IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware...

96
IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology @ehorley WCL324

Transcript of IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware...

Page 1: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Bootcamp: Getting Up to Speed Quickly

Edward HorleyPrincipal Solutions ArchitectGroupware Technology @ehorley

WCL324

Page 2: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

What is Driving IPv6?Depletion of IPv4

Page 3: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

What is Driving IPv6?

Adoption of DirectAccess by Microsoft Enterprises

Audit and security compliance due to IPv6 being enabled by default since Windows Vista and Server 2008

Ability to provide effectively unlimited number of IP addresses for large business divisions

The rapid growth of cloud services requiring elastic compute resources and flexible addressing

Page 4: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

What is IPv6 and how do I get started?

IPv6 is the next generation Internet networking protocol

Much larger than IPv4 which uses 32 bits or 232 or 4,294,967,296

IPv6 is 128 bits or 2128 or 340 undecillion addresses 340,282,366,920,938,463,463,374,607,431,768,211,456

IPv6 is enabled by default in Windows

You have likely already deployed IPv6You just didn’t know it - oops

Page 5: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

What does an IPv6 address look like?

2001:0470:82a9:0007:f2de:f1ff:fe5b:b324

Or

2001:470:82A9:7::1/64

Or

fe80::f2de:f1ff:fe5b:b324%13

Page 6: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

2001:470:1f05:d37:202c:7674:c4c2:4fa8

Each : divides the address along 16-bit boundaries

And the address is represented in HEX

4-bits is called a nibble

Page 7: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 address types

UnicastIdentifies a single interface and is used for host to host communication

MulticastIdentifies zero or more interfaces on one or more hostsMulticast are group addresses used for one to many hosts or many to many hosts

AnycastIdentifies multiple interfaces on one or more hostsAnycast are special purpose unicast addresses

Page 8: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Unicast IPv6 Addresses

Unicast typesGlobal unicast addresses (2000::/3 – RFC 4291 & RFC 3587)Link-local addresses (FE80::/64 – RFC 4007)Unique local addresses or ULA (FC00::/7 – RFC 4193)Special addresses (unspecified is :: & loopback is ::1 – RFC 5156)Transition addresses (6to4, ISATAP, Teredo)

Unicast types that have been deprecatedSite-local addresses (see RFC 3879)IPv4-compatible addresses (see RFC 4291)

Most common IPv6 addresses you will see are Global and Link-

local

Page 9: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Multicast IPv6 Addresses

Multicast addresses have the first 8 bits set to 1So multicast addresses start with FF (FF00::/8)Multicast also has a 4 bit flag field and 4 bit scope fieldSolicited-node address (FF02::1:FF00:0/104)

Some example multicast addressesFF01::1 – interface-local scope all-nodesFF02::1 – link-local all-nodesFF01::2 – interface-local scope all-routersFF02::2 – link-local add-routersFF05::2 – site-local scope all routers

Page 10: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Anycast IPv6 Addresses

Anycast addresses are assigned out of the unicast space

Anycast addresses are destination onlyThe address is advertised by a local routerThe address can be redistributed by routersMultiple routing paths to the same address are possible

You can’t tell it is an Anycast address by

looking at it

Page 11: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

“IPv6 Addresses” are unicast and global

“Temporary IPv6 Addresses” are unicast and global

“Link-local IPv6 Address” is unicast and local

Link-local will have a Zone ID (also called

Scope ID) represented by the

%<ID> after the IPv6 Address

Page 12: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Interface ID

Last 64 bits of a unicast addressInterface ID is fixed length (host portion of the IPv6 address)

Interface ID optionsEUI-64 (RFC 4291) – stateless autoconfigurationTemporary Address (RFC 4941) – stateless autoconfigurationStateful autoconfiguration (DHCPv6)Manual (statically assigned)Permanent (randomly generated)

Page 13: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Organizational Unique Identifier

Factory Assigned 48 bit MAC Address

xxxxxx00 xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxxx

xxxxxxxx xxxxxxxx xxxxxxxxxxxxxxx00 xxxxxxxx xxxxxxxx

1111111011111111

0xFF 0xFE

xxxxxx10 xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxx xxxxxxxxx1111111011111111

Flip this Bit

Standard EUI-64

Modified EUI-64 – flip the universal/local bit

EUI-64 – How it is Built

Page 14: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

2001:470:82a9:7:f2de:f1ff:fe5b:b324

MAC address: F0-DE-F1-5B-B3-24

Take MAC and split it, stuff in FF:FE and flip the 7th bit

Look for the FF:FE in the address, then it is

likely EUI-64

Page 15: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Prefix

A network prefix such as 2001:db8::/64Is saying the following :

2001:0db8:0000:0000:0000:0000:0000:0000/64| network portion | host portion |

| provider assigned | locally assigned |

A different network prefix example 2001:db8::/48

2001:0db8:0000:0000:0000:0000:0000:0000/48| Network Prefix |subnet| host |

| 48 bits |16 bits | 64 bits |

Indicates the number of bits that define the network

Page 16: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Subnetting

An example network prefix of 2001:db8:cafe::/48:2001:0db8:cafe:0000:0000:0000:0000:0000/48| Network |subnet| host |

| 48 bits |16 bits | 64 bits |

When subnetting use natural nibble boundaries (count in increments of 4 when selecting subnets, i.e. /60 /56 /52)

/48 = 65,536 networks of /64/52 = 4,096 networks of /64 and 16 subnets/56 = 256 networks of /64 and 256 subnets/60 = 16 networks of /64 and 4,096 subnets

Page 17: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Subnetting Guidelines

An example network prefix of 2001:0db8:cafe::/48:2001:0db8:cafe:0000:0000:0000:0000:0000/48| Prefix |subnet| host |

| 48 bits |16 bits | 64 bits |

An example of subnetting 2001:0db8:cafe::/48 into /60’s:

2001:0db8:cafe:0000:0000:0000:0000:0000/60| 48 bits |12| 0 | do not use |

| 60 bits | 0 | do not use |

Therefore a /48 has 4,096 subnets of /60 networks260 – 248 = 212 = 4,096

Page 18: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Subnetting Math

An example of subnetting 2001:db8:cafe:cab::/60 into /64’s :

2001:0db8:cafe:cab0:0000:0000:0000:0000/60| 60 bits | | 64 bits |

A /60 has 16 /64 subnets264-260 = 24 = 16

The /60 value ranges in HEX would be:0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F

Page 19: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Subnetting Math – non-nibble horror

An example of subnetting 2001:db8:cafe:cab::/60 into /62’s :

2001:0db8:cafe:cab0:0000:0000:0000:0000/60| 60 bits | | 64 bits |

A /62 has 4 /64 subnets264-262 = 22 = 4

The /62 value ranges in HEX would be:0, 1, 2, 3 4, 5, 6, 78, 9, A, B C, D, E, F

Page 20: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Subnetting Math – non-nibble horror

So subnetting 2001:db8:cafe:cab::/60 into /62’s ranges :

2001:0db8:cafe:cab< 0 - 3 >:0000:0000:0000:0000/62| 60 bits |range| 64 bits |

2001:0db8:cafe:cab< 4 - 7 >:0000:0000:0000:0000/62| 60 bits |range| 64 bits |

2001:0db8:cafe:cab< 8 - B >:0000:0000:0000:0000/62| 60 bits |range| 64 bits |

2001:0db8:cafe:cab< B - F >:0000:0000:0000:0000/62| 60 bits |range| 64 bits |

Page 21: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Subnetting Best Practices

Stick to increments of 4!

Count by 4!!!

Page 22: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Have you noticed anything odd yet?

Why is it always

/64?

Page 23: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Stateless Address Autoconfiguration (SLAAC)

IPv6 hosts have the ability to self provision an IPv6 address

A host uses router discovery to:Router Solicitation messagesRouter Advertisement messages (RA’s are sent via ICMPv6)Get information like on-link prefixes and other routers

SLAAC requires the prefix be a /64If the prefix is smaller the host cannot do EUI-64This breaks the ability of the host to do SLAAC

Page 24: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

SLAAC Only

2001:470:82a9:7::/64 is the prefix

Notice there are no global DNS Servers

Notice there is no FQDN information

This typically indicates SLAAC – the host lacks DNS server

info

Also indicates poorly implemented IPv6

Page 25: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Autoconfiguration

There are multiple ways to do autoconfiguration

Stateless (SLAAC)Stateful (DHCPv6 stateful)Both (DHCPv6 stateless)

Router Advertisements include flagsAutonomous flag (A flag)Managed Address Configuration flag (M flag)Other Stateful Configuration flag (O flag)

Page 26: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

DHCPv6 – RFC 3315

DHCPv6 is stateful and stateless address configuration for IPv6 hosts

What is Stateful?The DHCPv6 server is assigning the IPv6 addressThe RA has the M and O flag set (A flag may or may not be set)All options except default gateway come from DHCPv6 scope

What is Stateless?The DHCPv6 server is used for options only (like DNS or NTP)The RA has the O flag set and the A flag

Page 27: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

DHCPv6 – RFC 3315

The typical flag settings combination:SLAAC: A flag = 1, M flag = 0, O flag = 0DHCPv6 Stateful: A flag = 0, M flag = 1, O flag = 1DHCPv6 Stateless: A flag = 1, M flag = 0, O flag = 1

For all situations a host link-local address is configured automatically (exception may be routers)

Page 28: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

DHCPv6 w/ A, O and M Flags

2001:470:82a9:7:41a6:5976:37ac:4f54 is from DHCPv6

2001:470:82a9:7:202c:7674:c4c2:4fa8 is from SLAAC

2001:470:82a9:7:3d1f:ad49:ee12:4880 is from SLAAC

Page 29: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Windows specific Autoconfiguration behavior

By default Windows generates a random interface ID for

Non-temporary autoconfiguration addresses (permanent)In other words – it doesn’t do EUI-64

Because the host randomly built an interface IDIt starts using it right awayIt doesn’t wait for duplicate address detection (DAD)

Autoconfiguration is used to build link-local and can be used for global and ULA (depending on the flags A/M/O)

Page 30: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Windows specific Autoconfiguration behavior

If you are using a Windows Server as an IPv6 routerWindows always sets the A flagThis means that the RA is enabling SLAACBy default all hosts on that subnet will build out a random permanent address and random temporary address

Windows Server 2008 and Window Vista do not attempt stateful DHCPv6 if no RA advertisement are received

Page 31: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

SLAAC + DHCPv6 w/ O flag

2001:470:1f05:d37::/64 gets a permanent and temporary

2001:470:82a9:7::/64 gets a permanent and temporary

The router only has 2001:470:82a9:7::/64 as an address

Page 32: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Cisco IPv6 SLAAC + DHCPv6 w/ O flag config

interface Vlan7 description - work - ipv6 address 2001:470:82a9:7::/64 and 2001:470:1f05:d37::/64 ipv6 address 2001:470:1F05:D37:2::1/64 ipv6 enable ipv6 nd prefix 2001:470:1F05:D37::/64 300 300 ipv6 nd prefix 2001:470:82A9:7::/64 300 300 ipv6 nd other-config-flag ipv6 dhcp server HE Setting the O flag

Page 33: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Cisco IPv6 DHCPv6 w/ M & O flag config

interface Vlan7 description - work - ipv6 address 2001:470:82A9:7::1/64 ipv6 address 2001:470:82A9:7::1/64 ipv6 enable ipv6 nd prefix 2001:470:82A9:7::/64 300 300 ipv6 nd managed-config-flag ipv6 nd other-config-flag ipv6 dhcp server HE

Setting the M and O flag

Page 34: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Cisco IPv6 SLAAC config

interface Vlan7 description - work - ipv6 address 2001:470:82a9:7::/64 ipv6 address 2001:470:82A9:7::1/64 ipv6 enable

By default the A flag is enabled

Page 35: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IP Address Management (IPAM)

It is normal for a single host to have 3 or more IPv6 addresses

Each /64 subnet can have 18 million trillion addresses

I don’t think you want to manage a spreadsheet with 18 million trillion fields for 128 bit long addresses in HEX

If you don’t want to do that use an IPAM solution!

Page 36: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv4 and Equivalent IPv6 properties

IPv4

Multicast (224.0.0.0/4)BroadcastAPIPA (169.254.0.0/16)Public Address SpaceLoopback (127.0.0.1)Unspecified (0.0.0.0)Dotted decimalRFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

IPv6

Multicast (FF00::/8)Replaced with Multicast groupsLink-local (FE80::/64)Global Unicast SpaceLoopback (::1)Unspecified (::)Colon HEX formatULA (FD00::/8)

Page 37: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

ICMPv4 vs. ICMPv6 properties

ICMPv4

Destination Unreachable – Network Unreachable (Type 3, Code 0)Destination Unreachable – Host Unreachable (Type 3, Code 1)Destination Unreachable – Protocol Unreachable (Type 3, Code 2)

Destination Unreachable – Port Unreachable (Type 3, Code 3)Destination Unreachable – Fragmentation Needed and DF Set (Type 3, Code 4)

ICMPv6

Destination Unreachable – No Route to Destination (Type 1, Code 0)Destination Unreachable – Address Unreachable (Type 1, Code 3)Parameter Problem – Unrecognized Next Header Type Encountered (Type 4, Code 1)Destination Unreachable – Port Unreachable (Type 1, Code 4)Packet Too Big (Type 2, Code 0)

Table 5-3 Chapter 5 – ICMPv6 from Understanding IPv6, 3rd Ed. By Joseph Davies, Microsoft Press

Page 38: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

ICMPv4 vs. ICMPv6 properties cont.

ICMPv4

Destination Unreachable – Communication with Destination Host Administratively Prohibited (Type 3, Code 10)Source Quench (Type 4, Code 0)Redirect (Type 5, Code 0)

Time Exceeded – TTL Exceeded in Transit (Type 11, Code 0)Time Exceeded – Fragment Reassembly Time Exceeded (Type 11, Code 1)Parameter Problem (Type 12, Code 0)

ICMPv6

Destination Unreachable – Communication with Destination Administratively Prohibited (Type 1, Code 1)This message is not present in IPv6.Neighbor Discovery Redirect message (Type 137, Code 0)Time Exceeded – Hope Limit Exceeded in Transit (Type 3, Code 0)Time Exceeded – Fragment Reassembly Time Exceeded (Type 3, Code 1)Parameter Problem (Type 4, Code 0 or Code 2)

Table 5-3 Chapter 5 – ICMPv6 from Understanding IPv6, 3rd Ed. By Joseph Davies, Microsoft Press

Page 39: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Why is Path MTU so important in IPv6?

MTU = 1500

MTU = 1400

MTU = 1400

MTU = 1500

Set your MTU to 1400

Page 40: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Important ICMPv6 Things to Know

Path MTU must be allowed or IPv6 will break

&

This means you need to allow ICMPv6 traffic through your network

Page 41: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 DNS

An IPv6 address record in DNS is AAAA

The PTR zone is IP6.ARPA.

Why is it AAAA?An A record in IPv4 represents 32 bitsIPv6 has 128 bits so 4 A’s make 128

Page 42: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPv6 Reverse DNS

Examples:2001:470:1f05:d37:202c:7674:c4c2:4fa82001:470:1f05:d37::1

The reverse entry in IP6.ARPA. looks like:8.a.f.4.2.c.4.c.4.7.6.7.c.2.0.2.7.3.d.0.5.0.f.1.0.7.4.0.1.0.0.2.IP6.ARPA.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.3.d.0.5.0.f.1.0.7.4.0.1.0.0.2.IP6.ARPA.

Every nibble must be included so:Zero compression has to be expanded back outLeading zeros must be added back in

Page 43: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

How Does a Windows Client get DNS Servers?

DNS Servers are obtained via DHCPv6 w/ O or M flag

If there is no DHCPv6 then:

the DNS is manually configured

Page 44: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.
Page 45: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

Page 46: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

TransitionTechnology

Page 47: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

Page 48: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

You run IPv6 and IPv4 side by side

You let the host decide which protocol to use

For routing the two protocols operate like ships in the night

You will consume more resources to run dual stack

You have to understand how your applications behave

Page 49: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Windows 8 and Windows Server 2012 have RFC 6555 implemented (Happy Eyeballs)

All applications benefit from Windows 8 and Windows Server 2012 having RFC 6555 enabled

You have to use RFC 3484 and RFC 6555 and the Internet draft update for RFC 3484 to determine app behavior

Dual stack is a transition technology – the eventual goal is only IPv6

Page 50: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

Page 51: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Tunneling

In Windows there are three main tunneling transition technologies

6to4ISATAPTeredo

All of these enable IPv6 to IPv6 communication they just use IPv4 as a transport

I recommend turning off all the transition tunneling technologies to avoid problems troubleshooting IPv6

Page 52: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Turning off 6to4

PowerShell for Windows Server 2012 and Windows 8

Set-Net6to4Configuration-State Disabled

Netsh for Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista

Netsh interface 6to4 set state disabled

Set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\DisabledComponents registry value to 0x2 (DWORD) (and then restart the computer)

Page 53: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Turning off 6to4

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

Set the 6to4 State Group Policy setting in Computer Configuration|Policies| Administrative Templates|Network|TCP/IP Settings|IPv6 Transition Technologies to Disabled

Page 54: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Turning off ISATAP

PowerShell for Windows Server 2012 and Windows 8

Set-NetIsatapConfiguration-State Disabled

Netsh for Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista

Netsh interface isatap set state disabled

Set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\DisabledComponents registry value to 0x4 (DWORD) (and then restart the computer)

Page 55: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Turning off ISATAP

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

Set the ISATAP State Group Policy setting in Computer Configuration|Policies| Administrative Templates|Network|TCP/IP Settings|IPv6 Transition Technologies to Disabled

Page 56: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Turning off Teredo

PowerShell for Windows Server 2012 and Windows 8

Set-NetTeredoConfiguration-Type Disabled

Netsh for Windows Server 2008 R2, Windows Server 2008, Windows 7, Windows Vista

Netsh interface teredo set state type = Disabled

Teredo client on managed networks (AD is present) is disabled by default

Page 57: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Turning off Teredo

Windows Server 2012, Windows Server 2008 R2, Windows 8, or Windows 7

Set the Teredo State Group Policy setting in Computer Configuration|Policies| Administrative Templates|Network|TCP/IP Settings|IPv6 Transition Technologies

Page 58: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Tunneling

So why do I recommend turning off all the transition tunneling technologies?

Unless you have a specific design build around them they introduce unpredictable behavior

Still leave IPv6 enabled, just disable the transition tunneling, that way when it is time to deploy IPv6 you don’t have to touch the hosts again

Page 59: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

Page 60: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Translation

In Windows there is one main translation technology

NAT64/DNS64

Additional Enterprise translation technologies to know

SLB64 & NPTv6

These do IPv6 to IPv4 translation (think of them as a proxy)

NAT64/DNS64 and SLB64

NPTv6 performs limited Prefix only NAT

Page 61: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

NAT64/DNS64

Windows Server 2008 R2 with Forefront UAG is capable of doing NAT64/DNS64

Windows Server 2012 is capable of doing NAT64/DNS64

NAT64 allows an IPv6 host to access an IPv4 host through a NAT64 devices that proxies the session

DNS64 builds synthetic AAAA records for an IPv4 A record if no IPv6 AAAA record exists

Page 62: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

Page 63: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Migration

You want to move away fromTunnelingTranslation

To Dual Stack

Eventually you will want to move from Dual Stack toNativeTranslation (as needed) for older IPv4 only hosts

Page 64: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Dual Stack

Tunneling Translation

NativeIPv6

Page 65: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Planning and Design

Plan IPv6 like any other IT Project

Do not use IPv4 design rules for IPv6

Build a lab – you will need it

Test and understand your software

Make sure you have the same SLA for IPv6 as IPv4

Page 66: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Deployment

Start with forgiving applicationsDNS and SMTP vs. Web Services

You need to understandDual Stack behaviorTransition technology behaviorImpact on your hardware and software

Do the heavy lifting in the lab – don’t try out IPv6 in your production network!

Remember – IPv6 is used FIRST so mistakes have

immediate impact!

Page 67: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Deployment

DO NOT TURN OFF IPv6!

Page 68: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Windows Commands with IPv6 Support

PingPathpingTracertNslookupIpconfigRoute printNetsh

Page 69: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Windows IPv6 Caveats and Notes

Windows will use 6to4 if it has a public IPv4 address

Make sure to add your IPv6 Prefixes to AD Sites and Services/Sites/Subnets

Windows does NOT support RFC 6106 which provides DNS information in SLAAC RA’s

Windows has a native DHCPv6 client

Page 70: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Windows IPv6 Caveats and Notes

Important thing to know:

Windows has IPv6 enabled by default

&

IPv6 is Preferred!

Page 71: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

DirectAccess and IPv6

IPv6 is required for DirectAccess

There are two OS deployment options for DirectAccess

Windows Server 2008 R2 and optionally Forefront UAG to utilize NAT64/DNS64Window Server 2012 now has NAT64/DNS64 built in

The first iteration of DirectAccess required hosts that DA client’s needed to reach must run IPv6

Because of NAT64/DNS64 this is no longer the case

Page 72: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

DirectAccess and IPv6

DA clients still use IPv6 but then use NAT64/DNS64 to talk to IPv4 only hosts

DA clients can utilize Native IPv6, and all of the tunnel transition technologies plus IP-HTTPS to connect back to the DA server

IPv6 is still the main transport method but because DNS64/NAT64 is available the internal servers are not required to run IPv6

Page 73: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Where is IPv6 used in DirectAccess today? DA Client

IPv6 in IPv4Tunnel

IPv6

IPv6

IPv4

Dual Stack Network

DA Server

Page 74: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

DirectAccess with Server 2012 NAT64/DNS64DA Client

IPv6 in IPv4Tunnel

IPv6

IPv6

IPv4

NAT64/DNS64

DA Server

Dual Stack Network

Page 75: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Exchange and IPv6

Exchange 2007 and 2010 will prefer IPv6 for same subnet traffic

Even if you only have static IPv4 addresses configuredYou likely didn’t even notice unless you disable IPv6

Exchange Edge Transport role is a special IPv6 caseIf you have it running in a DMZ that uses Public IPv4 addresses it will attempt to use 6to4This means if someone has a AAAA record published for their MX in DNS the Exchange server will FIRST use 6to4 to attempt delivery

Page 76: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Exchange and IPv6

If IPv6 is enabled and is being routed properly make sure your advanced firewall is ON!

Make sure to test reachability from all networks prior to turning up IPv6 for client access networks

Test all Exchange services for both IPv4 and IPv6

If you are using IPv4 Load Balancers make sure you do the same for IPv6 or you might get strange behavior in clients

Page 77: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

IPD’s and IPv6

Microsoft currently does not call out separate IPv6 deployment configurations in the IPD’s

My understanding is that there are plans to publish specific IPD guidelines to show the impact of disabling IPv6 in certain deployment scenarios

In the meantime, you will have to determine the ramifications of disabling IPv6 for each IPD

Page 78: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

So What Does Microsoft Recommend?

Microsoft no longer tests their software with IPv4 ONLY networks

Microsoft has standardized on dual stack support

There are only three products that have been delay in broad IPv6 support

Forefront TMGLyncWindows Phone 7

Page 79: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

What impact will disabling IPv6 have on me?

Recent anecdotal information about Microsoft support cases indicates customers disabling IPv6 and then having operational problems has grown dramatically

Make sure you test the planned configuration with IPv6 disabled in a lab

Do NOT randomly turn it off in your production environment – bad things can happen!

Page 80: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Windows 8 and Windows Server 2012

Continued high quality IPv6 support

Improved PowerShell commands

Additional performance benefits by supporting Happy Eyeballs (RFC 6555) like behavior

Page 81: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

How does Happy Eyeballs work?

IPv6

IPv4

IPv4

IPv6

DNS Lookup:www.example.co

mHas both A and AAAA records

Client sends both IPv6 and

IPv4 requests at the same time

IPv6 works and there

isn’t significant delay then it is used

If IPv6 doesn’t work or has a big delay then IPv4 is used

Page 82: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

How is it implemented in Windows 8?

It makes use of the same process that tells the OS that Internet access is available or that you might have to log in to gain Internet access

Network Connectivity Status Indicator (NCSI)

It modifies the cache tableSorting improvements have been madePeriodic rechecks are done

All applications benefit from this new behavior

Page 83: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

?

Page 84: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

June 8 2011 – World IPv6 DayTurn on IPv6 to test functionality

June 6 2012– World IPv6 LaunchTurn on IPv6 and leave it on

Significant IPv6 Event

Page 85: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.
Page 86: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Microsoft SitesOn World IPv6 Launch Day

Page 87: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Next Steps

Obtain IPv6 Address SpaceProvider Independent – use a registrar like ARINProvider Assigned – your ISP can give you

Set up DHCPv6 and DNSBuilt out prefix and DHCPv6 scopesBuild out AAAA records

Get a firewall up and workingTest a portion of your network to confirm rules and routing

Page 88: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Related Content

WCL324 – IPv6 Bootcamp: Getting Up to Speed Quickly

Find Me Later At… http://www.howfunky.com/

WSV312 – IPv6: (Hard)Core Networking Services

WSV308 – Standards Support and Interoperability in Windows Server 2012

Page 89: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Track Resources

Resources for Developers http://msdn.microsoft.com/en-us/windows/apps

Windows 8 is ready for Businesshttp://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/windows-8/default.aspx

Microsoft Desktop Optimization Pack:www.microsoft.com/MDOP

Microsoft Desktop Virtualization: www.microsoft.com/dv

Page 90: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Track Resources

Springboard Series: www.microsoft.com/springboard Explore > Plan > Deliver > Operate > Support for

Windows 7 and Windows 8MDOPDesktop VirtualizationWindows IntuneInternet Explorer 8, 9 and 10

Track Resources

Page 91: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Download

http://windows.microsoft.com/en-US/windows-8/release-preview

Download the Windows 8 Release Preview Today

Page 92: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Resources

Connect. Share. Discuss.

http://northamerica.msteched.com

Learning

Microsoft Certification & Training Resources

www.microsoft.com/learning

TechNet

Resources for IT Professionals

http://microsoft.com/technet

Resources for Developers

http://microsoft.com/msdn

Page 93: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

Complete an evaluation on CommNet and enter to win!

Page 94: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

MS Tag

Scan the Tagto evaluate thissession now onmyTechEd Mobile

Page 95: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.

© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to

be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS

PRESENTATION.

Page 96: IPv6 Bootcamp: Getting Up to Speed Quickly Edward Horley Principal Solutions Architect Groupware Technology@ehorley.