untitled

Size: px

Start display at page:

Download "untitled"

たみえいなくら
4 years ago
Views:

1 IPv6 - IPv NTT IP (Yasuhiro Shirasaki) ( ) (Shin Miyakawa, Ph.D) IPv6 5 IPv Q&A

2 IPv6 3 IPv4 : DARPA

3 NAT Network Address Translation IPv4 NAT IPv4 IPsec Mobile IP 5 IPv6 32bit 128bit ( ) NAT Free 6 3

4 IPv6 Version Traffic Class Flow Label Payload Length Next Header Hop Limit Source Address Destination Address 32 bits 7 IPv6 header next header = TCP TCP header + data IPv6 header Routing header TCP header + data next header = Routing next header = TCP IPv6 header next header = Routing Routing header next header = Fragment Fragment header next header = TCP fragment of TCP header + data 8 4

5 ( ) ( ) ( ) [ ]

6 ID ID (48 bits) (16 bits) (64 bits) ISP ISP RIR 11 TLA Assignment 2 ptla (pseudo TLA) : 6bone 2006/6/6 stla (Sub TLA) : IPv4 IANA RIR IPv4 12 6

7 : EBGP? ID : L=1 (FD00::/8) L ID ID ID bits ID bits : / SSM/ASM : 1 2 5!) 8 B E 14 7

8 IPv4 CIDR IPv4 128bit OSPFv3 RIPng IS-IS BGP4+ PIM 15 ( Plug-and-Play ) : ID MAC IP DHCPv6 NTP DNS DHCP DHCP 16 8

9 Mobile IP (v4 ) correspondent host foreign agent 17 Mobile IP (v6 ) correspondent host 18 9

10 IP 19 IPv4/IPv6 IPv6 IPv6 IPv4 IPv6 NAT IPv4 NAT DMZ 20 10

11 OS Windows 2003 Server HP-UX, AIX, Solaris NetBSD, FreeBSD, OpenBSD DNS Linux OS Windows XP (SP2) CE.NET Mac OS X *BSD Linux 21 L3 *BSD Linux Cisco, Foundry, Juniper, Alaxala YAMAHA, Netscreen Firewall-1 IPv6 NAT? 22 11

12 L2 L3 MLD VLAN VLAN LAN 3 IPv6 NAT 23 IPv6 NTT IIJ, JT, POWEREDCOM,KDDI

13 ADSL SOHO MPLS IP-VPN 25 NTT.net NSPIXP6 JPNAP6 PAIX EQUI6IX UK6X LINX AMS-IX Hong Kong NTT Com Asia Korea NTT Korea Taiwan NTT Taiwan U.S. Verio Europe NTT Europe Malaysia NTT MSC Australia NTT Australia IPv6 (Planned) OCN IPv6 Dual (A) OCN IPv6 Tunnel Service IPv6 Gateway Service ESPANIX PARIX Japan NTT Communications 26 13

14 NTT.net IPv6 - Tier1 - IPv AS IX 27 NTT.net IPv6 - - ISP/iDC IPv6 - OCN IPv6 - SOHO OCN ADSL IPv6 - Virtual Private Server

15 ISP / IPv4 /24 A Subnet /64 APNIC IPv4 1? 8? 16? NAT 10.X.Y.Z 29 /64 Point-to-Point Ethernet L

16 < >::< > 2001:218::25 SMTP [2001:218:1f01::80]:80 HTTP 2001:218::53 DNS ::19, ::50, :: IPv6/IPv4 IPv4 IPv4 IPv6 IPv6 IS-IS AS 32 16

17 Unicast IGP Unicast EGP Multicast IPv4 RIPv2 OSPFv2 ISIS BGP4 PIM IPv6 RIPng OSPFv3 ISIS BGP4+ PIM 33 static ISP BGP JPNAP NSPIXP6 dix-ie IPv4 IPv6 AS IGP Static OSPFv3 OSPFv3 RIPng IS-IS IS-IS IPv

18 Firewall Fragment Stateful inspection 35 /etc/inetd.conf IPv4 ::ffff: Kernel API IPv6/IPv4 socket IPv6/IPv4 DNS DNS 36 18

19 DNS DNS IPv6/IPv4 IPv6 IPv6 *BSD Linux Windows 2003 Server IPv6 37 DNS ip6.arpa ip6.int.jp AAAA.jp NS IP 38 19

20 DNS DNS AAAA 39 IPv4 IPv6 DNS MX IPv4 MX sendmail postfix IPv6/IPv4 qmail patch) 40 20

21 LPR IPv6 41 NFS NetBIOS WebDAV 42 21

22 SSH IPv6 UNIX SSH 43, DMZ, NAT Netscreen ip6fw, ipfw + natd Cisco DNS Mail SSH WWW 44 22

23 RA IGP EGP 45 N NiceAge.jp (GR2k-1)! IPv6 internet IPv4 internet BBA TOC Cisco! Dom Zaku!! 46 23

24 RA Cisco IPv6 RA ipv6 nd suppress-ra GR2k ra Lifetime RA 47 IGP Cisco ipv6 route ::/0 2001:218::1 ipv6 router rip ipv6 router ospf 3949 GR2k static ::/0 gateway fe80::1234%fa-1-1 ripng yes ospf6 yes 48 24

25 EGP Cisco router bgp XXXX address-family ipv6 GR2k bgp4+ yes 49 (Cisco) ipv6 unicast-routing ipv6 cef! interface FastEthernet1/0 ip address ipv6 enable ipv6 address 2001:218:1:1045::229/64 ipv6 ospf 3949 area 0! interface FastEthernet1/1 ip address ipv6 enable ipv6 address 2001:218:1f01:f010::1/64! router ospf network area 0 network area 0! router bgp 3949 bgp log-neighbor-changes neighbor 2001:218:1:1045::1 remote-as 3949 address-family ipv4 no neighbor 2001:218:1:1045::1 activate exit-address-family! address-family ipv6 neighbor 2001:218:1:1045::1 activate exit-address-family! ip classless! ipv6 route ::/0 2001:218:1f01:f000::/56 Null0 ipv6 router ospf 3949 redistribute static 50 25

26 (Cisco) access-list 99 permit ! ipv6 access-list acl99 permit ipv6 2001:218:1f01:f010::/64 any permit ipv6 host 2001:218:1:1040::4 any deny ipv6 any any! line vty 0 4 access-class 99 in ipv6 access-class acl99 in 51 (GR2k) line fa-0-0 ethernet 0/0; line fa-0-1 ethernet 0/1; line fa-0-2 ethernet 0/2; line fa-1-1 ethernet 1/1; ip fa-0-0 { 2001:218:0:4f:0:1400:0:1e/126; }; ip fa-0-1 { 2001:218:1f01::1/64; /30; }; ip fa-0-2 { /29; 2001:218:1:1040::1/64; }; ip fa-1-1 { fe80::2914:9; 2001:200:0:1800::2914:9; }; ra yes { interface fa-0-2; }; autonomoussystem 3949; routerid ; ospf6 yes { area 0 { interface fa-0-3 cost 1; }; }; bgp4+ yes { group type routing peeras 3949 { peer 2001:218:1:1045::229 description "musai"; }; }; static { default gateway ; /29 gateway ; ip6-default gateway 2001:218:0:4f:0:1400:0:1d; }; 52 26

27 GR2k pim6 yes sparse KAME pim6sd (PIM-SM ) phyint 53 PIM GR2000 pim6 yes { sparse { interface fa-0-3; interface fa-0-1; interface fa-1-1; }; }; KAME pim6sd.conf phyint fxp0 disable; phyint fxp1 disable; phyint fxp2; phyint fxp3 disable; phyint fxp4 disable; phyint fxp5; phyint xl0; 54 27

28 ip6fw IPv4 IPv6 link-local ICMPv6 add 200 pass ipv6-icmp from any to any add 210 pass all from fe80::/64 to ff02::/16 add 220 pass all from fe80::/64 to fe80::/64 add 310 pass tcp from any to 2001:218:1:10c2::2 smtp,domain setup add 320 reset tcp from any to 2001:218:1:10c2::2 auth setup 55 MIP Firewall 56 28

29 Firewall # UNTRUST set int eth1 zone UNTRUST set int eth1 ip /29 set int eth1 manage-ip set int eth1 ipv6 mode router set int eth1 ipv6 interface-id set int eth1 ipv6 ip 2001:db8:1001:1001::9/64 set int eth1 ipv6 enable ### RIPNG ### set vrouter trust protocol ripng set vrouter trust protocol ripng enable set int eth1 protocol ripng enable # outgoing SSH set policy id from MONITOR to UNTRUST any-ipv6 any-ipv6 SSH permit # outgoing DNS query set policy id from MONITOR to UNTRUST any-ipv6 any-ipv6 DNS permit # outgoing ESP set policy id from MONITOR to UNTRUST any-ipv6 any-ipv6 ESP permit # incoming ESP set policy id from UNTRUST to MONITOR any-ipv6 any-ipv6 ESP permit 57 SOHO (ex. ADSL) IPv4 IPCP DHCP IPv6 link-local IPV6CP ND DNS DHCPv6 ID Password Web 58 29

30 IP ID ifconfig fxp0 inet6 fe80::10 RA+ ID inet6 fe80::10 + RA (2001:218::/64) > 2001:218::10/64 RA 2 *BSD: HP-UX: 59 inetd /etc/inetd.conf ftp stream tcp6 nowait root /usr/libexec/ftpd ftpd -l 60 30

31 DNS RR AAAA AAAA IPv6 61 bind9 Configure IPv6 -enable-ipv6 bind

32 named.conf options { listen-on-v6 { any; }; # any or none before bind transfer-source-v6 2001:218:1f01:f010::10; # specify some source IPv6 address especially you have multiple global address on the interfaces notify-source-v6 2001:218:1f01:f010::10; }; # share zone file with ip6.int and ip6.arpa zone f.1.0.f ip6.int" { type master; allow-transfer { slaves; }; file "0.1.0.f.1.0.f ip6"; }; zone "0.1.0.f.1.0.f ip6.arpa" { type master; allow-transfer { slaves; }; file "0.1.0.f.1.0.f ip6"; }; 63 A6 AAAA $TTL zaku IN A IN AAAA 2001:218:1f01:f010::10 dom IN A IN AAAA 2001:218:1f01:f010::11 musai IN A IN AAAA 2001:218:1f01:f010::

33 ..ip6.arpa.ip6.int $TTL ; * PTR niceage.jp PTR musai.niceage.jp PTR zaku.niceage.jp PTR dom.niceage.jp. 65 IPv6 + IPv4 Private zone file $INCLUDE global.zone host1 IN A Global zone IN SOA dom.niceage.jp. root.niceage.jp. ( ; Serial 7200 ; Refresh 1800 ; Retry ; Expire 3600 ) ; Minimum IN NS dom.niceage.jp. IN NS zaku.niceage.jp. host1 IN AAAA 2001:218::1234:

34 DNS MX AAAA IPv6 IPv6 67 sendmail IPv6 IPv4 DaemonPortOptions sendmail.cf O DaemonPortOptions=Name=IPv4, Family=inet O DaemonPortOptions=Name=IPv6, Family=inet

35 Postfix postfix/main.cf inet_protocols = all postfix/mynetworks /28 [::1]/128 [2001:218:1f01:f010::]/64 69 POP3 IMAP Courier-IMAP IPv6 Configure Cyrus Patch

36 Apache Apache 1.3.x IPv6 patch Apache2 IPv6 71 IIS Windows Server 2003 IIS 6.0 Microsoft TCP/IP version 6 IPv

37 httpd.conf IP IP <VirtualHost [2001:218:1f01:f010::11]:80> ServerAdmin DirectoryIndex index6.html index.html </VirtualHost> 73 MRTG Nagios hp OpenView NNM extended topology 74 37

38 75 Web IE Firefox Mail EdMax IM MSN Messenger, 3degrees Streaming Windows Media VoIP, 76 38

39 IPv6/IPv4 IPv6 IPv

40 Magazine UNIX BSD Books IPv6- Mark Miller IP IP IDG & IPv6 Service NTT IP IETF WG V6OPS WG NGTRANS WG) DHCP IPSEC DNS MobileIP Zerouter Send IP IPv6 FORUM

untitled

untitled NTT TOP A WAN WAN VRRP NIC OSPF VRRP STP 1. IPv6 IPv6 2. 3. IPv6 1. IPv4 NAT IPv6 1. 2. (IPv4 ) NAT? Unique Local IPv6 Unicast Address /8 /48 /64 /128 7 1 40 16 64 ULA Global ID Interface ID Type Subnet