel endpoint addr is determined from the IPv4-compatible destination addr • IPv4 Multicast Tunneling IPv4 tunnel endpoint addr is determined using Neighbor Discovery
Check Packet Length for Tunneling (1/2) If (IPv4 path MTU – 20) <= 1280 if packet length > 1280 bytes send IPv6 ICMP “packet too long” with MTU = 1280; Drop packet else Encapsulate; don’t set Don’t Fragment flag in the IPv4 header endif
Check Packet Length for Tunneling (2/2) Else if packet length > (IPv4 path MTU – 20) send IPv6 ICMP “packet too big” with MTU = (IPv4 path MTU – 20); Drop packet else Encapsulate and set the Don’t Fragment flag endif endif
IPv4 Header Construction (1/2) • Version: 4 • Header Length: 5 • Type of Service: 0 (Might be changed) • Total Length: Payload length from IPv6 header plus length of IPv6 and IPv4 headers • Identification: Generated uniquely • Flags: As specified before • Fragment Offset: Set as necessary
IPv4 Header Construction (2/2) • Time to Live: Implementation specific • Protocol: 41 • Header Checksum: Calculate the checksum • Source Address: IPv4 address of encapsulating node • Destination Address: IPv4 address of tunnel endpoint
Configured Tunneling • The tunnel endpoint addr is determined from configuration information • IPv6/IPv4 hosts that are connected to datalinks with no IPv6 routers MAY use a default configured tunnel to reach an IPv6 router.
Automatic Tunneling Operation • Perform automatic tunneling if the destination IPv6 addr is IPv4-compatible with prefix 0:0:0:0:0:0/96 • The automatic tunneling module MUST NOT send to IPv4 broadcast or multicast destinations
Ingress Filtering • Invalid IPv6 addresses after de-capsulation multicast, broadcast, ::0.0.0.0, ::127.0.0.1 • IPv6 link-local address for an IPv4 virtual interface: FE80::/64 || Interface Identifier • Link-local addresses are used by the routing protocols operating over the tunnels • Interface Identifier = 0:0:0:0:v4addr • Need ingress filter for packet filtering
Transmission of IPv6 over IPv4 Domains without Explicit Tunnels (6over4) (RFC 2529)
Purpose and Approaches • Specifies frame format of IPv6 packets and the method of forming IPv6 link-local addresses over IPv4 multicast domains • Specifies contents of Source/Target Link-Layer Address option used in Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, Redirect messgaes • Uses IPv4 multicast as a “virtual Ethernet”
Motivation • Allow isolated IPv6 hosts to become fully functional IPv6 hosts by using an IPv4 domain that supports IPv4 multicast as their virtual local link • Does not require IPv4-compatible addr or configured tunnels • Known as “6over4” or “virtual Ethernet”
Maximum Transmission Unit • The default MTU for IPv6 packets on an IPv4 domain is 1480 octets. • MTU may be varied by a Router Advertisement containing an MTU option or by manual configuration • The IPv4 DF bit MUST NOT be set if the IPv6 MTU proves to be too larger for some intermediate IPv4 subnets
Frame Format • Protocol type = 41 (IPv6 packets tunneled inside IPv4 frames) for outer IPv4 header • If there are IPv4 options, then padding should be added to the IPv4 header such that the IPv6 header starts on a boundary that is a 32-bit offset from the end of the datalink header • Recommended default TTL = 8
Link Local Address • Prefix: FE80::/64 • Link Local Address: FE80::0:0:V4ADDR • The “Universal/Local” bit is zero (i.e., the Interface Identifier is not globally unique)
Address Mapping – Unicast (1/2) • RFC 2461 “Neighbor Discovery for IP Version 6” describes the procedure for mapping IPv6 addr into IPv4 virtual link-layer addr
Address Mapping – Unicast (2/2) • Type: 1 for Source Link-Layer addr 2 for Target Link-Layer addr • Length: 1 (in units of 8 octets) • IPv4 Address: The 32 bit IPv4 addr in network byte order
Address Mapping – Multicast (1/2) • IPv4 multicast must be available • An IPv6 multicast destination addr DST MUST be transmitted to the IPv4 multicast addr of Organization-Local Scope taken from the block 239.192.0.0/16
Address Mapping – Multicast (2/2) • DST 14, DST 15: Last two bytes of IPv6 multicast addr • OLS: Configured Organization-Local Scope addr block. Should be 192.
Transition Issues • A site may choose to start its IPv6 transition by configuring one IPv6 router to support “6over4” on an interface connected to the site’s IPv4 domain, and another IPv6 format on an interface connected to the IPv6 Internet. • During transition, routers may need to advertise at least two IPv6 prefixes, one for the native LAN (e.g., Ethernet) and one for “6over4”.
Connection of IPv6 Domains via IPv4 Clouds (6to4) (RFC 2893)
Purpose and Approaches • Interoperation of IPv6 sites over the IPv4 network without explicit tunnel setup • Communication of isolated IPv6 sites with native IPv6 domains via relay router • Treats the wide area IPv4 network as a unicast point-to-point link layer • The site needs a globally unique IPv4 addr • Can coexist with Firewall and NAT
Terminologies (1/2) • 6to4 pseudo interface: 6to4 encapsulation point • 6to4 prefix: 2002::/16 (The site addr prefix: 2002:V4ADDR::/48) • 6to4 router: An IPv6 router supporting a 6to4 pseudo interface • 6to4 site: A site running IPv6 internally using 6to4 addresses
Terminologies (2/2) • Relay router: A 6to4 router configured to support transit routing between 6to4 addresses and native IPv6 addresses • 6to4 exterior routing domain: a routing domain interconnecting a set of 6to4 routers and relay routers. It is distinct from an IPv6’s interior routing domain and all native IPv6 exterior routing domains
Sending Rule for 6to4 Router (1/2) • If the final destination is a 6to4 addr, it will be considered as the next hop • If the final destination is not a 6to4 addr and is not local, the next hop indicated by routing will be the 6to4 addr of a relay router
Sending Rule for 6to4 Router (2/2) • If the next hop IPv6 addr for an IPv6 packet does match the prefix 2002::/16, and does not match any prefix of the local site then apply any security checks encapsulate the packet in IPv4 with IPv4 dest addr = the NLA value V4ADDR extracted from the next hop IPv6 addr queue the packet for IPv4 forwarding
De-capsulation Rule • For an incoming IPv4 packet with protocol type 41, a 6to4 router performs: Apply any security checks Remove the IPv4 header Submit the packet to local IPv6 routing
Stateless IP/ICMP Translation (SIIT) (FRC 2765)
Purpose and Approaches • Interoperation of an IPv6-only node with an IPv4-only node • IPv6 node somehow acquires an IPv4 addr. • The temporary IPv4 addr. is used as an IPv4-translated IPv6 addr. • Stateless IP/ICMP translation
Applicability and Limitation • IPv6 node sees an IPv4-mapped addr. for the peer • IPv6 node uses an IPv4-translatable addr. for its local addr. for that communication • Only ESP transport mode (IPsec) is relatively easy to make work through a translator • Does not work for multicast packets
Addresses • IPv4-mapped: 0::ffff:a.b.c.d (refers to an IPv4 node) • IPv4-compatible: 0::0:a.b.c.d (refers to automatic tunneling) • IPv4-translated: 0::ffff:0:a.b.c.d (refers to an IPv6-enabled node) • 0::ffff:0:0:0/ 96 is chosen to checksum to zero to avoid any changes to the transport protocol’s pseudo header checksum
Translating IPv4 Headers to IPv6 Headers(1/5) • Version: 6 • Traffic Class: Always set to zero or, by default, copied from Type of Service and Precedence field • Flow Label: 0 • Payload Length: Total length value from IPv4 header, minus the size of the IPv4 header and IPv4 options, if present
Translating IPv4 Headers to IPv6 Headers(2/5) • Next Header: protocol field copied from IPv4 header • Hop Limit: TTL value copied from IPv4 header • Source Address: low-order 32 bits: IPv4 source addr high-order 96 bits: ::ffff:0:0/96 (IPv4- mapped prefix)
Translating IPv4 Headers to IPv6 Headers(3/5) • Destination Address: low-order 32 bits: IPv4 destination addr high-order 96 bits: 0::ffff:0:0:0/96 (IPv4-translated prefix) • IPv4 options are ignored (not translated) • Error if an un-expired source route option is present
Translating IPv4 Headers to IPv6 Headers(4/5) • If a fragment header is needed (DF bit is not set or the packet is a fragment) • IPv6 Fields Payload Length: Total length value from IPv4 header + 8 (fragment header) – IPv4 header length Next Header: Fragment Header (44)
Translating IPv4 Headers to IPv6 Headers(5/5) • Fragment Header Fields • Next Header: Protocol field copied from IPv4 header • Fragment Offset: Fragment Offset copied from IPv4 header • M Flag: More Fragment bit copied from IPv4 header • Identification: Low-order 16 bits: copied from the ID field in the IPv4 header High-order 16 bits: set to zero
Translating UDP over IPv4 • Un-fragmented UDP IPv4 packets Calculate the checksum if the checksum field is zero • Fragmented UDP IPv4 packets First fragment: Drop the packet, generate a system management event Other fragments: Drop the packet
When to Translate • Assume the translator knows the pool of IPv4 addresses that are used to represent internal IPv6-only nodes • CPU translates ICMPv4 to ICMPv6
Translating IPv6 Headers into IPv4 Headers(1/6) • Version: 4 • Internet Header Length: 5 (no IPv4 options) • Type of Service and Precedence: By default, copied from the Traffic Class (all 8 bits) or always set to zero • Total Length: Payload Length value from IPv6 header + size of the IPv4 header
Translating IPv6 Headers to IPv4 Headers(2/6) • Identification: All zero • Flags: More Fragment = 0 Don’t Fragment = 1 • Fragment Offset: All zero • Time to Live: Hop Limit value copied from IPv6 header (Decrement TTL and check if zero after translation)
Translating IPv6 Headers into IPv4 Headers(3/6) • Protocol: Next Header field copied from IPv6 header • Header Checksum: Computed once the IPv4 header is created • Source Address: If the IPv6 source addr is an IPv4-translated addr Use the low-order 32 bits for IPv4 addr else Set to 0.0.0.0 (to avoid completely dropping)
Translating IPv6 Headers to IPv4 Headers(4/6) • Destination Address: Low-order 32 bits of the IPv6 destination address • IPv6 hop-by-hop options header, destination options header, or routing header (with Segments Left field equal to zero) are ignored with Total Length adjusted • Routing header with a non-zero Segments Left field: Error
Translating IPv6 Headers to IPv4 Headers(5/6) • IPv6 packets with Fragment header Total Length: Payload length value from IPv6 header – 8 (Fragment header) + size of IPv4 header • Identification: Copy from the low-order 16 bits of the ID field in the Fragment header
Translating IPv6 Headers to IPv4 Headers(6/6) • Flags: More Flag = M flag in the Fragment header Don’t Fragment Flag = 0 • Fragment Offset: Copied from the Fragment Offset field in the Fragment header • Protocol: Next Header field copied from Fragment header
When to Translate • Receives an IPv6 packet with an IPv4-mapped destination address
Network Address Translation – Protocol Translation (NAT-PT) (RFC 2766)