Pennington, Mike: I wanna thank everyone for joining events like this are
Pennington, Mike: brought to you by our engagement and Development Advisory
Pennington, Mike: Council. Same group of members that plan our annual conference.
Pennington, Mike: Stay tuned for more training throughout the year.
Pennington, Mike: I'd like to introduce myself.
Pennington, Mike: I'm Mike Pennington.
Pennington, Mike: If you don't know, I'm ACN engineer coming up on my 14th
Pennington, Mike: year here at CEN.
Pennington, Mike: I'll be moderating the session helping with Q&A as needed.
Pennington, Mike: Jason's presentation is divided into several sections.
Pennington, Mike: A pause at the end of each section for questions, but feel
Pennington, Mike: free to type in any questions while he's speaking.
Pennington, Mike: So you don't forget and we'll. We'll keep an eye on that and
Pennington, Mike: and let him know. But in terms of that, I'd like to introduce
Pennington, Mike: our main speaker, Jason Healey, the Director of Technology at
Pennington, Mike: Southfield Academy.
Jason Healy: Hi, thank you, Mike.
Jason Healy: What a lovely audience we have today.
Jason Healy: Thank you for joining me on a Tuesday morning.
Jason Healy: I know you're probably all busy, but I am excited to present
Jason Healy: about this.
Jason Healy: I've been a big fan of IPP 6 for a long time and I'm happy to
Jason Healy: sort of share our experience and hopefully bring you further
Jason Healy: along in your planning for this. As Mike said, the presentation
Jason Healy: is broken up into several sections.
Jason Healy: I'll try to pause.
Jason Healy: To give people chances to ask questions but do drop stuff in
Jason Healy: the chat.
Jason Healy: Michael, interrupt me if I get on A roll here. If there any
Jason Healy: questions that I should be getting too.
Jason Healy: Briefly, as people are still arriving a little bit about me,
Jason Healy: as Mike said, I'm the director of it at Suffield Academy.
Jason Healy: Suffield Academy is right up in the North Central part of the
Jason Healy: state.
Jason Healy: I like to joke that if you're not sure where we are, we're
Jason Healy: right. Between the airport and Six Flags. So if you know where
Jason Healy: those two are, then you can pretty much find me.
Jason Healy: Where Aboarding high school.
Jason Healy: So we about 420 students, about 2/3 of them.
Jason Healy: Live on campus, so it's kind of like a really small College in
Jason Healy: that way. We do have a residential component, so
Jason Healy: students are on the network all the time. I have the the
Jason Healy: pleasure of saying that I'm on CEN all the time because I have
Jason Healy: it at my.
Jason Healy: House as well. So I'm living this network stuff that I do
Jason Healy: every day as the director of ITI managed the IT department. I
Jason Healy: also get to teach two sections of computer science and I run
Jason Healy: most of our networking so I wear several hats.
Jason Healy: I'm deeply involved in all of this.
Jason Healy: And like I said, I'm I'm eating my own dog food in terms of of
Jason Healy: all the changes that I make to the network.
Jason Healy: Let's get going on on what we're doing today.
Jason Healy: So today's talk, a couple things.
Jason Healy: What it is not, we're not going to be talking about whether you
Jason Healy: want to be using IPV 6V6 or not. I'm assuming that you want to.
Jason Healy: Otherwise you wouldn't be attending this.
Jason Healy: So we're not going to go over that.
Jason Healy: It's also not going to be a real background talk about IPV 6
Jason Healy: itself, so it is going to be fairly technical. We're going to
Jason Healy: be talking about.
Jason Healy: Some of the adoption technologies that you can use,
Jason Healy: I'm gonna give a super short slide reminder for people.
Jason Healy: So even if you're not.
Jason Healy: Great on IPV 6 yet.
Jason Healy: Maybe it's not all familiar.
Jason Healy: I'll try to give you enough background to get started.
Jason Healy: OK.
Jason Healy: So why IPV 6 mostly and I I wish I had called the the
Jason Healy: presentation that when I started, but that's a term
Jason Healy: that's sort of starting to emerge now in a lot of the
Jason Healy: discussion groups around IPP 6 and that's really what this talk
Jason Healy: is about is trying.
Jason Healy: To get to IPV 6 mostly like, that's your primary network
Jason Healy: protocol K and so why are we doing that?
Jason Healy: We're doing that because things have changed a lot recently. IPV
Jason Healy: 6 has been around for a long time, but adoption has not been
Jason Healy: great.
Jason Healy: But it's getting better and better and better, and we've
Jason Healy: sort of turned a corner now in terms of the major operating
Jason Healy: system vendors starting to adopt it and support it and actually
Jason Healy: make it their preferred protocol.
Jason Healy: Dual stack wasn't meant to be forever, so the original plan
Jason Healy: was let's run dual stack.
Jason Healy: But then we found out that IPV 4 kind of wouldn't die off on its
Jason Healy: own.
Jason Healy: So it's gonna need a little bit of a push that's gonna require
Jason Healy: operators, network operators like ourselves to to take that
Jason Healy: step.
Jason Healy: IPV 6 is becoming a necessity. There really isn't going to be
Jason Healy: any more IPV 4, so we want to make sure that we're getting
Jason Healy: ready for that next protocol. And because dual stack.
Jason Healy: Wasn't always meant to be around forever, it it may. Maintaining
Jason Healy: multiple stacks is is a bit of a hassle, so we're really looking
Jason Healy: to get off of IPV 4 as much as possible and turn it into
Jason Healy: service a legacy service rather than the primary protocol and
Jason Healy: the the.
Jason Healy: Last bit about that is that Nat is Nat. The way we're going to
Jason Healy: do that is through is is using a Nat like technology and most of
Jason Healy: us are already using that.
Jason Healy: Unless you happen to work somewhere where you have plenty
Jason Healy: of IPV 4 addresses but a lot of us are already doing that.
Jason Healy: So my argument is going to be if you're doing that anyway.
Jason Healy: Why not do it for IPV 6 and eliminate it for IPV 4?
Jason Healy: OK so.
Jason Healy: Yes. And the time to start is now.
Jason Healy: So even if you think I don't need IPV 6, I'm not sure if I
Jason Healy: need IPV 6. This process does take time. You can learn from
Jason Healy: some of the mistakes and some of the things that I've done.
Jason Healy: But even even if you don't take as long as we did to do it,
Jason Healy: you're going to want to start as soon as possible.
Jason Healy: These next two slides, I'm just going to skip over if you come
Jason Healy: back to this presentation later. This basically outlines
Jason Healy: everything I'm going to talk about and it can also act as a
Jason Healy: little checklist.
Jason Healy: For you as you work through this process on your own.
Jason Healy: So if you're gonna sort of start your IPV 6 journey, you can
Jason Healy: follow along with these steps and that's gonna give you a
Jason Healy: blueprint, a road map of how to get this stuff done.
Jason Healy: So these are all the things that I'm gonna be going through
Jason Healy: today.
Jason Healy: So let's start gently.
Jason Healy: Pre IP IPv6 deployment.
Jason Healy: So again, some people are gonna be in different places on this.
Jason Healy: Some of you may already have AV6 allocation.
Jason Healy: Some of you may not have thought about it until now, so I wanted
Jason Healy: to give some brief background.
Jason Healy: Just some quick reminders for folks about what IPV 6 looks
Jason Healy: like.
Jason Healy: The addresses are much longer.
Jason Healy: They're 128 bits.
Jason Healy: We represent them as eight groups with 4X digits each.
Jason Healy: So there's a sample IPV 6 address there. You can compress
Jason Healy: the zeros out of it.
Jason Healy: So any leading zeros can go away.
Jason Healy: So this zero here, we don't need to write it 'cause, it's a
Jason Healy: leading 0.
Jason Healy: This chunk of zeros here we can replace with a double colon.
Jason Healy: You can only do that once in an address. So anytime we want to
Jason Healy: get rid of a whole run of zeros, we're just going to put.
Jason Healy: Colon. So when you see those addresses, don't be surprised.
Jason Healy: OK, the overwhelming default right now is to subnet IPV 6
Jason Healy: into slash 60 fours, so 64 bits of the 128 are for the network
Jason Healy: portion of the address.
Jason Healy: The other 64 bits are for the interface or host portion of the
Jason Healy: address. OK.
Jason Healy: You're probably used to an IPV 4. Being able to slice things up
Jason Healy: a bunch of different ways, and IPV 6. We really pretty much
Jason Healy: only do slash 60 fours.
Jason Healy: Multiple addresses per note are common. That's.
Jason Healy: A pretty major change from how we usually do IPV 4 and we'll
Jason Healy: see how that affects us a little bit later. But when you're
Jason Healy: seeing some of the output from the devices here, you're going
Jason Healy: to see multiple addresses. That's very normal.
Jason Healy: And IPV 6 makes extensive use of multicast.
Jason Healy: It uses an entirely different way of binding layer three to
Jason Healy: layer 2 called neighbor discovery. Instead of using ARP,
Jason Healy: that's way outside the scope of our talk for today. So I want to
Jason Healy: let you know we'll be talking about a few gotchas that happen
Jason Healy: with IPV 6, but.
Jason Healy: They're mostly going to be related to the transition
Jason Healy: technologies that I'm going to be discussing. If you're not
Jason Healy: familiar with IPV 6 very much.
Jason Healy: You're definitely going to want to read up on some of the other
Jason Healy: fundamental concepts that go along with it.
Jason Healy: One thing that I am going to talk about is the IPV 6 router
Jason Healy: advertisement.
Jason Healy: I've got a a picture from Wireshark here and so the router
Jason Healy: advertisement is a way that the router's advertise.
Jason Healy: Well, obviously that they're on the subnet and they're available
Jason Healy: to serve IPV 6, but they also pass out a bunch of options to
Jason Healy: let hosts on the subnet know.
Jason Healy: Not only that, this is a router, but also what address can they
Jason Healy: select for themselves.
Jason Healy: There's a process called stateful local auto config
Jason Healy: address configuration, so that's.
Jason Healy: That's slack. That's what that acronym is. And.
Jason Healy: They can also pass out other things.
Jason Healy: Now we started to load things into these router advertisements
Jason Healy: to hand out DNS servers, as you'll see later, Nat 64
Jason Healy: information.
Jason Healy: So if you're used to doing everything through DHCP, you're
Jason Healy: definitely going to want to know about these router
Jason Healy: advertisements, because that's where we're going to hand out a
Jason Healy: bunch of this stuff, right?
Jason Healy: Just looking briefly at some of these options, this is a sample
Jason Healy: advertisement up here.
Jason Healy: The stuff in the yellow you get to say whether you want clients
Jason Healy: to configure themselves.
Jason Healy: Or whether they're going to be configured via DHCP or some
Jason Healy: combination of the two. So this router advertisement says
Jason Healy: there's no managed configuration. There's no DHCP
Jason Healy: at all.
Jason Healy: These green ones are some of the IPV six options.
Jason Healy: You can see there's the router address that's going to be in
Jason Healy: there.
Jason Healy: We're also handing out Adns server address. This other green
Jason Healy: one down at the bottom.
Jason Healy: We're handing out a search list, so those are all available as
Jason Healy: options.
Jason Healy: That are loaded into the the router advertisement and then
Jason Healy: these ones in the red are for the prefix and those are really
Jason Healy: important when you want a host to be able to join AV6 network
Jason Healy: you have to tell it what address range is available to it. So.
Jason Healy: With DHCP, where we usually hand things out ourselves, we we have
Jason Healy: the server configured to specify certain addresses for users.
Jason Healy: With IPV 6, we kind of just give a hint. We say here's the
Jason Healy: network that's available to you.
Jason Healy: Go ahead and pick yourself an address.
Jason Healy: OK.
Jason Healy: There's 18 quadrillion addresses to pick from, so the chance of
Jason Healy: picking the same one as someone else at relatively low.
Jason Healy: So we let the host do it for themselves.
Jason Healy: So if you're not familiar with that change, that's a that's a
Jason Healy: big one to know, and that's why I mention it here.
Jason Healy: Before I move on, that's kind of all I'm going to talk about sort
Jason Healy: of fundamental V6 stuff, anything.
Jason Healy: I don't see anything in the in the chat here, but.
Pennington, Mike: One quick thing though, Jason.
Pennington, Mike: I'm just wondering if anyone else other than Justin and Andy
Jason Healy: Yep.
Pennington, Mike: are having that issue with not seeing your presentation. If you
Pennington, Mike: are just hit us up in chat.
Pennington, Mike: I'm not sure what this is about.
Pennington, Mike: I googled it but obviously that wasn't any help.
Pennington, Mike: All right, so a few people are getting that same thing.
Pennington, Mike: I'm not sure if I can see it, so I'm not sure if it's all
Jason Healy: Hmm, OK.
Pennington, Mike: attendees, but.
Pennington, Mike: OK.
Pennington, Mike: Yeah, I would.
Pennington, Mike: OK, so some people can't see, OK.
Jason Healy: OK, some of you can submit.
Pennington, Mike: So I would.
Pennington, Mike: I would continue and.
Pennington, Mike: I wonder if it's something with whether they're using the app or
Pennington, Mike: the program, but I would go ahead and continue and we'll.
Pennington, Mike: I'm gonna look around in the background.
Jason Healy: OK.
Arenberg, Wade: Did they try to leave and rejoin by chance?
Arenberg, Wade: Mine work perfectly when I first logged in so.
Pennington, Mike: OK, that may be.
Pennington, Mike: That may be a option.
Pennington, Mike: Leave and rejoin and see if that happens.
Pennington, Mike: And just let us know if that helps. Thanks, wade.
Jason Healy: That looks OK.
Collard, Rachael: So gave the everybody the ability to unmute. If you wanna
Collard, Rachael: tell us anything. If you're having problems.
Pennington, Mike: Thank you.
Jason Healy: OK, OK people, it seems like most people were to use it, so
Jason Healy: I'm my apologies for folks that are having trouble, but I think
Jason Healy: we'll stick with with this mode for now.
Jason Healy: OK so.
Jason Healy: Still in.
Jason Healy: Kind of the pre deployment phase here, something that I want you
Jason Healy: to consider. You may not have thought about is to update your
Jason Healy: specifications.
Jason Healy: Hopefully you have some kind of specifications.
Jason Healy: Document that you're allowed to use at your organization via
Jason Healy: construction, documentation, or procurement, or purchasing
Jason Healy: information you want to slip something in there now about IPV
Jason Healy: 6 being mandatory and the reason why is simply because purchase
Jason Healy: cycles are usually measured in years.
Jason Healy: If you're looking to get this done, you wanna make sure that
Jason Healy: all the equipment you're buying now supports IPV 6, so that when
Jason Healy: you are ready to turn it on for everybody, you're not chasing
Jason Healy: down a bunch of equipment trying to figure out why it doesn't
Jason Healy: work trying.
Jason Healy: To get rid of it because it it can't be updated.
Jason Healy: So even if you're not ready right now, this this year even
Jason Healy: to to turn on IPV 6 for yourself, or to try to switch to
Jason Healy: it, you want to start putting that language in so that you're
Jason Healy: ready for the future. So.
Jason Healy: Here's an example from our construction specifications of a
Jason Healy: highlighted it here.
Jason Healy: We were saying the new equipment that uses IP must support
Jason Healy: operating only in IPV 6 must be possible to deploy, configure
Jason Healy: and operate fully using only IPV 6.
Jason Healy: Technically, we want to say, you know, IPV 4 or IPV 6, but in
Jason Healy: reality you don't ever need to say that V4 is always supported.
Jason Healy: So we just phrase it as IPV 6 only is is what we want to have
Jason Healy: in there. Now as I said here at the bottom, that doesn't
Jason Healy: magically make everything work.
Jason Healy: The vendors are going to say to you, oh, yeah, of course.
Jason Healy: Those or or they'll push back on it, or they'll just ignore the
Jason Healy: requirement altogether.
Jason Healy: But you need that backstop so that if you have an issue down
Jason Healy: the road, you can come to them and say, look, look, look, we
Jason Healy: said that it had to do this.
Jason Healy: You agreed that it was going to do this, and now we're going to
Jason Healy: hold you to it because you don't want to be stuck with a piece of
Jason Healy: equipment that has a long lifetime. That's not going to
Jason Healy: happen.
Jason Healy: We're in the middle of that right now.
Jason Healy: We're trying to get a hard access system on our campus and
Jason Healy: we wrote this into the specs and it was all.
Jason Healy: You know, everybody was happy and it was going to work and it
Jason Healy: was going to be amazing. And then halfway through we found
Jason Healy: out, oh, actually there are some bugs with V6 and it's not going
Jason Healy: to work.
Jason Healy: And we came back to the specs and we said look, it's in the
Jason Healy: contract.
Jason Healy: We we said that this was very important to us and you need to
Jason Healy: make it right.
Jason Healy: And so now we're pushing back on the manufacturer and and we're
Jason Healy: essentially withholding payment until that comes in. It's much
Jason Healy: harder to do if you don't have it in writing somewhere.
Jason Healy: So try to update your documentation now so that you're
Jason Healy: ready for that down the line.
Jason Healy: All right.
Jason Healy: And then the last sort of pre deployment step is to actually
Jason Healy: get some IPV 6 addresses.
Jason Healy: So how do you do that?
Jason Healy: You file a ticket with Cen Mike over here is going to be.
Jason Healy: Happy to get you some addresses. He'll give you a slash 48, which
Jason Healy: is an awful lot.
Pennington, Mike: 1.2 septillion addresses.
Jason Healy: There we go.
Jason Healy: So he's got plenty of handout.
Jason Healy: So the the slash 48. If you look at at the beginning of your IPV
Jason Healy: 6 address, those first 32 bits are going to belong to CEN, and
Jason Healy: then the next.
Jason Healy: 16 bits are going to be yours.
Jason Healy: Those next 4X digits.
Jason Healy: So to put that in perspective, what does that mean that that
Jason Healy: gives you enough space to carve up about 65,000 subnets assuming
Jason Healy: we use the standard size subnet of a slash 64?
Jason Healy: So you should have plenty of space.
Jason Healy: To divide that up and use it however you want, to put that
Jason Healy: into context. If you're in AV4 segment, that's the same as as
Jason Healy: having the entire 10.8.
Jason Healy: I mean 10.0 dot 0.0 space divided up into individual slash
Jason Healy: 24 subnets, OK.
Jason Healy: So here I'm giving an example right the the the 16 there is
Jason Healy: all available to you and then underneath if we were to provide
Jason Healy: the 10 space up, we'd use the middle 2 digits to do that.
Jason Healy: It's also 16 bits.
Jason Healy: So 65,000 subnets are available.
Jason Healy: The handoff and the routing and all that stuff are just like
Jason Healy: they are in IPV 4, so I'm not going to go into a lot of
Jason Healy: detail. CN will give you an individual slash 64 as a handoff
Jason Healy: address to your equipment if you're like us, you're just.
Jason Healy: Going to make cen your default route.
Jason Healy: Send everything out that way and then they'll route everything
Jason Healy: back to your prefix and hand it back off to you.
Jason Healy: Now that you've got 65,000 subnets worth of space, what are
Jason Healy: you going to do?
Jason Healy: Give a little bit of thought in terms of how you'd like to
Jason Healy: divide that up.
Jason Healy: There's a lot of lot of different ways you can do it.
Jason Healy: The recommendations generally go around using the nibble
Jason Healy: boundaries, right? Those individual hex digits you want
Jason Healy: things to to line up on a nice binary digit if possible.
Jason Healy: You can divide things up by campus or site.
Jason Healy: You can divide them up by building or by function. The way
Jason Healy: that we've decided to do it.
Jason Healy: Is just by lining the subnets up with the VLAN that they belong
Jason Healy: to. If you're like us, we have a campus, we have a bunch of
Jason Healy: vlan's for different administrative functions, and So
Jason Healy: what we do is we just embed the VLAN ID into the IPV 6 address.
Jason Healy: There's plenty of space. You only need 12 bits for all the
Jason Healy: VLAN IDs, and we've got 16, so we use 3 digits to represent
Jason Healy: that.
Jason Healy: So for example VLAN 2.
Jason Healy: Here you can see the address starts with our prefix and then
Jason Healy: has a 2.
Jason Healy: Be line 37 starts with the same prefix and then has a 25.
Jason Healy: The reason for the 25 is that we're using the hexadecimal
Jason Healy: representation of the ID, so VLN 37 in decimal is VLAN 25 in
Jason Healy: hexadecimal.
Jason Healy: We have a lot of automation that we use to roll out stuff to our
Jason Healy: switches.
Jason Healy: So it's not. I'm not doing the the binary arithmetic in my head
Jason Healy: for sure I'd mess it up.
Jason Healy: So if you're using automation, it can usually spit those
Jason Healy: numbers out in whatever form you need them.
Jason Healy: So if you need them decimal for one place and hexadecimal for
Jason Healy: another, then that should be fine.
Jason Healy: So that's the way that we're doing it.
Jason Healy: Happy to talk about it with anybody offline, but that's as
Jason Healy: much as I'll go into it right now.
Jason Healy: It does behoove you to spend a little bit of time thinking
Jason Healy: about how you want to slice things up so that as you start
Jason Healy: to turn those subnets on, you've got a plan that you're following
Jason Healy: instead of just doing it on an ad hoc kind of basis.
Jason Healy: I think that wraps up most of the pre IPV 6 stuff.
Jason Healy: So.
Jason Healy: If there's anything else, I don't see anything in the chat.
Pennington, Mike: No, no questions in chat.
Jason Healy: OK.
Pennington, Mike: Rachel did open up microphones if anyone wanted to. If they had
Pennington, Mike: any questions real quick on before they forget.
Pennington, Mike: Think we're good?
Jason Healy: OK.
Pennington, Mike: So yeah, go for it.
Jason Healy: So on to dual stack then.
Jason Healy: So once you've got everything ready to go with IPV 6, it's
Jason Healy: time to start rolling it out, at least to a test subnet.
Jason Healy: So let's let's take a single subnet and see what that looks
Jason Healy: like.
Jason Healy: So we'll identify a test subnet.
Jason Healy: I'm picking VLAN 2 on my hypothetical campus.
Jason Healy: That means that my subnet ID is going to have that two embedded
Jason Healy: in the the V6 address.
Jason Healy: And what we have to do is we have to set up our our core
Jason Healy: router, our core switch.
Jason Healy: With a router address that defines that subnet, and we're
Jason Healy: also gonna broadcast adns server just so we can see what those
Jason Healy: router advertisements look like.
Jason Healy: So here's some examples.
Jason Healy: You'll you wanna look at the individual manufacture
Jason Healy: instructions.
Jason Healy: So here's a Cisco example where we assign the V6 address and
Jason Healy: then we have an option down there for the router
Jason Healy: advertisement.
Jason Healy: That's the RA that you see there, where we're putting out
Jason Healy: the DNS server on Juniper.
Jason Healy: It's a little bit different, but the same idea. We wanna set up a
Jason Healy: a VLAN.
Jason Healy: We want to bind a layer three address to that VLAN.
Jason Healy: And then we want to turn on router advertisements and send
Jason Healy: out that DNS address, and once you commit that change, then any
Jason Healy: host that connects to that subnet should start getting
Jason Healy: those router advertisements and set themselves up accordingly.
Jason Healy: So here's what it looks like on my Mac if I plug it into that
Jason Healy: subnet, it's going to get that router advertisement.
Jason Healy: Find that IPV 6 prefix and assign itself an address.
Jason Healy: In the prefix. So here you can see the prefix is as defined by
Jason Healy: the router up to that two and then these last bits here are
Jason Healy: made-up by the machine and claimed as an address.
Jason Healy: These are fake addresses.
Jason Healy: I made these up different machines do a different way.
Jason Healy: Some of them pick a number based on their hardware.
Jason Healy: Some pick your random number, some do both.
Jason Healy: But the main thing is that you want that prefix to look
Jason Healy: correct.
Jason Healy: Additionally, since we're sending out that DNS server,
Jason Healy: that should show up on your machine as well.
Jason Healy: That varies by machine.
Jason Healy: If you're on a Unix like machine, it'll be an
Jason Healy: etsyresolve.com.
Jason Healy: Probably. And it may be merged with V4.
Jason Healy: Again, this is turned on in addition to V4.
Jason Healy: So we've gonna have both address families there at the same time.
Jason Healy: And with that, assuming that you have your route set up to send
Jason Healy: everything out to CEN, you should have enough now to ping
Jason Healy: the outside world.
Jason Healy: So this is the shortest address I can think of to Ping 2600
Jason Healy: colon colon one. I think that's Sprint.
Jason Healy: So if you've got your routing set up then you should be able
Jason Healy: to.
Jason Healy: Ping directly at this point on your test subnet and at that
Jason Healy: point you are dual stack.
Jason Healy: You're ready to go.
Jason Healy: V6 is up and running.
Jason Healy: And you should be able to start using it.
Jason Healy: So you've got your dual stack network going. What I would
Jason Healy: recommend next is that you start trying to get your own house in
Jason Healy: order. If you have internal servers or servers that you
Jason Healy: control, you're going to want to start to convert those to IPV
Jason Healy: six first.
Jason Healy: Want to have stuff available for your IPV 6 network to talk to?
Jason Healy: Also, you want to make sure that you're ready before you start
Jason Healy: worrying about the Internet at large.
Jason Healy: So you kind of want to get your own house in order.
Jason Healy: So here's a quick example from a Linux machine.
Jason Healy: You just add a stanza here that says that you want to do IPV 6.
Jason Healy: There's usually an automatic mode, which is what your clients
Jason Healy: are going to be using.
Jason Healy: It'll get a hardware derived address or it'll pick.
Jason Healy: A random one. But if you want to have a fixed address, you can
Jason Healy: also put that in as well.
Jason Healy: Usually for servers you want addresses that don't change, so
Jason Healy: you either wanna use a hardware derived one or you can manually
Jason Healy: specify one we used to manually specify. Now we just do the
Jason Healy: hardware based ones, we just put it into DNS.
Jason Healy: The hardware address doesn't change and it stays stable over
Jason Healy: time.
Jason Healy: OK, if you're doing server stuff, you may need to turn on
Jason Healy: V6 in some of your server packages.
Jason Healy: So for example engine X or Apache.
Jason Healy: You may have to add a listen directive that specifically
Jason Healy: mentions IPP 6 or it'll continue to only listen on V4.
Jason Healy: So if you get this stuff turned on and you're able to ping your
Jason Healy: server, but then you still can't get to it from Web browser or
Jason Healy: whatever you're testing it with. Just double check that the
Jason Healy: service is actually listening.
Jason Healy: As you start to roll this out, you're going to want to pay
Jason Healy: attention to security policies.
Jason Healy: A/C LS if you're like us, you might have had a lot of kind of
Jason Healy: allow list only sort of ACL set up. If that's the case, you may
Jason Healy: be restricting things only to certain trusted IPV 4 addresses,
Jason Healy: but now that you're adding V6, you got to make.
Jason Healy: Sure that you're opening those up as well, so.
Jason Healy: Try to make sure that you're testing this out as you're
Jason Healy: starting to roll it out. Make sure that you can reach your
Jason Healy: machines both from V4 and from V6.
Jason Healy: Six as you go, you'll need to duplicate your policies.
Jason Healy: I recommend just grabbing a test machine, shutting V4 off and
Jason Healy: seeing if you can get the stuff.
Jason Healy: I did that for about a month on our network.
Jason Healy: I restricted my machine to V6 only, tried to do my daily
Jason Healy: system administration tasks and I very quickly found out which
Jason Healy: machines were working and which ones weren't.
Jason Healy: So you can you can get things cleaned up pretty quickly by
Jason Healy: just living in it for a little while.
Jason Healy: Add your V6 addresses to your service monitoring also. That
Jason Healy: way you'll know.
Jason Healy: If the V6 addresses are down or unreachable, or the service is
Jason Healy: down or unreachable in one address family versus another.
Jason Healy: I see a question here about tracking so tracking machines.
Jason Healy: If they're using hardware derived addresses, those
Jason Healy: addresses should remain stable.
Jason Healy: Now what?
Jason Healy: You might be talking about is probably.
Jason Healy: We're used to using DHCP. Dhcp kind of gave us a CHEAT SHEET
Jason Healy: when we wanted to find machines on the network. It logged a Mac
Jason Healy: address and associated it with an IPP 4 address.
Jason Healy: And that gave us an ability to go back later and say, OK, which
Jason Healy: machine was this at the time that had this particular IP
Jason Healy: address? That functionality doesn't quite map in IPV 6 land.
Jason Healy: There is dhcpv 6.
Jason Healy: It does exist and it fulfills that same role, but not all
Jason Healy: machines actually support dhcpv 6. Notably Android. Android has
Jason Healy: kind of a philosophical argument against it, and they haven't
Jason Healy: supported it in.
Jason Healy: Their operating system.
Jason Healy: So in those cases, the only way to get that information is to
Jason Healy: actually, well, the only way that I know of that's that's
Jason Healy: fairly reliable is to scrape the binding tables off of your
Jason Healy: switches. You log in with SNMP, you pull down the the neighbour
Jason Healy: discovery tables and.
Jason Healy: You can link Mac addresses to IPV 6 addresses.
Jason Healy: This is kind of a known operational issue that people
Jason Healy: want that tracking ability and there's an RFC right now that's
Jason Healy: in platform that's trying to talk about.
Jason Healy: Practices around that.
Jason Healy: But right now, one of their major recommendations is just to
Jason Healy: scrape the tables in order to get that information.
Jason Healy: And then the other question was how do you deal with Mac
Jason Healy: addresses that change if you have something like that where
Jason Healy: you're going to where, you know, the machine is going to be
Jason Healy: changing Mac addresses, then a hardware derived address
Jason Healy: probably isn't your best bet. You can you.
Jason Healy: Can move to a randomized address that has some kind of stable
Jason Healy: seed so that it doesn't change over time. Or you can just go to
Jason Healy: picking static addresses that have a well known number
Jason Healy: associated with it.
Jason Healy: That's also fine.
Jason Healy: Alright, so you've got your machines pretty well tested.
Jason Healy: This is gonna be kind of concurrent with that.
Jason Healy: You're gonna wanna set up DNS records that reach your IPV 6
Jason Healy: hosts.
Jason Healy: Fortunately, that's done in parallel with your V4 host, so
Jason Healy: we use a records for IPV 4 and we use Quad a records for IPV 6.
Jason Healy: Because the addresses are four times as long.
Jason Healy: So that's what they decide to name.
Jason Healy: They can coexist nicely.
Jason Healy: You can have both records available for a server.
Jason Healy: If you have like A/C name or an MX that refers to some host dot
Jason Healy: domain, you can have an IPV 6 entry for that and AV4 entry and
Jason Healy: it'll be up to the the clients that are querying DNS to decide
Jason Healy: which one it is that they want.
Jason Healy: To use again, you want to be testing this well and make sure
Jason Healy: that those services are answering your A/C. LS are in
Jason Healy: order, because once you publish those records, hosts are going
Jason Healy: to start to use them right away.
Jason Healy: I'll an example.
Jason Healy: About well, right now.
Jason Healy: So.
Jason Healy: When you're when you're ready and you're tested, you can start
Jason Healy: to roll this out to subnets.
Jason Healy: OK, all subnets.
Jason Healy: So you're gonna wanna keep V4 on.
Jason Healy: We're doing dual stack right now.
Jason Healy: I'm on and available to continue to work. You add the V6 as we
Jason Healy: just described.
Jason Healy: There's the mystery. Step three and then profit.
Jason Healy: So what I've got here is a graph from last year before we were
Jason Healy: doing any transition mechanisms we had V6 enabled.
Jason Healy: Across our network, on all subnets, we didn't do anything
Jason Healy: else. So we didn't tell anybody.
Jason Healy: Hey, use V6 we didn't.
Jason Healy: We didn't prefer one over the other.
Jason Healy: We didn't do any kind of traffic engineering and what you see
Jason Healy: here in the in the green, that's our V6 traffic and the red is
Jason Healy: our our V4 traffic.
Jason Healy: So V6 actually accounts for about 60 plus percent, usually
Jason Healy: of of all of the traffic on our network.
Jason Healy: This was of last year before we did anything else.
Jason Healy: So like I said, as soon as you start publishing those records
Jason Healy: and you start making those things available, hosts are
Jason Healy: going to start to use it.
Jason Healy: Our campus is all Apple apples particularly aggressive about
Jason Healy: preferring IPV 6.
Jason Healy: So your mileage may vary depending on what kind of
Jason Healy: machines you have, but.
Jason Healy: We're a school campus, so there's a lot of YouTube.
Jason Healy: A lot of social media, a lot of web browsing, and most of those
Jason Healy: things work well the the big companies have rolled out IPV 6,
Jason Healy: so without any other effort, you're immediately going to be
Jason Healy: jumping on.
Jason Healy: It's gonna take a sip of water if there are any questions here.
Jason Healy: Otherwise, we're gonna move on to sort of more advanced stuff.
Jason Healy: We'll get to transition mechanisms.
Pennington, Mike: I just had a couple things. There was a question in chat on
Pennington, Mike: how to get addresses from us.
Pennington, Mike: Just open a ticket, any of your normal options. That's where
Pennington, Mike: you're gonna get addresses and we'll, we'll get you going. Then
Pennington, Mike: help you out. Getting it set up and tested and everything as
Pennington, Mike: well.
Pennington, Mike: The first Test you do with us is basically see if you can ping
Pennington, Mike: across to our side and that's a good start.
Pennington, Mike: So and the other thing is I actually had a quick question,
Pennington, Mike: Jason, I don't know if I don't mention this, but I know
Pennington, Mike: something that some of the guys like to do over here with V6 and
Pennington, Mike: dual stack is you can put like.
Pennington, Mike: The V4 address within the V6, right?
Jason Healy: That's coming up.
Pennington, Mike: Oh, it's perfect. Thank you.
Pennington, Mike: So we will wait for that.
Jason Healy: Well, yes, sorry. There is a mapped out that's been
Jason Healy: deprecated. So you can't normally you need something
Jason Healy: that's gonna translate for you, but it is possible to to embed
Jason Healy: it into AV6 address.
Jason Healy: But that only works if the machine has AV4 stack. So.
Pennington, Mike: Yep, and that's what we're we do a lot of that on our firewall.
Jason Healy: OK.
Pennington, Mike: So perfect. Thanks.
Jason Healy: OK, so dual stack is up and running.
Jason Healy: You're happy if if you're. If you're like us, that process
Jason Healy: alone took several years. But it I was chiseling away at it.
Jason Healy: Little little pieces you can definitely do it quicker.
Jason Healy: Now that there's really good support for it.
Jason Healy: So let's talk about transition technology. So getting to to
Jason Healy: sort of the heart of this talk, which is trying to make IPV 6
Jason Healy: your main protocol, your flagship protocol, why would we
Jason Healy: want to do that?
Jason Healy: Right, dual stack seems pretty good.
Jason Healy: Right, my machine can use V4 if it wants to. It can use V6 if it
Jason Healy: wants to. I can get to everything.
Jason Healy: So so what's the issue?
Jason Healy: Why would I want to change that?
Jason Healy: Well, it doesn't address Ibvc 4. Sorry, shortages.
Jason Healy: That's the one thing. If you're like us, you're running on
Jason Healy: private RFC 1918 space internally 'cause you don't have
Jason Healy: enough public IPV 4 addresses for all of your notes.
Jason Healy: Additionally, running in dual stack mode. Now you've got two
Jason Healy: network stacks to debug instead of 1, so client is telling you
Jason Healy: they're having problems connecting to something.
Jason Healy: Now we have to start to worry about, OK?
Jason Healy: Well, are you connecting on four or you connecting on 6?
Jason Healy: Does one of them work and not the other?
Jason Healy: Do they both not work so that that actually makes your life a
Jason Healy: little bit tougher as a network operator and you definitely
Jason Healy: don't want that?
Jason Healy: There have been changing rules about how address selection is
Jason Healy: going as IPV 6 has has been adopted more and more. Those
Jason Healy: sans have shifted a little bit.
Jason Healy: And happy eyeballs is A is an RFC that tries to.
Jason Healy: Encourage IPV 6 adoption by falling back to V4 when V6
Jason Healy: doesn't work.
Jason Healy: Unfortunately, when you do that, you don't always know that V6 is
Jason Healy: broken.
Jason Healy: Your users aren't going to tell you, oh, there was a half second
Jason Healy: lag when I tried to load this web page, which is when it's,
Jason Healy: you know, switching back to V4.
Jason Healy: They don't know that they don't know that it's happening, so you
Jason Healy: might be running dual stack and thinking everything is great and
Jason Healy: then you start to turn off some V4 functionality and boom,
Jason Healy: you're going to get.
Jason Healy: More problems because it's been hiding those along the way.
Jason Healy: So we really want to try to move as quickly as possible once once
Jason Healy: V6 is up and running, we want to move to make it our main
Jason Healy: protocol and get rid of V4 as much as we can. Not talking
Jason Healy: about eliminating it completely, but making it.
Jason Healy: Secondary to RV6 network.
Jason Healy: So.
Jason Healy: There have been many attempts over the years to have
Jason Healy: transition technologies that do this. The one that we are using,
Jason Healy: the one that seems to be getting a lot of support right now, is
Jason Healy: known as Nat 6/4.
Jason Healy: So Nat 6/4.
Jason Healy: Allows IPV 6 only hosts to reach the IPV 4 Internet, and the way
Jason Healy: that it does this is that you embed the V4 address you want to
Jason Healy: reach inside of a special V6 address. V6 addresses are so big
Jason Healy: 128 bits that there's more.
Jason Healy: Than enough room to stick an entire 32 bit address inside of
Jason Healy: it.
Jason Healy: So the V6 host can basically say OK.
Jason Healy: I'll embed the V4 address in here.
Jason Healy: I'll send that message along and then we.
Jason Healy: A special router special device that can unembed that and turn
Jason Healy: it back into V4 at the network edge.
Jason Healy: And I have some diagrams after this that'll kind of walkthrough
Jason Healy: how that process works.
Jason Healy: So you still need IPV 4 addresses. You still need public
Jason Healy: V4 addresses, but you don't need them on every single host.
Jason Healy: You just need them on this router that's at the edge.
Jason Healy: And there are a bunch of different flavours of net 64.
Jason Healy: That process describes any translation between.
Jason Healy: IPV 6 and IPV 4.
Jason Healy: The one we're gonna talk about, and it's probably most relevant
Jason Healy: to you, is stateful net 64 where we have a lot of V6 clients
Jason Healy: behind.
Jason Healy: Our our router and just a few public V4 addresses that we're
Jason Healy: gonna share that requires keeping state. If you're doing
Jason Healy: that right now, not 4/4 as as it's now been sort of backer
Jason Healy: name, then it's the exact same process of having to keep state.
Jason Healy: Remember who?
Jason Healy: Connected where and share those public IBV 4 addresses.
Jason Healy: All right, so let's walk through an example of how net 64 works.
Jason Healy: For those of you that may not be familiar with it.
Jason Healy: So on the inside of our network we have an IPV 6 only host.
Jason Healy: It has an address here ending in double colon 6.
Jason Healy: Out on the Internet somewhere we have a host that is only
Jason Healy: reachable via IPV 4, the Famous Nerd news site slashdot.org is
Jason Healy: famous for still not adopting V6 to this very day.
Jason Healy: So that's its address out on the Internet and that device, that
Jason Healy: router I was talking about in the middle is known as AP Lat in
Jason Healy: the in the RFC terminology that stands for the provider.
Jason Healy: Side translator. That's where the lap comes from.
Jason Healy: So again, it's intended to be at the network edge.
Jason Healy: It's intended to be run by the person who's operating the
Jason Healy: network.
Jason Healy: So that device has a public V4 address on it, or more than one,
Jason Healy: and then on the inside we have that special range of addresses
Jason Healy: that address range that we're going to embed the V4 addresses
Jason Healy: inside of.
Jason Healy: So this one that I'm showing here is the one called out by
Jason Healy: the RF Cs.
Jason Healy: It's known as the well known prefix because it's the one that
Jason Healy: they sort of suggest as a default.
Jason Healy: SO64FF9B and then.
Jason Healy: There are 96 bits after that that are available for us.
Jason Healy: Oh sorry, it's using 96 bits for the network.
Jason Healy: That leaves 32 bits at the end, which is just enough space to
Jason Healy: embed an IPV 4 address inside of.
Jason Healy: Our plat does also need AV6 address inside of it so that we
Jason Healy: can route that range of addresses to it. So in a
Jason Healy: complete setup you have to add at least a static route if not a
Jason Healy: a dynamic rout for that well known prefix to point towards.
Jason Healy: Your your Nat 64 router.
Jason Healy: So let's see how this works in practice.
Jason Healy: So here's the internal node saying I wanna talk to slash
Jason Healy: dot.
Jason Healy: It looks at the address.
Jason Healy: It gets AV4 address. First thing we do is we convert that V4
Jason Healy: address.
Jason Healy: It doesn't actually do this step, but we're gonna convert it
Jason Healy: into hex.
Jason Healy: So I'm gonna go step by step here.
Jason Healy: SO172 becomes AC64, becomes 40 in a Hex, 151 becomes 97 in Hex
Jason Healy: and 192 becomes C0 next.
Jason Healy: And then we just smush that right into.
Jason Healy: Well known prefix SO64FF9B.
Jason Healy: And then here's the mapped version of the IPV 4 address
Jason Healy: stuck inside of it, and then the host sends it normally.
Jason Healy: So it sends it off and the route that we have on our network is
Jason Healy: going to forward it to that Mat 64 box. The net 64 box receives
Jason Healy: the packet. It looks at that prefix and says ah, this is that
Jason Healy: special prefix that we embed address.
Jason Healy: Into, so I'm going to extract the last 32 bits out of it so it
Jason Healy: pulls out those hex digits.
Jason Healy: And it turns it back into AV4 address and makes AV4 packet.
Jason Healy: So it's performing normal Nat now it chooses.
Jason Healy: Its public V4 address as the source of the packet. It takes
Jason Healy: the embedded destination and makes that the destination of
Jason Healy: the V4 packet. Does its regular nap thing.
Jason Healy: It may need to change the port you know, depending on which
Jason Healy: ports are in use.
Jason Healy: All the regular Nat stuff stores the state and then sends the
Jason Healy: packet on its way off to Slashdot.
Jason Healy: Then for the reverse slash dot sends its reply back. It
Jason Healy: addresses it to the public address of the 964 router,
Jason Healy: because that was the source that it saw.
Jason Healy: Then access C4 receives it and says OK, who does this belong
Jason Healy: to?
Jason Healy: It looks it up in its state. It says.
Jason Healy: Oh, who was talking to slash dot?
Jason Healy: That's right.
Jason Healy: It was this internal node and it does the exact reverse. It turns
Jason Healy: it back into AV6 packet.
Jason Healy: It changes the source of the packet to be embedded in this
Jason Healy: IPV 6.
Jason Healy: Refix once again and it returns the packet back to the IPP 6
Jason Healy: node.
Jason Healy: So from sort of the peel out is the only thing that really knows
Jason Healy: what's going on in its entirety. The IPP 6 node thinks that it's
Jason Healy: talking IPV 6 all the time.
Jason Healy: Meanwhile, Slashdot thinks it's just having a conversation with
Jason Healy: a regular V4 host all the time.
Jason Healy: But in reality, they're both talking to the Nat 64 router,
Jason Healy: and that's the thing that's making.
Jason Healy: Both sides be able to talk to each other.
Jason Healy: So there are multiple devices or software packages that perform
Jason Healy: this Nat 64 process. The one that that we're using is the one
Jason Healy: at the top of this list.
Jason Healy: It's called jewel.
Jason Healy: It's open source.
Jason Healy: It runs on Linux.
Jason Healy: They've made some good improvements to it recently.
Jason Healy: It's kind of a solved problem, so it's not being hyper actively
Jason Healy: developed anymore because the software is more or less feature
Jason Healy: complete.
Jason Healy: They're just squashing bugs.
Jason Healy: We did find bugs when we were using it, so you can thank me
Jason Healy: later, but the last release has fixes for all those in place.
Jason Healy: So we've been using in production. We've been quite
Jason Healy: happy with it.
Jason Healy: It does have a a failover capability, which is really nice
Jason Healy: if you're going to depend on it in production, which we do.
Jason Healy: Another one.
Jason Healy: Oh my goodness. I've been sitting still for too long.
Jason Healy: The lights went out.
Jason Healy: Another one is PF, which is part of the open BSD project.
Jason Healy: They have an excellent firewall built into their OS. We've been
Jason Healy: using that for almost 2 decades.
Jason Healy: It also does address family translation, which is this Nat
Jason Healy: 64 bit.
Jason Healy: We decided not to use that because it didn't have quite the
Jason Healy: same feature set as jewel, but for basic not 64 stuff it works.
Jason Healy: It works just fine.
Jason Healy: We have used it does work.
Jason Healy: Tyga is the I hope I'm pronouncing that correctly.
Jason Healy: That's another one that's very popular.
Jason Healy: It didn't have a failover component, so we didn't really
Jason Healy: consider it when we were looking.
Jason Healy: We were happy with Jewel, so we didn't move down the list to
Jason Healy: look at others.
Jason Healy: And the Fdio project that that does really high speed vector
Jason Healy: packet processing does have a Nat 64 component to it.
Jason Healy: I don't think it has failover though.
Jason Healy: That's the that's the main reason why we didn't do that.
Jason Healy: We were really keen on having redundancy in ours.
Jason Healy: There are commercial solutions as well.
Jason Healy: If you guys are on paleozo for the gates, you may actually have
Jason Healy: this functionality built into your firewall devices so you can
Jason Healy: check out the docs there and you may be able to leverage a piece
Jason Healy: of equipment that you already have if you just want to try it.
Jason Healy: Real quick without setting a bunch of stuff up, there's
Jason Healy: actually a website here.
Jason Healy: These guys run a few.
Jason Healy: They've gotten some donated equipment. I think they have one
Jason Healy: from a 10 something from Cisco and they're running Joule.
Jason Healy: So you can actually use theirs without having to set anything
Jason Healy: up.
Jason Healy: So if you have V6 working on your campus.
Jason Healy: And you wanna give it a shot?
Jason Healy: Then you can try it out for free.
Jason Healy: We did this ourselves before we dug into it on our own and it
Jason Healy: was really helpful just to try it out and confirm, OK.
Jason Healy: Yep, this is working.
Jason Healy: I'm able to reach AV4 only site.
Jason Healy: I think that I've got all my V6 plumbing ready to go and then
Jason Healy: you can kind of investigate and commit to how you wanna run it
Jason Healy: yourself.
Jason Healy: I think I say this on the next slide, but.
Jason Healy: If there's interest I've been proposing to CEN that they
Jason Healy: actually run this as a service for Members, I think that would
Jason Healy: be great.
Jason Healy: It's kind of a commodity item where you know you're just
Jason Healy: translating packets.
Jason Healy: So if that's something that you think would be of interest or
Jason Healy: value to CEN Members, I have a question about on that survey,
Jason Healy: which I'll post again at the end.
Jason Healy: I'd love it if you if you think that's good to, to throw some
Jason Healy: support behind that and then I can bring that back to CEN and
Jason Healy: see if that's a a possibility for us to make as a member
Jason Healy: service.
Jason Healy: So few last things to know about Nat 64 and then I'll pause for
Jason Healy: questions before I go on to anything else.
Jason Healy: Again, it lets us talk V6 to V4.
Jason Healy: You should know that it only works with kind of the big three
Jason Healy: IP technologies.
Jason Healy: These are the ones that we use most often.
Jason Healy: TCPUDPICMP, there are others out there.
Jason Healy: You know Rtsp and GRE and some other ones.
Jason Healy: So Nat 64 does cause problems with things like VPNs that work
Jason Healy: over protocols other than the ones listed here.
Jason Healy: So you should be aware of that.
Jason Healy: I'll talk about that more at the end.
Jason Healy: I have kind of a gotchas section.
Jason Healy: It's very similar to Nat 4/4 in terms of how it operates and the
Jason Healy: bugs that you might run into.
Jason Healy: So if you have an application that doesn't work well through
Jason Healy: Nat four, it's probably not going to work great through Nat
Jason Healy: 64 either.
Jason Healy: There are stateless varieties of Nat 64.
Jason Healy: So if you want to have like a server on your internal network,
Jason Healy: that's V6 only and have it be reachable from outside from V4,
Jason Healy: that's certainly possible.
Jason Healy: You just need to set up kind of a one to one mapping so that
Jason Healy: there's a public.
Jason Healy: V4 address that's reserved for a specific IBB 6 address.
Jason Healy: On the inside, I'm not going to cover that today, but that
Jason Healy: functionality absolutely exists.
Jason Healy: And as part of I'm assuming all of the products that I listed on
Jason Healy: the last page.
Jason Healy: Questions about any confusion about.
Jason Healy: Nat.
Jason Healy: 64 before I go on to other things, because the other things
Jason Healy: I'm going to talk about depend on this, in order to to
Jason Healy: function.
Pennington, Mike: I just had a quick question on the UDP.
Pennington, Mike: You said it works with UDP.
Pennington, Mike: Does it work with like the Google Quic since that's
Pennington, Mike: technically UDP?
Pennington, Mike: Have you seen it work?
Jason Healy: Yes, I haven't had it.
Jason Healy: Yeah, I've had no issues.
Jason Healy: No reported issues with that.
Pennington, Mike: OK.
Jason Healy: It's it's a lot like Nat 4/4, so the port might change the source
Jason Healy: port. I should say should might change because we're you're
Jason Healy: overloading the ports on those shared addresses, but the
Jason Healy: destination ports remain the same.
Jason Healy: And you can, at least on jewel you can toggle. You know how
Jason Healy: long a session stays active without any traffic on it before
Jason Healy: the port is recycled and used for something else.
Jason Healy: So you have some granular control over over the timeouts
Jason Healy: and same stuff that you would have in Nat 4/4.
Pennington, Mike: There's any other questions you can unmute yourself?
Pennington, Mike: Nothing in chat. I'm pretty. I'm pretty sure we'll be doing
Jason Healy: OK.
Pennington, Mike: sharing the slides and the presentation later.
Jason Healy: Yes, yes, yes, yes.
Pennington, Mike: OK, excellent.
Jason Healy: OK.
Jason Healy: So you may remember a few slides ago I highlighted something in
Jason Healy: red and I said don't worry about this part, time to worry about
Jason Healy: that part.
Jason Healy: How does our node know to map IPV 4 addresses into IPV 6?
Jason Healy: You know, how does it know what prefix to use? OK, so.
Jason Healy: We'll move on to the next item in our stack here, which is
Jason Healy: known as DNS64DNS64 was basically invented to work with.
Jason Healy: So its job is to trick IPV 6 hosts into thinking that
Jason Healy: everything is an IPV 6 address.
Jason Healy: So I'll go into how it does that in one second, but it's a little
Jason Healy: bit of trickery, but the nice thing is that because of that
Jason Healy: trickery, you don't really have to do anything on the client at
Jason Healy: all.
Jason Healy: The client machines just think they're talking V6 to everybody
Jason Healy: and they go about their day without any problems and it's
Jason Healy: relatively easy to deploy. You just change the DNS server that
Jason Healy: nodes are using, and if they use adns 64 server.
Jason Healy: And they'll get the correct answers and things more or less
Jason Healy: move along.
Jason Healy: It's not all perfect.
Jason Healy: I'll talk about some drawbacks, but that's that's the appeal of
Jason Healy: it. Setting up your own net 64 server is not particularly
Jason Healy: difficult.
Jason Healy: This is a snippet from the unbound DNS server. You give it
Jason Healy: the DNS 64 prefix.
Jason Healy: So you tell it the prefix that you want to embed all the V4
Jason Healy: addresses into, and then in my case we just set it up to
Jason Healy: forward to our main DNS server so it actually can be like a
Jason Healy: proxy. Almost.
Jason Healy: Top of a functioning uh DNS server and and that's about all
Jason Healy: you need. You can also embed it in your main DNS server if you'd
Jason Healy: like, and in fact the easiest way to do this is to use someone
Jason Healy: else's. If you don't want to spin one up.
Jason Healy: On your own from the get go, there are a bunch of DNS servers
Jason Healy: out there.
Jason Healy: Google DNS and Cloudflare and also this one that 64.net all of
Jason Healy: the addresses listed here.
Jason Healy: Will act as DNS64 servers for you.
Jason Healy: So if you point your machine to them right now, you'll start.
Jason Healy: You can start using it right away.
Jason Healy: So between this and the the demo sites for Nat 64 that I gave you
Jason Healy: earlier.
Jason Healy: You can pretty much try out the whole thing without having to
Jason Healy: set up any equipment on your own.
Jason Healy: So how does DNS 64 actually do what it needs to do?
Jason Healy: Well, let's review what DNS does. In a normal circumstance.
Jason Healy: So let's suppose that I want to talk to Slashdot, my favorite
Jason Healy: website.
Jason Healy: So I'll ask on a dual stack host, one with V6 and V4.
Jason Healy: I will say, OK, can you give me the records, the address records
Jason Healy: for slash dot the DNS server says shirt no problem.
Jason Healy: Here's the V4, then I'll say hey, give me the V6 DNS records
Jason Healy: for slash dot and in this case, because slash dot.
Jason Healy: Doesn't do V6.
Jason Healy: It'll say sorry, there aren't any.
Jason Healy: Not big deal because my host is dual stack so it just ends up
Jason Healy: using V4. Nothing bad happens.
Jason Healy: However, if I have an IPV 6 only machine, that process gets
Jason Healy: truncated a little bit.
Jason Healy: There's no address, no a record that I'm asking for because my
Jason Healy: host doesn't do V4.
Jason Healy: No point in asking for the address when I ask for the V6
Jason Healy: address. Slash dot didn't publish 1, so I'm stuck.
Jason Healy: I can't get to that site now.
Jason Healy: It'll say host not found.
Jason Healy: So DMS 64 prevents this problem by lying a little bit.
Jason Healy: So with DNS64I once again on AV6 only host, I'm going to ask the
Jason Healy: DNS server OK. Please give me the V6 record for this.
Jason Healy: The DNS64 server is going to say hmm, there isn't a quad a record
Jason Healy: for this. But you know what?
Jason Healy: There is an A record.
Jason Healy: It goes and asks and it says there's an A record for this.
Jason Healy: So what I'll do is I'll take that a record address.
Jason Healy: And I will embed the address into ad N SV6 response and send
Jason Healy: that back.
Jason Healy: So the client, from the client's perspective, it asked for AV6
Jason Healy: address, it got AV6 address. It's good to go.
Jason Healy: The DNS664 server is telling a little bit of a fib because we
Jason Healy: asked for AV6 record and there really isn't one.
Jason Healy: But it's synthesized one that will allow it to reach that
Jason Healy: host.
Jason Healy: Now we have to have Nat 64 set up, otherwise there'd be no way
Jason Healy: for this address that the DNS64 server is giving back to be
Jason Healy: translated.
Jason Healy: So they go hand in hand.
Jason Healy: And what are we saying here?
Jason Healy: So yeah, V6 is supported on the on the CEN Info box.
Pennington, Mike: Yeah, just to let you know, Jason does basically use his our
Pennington, Mike: infoblocks for all of his external DNS and he's helped us
Jason Healy: But it does.
Pennington, Mike: with a lot of the V6 setup in the past years.
Jason Healy: When he said, when he says help, that means bothering Mike.
Jason Healy: When it doesn't work so.
Jason Healy: It doesn't do DNS64 though, right?
Jason Healy: We don't have one that returns.
Pennington, Mike: We we we Nope.
Pennington, Mike: No, we don't have that.
Jason Healy: Not yet.
Pennington, Mike: Just. Yeah, no.
Jason Healy: So we could maybe add that one on, but for now.
Pennington, Mike: Maybe another thing exactly.
Jason Healy: Yep, just like the DNS firewall, we'd have another set of
Jason Healy: addresses that would do DNS64.
Jason Healy: All right, so I keep talking about DNS64 lying to us.
Jason Healy: So I want to make sure that we address that this does break DNS
Jason Healy: SEC a lot of people aren't using DNS SEC yet.
Jason Healy: I'm not using it yet.
Jason Healy: I would like to be using it, but because you're modifying the DNS
Jason Healy: queries and responses that you're getting that it makes it
Jason Healy: incompatible with any kind of security mechanism that
Jason Healy: validates the DNS responses.
Jason Healy: Again, it's not widespread, but it's not something we want to
Jason Healy: kind of do forever.
Jason Healy: If the client.
Jason Healy: Our own DNS server.
Jason Healy: So if they go to 8.8 dot 8.8 instead of the one that you've
Jason Healy: set up for them, they're not gonna get the right answers, and
Jason Healy: it's not gonna work.
Jason Healy: They won't use Nat 64 and the bigger drawbacks are that this
Jason Healy: only works for things that use DNS.
Jason Healy: For cheating by by answering DNS queries. If somebody just types
Jason Healy: an address in like 8.8 dot 8.8, it's not gonna work.
Jason Healy: There's no DNS request involved in that process.
Jason Healy: Similarly, if you have old software that's binding to AV4
Jason Healy: only socket, it's not gonna work.
Jason Healy: It's not binding to AV6 socket.
Jason Healy: It won't be able to use that embedded address when it comes
Jason Healy: back.
Jason Healy: It's just gonna say error because it's not expecting
Jason Healy: something that looks that way.
Jason Healy: So here's an example right on on a machine that has V6 But no V4.
Jason Healy: I can ping the V6 embedded address, but I can't ping the V4
Jason Healy: address.
Jason Healy: It just doesn't work because even though Nat 64 is available,
Jason Healy: the machine doesn't know to use it because.
Jason Healy: We're typing in V4 literals.
Jason Healy: So that brings us to the next thing on the stack. And actually
Jason Healy: the last thing on the stack.
Jason Healy: I promise, no more new stuff after this.
Jason Healy: Which is RFC that describes a process known as 464X Lab, and
Jason Healy: that introduces a new piece of terminology, the C lat.
Jason Healy: So remember that our Nat 64 router was called the P lat. The
Jason Healy: provider side translator. This is the client side translator
Jason Healy: and it kind of does the opposite of Nat 6/4.
Jason Healy: It it turns V4 into V6.
Jason Healy: And the idea is that you use this in conjunction with a Nat
Jason Healy: 64 translator so that you can send IPV 4 traffic over an IPV 6
Jason Healy: only network and then have it translated back at the network
Jason Healy: edge to go out to the Internet at large. OK, so.
Jason Healy: In this way, the the the major benefit here is that the client
Jason Healy: node thinks that it's dual stack.
Jason Healy: It thinks that it has a fully functioning IPV 4 STACK and AV6
Jason Healy: stack.
Jason Healy: But in reality it is V6 only we are.
Jason Healy: We are performing some trickery on the machine itself, so that
Jason Healy: old software and non DNS related software can function.
Jason Healy: This was introduced by T-Mobile and some other mobile providers
Jason Healy: in Japan over 10 years ago, 2013.
Jason Healy: Team and it's been used extensively in the mobile space
Jason Healy: because there weren't enough IPV 4 addresses for all mobile
Jason Healy: handsets to get it.
Jason Healy: So basically you've been using this technology probably for
Jason Healy: years now on your phone without knowing it, when you're on a,
Jason Healy: when you're on a cell connection.
Jason Healy: Now there's been a movement to start to push it out into the
Jason Healy: desktop and and laptop space as well. So let's see how that all
Jason Healy: works.
Pennington, Mike: I actually saw AI was at NANOG in Seattle.
Pennington, Mike: I don't know.
Pennington, Mike: Nine years.
Pennington, Mike: Ten years ago and T-Mobile did a presentation on this.
Pennington, Mike: You know, they were up to about 1 billion V6 addresses on their
Pennington, Mike: network back then, so I can't only imagine now.
Jason Healy: Yeah, yeah.
Jason Healy: So it is not new.
Jason Healy: This is this is tested technology.
Jason Healy: Fortunately, so there's kind of two flavors of celap. I'm gonna
Jason Healy: start with the discrete version.
Jason Healy: Because it's a little bit under easier to understand, I think in
Jason Healy: terms of how it works.
Jason Healy: So the idea of of the clat is you can imagine this left side
Jason Healy: of the slide is like your home network, right?
Jason Healy: The C lad is going to be something like your cable modem
Jason Healy: or whatever router that you have at your house, and so you want
Jason Healy: to use IPV 4, But your ISP only gives you IPV 6.
Jason Healy: So what happens is the seal at will run V4 internally.
Jason Healy: Maybe it hands out stuff via DHCP or whatever.
Jason Healy: And you have IPV 4 on the inside your IPV 4 node sends an IPV 4
Jason Healy: packet and when it gets to the C lat the C lat embeds it into
Jason Healy: that mat 64 prefix for you.
Jason Healy: So the IPV 4 node has no idea that this is happening.
Jason Healy: It just thinks it's sending V4 and that Nat is happening.
Jason Healy: But really the Nat that's happening is it's being turned
Jason Healy: into AV6.
Jason Healy: And then transits the I the is PS network pure V6.
Jason Healy: And then it lands at the network edge on the P Latt, where it's
Jason Healy: converted back via the process that we just described.
Jason Healy: So we're doing double translation here, but we're
Jason Healy: we're translating once so that it can go over the network. And
Jason Healy: then the other translation is done by the provider.
Jason Healy: Now, the way that this is more frequently used in a wireless
Jason Healy: situation is that we actually embed the CLAT functionality
Jason Healy: inside the devices operating system itself.
Jason Healy: So there's not actually a discrete router that you need to
Jason Healy: use.
Jason Healy: Instead, it's a process that runs on the phone or on the on
Jason Healy: the computer.
Jason Healy: So the the virtual router. If you want to think of it that
Jason Healy: way.
Jason Healy: Inside your device makes a fake IPV 4 gateway and it gives the
Jason Healy: machine a fake IPV 4 address.
Jason Healy: So again, when you try to connect from a piece of
Jason Healy: software, the software says I need to talk IPV 4.
Jason Healy: Here's my address.
Jason Healy: Here's my default router and it sends the packets like it always
Jason Healy: does. But what happens behind the scenes is that this piece of
Jason Healy: software translates it into IPV 6 and then puts it out on the
Jason Healy: wire or the wireless.
Jason Healy: And then the rest of the process is the same.
Jason Healy: So we've got a little virtual router that's doing all the
Jason Healy: translation here.
Jason Healy: So no V4 packets ever leave the device. Under this scenario
Jason Healy: everything is V6, but the software on the device it
Jason Healy: doesn't know.
Jason Healy: It doesn't realize that V4 doesn't really exist in this
Jason Healy: scenario.
Jason Healy: So what does that give us?
Jason Healy: So Clat is great.
Jason Healy: Because now we're translating all IPV 4 traffic, not just.
Jason Healy: We're not just messing up the DNS responses to trick us into
Jason Healy: using V6.
Jason Healy: We're actually accepting real V4 packets from the software on our
Jason Healy: machine.
Jason Healy: We're just translating it immediately after we receive it,
Jason Healy: without telling that software, but the software is talking V4
Jason Healy: so we can bind to AV4 socket. It can send to AV4 liberal.
Jason Healy: All of those things work.
Jason Healy: We don't need physical equipment.
Jason Healy: We can run it as a as a virtual router inside the machine.
Jason Healy: And things like DNS SEC don't get messed up because we're not
Jason Healy: messing up the DNS.
Jason Healy: We we aren't lying to the DNS anymore, so this is a slightly
Jason Healy: better solution in most cases.
Jason Healy: The drawbacks are that you have to have this functionality
Jason Healy: obviously in the device in order for it to work.
Jason Healy: So DNS64 is easy to roll out because your everything already
Jason Healy: talks DNS. The Clat functionality you need to have
Jason Healy: it in the device in order for it to function and the clat has to
Jason Healy: be configured with the correct Nat 64 prefix.
Jason Healy: Remember, we're relying on the ISP.
Jason Healy: To have that P lat that's gonna translate everything back to V4
Jason Healy: at some point.
Jason Healy: So we need to somehow tell every device on the network what to
Jason Healy: use as the net 64 prefix. OK, so on mobile network like T-Mobile
Jason Healy: they have, you know, firmware that they load on the phones.
Jason Healy: They can, they can mandate all of that. And so it.
Jason Healy: Wasn't an issue for them, but now on an enterprise network
Jason Healy: like the ones that we run, we have to have a way of
Jason Healy: communicating that to the devices so that they know how to
Jason Healy: use it.
Jason Healy: So how do we do that?
Jason Healy: We have a couple RF Cs that deal with this. One uses DNS64 just
Jason Healy: to discover the prefix.
Jason Healy: It makes a special query. It looks for DNS answer that has
Jason Healy: the prefix in it, and then it uses it and then there are two
Jason Healy: more recent ones. One of them uses that router advertisement I
Jason Healy: talked about earlier and it specifies it there and this
Jason Healy: other one act.
Jason Healy: Tells.
Jason Healy: Clients to turn off their V4 and not even request AV4 address if
Jason Healy: possible.
Jason Healy: And most of them take that as a signal that they should.
Jason Healy: And use an embedded C lat functionality.
Jason Healy: So all three of these in conjunction can be used to tell
Jason Healy: clients that they should activate A/C functionality if
Jason Healy: it's available, and make use of it.
Jason Healy: So I'm not going to go into the details of it here because I'm
Jason Healy: running a little over my time already.
Jason Healy: So let's breeze through some of the hosts and see what that
Jason Healy: looks like. So on Android this has been supported forever.
Jason Healy: Thanks T-Mobile.
Jason Healy: Because they were used in a in a cellular setup.
Jason Healy: Android 12 also introduced support for that DHCP option.
Jason Healy: Which should allow it to work on wireless networks as well, not
Jason Healy: just mobile networks.
Jason Healy: And they also accept the option.
Jason Healy: So if you're on Android, all three of these things work well
Jason Healy: together.
Jason Healy: And you can advertise them on your network now.
Jason Healy: Apple also has excellent support again on their handsets. They've
Jason Healy: been doing it for a long time, but they recently rolled it out
Jason Healy: on all of their devices.
Jason Healy: So this is what it looks like on my Mac when I'm on my network.
Jason Healy: You can see that I have my V6 addresses, but I have this
Jason Healy: special V4 address.
Jason Healy: 92002 and that is paired with the default route on the machine
Jason Healy: of 192001.
Jason Healy: That's the basically the virtual gateway that the software inside
Jason Healy: has set up to take those V4 packets, embed them and send
Jason Healy: them on their way.
Jason Healy: So it uses a special IPV 6 address just reserved for
Jason Healy: sending these out.
Jason Healy: Again, it's fine to have multiple addresses and you can
Jason Healy: see it even picked up the net 64 prefix. It figured it out based
Jason Healy: on the DNS info that I was using.
Jason Healy: And so it includes that here in the information.
Jason Healy: So Apple does a good job.
Jason Healy: They didn't really publicize this.
Jason Healy: They don't have any documentation on it, so a lot of
Jason Healy: us were surprised when, you know, we were testing this out
Jason Healy: and all of a sudden we could ping an IPV 4 address and we
Jason Healy: were like, how did that happen?
Jason Healy: Well, apple.
Jason Healy: So Apple hasn't really been talking about it much, but the
Jason Healy: support is definitely there.
Jason Healy: Oh, sorry, the last thing there is DNS 64.
Jason Healy: There's some debate about this.
Jason Healy: Safari uses still uses DNS 64 directly for certain things. So.
Jason Healy: Even though C lat should should obviate the need for DNS 64, you
Jason Healy: still probably want to run it.
Jason Healy: You probably want to run it for other clients too, so it's it's
Jason Healy: not an either or kind of a thing.
Jason Healy: I know we probably have a lot of schools on here.
Jason Healy: You're probably using from books.
Jason Healy: Fortunately for you, Chrome has supported having A/C lat like
Jason Healy: functionality since version 114.
Jason Healy: You can activate it by broadcasting that DHCP option
Jason Healy: 108 in your DHCP server.
Jason Healy: However, it's not on by default on the Chromebook, so you
Jason Healy: actually have to dig into the flags and turn on this feature
Jason Healy: in order for it to work correctly and then reboot.
Jason Healy: So I got a chromos flex the other day.
Jason Healy: That's a screenshot and it does work.
Jason Healy: I tested, it works correctly.
Jason Healy: You do need to reboot when you're done, so it gives up its
Jason Healy: V4 address.
Jason Healy: What's interesting here is that there's no visible fee for
Jason Healy: address fake V4 address on the machine.
Jason Healy: But it does work.
Jason Healy: So you can go to 101.1. You can see here that it's actually
Jason Healy: going to the embedded version and it works.
Jason Healy: I tried going to slash dot. It's hard to see on the slide, but
Jason Healy: it's using that embedded IPV 6 address there as well.
Jason Healy: So the functionality is there and it works correctly.
Jason Healy: Linux unfortunately, there's nothing built in if there's no
Jason Healy: one Linux distribution. They do have a user space statement
Jason Healy: that'll do see lat like functionality that you can set
Jason Healy: up.
Jason Healy: We're all Linux on our server side and we actually haven't
Jason Healy: bothered with this.
Jason Healy: We've found that it isn't really necessary.
Jason Healy: Most of our Linux machines are servers, so they have very well
Jason Healy: defined processes and software.
Jason Healy: Most of the software that we run on them is V6 capable or running
Jason Healy: all open source stuff. It's all been up to date for years and.
Jason Healy: DNS64 works for all the outbound stuff, so we're trying to get
Jason Healy: software updates.
Jason Healy: We're trying to connect to other machines.
Jason Healy: DNS64 does the job.
Jason Healy: It embeds the the addresses correctly and we haven't had any
Jason Healy: issues.
Jason Healy: So even without that clat functionality, it's OK.
Jason Healy: Windows. Windows.
Jason Healy: So Windows has technically supported C LAT since Windows
Jason Healy: 10, which might surprise you, but unfortunately it only works
Jason Healy: on LTE modems.
Jason Healy: So they basically did this just to comply with T-mobile's demand
Jason Healy: that they do 464X lat.
Jason Healy: They didn't roll that out to the rest of the operating system.
Jason Healy: Windows 11 has announced official plans to support C lat
Jason Healy: functionality in the OS for other uses, but we haven't seen
Jason Healy: it yet.
Jason Healy: We were kind of hoping that the big October update that just
Jason Healy: came out was gonna have it, but it doesn't. So right now,
Jason Healy: there's not even a road map for when this feature is gonna land.
Jason Healy: They said it's supposed to be in Windows 11, but Windows 11 has
Jason Healy: been around for three years, so I'm not sure when they're
Jason Healy: actually planning to get to it.
Jason Healy: So we're hoping soon, but it's not there yet.
Jason Healy: And just like Linux, that that shouldn't necessarily stop.
Jason Healy: You just be aware that you're gonna have to fall back on
Jason Healy: something like DNS64 in order to get your Windows machines to
Jason Healy: behave.
Jason Healy: Questions there. I know there was a lot, but I also know that
Jason Healy: I'm already at the hour mark and I do wanna have time to get
Jason Healy: through a few more things.
Jason Healy: Working on them.
Jason Healy: So let's let's see this in action.
Jason Healy: OK, when you've got all this stuff set up, it's time to start
Jason Healy: turning off IPV 4. So let's do it.
Jason Healy: I recommend that before you do it widespread you try it on a
Jason Healy: couple smaller machines, maybe turn off V4 completely. Again,
Jason Healy: you want to try to check and make sure I ran the laptop that
Jason Healy: I'm on now for months with V4 turned off and I learned.
Jason Healy: A lot, but it actually was a pretty good experience. Most
Jason Healy: things work.
Jason Healy: And most of the problems there were were problems of my own
Jason Healy: making in terms of my internal systems.
Jason Healy: So when you're ready, you want to turn on prefix before on your
Jason Healy: router.
Jason Healy: Advertisements. If you have it.
Jason Healy: Our juniper gear doesn't have it yet, so we couldn't do it.
Jason Healy: That's OK, but if you have DNS 64 and you turn on option 108,
Jason Healy: that's usually enough of a signal to a host that they
Jason Healy: should use clat functionality if it exists so.
Jason Healy: Big reveal we did this.
Jason Healy: We did this over the summer.
Jason Healy: We enabled DHCP option 108 for our guest and student subnets.
Jason Healy: And we didn't tell anyone that we did it.
Jason Healy: So we waited for the students to come back from from their summer
Jason Healy: vacation, and I'm pleased to report that in that amount of
Jason Healy: time I got to move more. My watch is going to be yelling at
Jason Healy: me in that amount of time. We've only had about 10. Help.
Jason Healy: Desk tickets that were related to network problems and all but
Jason Healy: one of those tickets were about VPNs.
Jason Healy: Remember I said earlier that net 64 doesn't play well with VPNs.
Jason Healy: That was the issue that we were having.
Jason Healy: We had students that were trying to use VPNs over V4 and it
Jason Healy: wasn't working.
Jason Healy: Because before didn't exist and it couldn't get through the Nat.
Jason Healy: The one issue that we did have was from a guest that we had on
Jason Healy: campus.
Jason Healy: We did standardized testing on campus for so for those of you
Jason Healy: that are thinking, oh, I could never roll this out, I'd be
Jason Healy: worried I'm going to break something. We went for it.
Jason Healy: We ran the SA TS. We had one person who had turned off V6 on
Jason Healy: their machine.
Jason Healy: We turned it back on.
Jason Healy: Everything was fine, so we used Bluebook.
Jason Healy: We've survived the College Board process V6 only, no problems.
Jason Healy: We've also had two major guest events on campus.
Jason Healy: We had our parents weekend and we had an alumni weekend.
Jason Healy: This one take with a grain of salt because people have issues,
Jason Healy: they probably just fall back to using their cellular connection.
Jason Healy: But again, I didn't hear from folks. I didn't hear any
Jason Healy: widespread issues of people saying I'm on your Wi-Fi and it
Jason Healy: doesn't work. So all the stuff that we rolled out did a pretty
Jason Healy: good job and we actually had one day this fall where our DHCP
Jason Healy: server was.
Jason Healy: Down and we didn't know.
Jason Healy: We actually didn't notice that it happened because all the
Jason Healy: machines.
Jason Healy: Using V6 the entire time, it was until somebody's PlayStation
Jason Healy: didn't work and they called to complain that we realized that
Jason Healy: we hadn't handed out an IPV 4 address all day.
Jason Healy: So that's kind of a testament to how well it worked.
Jason Healy: We didn't need V4 at all.
Jason Healy: So what does that look like on our network?
Jason Healy: So here's some measurements for that.
Jason Healy: Again, where I'm mostly Apple campus.
Jason Healy: So your mileage may vary, and then the table below we're
Jason Healy: basically counted up how many Mac addresses had AV4 address
Jason Healy: and how many Mac addresses had AV6 address.
Jason Healy: It didn't matter how many addresses they had. We counted
Jason Healy: it once.
Jason Healy: So I know that machines have multiple V6 addresses.
Jason Healy: We're not counting them multiple times.
Jason Healy: We took two samples recently and so divided here in 1/2 and as
Jason Healy: you can see on the subnets where we've turned on DHCP 108,
Jason Healy: there's a a huge difference, right? We got 746 devices that
Jason Healy: had picked up AV6 address but only.
Jason Healy: 36 That wanted AV4 address again.
Jason Healy: We're overwhelmingly Apple, and Apple supports this, so it's not
Jason Healy: surprising from our end.
Jason Healy: But you can have a real reduction in in terms of how
Jason Healy: many machines.
Jason Healy: Need an IPV 4 address to get their daily work done and again
Jason Healy: this is in production at our school and we have students that
Jason Healy: are running and nobody has batted an eye at this behavior.
Jason Healy: So what's left for us?
Jason Healy: Probably roll it out to the rest of campus.
Jason Healy: We're not concerned about that now and it should be a pretty
Jason Healy: straightforward change. And then we head into kind of the hardest
Jason Healy: part, which is the long tail of getting rid of IPV 4 things
Jason Healy: we're thinking about doing or trying to restrict DHCP only to
Jason Healy: known devices that.
Jason Healy: We want to give IV 4 addresses so we can kind of deprecate it
Jason Healy: for everybody else.
Jason Healy: We might start to herd them all into one or two subnets so that
Jason Healy: we don't have to have IPV 4 everywhere all the time.
Jason Healy: We might even put A/C lat device in place.
Jason Healy: A physical one.
Jason Healy: So that V4 can be crowded behind that and then that would allow
Jason Healy: us to get rid of V4 in our core network. We could be V6 all the
Jason Healy: way through the core and really just support V4 as kind of a
Jason Healy: legacy service just in.
Jason Healy: The spots on the network where it's necessary.
Jason Healy: And then when we're finally done, obviously shut everything
Jason Healy: off.
Jason Healy: So.
Jason Healy: It's not all sunshine and rainbows or rainbows and
Jason Healy: unicorns.
Jason Healy: Rather, I should say what kinds of things do we run into that I
Jason Healy: haven't already talked about?
Jason Healy: I already talked about ACLS and services being off, so I won't
Jason Healy: spend time there.
Jason Healy: Legacy software is tricky. If you have pieces of software that
Jason Healy: you can't update.
Jason Healy: Or you can't upgrade.
Jason Healy: It can be difficult to work around them.
Jason Healy: We have some, you know, building management software that's
Jason Healy: that's relatively old.
Jason Healy: We're lucky that since we have students, they turn over every
Jason Healy: four years.
Jason Healy: So we don't have a ton of legacy hardware from our users.
Jason Healy: But it's more the infrastructure stuff that we have to keep up to
Jason Healy: date.
Jason Healy: I have here devices that suck.
Jason Healy: The Nintendo Switch was the first thing that broke when I
Jason Healy: rolled this out at my house.
Jason Healy: My kids were not happy with me that their Nintendo didn't work,
Jason Healy: so it just doesn't do V6 at all, period, let alone some of these
Jason Healy: other things. It it won't do V6. Some IoT devices still won't do
Jason Healy: it, so you have to watch out for those.
Jason Healy: We already addressed the DHCP 4 tracking issue because we don't
Jason Healy: have DHCP.
Jason Healy: Trying to keep track of hosts.
Jason Healy: You're going to have to scrape tables in order to do that, and
Jason Healy: this last one I wanted to throw in as a warning to other people.
Jason Healy: This one didn't get us, but it has gotten others because you
Jason Healy: have more V6 addresses assigned to a a host at.
Jason Healy: A time than you do.
Jason Healy: Sorry, more V6 addresses assigned than V4.
Jason Healy: That can run afoul of of security settings. Sometimes
Jason Healy: that are locked down.
Jason Healy: So if you have a rule that says each host can only have one or
Jason Healy: two addresses, it's not uncommon for AV6 host to have three plus
Jason Healy: addresses assigned to it.
Jason Healy: So you wanna make sure that you don't have those settings in
Jason Healy: place?
Jason Healy: The DNS 64 side.
Jason Healy: We've covered a lot of the problems there. If you have a
Jason Healy: split Horizon DNS where you have different DNS answers, you know
Jason Healy: on your LAN versus externally that can complicate things.
Jason Healy: You know which addresses are you gonna embed so that can be a
Jason Healy: little tricky to deal with.
Jason Healy: We ended up just sort of treating everything as outside.
Jason Healy: That was the best way we could do it. As we mentioned, it
Jason Healy: breaks DNS SEC.
Jason Healy: So I also mentioned if if they configure their own DNS servers
Jason Healy: that may cause it to stop working, and happy eyeballs is
Jason Healy: gonna get in your way here where it's gonna fall back, you may
Jason Healy: not be aware that there's an issue.
Jason Healy: On the net 64 side.
Jason Healy: The RF Cs are written that you're not supposed to translate
Jason Healy: internal private addresses using Nat 64, so that can cause a
Jason Healy: little bit of trouble. If you were thinking, I'll just.
Jason Healy: I'll just use net 6/4 for everything on my network.
Jason Healy: You can't.
Jason Healy: Really, we found out that the Apple C lat implementation
Jason Healy: strictly enforces this, so you can't connect to like A10 dot
Jason Healy: address using Nat 64.
Jason Healy: So all of your internal resources, if you're going to do
Jason Healy: this, you're going to want to make sure that they're answering
Jason Healy: on V6. You want to make sure that all your servers internally
Jason Healy: are dual stacked and ready so that clients that have V6 can
Jason Healy: use V.
Jason Healy: 6 natively, to get to them, you can't fall back to DNS.
Jason Healy: Sorry to Nat 64.
Jason Healy: For your internal hosts, if you have internal addresses and you
Jason Healy: really should be getting your own house in order anyway. So
Jason Healy: try to make sure that you got V6 ready to roll out before you
Jason Healy: start trying to deal with the transition mechanisms that
Jason Healy: really intended for public.
Jason Healy: Internet legacy host.
Jason Healy: We talked a little bit about VPNs.
Jason Healy: VPNs don't work well with net 6/4.
Jason Healy: If you have avpn that works over V6, not a problem.
Jason Healy: So it's not all VPNs that don't work, it's just the ones that
Jason Healy: are V4 only.
Jason Healy: That operate over a non UDP or non TCP connection type.
Jason Healy: Some protocols embed IPV 4 addresses directly in them, but
Jason Healy: you were probably already having problem with those anyway,
Jason Healy: because not 4/4 often breaks those because the addresses
Jason Healy: change.
Jason Healy: Mtu is mostly solved on the Nat 64 side because IPV 6 addresses
Jason Healy: are longer, they take up more space in the packet header.
Jason Healy: So that means that if you try to translate AV4 packet into a V6
Jason Healy: packet.
Jason Healy: And the V4 packet is as big as it can possibly be.
Jason Healy: It's not gonna fit in the V6 packet. You need more space in
Jason Healy: the header, so this isn't operationally typically a
Jason Healy: problem. The the not 64 box will return the packet and say it's
Jason Healy: too big.
Jason Healy: You need to fragment and the host should do the right thing.
Jason Healy: But if you are accidentally filtering those or misdirecting
Jason Healy: them, as happened to us once, you're gonna start to see path
Jason Healy: MTU issues where connections appear to hang or don't appear
Jason Healy: to complete, you're gonna wanna break.
Jason Healy: Shark make sure that you're keeping your packets.
Jason Healy: The correct size you should be seeing amtr basically of like
Jason Healy: 4/14/80.
Jason Healy: There's a lack of device support for next 64. We were really
Jason Healy: bummed about the Xbox.
Jason Healy: The Xbox was has been V6 for a super long time, but that's just
Jason Healy: for the operating system.
Jason Healy: It's not for the games.
Jason Healy: So like Call of Duty did not like operating in AV6 only
Jason Healy: environment really really really wants V4. So that kind of bummed
Jason Healy: us out. As we mentioned earlier, Windows doesn't have C lat
Jason Healy: support yet.
Jason Healy: We hope that it does soon and then we'll be on a better spot
Jason Healy: and there's just been a couple weird issues that have come up
Jason Healy: due to lack of testing.
Jason Healy: Through the YouTube app on Apple TV just doesn't work in AV6C
Jason Healy: Lat. I've been trying to get somebody at at Google to pay
Jason Healy: attention to this. I haven't gotten anybody yet.
Jason Healy: It's been it's been odd.
Jason Healy: We're not sure why it doesn't work.
Jason Healy: We've been taking packet captures and trying to figure it
Jason Healy: out, but our only guess is that there was some some legacy piece
Jason Healy: in there that even the C lab isn't catching.
Jason Healy: So with with those issues, you're probably thinking to
Jason Healy: yourself, OK?
Jason Healy: So is it worth it?
Jason Healy: And I have to go with Thanos on this one.
Jason Healy: Yes, absolutely.
Jason Healy: So why?
Jason Healy: We're at a point now where V6 is becoming necessary.
Jason Healy: We're out of V4 addresses.
Jason Healy: It's it's really time to get on to V6.
Jason Healy: And the transition technologies have made it possible to treat
Jason Healy: V6 as your primary protocol.
Jason Healy: A lot of us are already doing that.
Jason Healy: Nad 64 is just nab, so if you're already doing that for IPV 4,
Jason Healy: why not swap it out and do not? For V6 that is just Nat, right?
Jason Healy: You can get yourself back down to one protocol.
Jason Healy: You still using Nat, but you were doing that before and you
Jason Healy: have the advantages of IPV 6. You have a.
Jason Healy: You have a modern standard protocol that you're using for
Jason Healy: everything. You have end to end reachability. If you want it,
Jason Healy: you're no longer netting your V6 traffic.
Jason Healy: So it's better that way.
Jason Healy: Plenty of addresses to assign as you see fit, so the time is
Jason Healy: really gotten.
Jason Healy: Or we've really gotten to the time where it makes sense to do
Jason Healy: this as your primary protocol.
Jason Healy: There's good client support as soon as we get windows on board,
Jason Healy: but there's good client support for it. And definitely if you
Jason Healy: haven't started this process, now's a great time to get that
Jason Healy: going.
Jason Healy: The support is enough there that you can start this process and
Jason Healy: have it work pretty well. As you saw with my campus, right?
Jason Healy: We turned it off for everybody, and there really hasn't been any
Jason Healy: issue.
Jason Healy: So it's good enough now that you can, you can get going and and
Jason Healy: have that in place for when IPV 6 sort of really really becomes
Jason Healy: necessary for you, if it isn't already.
Jason Healy: I have some resources here. When we put out the the slides but I
Jason Healy: want to be able to get to questions.
Jason Healy: So there's some other great talks from some other folks.
Jason Healy: I've learned a lot from them, so if this interested you and you
Jason Healy: want to hear more about it, there's some great resources
Jason Healy: here from some of the other folks.
Jason Healy: Jen Linkova at Google is great.
Jason Healy: She's really been pushing it there and she's been pushing a
Jason Healy: lot of the RF Cs that I've been mentioning, including the the
Jason Healy: other one on this page which talks about kind of best
Jason Healy: practices for how to roll this all out.
Jason Healy: But for now, I want to remind you that there is a survey.
Jason Healy: I want to thank you very much for sitting through over an hour
Jason Healy: of me talking at you and I do want to open it up for anybody
Jason Healy: who has questions, anything that you want to discuss?
Pennington, Mike: Free to chat or you should I think, Rachel said it. So you
Pennington, Mike: can turn your microphone on.
Jason Healy: And for those of you that are working, I understand you gotta
Jason Healy: get back to work. Feel free.
Jason Healy: That's the end of the presentation, but I'm I'm gonna
Jason Healy: hang out for a little bit longer and answer any questions.
Jason Healy: I really appreciate your time.
Pennington, Mike: Thank you, Jason.
Pennington, Mike: Yeah, we'll we'll stick around if anyone's got any questions in
Pennington, Mike: chat or.
Jason Healy: Thank you.
Pennington, Mike: Hopefully you get an influx of tickets requesting V6
Pennington, Mike: addressing.
Jason Healy: I was thinking, Mike, you know, if we just started.
Jason Healy: If we incentivize if we give you a, if we give you a discount for
Jason Healy: using V6 only, give back some of my V4 addresses.
Pennington, Mike: Yeah.
Pennington, Mike: That one you you have to talk to. To Rachel about that one.
Pennington, Mike: Yeah, but the presentation, that's great.
Pennington, Mike: I.
Pennington, Mike: I actually learned quite a lot of stuff that I had no clue
Pennington, Mike: about.
Jason Healy: That was my hope.
Jason Healy: I know it's it was. I was trying to cover a lot, but put this up
Jason Healy: when it's when it's done so people can come back to it and
Jason Healy: click through the slides.
Arenberg, Wade: I was gonna say, do you find that you're memorizing IPV 6
Arenberg, Wade: addresses like so many of us do with IPV 4 addresses?
Jason Healy: I remember.
Jason Healy: I know my prefix with CEN right?
Jason Healy: So I know I'm 2607 F 460-1833. That's me.
Jason Healy: But for our servers we we started out doing fixed
Jason Healy: addresses and like I said, we've moved away from that.
Jason Healy: Now we just use stable hardware addresses and I let DNS handle
Jason Healy: it from there.
Jason Healy: We do have a few for services like DNS. My DNS server had a
Jason Healy: very easy to remember address because you need to type that
Jason Healy: one in manually sometimes.
Jason Healy: But no, I can't remember all those characters.
Arenberg, Wade: It's a change of things that it's a change of mindset for
Arenberg, Wade: sure. From what I'm seeing, you know.
Jason Healy: Yes. Yep, it's yeah.
Jason Healy: And that and that's been one of the arguments against people who
Jason Healy: are who are been saying, oh, you know, I don't wanna switch to
Jason Healy: V6.
Jason Healy: I can't remember those numbers.
Jason Healy: You just have to kind of give up and and and say I'm never gonna
Jason Healy: be able to remember these numbers.
Jason Healy: I know that I could remember IPV 4 addresses, but you know with
Jason Healy: V6 you're just gonna have to get used to doing DNS for
Jason Healy: everything.
Arenberg, Wade: Yeah. And I assume there's some kind of technology out there
Arenberg, Wade: that would just do do your?
Arenberg, Wade: Do IP management for you so you know what has what you know kind
Arenberg, Wade: of deal like you said, scraping the scraping the tables and
Jason Healy: Yeah, I mean the the info blocks definitely.
Arenberg, Wade: things like that.
Arenberg, Wade: So at least you know. Oh, I need to hit this by the IP address.
Arenberg, Wade: Let me go find where what is that?
Jason Healy: Yeah. Yeah, we have something that scrapes it right now, but
Jason Healy: we haven't found anything particularly better for it.
Jason Healy: The the Infoblocks does do like IP address management, but
Jason Healy: that's kind of for known hosts.
Pennington, Mike: Yeah.
Jason Healy: I know there's a way to do you know dynamic DNS. You can have
Jason Healy: the host.
Jason Healy: Update their own host name when they when they pick a new slack
Jason Healy: address.
Jason Healy: But we definitely haven't rolled that out.
Jason Healy: That sounds like a little bit of a security nightmare, and
Jason Healy: unfortunately there hasn't been anything that's wanted reverse
Jason Healy: DNS for our clients.
Jason Healy: The servers.
Jason Healy: Yes, you definitely want reverse DNS, but for the clients it
Jason Healy: hasn't mattered.
Pennington, Mike: There was one question in chat too.
Arenberg, Wade: I I would say.
Pennington, Mike: When you're done, when you're all set.
Jason Healy: OK.
Arenberg, Wade: OK.
Arenberg, Wade: Yeah, for reverse DNS you use it a ton for remoting into people's
Arenberg, Wade: PCs and and for like deploying software by name, you know. So
Arenberg, Wade: we use the names and it uses reverse DNS to find the machine.
Arenberg, Wade: So.
Jason Healy: Yep. Where was the question, Mike?
Pennington, Mike: So Russ asked the issues with wireless clients with multiple
Pennington, Mike: V6 addresses. Is that related to wireless LAN controller setting
Pennington, Mike: that reacts in traffic from multiple addresses on the same
Pennington, Mike: wireless client?
Jason Healy: Yeah, that's that's gonna be a a controller setting.
Jason Healy: Hi Russ, by the way.
Jason Healy: So I think Lynn Cova found out that that was on their their.
Jason Healy: Cisco D Wireless LAN I think, but it was basically a security
Jason Healy: setting.
Jason Healy: It was trying to prevent address spoofing or something like that.
Jason Healy: If it saw a lot of activity from multiple addresses, but some of
Jason Healy: their devices if they had some D Ms. on or something, they might
Jason Healy: have had upwards of 20 IPV 6 addresses coming from the same
Jason Healy: host.
Jason Healy: So they had to.
Jason Healy: They had to dial that back.
Jason Healy: In the controller settings to make sure that it wasn't cutting
Jason Healy: them off.
Jason Healy: I can close this share to me.
Pennington, Mike: Yeah.
Pennington, Mike: That's about it.
Pennington, Mike: I have another meeting that I gotta hop onto. Of course too.
Pennington, Mike: But I mean, if you I think you and as Rachel sit here.
Pennington, Mike: Yeah. I think as you guys are around, I think the meeting will
Pennington, Mike: still be running so.
Jason Healy: Yeah, I'll hang out for a few more minutes. As I said in the
Jason Healy: survey too, it has my e-mail address, so anybody who doesn't
Jason Healy: wanna ask in the group or thinks of something later, I'm. I'm big
Jason Healy: on advocacy, so I'm happy to talk to you about this even.
Jason Healy: Just to bounce ideas off of and then I'll be at the CEN
Jason Healy: conference as well in May.
Jason Healy: So you can find me walking around the vendor tables and
Jason Healy: torturing people so.
Pennington, Mike: Was your V6 support?
Jason Healy: Exactly. I love asking him.
Pennington, Mike: Yep.