May 2016 - ipv6-wg - mailman.ripe.net

Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2
by christian bretterhofer 03 Oct '16

03 Oct '16

1. Re: RIPE72 IPv6 WG: call for presentations (Benedikt Stockebrand) Hello to all I think the basic work for ISPs in concern to IPv6 is covered. But i miss the topics to be addressed if you want to migrate from a IPv4 Microsoft Active domain using company to an system where most server in an enterprise could by just IPv6 only and use technologies like NAT46 ( SIIT-DC ) or similar to still make IPv4 only windows clients happy. Switching an enterprise with location around the global from a "we donot route any IPv6 traffic across our WAN Links" "most servers have IPv6 disabled" to We start IPv6 routing partially and enable partial IPv6 support on servers in a Microsoft ADS environment seems not covered in most IPv6 covering websites and presentations. Maintaining dual stack for the datacenters is just painfull and there should be a "single" device in the form of NAT46/SIIT/SIIT-DC in front of each server area. I am not sure that Active directory is ready for that. We are currently moving a complete test ads domain into a Testlab with locations in AT/CN/FI/US into dualstack and here we accept a "not working" during migration and i also hope we can move some servers into a IPv6 only area of those networks. But for a production move we need to be shure that a partial enabling of Dualstack and IPv6 only networking for servers does not break things. Any ideas or links which could help us here? best regards Christian Bretterhofer https://andritz.me ( one Testlab DMZ)

13 32

New on RIPE Labs: How are you Deploying IPv6? Take this Survey
by Mirjam Kuehne 31 May '16

31 May '16

Dear colleagues, For those of you who missed Jordi Palet's original announcement, his call for the IPv6 deployment survey is now also on RIPE Labs: https://labs.ripe.net/Members/jordipaletm/how-are-you-deploying-ipv6-take-t… Kind regards, Mirjam Kuehne RIPE NCC

1 0

v4 versus v6 -- who connects faster?
by Vaibhav Bajpai 23 May '16

23 May '16

Dear v6 WG, Here [a] is a toy v6 service I came up with during the RIPE Atlas hackathon over this weekend. Thought I share this along: [a] http://goo.gl/hbzbwD <http://goo.gl/hbzbwD> You enter a dual-stacked website (ALEXA top 10K) and it shows you the difference in TCP connect times over v4 and v6 as seen by all dual-stacked RIPE Atlas probes (~1.3K probes). You can also filter the visualisation from a specific origin-AS. This additional filter can be useful to view performance towards a website from a specific origin-AS (say DTAG). Disclaimer: This is an outcome of a 1.5d long hackathon project. As such, the codebase is possibly inundated with bugs. Please don’t see it as a production service :-) Best, Vaibhav =================================== Vaibhav Bajpai www.vaibhavbajpai.com <http://www.vaibhavbajpai.com/> Room 91, Research I School of Engineering and Sciences Jacobs University Bremen, Germany ===================================

6 11

v4 versus v6 -- who connects faster?
by Bajpai, Vaibhav 23 May '16

23 May '16

Dear v6 WG, Here [a] is a toy v6 service I came up with during the RIPE Atlas hackathon over this weekend. Thought I share this along: [a] http://goo.gl/hbzbwD You enter a dual-stacked website (ALEXA top 10K) and it shows you the difference in TCP connect times over v4 and v6 as seen by all dual-stacked RIPE Atlas probes (~1.3K probes). You can also filter the visualisation from a specific origin-AS. This additional filter can be useful to view performance towards a website from a specific origin-AS (say 3320). Disclaimer: This is an outcome of a 1.5d long hackathon project. As such, the codebase is possibly inundated with bugs. Please don’t see it as a production service :-) Best, Vaibhav =================================== Vaibhav Bajpai www.vaibhavbajpai.com<http://www.vaibhavbajpai.com> Room 91, Research I School of Engineering and Sciences Jacobs University Bremen, Germany ===================================

2 1

Re: [ipv6-wg] v4 versus v6 -- who connects faster?
by Eric Vyncke (evyncke) 23 May '16

23 May '16

Hello Vaibhav, The map with blue/red is really a nice one :-) May I dare to propose some improvements? * on the blue/red map, be sure to have blue meaning all the time that IPv6 is faster (the legend is unclear and by using those tools, I know that this is not trivial to do) * State the date of the 'scan' * Some web sites are in the top 10K of Alexa but are not in: www.iet.org, www.lesoir.be, .... (Even www.ripe.net is not in the data :-) but RIPE is only 25.000th so out of your data set) Again, nice visualisation! -éric From: ipv6-wg <ipv6-wg-bounces(a)ripe.net<mailto:ipv6-wg-bounces@ripe.net>> on behalf of "Bajpai, Vaibhav" <v.bajpai(a)jacobs-university.de<mailto:v.bajpai@jacobs-university.de>> Date: Monday 23 May 2016 at 08:08 To: "ipv6-wg(a)ripe.net<mailto:ipv6-wg@ripe.net> IPv6" <ipv6-wg(a)ripe.net<mailto:ipv6-wg@ripe.net>> Subject: [ipv6-wg] v4 versus v6 -- who connects faster? Dear v6 WG, Here [a] is a toy v6 service I came up with during the RIPE Atlas hackathon over this weekend. Thought I share this along: [a] http://goo.gl/hbzbwD You enter a dual-stacked website (ALEXA top 10K) and it shows you the difference in TCP connect times over v4 and v6 as seen by all dual-stacked RIPE Atlas probes (~1.3K probes). You can also filter the visualisation from a specific origin-AS. This additional filter can be useful to view performance towards a website from a specific origin-AS (say 3320). Disclaimer: This is an outcome of a 1.5d long hackathon project. As such, the codebase is possibly inundated with bugs. Please don’t see it as a production service :-) Best, Vaibhav =================================== Vaibhav Bajpai www.vaibhavbajpai.com<http://www.vaibhavbajpai.com> Room 91, Research I School of Engineering and Sciences Jacobs University Bremen, Germany ===================================

2 1

IPv6 residential deployment survey (looking into technical aspects)
by JORDI PALET MARTINEZ 20 May '16

20 May '16

Hi all, I got so much input for a small “email survey”, that I’ve decided to make it more complete and on-line. The results will be published and updated every month or so, I will provide ASAP the link to those stats. No personal data will be published. http://survey.consulintel.es/index.php/175122 (If you know your network, it takes less than 2 minutes to complete it) It can be responded even if is not yet a commercial service, and customers can also respond, not just the ISP. However, to avoid duplicate data, make sure to include the country and ISP name. For those that already replied to me by email, it will be much better if you can fill in the on-line survey. Otherwise, after a week or so, I will input “manually” the data that you provided, but then there will be many “empty” questions. Please, feel free to circulate this message as much as you can ! Thanks a lot! Regards, Jordi ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.consulintel.es The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

1 0

New on RIPE Labs: IPv6 Fragmentation (by Geoff Huston)
by Mirjam Kuehne 19 May '16

19 May '16

Dear colleagues, Please find this new article on "Fragmenting IPv6" by Geoff Huston on RIPE Labs: https://labs.ripe.net/Members/gih/fragmenting-ipv6?pk_campaign=labs&pk_kwd=… Kind regards, Mirjam Kuehne RIPE NCC

1 0

IPv6 residential service: What prefix, static, dynamic, extra cost ?
by JORDI PALET MARTINEZ 19 May '16

19 May '16

Hi all, I’m trying to make a table to compare the way actual IPv6 services to residential customers are being provissioned mainly in EU, but I will do to the same also in other regions. I’m happy to make a single “table” with all the information that I can collect and publish it so others can make use of it, and keep it updated, may be in some URL, etc. So here are the questions for actual IPv6 services providers to residential customers: 1) What prefix size is provided? 2) Is that prefix static or dynamic? 3) In case is dynamic, there is a chance for static? 4) Any extra cost for having it static, or having a bigger prefix (i.e., /48 instead of /56)? 5) If the customer has already a static IPv4 with a monthly charge, is still IPv6 static prefix being charged on top of that? Please state the ISP name, country and if you have a URL or document that state this service, other options, etc. If you’re not yet providing the service, but it will happen soon and the “model” for this has been already defined, please let me know as well! Hopefully I can get a lot of anwers! Private or in the list, I’m fine either way. Thanks! Regards, Jordi PD: In my opinion it should be /48 by default, static and opt-in to dynamic, no extra charge on top of the Internet service price, but I know many ISPs will not agree :-( Here just trying to collect the info in a single place. ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.consulintel.es The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

15 21

Re: [ipv6-wg] IPv6 cloud!
by Benedikt Stockebrand 12 May '16

12 May '16

Hi Ole and list, "Ole Troan (otroan)" <otroan(a)cisco.com> writes: >> Considering the increasing reports of people having problems with >> DS-Lite > > Any more details on that? > New problems not mentioned in RFC6269? sorry I haven't got the time right now to review RFC6269 for what's exactly mentioned there and what isn't, but: When I do IPv6 trainings these days it's about one in eight who is struggling with their land line access, which is based on DS-Lite and which reasonably well matches the estimated percentage of DS-Lite on land lines. The problems are however of a somewhat different nature than what RFC6269 addresses; they are roughly these: - Various services don't work. Like STUN, and due to that, SIP. And apparently various VPN solutions, too, but I never got access to any details with this. The real culprit here seems to be restricted cone NAT in the AFTR, plus apparently IPsec not working through DS-Lite. - There have been multiple reports that during peak hours there are significant connection drops. The impact varies from user to user as well as from ISP to ISP, apparently. Or as one user put it: "I solved the problem. I just don't even try to access IPv4-only web pages on saturday afternoons any longer." I don't have access to the AFTRs involved, so I can't reliably tell what's happening there, but from the descriptions I got it looks like some of them are actually running out of memory/CAM during peak hours and start to drop the connections. This is economically plausible, too, since the ISPs won't spend significant money on AFTR hardware until problems have already shown up. - First level support is frequently completely helpless when confronted with DS-Lite, or even IPv6 in general. The most annoying aspect here is that frequently it comes across that "it's a problem with IPv6" and "if you keep complaining they'll switch it off again for you" (i.e. they go back to IPv4-only connectivity without restricted cone NAT). All the information I have here is largely based on anecdotal reports, but enough of them for me to consider these problems anything but isolated cases. Cheers, Benedikt -- Benedikt Stockebrand, Stepladder IT Training+Consulting Dipl.-Inform. http://www.stepladder-it.com/ Business Grade IPv6 --- Consulting, Training, Projects BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/

3 4

Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 4 -NAT64 Benedikt Stockebrand
by Thorsten Trottier 05 May '16

05 May '16

Hello Benedikt, I’m not a friend of NAT as well, but demonize NAT for any actions is a kind of overdo, isn’t it. We are living with NAT a long time now for better or for worse. A customer of mine (enterprise customer with hundreds of sites and thousands of employees) has setup his IPv6 project more than 4 years ago and plans to be finished 2020. Their project team produced hundreds of pages in planning strategy, timeline and migration. In one of their sub projects they saw NAT as a interim solution for their Webservice as best method. We implemented a redundant NAT64 solution based on Cisco Adress Family Translation. Now IPv6-only or Dual-stacked Users can hit the customers web service which is still IPv4 only. Of course not a low-cost solution, but for „political" and/or technical reasons a solid way. Best regards Thorsten > > > -----Ursprüngliche Nachricht----- > Von: ipv6-wg [mailto:ipv6-wg-bounces@ripe.net] Im Auftrag von ipv6-wg-request(a)ripe.net > Gesendet: Dienstag, 26. April 2016 12:00 > An: ipv6-wg(a)ripe.net > Betreff: ipv6-wg Digest, Vol 55, Issue 4 > > Send ipv6-wg mailing list submissions to > ipv6-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/ipv6-wg > or, via email, send a message with subject or body 'help' to > ipv6-wg-request(a)ripe.net > > You can reach the person managing the list at > ipv6-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific than "Re: Contents of ipv6-wg digest..." > > > Today's Topics: > > 1. Re: ipv6-wg Digest, Vol 55, Issue 2 (Benedikt Stockebrand) > 2. Re: ipv6-wg Digest, Vol 55, Issue 2 (Silvia Hagen) > 3. Re: ipv6-wg Digest, Vol 55, Issue 2 (Sander Steffann) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 25 Apr 2016 18:13:35 +0000 > From: Benedikt Stockebrand <bs(a)stepladder-it.com> > To: christian bretterhofer <christian.bretterhofer(a)gmail.com> > Cc: ipv6-wg(a)ripe.net > Subject: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > Message-ID: <87eg9th7zk.fsf(a)moa.stepladder-it.com> > Content-Type: text/plain > > Hi Christian and list, > > christian bretterhofer <christian.bretterhofer(a)gmail.com> writes: > >> I think the basic work for ISPs in concern to IPv6 is covered. > > well, depends on the ISP in question. To me it looks a lot like many are still struggling to get the necessary knowledge and experience to their tech and support crowd---not necessarily with the people actively involved in the RIPE community, but at least with the big ones. > > A customer recently asked one of the large players here in Germany if they were interested in a contract that would have allowed my customer to outsource some IPv6-related tasks---or rather, to outsource some tasks that were also expected to be supported via IPv6. They were turned down with the explanation "we don't have the necessary manpower to operate this". > >> But i miss the topics to be addressed if you want to migrate from a >> IPv4 Microsoft Active domain using company to an system where most >> server in an enterprise could by just IPv6 only and use technologies >> like NAT46 ( SIIT-DC ) or similar to still make IPv4 only windows >> clients happy. > > Now I've taken a bit of a look at these things, but then I'm not exactly a Microsoft guy. From all I've seen, going for NAT64 and such is generally a bad idea. Instead, ensure that IPv6 is provided wherever it is needed and then make your servers dual stacked. > > Yes, that frequently involves upgrades on various servers nobody really wants to touch, but the very reasons why nobody wants to touch them are the reasons why you actually clean that stuff up. > >> Switching an enterprise with location around the global from a "we >> donot route any IPv6 traffic across our WAN Links" "most servers have >> IPv6 disabled" to >> We start IPv6 routing partially and enable partial IPv6 support on >> servers in a Microsoft ADS environment seems not covered in most IPv6 >> covering websites and presentations. > > That may be because your approach is unnecessarily painful. You want to get IPv6 up and running in the network infrastructure first, then make your servers dual-stacked and then deal with the clients. > > At least that's the "strategic" outline of an approach. Beyond that it's really a lot of detail work to do on an individual basis. > >> Maintaining dual stack for the datacenters is just painfull and there >> should be a "single" device in the form of NAT46/SIIT/SIIT-DC in front >> of each server area. I am not sure that Active directory is ready for >> that. > > Nonononono, don't do that. Whenever something goes wrong with that "single device", you'll have a serious disruption of service, not everything works through it, and you'll never ever get a chance to get rid of it in the long run because there'll always be that one last server that depends on it, or might depend on it but nobody knows for sure. > > Yes, that means that you need to have all your servers dual stacked, and yes, that's some serious extra workload in a data center context, but anything else is quite likely way worse. > > > Cheers, > > Benedikt > > -- > Benedikt Stockebrand, Stepladder IT Training+Consulting > Dipl.-Inform. http://www.stepladder-it.com/ > > Business Grade IPv6 --- Consulting, Training, Projects > > BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/ > > > > ------------------------------ > > Message: 2 > Date: Mon, 25 Apr 2016 18:35:28 +0000 > From: Silvia Hagen <silvia.hagen(a)sunny.ch> > To: Benedikt Stockebrand <bs(a)stepladder-it.com>, christian > bretterhofer <christian.bretterhofer(a)gmail.com> > Cc: "ipv6-wg(a)ripe.net" <ipv6-wg(a)ripe.net> > Subject: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > Message-ID: <F1D4404E5E6C614EB9D3083F4D15A7E70129FFFA@hex02> > Content-Type: text/plain; charset="iso-8859-1" > > That would be a great panel discussion with some diverse speakers on the panel :-) > > Silvia > > -----Urspr?ngliche Nachricht----- > Von: ipv6-wg [mailto:ipv6-wg-bounces@ripe.net] Im Auftrag von Benedikt Stockebrand > Gesendet: Montag, 25. April 2016 20:14 > An: christian bretterhofer > Cc: ipv6-wg(a)ripe.net > Betreff: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > > Hi Christian and list, > > christian bretterhofer <christian.bretterhofer(a)gmail.com> writes: > >> I think the basic work for ISPs in concern to IPv6 is covered. > > well, depends on the ISP in question. To me it looks a lot like many are still struggling to get the necessary knowledge and experience to their tech and support crowd---not necessarily with the people actively involved in the RIPE community, but at least with the big ones. > > A customer recently asked one of the large players here in Germany if they were interested in a contract that would have allowed my customer to outsource some IPv6-related tasks---or rather, to outsource some tasks that were also expected to be supported via IPv6. They were turned down with the explanation "we don't have the necessary manpower to operate this". > >> But i miss the topics to be addressed if you want to migrate from a >> IPv4 Microsoft Active domain using company to an system where most >> server in an enterprise could by just IPv6 only and use technologies >> like NAT46 ( SIIT-DC ) or similar to still make IPv4 only windows >> clients happy. > > Now I've taken a bit of a look at these things, but then I'm not exactly a Microsoft guy. From all I've seen, going for NAT64 and such is generally a bad idea. Instead, ensure that IPv6 is provided wherever it is needed and then make your servers dual stacked. > > Yes, that frequently involves upgrades on various servers nobody really wants to touch, but the very reasons why nobody wants to touch them are the reasons why you actually clean that stuff up. > >> Switching an enterprise with location around the global from a "we >> donot route any IPv6 traffic across our WAN Links" "most servers have >> IPv6 disabled" to >> We start IPv6 routing partially and enable partial IPv6 support on >> servers in a Microsoft ADS environment seems not covered in most IPv6 >> covering websites and presentations. > > That may be because your approach is unnecessarily painful. You want to get IPv6 up and running in the network infrastructure first, then make your servers dual-stacked and then deal with the clients. > > At least that's the "strategic" outline of an approach. Beyond that it's really a lot of detail work to do on an individual basis. > >> Maintaining dual stack for the datacenters is just painfull and there >> should be a "single" device in the form of NAT46/SIIT/SIIT-DC in front >> of each server area. I am not sure that Active directory is ready for >> that. > > Nonononono, don't do that. Whenever something goes wrong with that "single device", you'll have a serious disruption of service, not everything works through it, and you'll never ever get a chance to get rid of it in the long run because there'll always be that one last server that depends on it, or might depend on it but nobody knows for sure. > > Yes, that means that you need to have all your servers dual stacked, and yes, that's some serious extra workload in a data center context, but anything else is quite likely way worse. > > > Cheers, > > Benedikt > > -- > Benedikt Stockebrand, Stepladder IT Training+Consulting > Dipl.-Inform. http://www.stepladder-it.com/ > > Business Grade IPv6 --- Consulting, Training, Projects > > BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/ > > > > > ------------------------------ > > Message: 3 > Date: Mon, 25 Apr 2016 19:45:27 +0100 > From: Sander Steffann <sander(a)steffann.nl> > To: Silvia Hagen <silvia.hagen(a)sunny.ch> > Cc: christian bretterhofer <christian.bretterhofer(a)gmail.com>, > "ipv6-wg(a)ripe.net" <ipv6-wg(a)ripe.net> > Subject: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > Message-ID: <0831019F-B2A2-40DB-99E4-9CAA526D1581(a)steffann.nl> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > >> Op 25 apr. 2016, om 19:35 heeft Silvia Hagen <silvia.hagen(a)sunny.ch> het volgende geschreven: >> >> That would be a great panel discussion with some diverse speakers on >> the panel :-) > > I have been doing some enterprise stuff as well recently. If there is going to be such a panel I would love to participate! :) > > Cheers, > Sander > >

2 1