Agenda IPv4 over IPv6 MAP MAP IPv4 over IPv6 MAP packet MAP Protocol MAP domain MAP domain ASAMAP ASAMAP 2

Size: px

Start display at page:

Download "Agenda IPv4 over IPv6 MAP MAP IPv4 over IPv6 MAP packet MAP Protocol MAP domain MAP domain ASAMAP ASAMAP 2"

はなやまがた
5 years ago
Views:

1 MAP 1

2 Agenda IPv4 over IPv6 MAP MAP IPv4 over IPv6 MAP packet MAP Protocol MAP domain MAP domain ASAMAP ASAMAP 2

3 IPv4 over IPv6 IPv6 network IPv4 service Internet Service ProviderISP IPv4 service ISP IPv6 network IPv4 service IPv6 network CPE 3

4 MAP IETF Softwire WG IPv4 over IPv6 IPv4 packet IPv6 header capsule MAP-E Encapsulation IPv4 packet IPv4 header IPv6 header MAP-T Translation 2 Provider network table address and port Carrier side Stateless Mesh topology 4 IPv4 address

5 Translation or Encapsulation Translation Encapsulation The Internet IPv4 header TCP header Payload IPv4 header TCP header Payload BR Provider IPv6 Network CE IPv6 to IPv4 Translation IPv4 to IPv6 Translation IPv4 to IPv6 Decapsulation Encapsulation Translation IPv6 header IPv6 header IPv4 header TCP header TCP header Payload Payload IPv6 to IPv4 Translation Encapsulation Decapsulation Customer Network IPv4 header TCP header Payload IPv4 header TCP header Payload 5

6 Translation or Encapsulation Translation Provider IPv6 network IPv6 ACL QoS Single translation IPv6 only IPv4 only Encapsulation IPv4 header Provider IPv6 network checksum 6

7 Carrier side Stateful or Stateless Stateful (Ex. DS-Lite) Stateless (Ex. MAP) AFTR BR Protocol Src Addr Src Port Map Addr Map Port Dst Addr Dst Port TCP TCP UDP B4 CE 7

8 Carrier side Stateful or Stateless Stateful Stateless IPv4 address IPv4 service Stateless port Provider Stateful Anycast Port log 8

9 Mesh or Hub and spoke topology BR Provider IPv6 Network Mesh CE CE Customer Network Customer Network 9

10 Mesh or Hub and spoke topology BR Provider IPv6 Network Hub and spoke CE CE Customer Network Customer Network 10

11 MAP IPv4 over IPv6 *1 464XLAT *2 DS-Lite *3 MAP-T *3 MAP-E *4 4rd *5 Lightweight 4over6 Trans or Encap Stateful or Stateless Trans Encap Trans Encap Hybrid Encap Stateful Stateful Stateless Stateless Stateless Stateless Mesh ready N N Y Y Y N 1:1 ready - - 1:1 ready 1:1 ready - 1:1 only IETF WG v6ops softwire softwire softwire softwire softwire 11 *1 *2 *3 *4 *5

12 Mapping BR address = 2001:db8::1 (MAP-E) BR prefix = 2001:db8::/64 (MAP-T) MAP Rule Table Rule IPv6 prefix Rule IPv4 prefix EA-bits length Rule #1 2001:db8:100::/ /24 16 Rule #2 2001:db8:200::/ /24 16 CE 2001:db8:112:3400::/56 12 Rule #1 0x1234 Rule IPv4 prefix = 0xc EA-bits length Port-set ID 0x34 32bits Port-set 16bits 2001:db8:112:3400:c0:2:1200:3400 = min max Port-set #1 0x1340 0x134f Port-set #2 0x2340 0x234f : : : Port-set #15 0xf340 0xf34f Port-set ID Offset 4bit MAP IPv6 Address

13 Mapping = 0xcb IPv6 dst addr 2001:db8::cb:71:5000:0 IPv6 src addr 2001:db8:112:3400:c0:2:1200:3400 TCP dst port 80 TCP src port 4928 MAP-T IPv6 dst addr 2001:db8::1 IPv6 src addr 2001:db8:112:3400:c0:2:1200:3400 IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port 4928 MAP-E CE src port Port-set IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port

14 Mapping IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port 4928 BR src addr src port validation MAP-T IPv6 dst addr 2001:db8::cb:71:5000:0 IPv6 src addr 2001:db8:112:3400:c0:2:1200:3400 TCP dst port 80 TCP src port 4928 MAP-E IPv6 dst addr 2001:db8::1 IPv6 src addr 2001:db8:112:3400:c0:2:1200:3400 IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port

15 Mapping IPv4 dst addr IPv4 src addr TCP dst port 4928 TCP src port 80 BR MAP Rule Table IPv4 dst addr key MAP-T IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::cb:71:5000:0 TCP dst port 4928 TCP src port 80 MAP-E IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::1 IPv4 dst addr IPv4 src addr TCP dst port 4928 TCP src port 80 15

16 Mapping IPv4 dst addr IPv4 src addr TCP dst port 4928 TCP src port 80 BR IPv4 dst addr dst port IPv6 dst addr MAP-T IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::cb:71:5000:0 TCP dst port 4928 TCP src port 80 MAP-E IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::1 IPv4 dst addr IPv4 src addr TCP dst port 4928 TCP src port 80 16

17 Mapping IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::cb:71:5000:0 TCP dst port 4928 TCP src port 80 MAP-T IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::1 IPv4 dst addr IPv4 src addr TCP dst port 4928 TCP src port 80 MAP-E CE NAPT Table IPv4 dst addr dst port IPv4 dst addr IPv4 src addr TCP dst port TCP src port 80 17

18 Mapping IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv6 src addr 2001:db8::1 IPv6 dst addr 2001:db8:112:3400:c0:2:1200:3400 IPv4 dst addr IPv6 src addr 2001:db8::cb:71:5000:0 IPv4 src addr TCP dst port 4928 TCP dst port 4928 IPv4 IPv6 algorithmic mapping TCP src port 80 TCP src port 80 MAP-T BR flow state CE IPv4 dst addr IPv4 src addr TCP dst port TCP src port 80 MAP-E NAPT Table IPv4 dst addr dst port 18

19 3 MAP rule 3 MAP rule Basic mapping rulebmr Forwarding mapping rulefmr Default mapping ruledmr BMR FMR parameter Rule IPv6 prefix Rule IPv4 prefix Rule EA-bits length Rule Port Parametersoptional DMR parameter 19 IPv6 address of BR

20 3 MAP rule Basic mapping rulebmr CE MAP IPv6 address MAP rule End-user IPv6 prefix Rule IPv6 prefix Forwarding mapping rulefmr IPv4 packet MAP rule Default mapping ruledmr Destination IPv4 address Rule IPv4 prefix CE IPv4 packet match FMR MAP rule 20

21 IPv4 3 Rule IPv4 prefix length EA-bits length 3 IPv4 Shared IPv4 address Rule IPv4 prefix length + EA-bits length > 32 IPv4 address CE Complete IPv4 address Rule IPv4 prefix length + EA-bits length = 32 IPv4 address CE IPv4 prefix 21 Rule IPv4 prefix length + EA-bits length < 32 CE IPv4 prefix

22 Shared IPv4 address Rule IPv4 prefix length + EA-bits length 32 EA bits Rule IPv4 prefix 32bit Shared IPv4 address PSID Rule IPv6 prefix EA bits subnet ID interface ID IPv6 address 22 Rule IPv4 prefix IPv4 address port PSID

23 Complete IPv4 address Rule IPv4 prefix length + EA-bits length 32 EA bits Rule IPv4 prefix 32bit Complete IPv4 address CE address Rule IPv6 prefix EA bits subnet ID interface ID IPv6 address Rule IPv4 prefix 23 IPv4 address

24 IPv4 prefix Rule IPv4 prefix length + EA-bits length 32 EA bits Rule IPv4 prefix IPv4 prefix Rule IPv4 prefix length /24 EA-bits length 4 /28 IPv4 prefix Rule IPv6 prefix EA bits subnet ID interface ID IPv6 address Rule IPv4 prefix 24 IPv4 address

25 MAP 1:1 Rule IPv4 prefix length = 32 EA-bits length = 0 PSID BR CE 1:1 MAP rule CE MAP rule Hub & spoke topology Rule IPv6 prefix IPv6 address subnet ID interface ID 25 Rule IPv4 prefix IPv4 address port PSID

26 Port-set ID Port-set CE Port-set ID port port Port-set ID CE 16bits port Port-set ID Port-set ID offset Port-set ID offset default 4 Port-set ID offset all-zero bits Portset offset 4 0~

27 Port-set ID Port-set port 16bits * 3 4 * 4bits PSID offset 8bits PSID length PSID = 0x34/8 min max Port-set #1 0x1340 0x134f Port-set #2 0x2340 0x234f : : : Port-set #15 0xf340 0xf34f 27

28 Fragment CE 28

29 Fragment 29

30 Fragment BR/CE reassemble BR/CE reassemble 30

31 Fragment IPv4 stack fragment IPv6 stack fragment 31

32 Fragment MAP domain IPv6 Path MTU tunnel MTU Carrier side stateless fragmented packet BR encapsulation/decapsulation CE fragment TCP MSS BR IPv6 fragmented packet identification IPv4 stack fragment 32

33 Port restricted NAPT MAPStateless A+P port CE DNS query proxy IPv4 IPv6 UDP connection-less NAPT session close source port NAPT session table source port destination IPv4 address unique Port overlapping 33

34 Port restricted NAPT IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port 4928 IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port 4928 CE src port dst addr unique IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port IPv4 dst addr IPv4 src addr TCP dst port 80 TCP src port Host 34

35 MAP domain Shared IPv4 address IPv4 address CE End-user IPv6 prefix Rule IPv4 prefix IPv4 prefix Rule IPv4 prefix Rule IPv6 prefix Rule IPv6 prefix 35

36 Shared IPv4 address 36 IPv4 address CE 1:256 IPv4 address 256 CE 1 CE port 240 PSID length 8bits 1:1024 port PSID length 1: : : : : : : : : : : : : Port-set ID Offset 4bit

37 End-user IPv6 prefix Reserved IPv6 prefix End-user IPv6 prefix Reserved IPv6 prefix 2001:db8:1200::/40 End-user IPv6 prefix 2001:db8:12**:**00::/56 /40 /56 65,536 IPv6 prefix 37

38 Rule IPv4 prefix IPv4 prefix IPv4 prefix length! = 32 - (End-user IPv6 prefix length!!!!!!!! - Reserved IPv6 prefix length!!!!!!!! - PSID length) 32 - ( ) = 26 /26 IPv4 prefix /27 1 /28 2 { /27, /28, /28 } 38 3 Rule IPv4 prefix

39 Rule IPv6 prefix IPv4 prefix Rule IPv4 prefix Rule IPv6 prefix EA-bits length End-user IPv6 prefix length - Rule IPv6 prefix length Rule IPv4 prefix Rule IPv6 prefix EA-bits length / :db8:1200::/ / :db8:1280::/ / :db8:12c0::/ MAP rule

40 ASAMAP Open Source MAP Vyatta ASAMAP ASAMAP Vyatta PC VMware/ Xen/KVM 40

41 ASAMAP URL vyatta-yyyy-mm-dd.iso download CD install Login prompt vyatta enter Password vyatta enter Command prompt install system enter Install CD reboot Login operation modeprompt $ mode configure configuration modeprompt # 41 commit save

42 BR command # set interfaces map map0 role br # set interfaces map map0 br-address 2001:db8::1/64 # set interfaces map map0 default-forwarding-mode encapsulation # set interfaces map map0 default-forwarding-rule true # set interfaces map map0 rule 1 ipv6-prefix 2001:db8:1200::/41 # set interfaces map map0 rule 1 ipv4-prefix /27 # set interfaces map map0 rule 1 ea-length 15 # set interfaces map map0 rule 2 ipv6-prefix 2001:db8:1280::/42 # set interfaces map map0 rule 2 ipv4-prefix /28 # set interfaces map map0 rule 2 ea-length 14 # set interfaces map map0 rule 3 ipv6-prefix 2001:db8:12c0::/42 # set interfaces map map0 rule 3 ipv4-prefix /28 # set interfaces map map0 rule 3 ea-length 14 # set protocols static interface-route /27 next-hop-interface map0 # set protocols static interface-route /28 next-hop-interface map0 # set protocols static interface-route /28 next-hop-interface map0 # set firewall send-redirects disable 42

43 CE command # set interfaces map map0 role ce # set interfaces map map0 tunnel-source eth1 # set interfaces map map0 br-address 2001:db8::1/64 # set interfaces map map0 default-forwarding-mode encapsulation # set interfaces map map0 default-forwarding-rule true # set interfaces map map0 rule 1 ipv6-prefix 2001:db8:1200::/41 # set interfaces map map0 rule 1 ipv4-prefix /27 # set interfaces map map0 rule 1 ea-length 15 # set interfaces map map0 rule 2 ipv6-prefix 2001:db8:1280::/42 # set interfaces map map0 rule 2 ipv4-prefix /28 # set interfaces map map0 rule 2 ea-length 14 # set interfaces map map0 rule 3 ipv6-prefix 2001:db8:12c0::/42 # set interfaces map map0 rule 3 ipv4-prefix /28 # set interfaces map map0 rule 3 ea-length 14 # set protocols static interface-route /0 next-hop-interface map0 # set firewall send-redirects disable 43 End-user IPv6 prefix IPv6 address eth1

44 $ show interfaces map map0 Interface name : map0 Role : CE Tunnel source : eth1 BR address : 2001:db8::1/64 Default forwarding mode : encapsulation Default forwarding rule : true IPv6 fragment size : 1280 IPv4 fragment inner : true NAPT always : true NAPT force recycle : false 44 Basic mapping rule : Rule IPv6 prefix : 2001:db8:1200::/41 Rule IPv4 prefix : /27 Rule PSID prefix : 0x0/0 EA-bits length : 15 PSID offset : 4 Forwarding mode : encapsulation Forwarding rule : true MAP IPv6 address : 2001:db8:1234:5600:c0:2:ed00:5600/128 Shared IPv4 address : Assigned port-set ID : 0x56/10 Port-set : Port-set #0000 : 4440(0x1158) (0x115b) Port-set #0001 : 8536(0x2158) (0x215b)... snip... Port-set #0014 : 61784(0xf158) (0xf15b)

45 $ show interfaces map map0 rule Mode: 'E' = Encapsulation, 'T' = Translation. FMR: 'T' = FMR, '-' = Not FMR. IPv6 prefix, IPv4 prefix, PSID prefix, EA-bits length, PSID offset, Mode, FMR. 0: 2001:db8:1200::/ /27 0x0000/ E F 1: 2001:db8:1280::/ /28 0x0000/ E F 2: 2001:db8:12c0::/ /28 0x0000/ E F $ show interfaces map map0 napt Proto: 'I' = ICMP, 'T' = TCP, 'U' = UDP. Flags: SynOut, SynAckIn, AckOut, FinOut, FinAckIn, FinIn, FinAckOut, Rst. '!' = Up, '.' = Down. Last used, Local address:port, Mapped port, Remote address:port, Proto, Flags. 21:31: : (0x3158) :123 U... 21:29: : (0x3158) :123 U... 45

IPv4aaSを実現する技術の紹介

IPv4aaSを実現する技術の紹介 : ( ) : (IIJ) : 2003 4 ( ) IPv6 IIJ SEIL DS-Lite JANOG Softwire wg / Interop Tokyo 2013 IIJ SEIL MAP-E 2 IPv4aaS 3 4 IPv4aaS 5 IPv4 1990 IPv4 IPv4 32 IPv4 2 = 42 = IP IPv6 6 IPv6 1998 IPv6 (RFC2460) ICMP6,