What's the general consensus for stateless vs. stateful IPv6 implementations? I'm specifically interested in small/medium deployment with a flat network topology. I like the idea of tying the mac to IP and am leaning towards stateless, but I can't really find much info from people who have made the transition / best practices. Any thoughts?
![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
IPv6 Stateless vs. Stateful
- Thread starter da sponge
- Start date
Stateful here, its easier to track and provision for a provider enviornment. Auto config can be used customer facing, though I dont think thats particularly a good idea for, again, tracking purposes. You're ALWAYS limited to a /64 for all your stateless hosts, which in some environments might not be optimal, especially for core links(no reason to waste billions of hosts).
xphil3:
Slightly off topic, but how far is the adoption of IPv6 where you are, and how long have you been using it?
I'm facing a bit of an uphill battle where I work to get anyone to even consider that IPv6 is something that might be worth at, or at least looking beyond the fact that the IPs are harder to remember...so would like to hear of some actual commercial experience with it
Slightly off topic, but how far is the adoption of IPv6 where you are, and how long have you been using it?
I'm facing a bit of an uphill battle where I work to get anyone to even consider that IPv6 is something that might be worth at, or at least looking beyond the fact that the IPs are harder to remember...so would like to hear of some actual commercial experience with it
archivalbackup
Gawd
- Joined
- Oct 12, 2007
- Messages
- 643
Funny thing is many people end up running it without knowing about it. Vista, Win7 and Server2008 all run an IPv6 stack by default, and leaves a huge attack surface if not configured / monitored.
You'd still need some way of traversing the IPv4 internet to get to the IPv6 stack, as very few places run IPv6 lines natively, and if there's no provision for translating/tunneling IPv6 packets, you aren't going to get very far. However if it's within an organization rather than from external sources, I can see the problems.
Pretty far along, to give you an example... I file bugs and lend advice to engineers on comcast/vz and att accounts on ipv6 security because ive delt with it already. The push is pretty fierce here.
I recently deployed it internally too, at home... with a few friends on here. VMware ipv6 vlan + static/isatap v6 tunnels... pretty sweet
I've been doing the old Hurricane Electric tunnel route at home, once I'm not tied to the ISPs router I think I may go IPv6-only internally, even if just for the challenge.
I'm gonna try pushing IPv6 harder where I am, who knows, with enough shouting and scaremongering they may go for it...
I'm gonna try pushing IPv6 harder where I am, who knows, with enough shouting and scaremongering they may go for it...
yep, I got a /48 from tunnel broker myself... but its annoying to track when my IP changes(manual tunnel as you know). What ill probably do is slap another interfaces in my 3800 and ipv6 address and internal hosts so I can hit the 6bone....
Shadowspawn
[H]ard|Gawd
- Joined
- Sep 17, 2002
- Messages
- 1,870
Why are any of you using IPv6 at all? Other than being able to say you have used it and understand it, is there a need?
I mean, especially internally. I doubt there are any organizations out there that exceed IPv4's abilities. Since nearly every organization NAT's, why screw with IPv6?
The DoD MAN that I support uses v4 only. On the small ISP I run I disable v6 on every customers system that I happen to touch so they don't end up with 20+ networks and connectivity issues. Why Microsoft leaves v6 enabled by default escapes me.
So anyway, just asking.
I mean, especially internally. I doubt there are any organizations out there that exceed IPv4's abilities. Since nearly every organization NAT's, why screw with IPv6?
The DoD MAN that I support uses v4 only. On the small ISP I run I disable v6 on every customers system that I happen to touch so they don't end up with 20+ networks and connectivity issues. Why Microsoft leaves v6 enabled by default escapes me.
So anyway, just asking.
Because it already exists out there, and IPv4 isn't far off getting to a point where places requesting new IP blocks wont be able to get them in IPv4, as there wont be any left.
You do realise NAT can break some applications functionality, and makes things a dog to troubleshoot at times? If one host in a network is causing problems, but I'm external and can only see it coming from the NAT'd IP, I can only point to the guys that run the network and say "something is wrong, there is something in your network doing this", rather than "Yep, this host is causing problems, do something about it". Some of the people I deal with on a day to day basis couldn't troubleshoot there way out of a paper bag, and with where I work dealing with sensitive financial information, packet sniffing is frowned upon.
It's the same as saying "Why would you want to know about DVDs when we already have VHS, VHS plays movies, whats wrong with it!" 15 years ago.
You do realise NAT can break some applications functionality, and makes things a dog to troubleshoot at times? If one host in a network is causing problems, but I'm external and can only see it coming from the NAT'd IP, I can only point to the guys that run the network and say "something is wrong, there is something in your network doing this", rather than "Yep, this host is causing problems, do something about it". Some of the people I deal with on a day to day basis couldn't troubleshoot there way out of a paper bag, and with where I work dealing with sensitive financial information, packet sniffing is frowned upon.
It's the same as saying "Why would you want to know about DVDs when we already have VHS, VHS plays movies, whats wrong with it!" 15 years ago.
Shadowspawn
[H]ard|Gawd
- Joined
- Sep 17, 2002
- Messages
- 1,870
If you're maintaining a network that is behind a NAT'd IP you should be using a VPN to reach inside and troubleshoot from within...right?
I get your point, although your comparison to VHS is off. DVD movies contain more information therefore the picture is higher quality. Having a larger pool of IP addresses does not improve the quality.
I get your point, although your comparison to VHS is off. DVD movies contain more information therefore the picture is higher quality. Having a larger pool of IP addresses does not improve the quality.
Direct Access - http://www.microsoft.com/windowsserver2008/en/us/directaccess.aspx
Allows laptops to be always connected to the intranet, for both file access and remote management, without needing a VPN. Unless I buy UAG, which is significantly more expensive than my TMG licenses, I need IPv6 internally to use this feature.
Allows laptops to be always connected to the intranet, for both file access and remote management, without needing a VPN. Unless I buy UAG, which is significantly more expensive than my TMG licenses, I need IPv6 internally to use this feature.
Shadowspawn
[H]ard|Gawd
- Joined
- Sep 17, 2002
- Messages
- 1,870
So there are features built into IPv6 above and beyond what IPv4 is capable of. Although this software looks to simply be a tunnel, from client to server.
If there are certain features about v6 that are truly useful then I can understand migrating to it. I just don't believe it is needed based purely on the number of IPs.
Meh, what do I know? I'm just a MAN administrator.
If there are certain features about v6 that are truly useful then I can understand migrating to it. I just don't believe it is needed based purely on the number of IPs.
Meh, what do I know? I'm just a MAN administrator.
Nope, what if these networks aren't yours?
Where I work, we have customers who connect in, via routers we send out, using leased lines into us, or our router acting as a VPN device, but the customers network beyond that is blind to us. If they are acting as a gateway to say, POS terminals or anything like that, and simply using us to transfer batches of transactions, or as a shared infrastructure to many different places elsewhere, we have no idea which terminal is causing problems if it is, or if they have a certain server causing problems, as their entire infrastructure will be NAT'd to a single or a few IPs.
So already, I can see that if they had individual addresses, I could pinpoint for a customer within seconds, "Your issue is right there" or at least "It has this IP, and if you are using EUI-64 to assign the addresses, this is the MAC Address to look for too". 200 terminals coming from one IP from a customer makes it so that we go "somethings got a problem, can you look at it?"
This to me, is increased quality, in that it provides more than IPv4 can in its current state and usage.
IPv6 also has IPSec built in. Not huge, but it means that certain routing protocols dont need to use authentication within them, as it can be implemented at header level.
There's also no strict broadcast (it can be implemented, but it isn't necessary), so you can cut down on where packets go, and cut down on bandwidth usage.
If you take a look further into IPv6 and understand it, you'll see that there are a good few reasons why people want to use it. There's way more than just more IPs, all I've done is scratched the surface and already shown how it could be used in my company alone to further help customers. I seriously doubt I'm alone in finding a way it would be useful.
wait... you're working for the DoD and you dont understand the need for ipv6.. and you're supporting a MAN? hmmmm... something is wrong with your logic and or, you're just a support guy
Regarding features, I mean... theres too many to list and it goes well beyond the scope of tunneling. Obviously, the main reason people are moving the v6 is the prepare themselves now, because you *should* know the seriousness of the situation within the DoD. Agree with stuh84 about looking into ipv6 a bit more, you need to understand the technology more to understand why people should make the move to the technology instead of waiting for the NEED.
Regarding features, I mean... theres too many to list and it goes well beyond the scope of tunneling. Obviously, the main reason people are moving the v6 is the prepare themselves now, because you *should* know the seriousness of the situation within the DoD. Agree with stuh84 about looking into ipv6 a bit more, you need to understand the technology more to understand why people should make the move to the technology instead of waiting for the NEED.
Shadowspawn
[H]ard|Gawd
- Joined
- Sep 17, 2002
- Messages
- 1,870
wait... you're working for the DoD and you dont understand the need for ipv6.. and you're supporting a MAN? hmmmm... something is wrong with your logic and or, you're just a support guy
Regarding features, I mean... theres too many to list and it goes well beyond the scope of tunneling. Obviously, the main reason people are moving the v6 is the prepare themselves now, because you *should* know the seriousness of the situation within the DoD. Agree with stuh84 about looking into ipv6 a bit more, you need to understand the technology more to understand why people should make the move to the technology instead of waiting for the NEED.
Actually, I am the lead for my network administration office. I support one of the largest bases in Iraq with a network composed of over 600 access switches plus the backbone. There is no need for IPv6 here. Don't confuse DISA and the DoD. I am sure there is much talk of it at DISA but little, if any, talk at my level.
I just haven't had the need or the time to study it. I believed the only real purpose behind it is the number of IPs. If that had been the case then I don't believe there is a need. As it stands, I'll take a closer look.