June 2023 - ipv6-wg - mailman.ripe.net

Clear Guidance for Enterprises
by Wilhelm Boeddinghaus 01 Aug '23

01 Aug '23

Hi, at the end of my talk during the RIPE86 IPv6 working group I promised to start work on a paper with clear guidance for enterprises to migrate their networks to IPv6. We have often wondere why enterprises do not migrate to IPv6. One possible answer is: They have no time and they lack knowledge. Many IT departments don't have any spare time for reading RFCs. From my understanding these IT departments don't need papers explaining the many possibilites to choose from. They need very clear guidance and examples. I am looking for 3 to 4 people who would like to start working on this with me. Peter Hessler contacted me during the meeting and he offered his help, time and expertise for this project. Thank you, Peter. Best, Wilhelm

18 28

Re: [ipv6-wg] contents of ipv6-wg Digest, Vol 135, Issue 10
by Clodagh Durkan 26 Jun '23

26 Jun '23

Hi Wilhelm, all, I am also really interested in this topic, really suspect it’s not broken for the most enterprises so why invest into what’s a whole new re architecture, skills in-house may also not exist. expensive in people and technology and high risk migration. Gsma announced this year global IOT devices surpassed SIMs this year, both now at 2bn + so change is already coming from the networks. I would really like to contribute however I can, Clodagh.durkan(a)ucdconnect.ie or gmail above Best regards, Clodagh On Thu 15 Jun 2023 at 11:00, <ipv6-wg-request(a)ripe.net> wrote: > Send ipv6-wg mailing list submissions to > ipv6-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/ipv6-wg > or, via email, send a message with subject or body 'help' to > ipv6-wg-request(a)ripe.net > > You can reach the person managing the list at > ipv6-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of ipv6-wg digest..." > > > Today's Topics: > > 1. Re: Clear Guidance for Enterprises (Paolo Volpato) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 14 Jun 2023 16:08:22 +0000 > From: Paolo Volpato <paolo.volpato(a)huawei.com> > To: Wilhelm Boeddinghaus <wilhelm(a)boeddinghaus.de> > Cc: "ipv6-wg(a)ripe.net" <ipv6-wg(a)ripe.net> > Subject: Re: [ipv6-wg] Clear Guidance for Enterprises > Message-ID: <2164ac90f1b34e908d39fe008217be7c(a)huawei.com> > Content-Type: text/plain; charset="utf-8" > > Hi Wilhelm, All, > > I have noticed that some people would be happy to cooperate to your idea > of a paper for IPv6 in enterprises (me included :-) > Wonder if you have thought of any rough plan to start and organize the > work. > > Many thanks > Paolo > > -----Original Message----- > From: Wilhelm Boeddinghaus <wilhelm(a)boeddinghaus.de> > Sent: Thursday, June 1, 2023 4:20 PM > To: Paolo Volpato <paolo.volpato(a)huawei.com> > Cc: ipv6-wg(a)ripe.net > Subject: Re: [ipv6-wg] Clear Guidance for Enterprises > > Hi Paolo, > > thanks for your help with this project. > > Lack of budget is of course a problem. But if the IT departments could at > least quantify the budget, this would help. If they have no idea how to > start the project, a budget eastimation is not possible. > > Best, > > Wilhelm > > Am 31.05.2023 um 08:42 schrieb Paolo Volpato via ipv6-wg: > > Hi Wilhelm, > > > > In addition, I would add that they also lack the budget to consider > deploying IPv6, meaning that enterprises don't consider IPv6 as a priority. > > At least, this is what we found during the editing of RFC 9386 on IPv6 > deployment status. > > > > I would be happy to contribute to this effort. > > > > Best regards > > Paolo > > > > -----Original Message----- > > From: ipv6-wg <ipv6-wg-bounces(a)ripe.net> On Behalf Of Wilhelm > > Boeddinghaus > > Sent: Tuesday, May 30, 2023 6:06 PM > > To: ipv6-wg(a)ripe.net > > Subject: [ipv6-wg] Clear Guidance for Enterprises > > > > Hi, > > > > at the end of my talk during the RIPE86 IPv6 working group I promised to > start work on a paper with clear guidance for enterprises to migrate their > networks to IPv6. > > > > We have often wondere why enterprises do not migrate to IPv6. One > possible answer is: They have no time and they lack knowledge. Many IT > departments don't have any spare time for reading RFCs. > > > > From my understanding these IT departments don't need papers > explaining the many possibilites to choose from. They need very clear > guidance and examples. > > > > I am looking for 3 to 4 people who would like to start working on this > with me. > > > > Peter Hessler contacted me during the meeting and he offered his help, > time and expertise for this project. Thank you, Peter. > > > > Best, > > > > Wilhelm > > > > > > > ------------------------------ > > Subject: Digest Footer > > -- > > To unsubscribe from this mailing list, get a password reminder, or change > your subscription options, please visit: > https://lists.ripe.net/mailman/listinfo/ipv6-wg > > > ------------------------------ > > End of ipv6-wg Digest, Vol 135, Issue 10 > **************************************** >

2 2

Not standing as working group chair for another term
by Benedikt Stockebrand 26 Jun '23

26 Jun '23

Hi folks, as I've already said during the working group session in Rotterdam my term as WG chair ends at the next RIPE meeting. Since I find it increasingly difficult to make the WG chair role agree with my daily work profile (too much firefighting, too little of a routine daily schedule), Jen and Ray had to cover for me more often than I am happy with---thanks, and apology, to both of them. As a consequence however it doesn't make any sense if I stood for another term. We'll start the process of finding a successor for me before RIPE 87. If you are interested in taking over the role, and are willing to keep a pretty much daily eye on the mailing list and such, you may already want to think about volunteering for the job. And one more thing: That doesn't mean that I have lost interest in the WG, or in IPv6 as such---in fact, in my opinion we still have some serious work to do eliminating the hidden dependencies on Vintage IP before they bite us in the backside. More about that at RIPE 87 in Rome... Cheers, Benedikt -- Benedikt Stockebrand, Stepladder IT Training+Consulting Dipl.-Inform. http://www.stepladder-it.com/ Business Grade IPv6 --- Consulting, Training, Projects BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/

1 0

IPv6 WG minutes from ripe 86
by Raymond Jetten 13 Jun '23

13 Jun '23

Here are the minutes from the RIPE 86 IPv6 wg session, please let us know if you want anything edited, or they will be published in a week on the website. Date: 24 May 2023, 11:00 - 12:30 (UTC+2) Chairs: Benedikt Stockebrand, Jen Linkova, Raymond Jetten Scribe: Tayfun Ozaltin Status: 1. Welcome Jen Linkova, IPv6 WG Co-chair The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/8-RIPE-86-IPv6-WG.… Jen Linkova welcomed everyone and introduced the co-chairs. The RIPE 85 minutes were approved. 1. Advanced IPv6 Course Input Request Tayfun Ozaltin, RIPE NCC The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/105-RIPE-86-Slide-… Tayfun Ozaltin, RIPE NCC, asked for input on the advanced IPv6 e-learning course that was being developed. There were no questions. 1. Deploying IPv6 and/or CGNAT Rinse Kloek, Delta Fiber / Kindes The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/67-RPE86-IPv6-depl… Rinse explained how their company made a transition from IPv4-only to an IPv6 supporting network. He mentioned the challenges they had during the implementation. Yannis Nikolopulos, Cellmobile, asked who the vendor was and what the real story was behind the denial. Rinse answered that Nokia was the vendor and that they did not support MAP-E and MAP-T. After several rounds of discussions, Rinse could not convince them to support these transition techniques. Yannis asked about the details of the deployment scenario. Rinse replied that they were using CGNAT, so the user was getting an internal IP address, a 164 address, and they were planning to assign the customers a v6 prefix as well. Thomas Schäfer, LMU, asked about the number of users who were already using IPv6 in their network. Rinse answered that they currently had about 50 friendly users (test users). Thomas added that it would be better to bypass internal services with IPv6. Rinse agreed and said that IPv6 was the way to go and that they already had a plan for it. Branimir Rajtar, 5x9 Networks, asked if they had implemented IPv6 in the core network as well or if they used 6PE/6VPE. Rinse answered that everything was dual-stack since day one in both the core and access networks. Peter Hessler, Globalways GmbH, said that the community should encourage people to deploy IPv6 whenever they were ready for it. Brian Storey, Gamma Telecom Limited, asked how long it had taken to reach this state and how they envisioned documenting IPv6 for their customers. Rinse answered that they hope by the end of this year 20% of the users will be IPv6 enabled, and next year it may be 80-100%. Peter Head, Gigaclear, asked for more elaboration on why they filtered the DHCPv6 releases. They decided to follow it up offline. 1. Clear Guidance for Implementing IPv6 in Enterprises Wilhelm Boeddinghaus The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/123-RIPE86-IPv6-Wi… Wilhelm Boeddinghaus emphasized the need for clear guidance on IPv6 deployment phases, challenges, and steps, especially for enterprise IT departments. He asked the question, "Can we as the community provide this clear guidance to the enterprises?" Peter Hessler said that he liked the idea and mentioned that it would be hugely beneficial to a lot of enterprises. Marco Davids, SIDN Labs, asked if Wilhelm agreed with him that the working group should also work on getting IPv6 knowledge into schools and universities so that young students have at least some knowledge. Wilhelm agreed. He emphasized that students in universities were still learning IPv4, and we needed to educate young people about IPv6. An audience speaker said that it was not only enterprises but also ISPs who needed to learn about this. He claimed that even big ISPs do not know how IPv6 works. Wilhelm agreed but also claimed that enterprises had many more problems since their core business was not IT. Urban Suhadolnik, TU Graz, agreed with the previous comments about universities. Wilhelm emphasized once again that universities should involve themselves much more in this. Gert Doering, SpaceNet AG, agreed and thanked Wilhelm for bringing up enterprise problems regarding IPv6 transition into the meeting. He added that he would like to help with the new BCOP for enterprises. He said that it will not be easy to pick up and agree on the right solution, but that it should be tried. Wilhelm agreed and said we should also involve enterprise admins in our group. Benedikt Stockebrand said that since most IT people in academia didn't receive any network training at all, it was still the RIPE community's job to spread the word at a level that people without a proper IT background can handle. Jen contributed to this with another online comment indicating that as the adoption of IPv6 increases among enterprises, universities will offer more. Peter Hessler said that for some ISPs, it was not even an option to provide IPv6 connections to enterprises. An audience speaker thanked Wilhelm for his proposal, mentioning how important it was for enterprises. He also said that he would be open to writing, reviewing, and working on documents of the best resources for newcomers and beginners in IPv6 and TCP/IP. Jen mentioned another online comment. Markus said that his students were unwilling to learn IPv6 since they think nobody used it. Jen said that there were different approaches to this depending on the availability of IPv6 in each part of the world. Finally, Jen asked what the next action should be. Wilhelm said that he would send an email to the mailing list to start working on this with people who can contribute. 1. Implications of IPv6 Addressing on Security Operations Fernando Gont The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/119-ripe86-fgont-i… Fernando Gont presented about the challenges of IPv6 security deployment. He also explained how IPv4 and IPv6 differ in terms of security implementations. Rinse Kloek mentioned that he conducted extensive CPE testing. One issue he encountered was that occasionally services were listening on local addresses, and if one copied the v4 test to the v6 test, it was possible to overlook this aspect. Fernando agreed and said testers did not know about ULA addresses. Benedikt Stockebrand suggested that leaving the IPv4 way of thinking would made things much easier. He added that not using dual-stack would simplify the way of working. Peter Hessler noted that a common mistake while translating IPv4 ACLs into IPv6, which was blocking ICMP as it should not be blocked in IPv6. Jen asked why it was important to care about the size of the prefix you block if it was someone else's network. Fernando answered that he experienced this in a meeting with a large content provider where they were just blocking a single IPv6 address instead of the /64. Fernando added that these kinds of things, which were obvious to this group, might not be obvious to the groups that were implementing rules in the networks. Jen added that with IPv4, it was much worse since you might be blocking many innocent users behind CGN just by blocking a single IPv4 address. 1. Conclusion & Thanks Benedikt Stockebrand announced that his term as the WG chair was ending with the next RIPE meeting, and that he did not want to go for another term. He asked the community if anyone was interested. As the last topic of the WG, Ondrej Caletka, RIPE NCC, asked everybody to test the IPv6-only network and try to identify any issues and report them to the vendors. Raymond , Benedikt, Jen. For Internal Use Only

1 0

Re: [ipv6-wg] Clear Guidance for Enterprises
by Gert Doering 04 Jun '23

04 Jun '23

Hi, On Sat, Jun 03, 2023 at 07:53:48PM +0000, Ole Troan (otroan) wrote: > Thought experiment. > IPv6 wasn?t invented. > Would we be able to make IPv4 continue to roll down the hill for another 25 years? Whether there's 3 or 4 layers of NAT won't matter much... everything that is not TCP or UDP won't survive, but since The Browser Oligopol seems to be set to move everything into QUIC anyway, we should be fine... It will nicely kill everything that is not Cloud or Rendezvous-Server- based, but there's quite a few parties outside that would consider this a feature. So yes. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

(IETF I-D) Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-ietf-opsec-ipv6-addressing-00.txt)
by Fernando Gont 02 Jun '23

02 Jun '23

Folks, The IETF OPSEC WG has adopted our IETF I-D entitled "Implications of IPv6 Addressing on Security Operations". This is the same material I presented at the last IPv6 WG meeting in Rotterdam (https://ripe86.ripe.net/programme/meeting-plan/ipv6-wg/). The IETF-ID is available at: * TXT: <https://www.ietf.org/archive/id/draft-ietf-opsec-ipv6-addressing-00.txt> * HTML: <https://datatracker.ietf.org/doc/html/draft-ietf-opsec-ipv6-addressing> We have tried to make the document as practical as possible for anyone doing security operations. Your comments and suggestions will be highly appreciated. P.S.: Thanks to those of you that sent feedback for previous revision of this document, by the way! Regards, Fernando -------- Forwarded Message -------- Subject: New Version Notification for draft-ietf-opsec-ipv6-addressing-00.txt Date: Fri, 02 Jun 2023 07:26:18 -0700 From: internet-drafts(a)ietf.org To: Fernando Gont <fgont(a)si6networks.com>, Guillermo Gont <ggont(a)si6networks.com> A new version of I-D, draft-ietf-opsec-ipv6-addressing-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Name: draft-ietf-opsec-ipv6-addressing Revision: 00 Title: Implications of IPv6 Addressing on Security Operations Document date: 2023-06-02 Group: opsec Pages: 13 URL: https://www.ietf.org/archive/id/draft-ietf-opsec-ipv6-addressing-00.txt Status: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-addressing/ Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-opsec-ipv6-addressing Abstract: The increased address availability provided by IPv6 has concrete implications on security operations. This document discusses such implications, and sheds some light on how existing security operations techniques and procedures might need to be modified accommodate the increased IPv6 address availability. The IETF Secretariat

1 0