- ipv6-wg - mailman.ripe.net

Re: [ipv6-wg] IPv6 cloud!
by Benedikt Stockebrand 12 May '16

12 May '16

Hi Ole and list, "Ole Troan (otroan)" <otroan(a)cisco.com> writes: >> Considering the increasing reports of people having problems with >> DS-Lite > > Any more details on that? > New problems not mentioned in RFC6269? sorry I haven't got the time right now to review RFC6269 for what's exactly mentioned there and what isn't, but: When I do IPv6 trainings these days it's about one in eight who is struggling with their land line access, which is based on DS-Lite and which reasonably well matches the estimated percentage of DS-Lite on land lines. The problems are however of a somewhat different nature than what RFC6269 addresses; they are roughly these: - Various services don't work. Like STUN, and due to that, SIP. And apparently various VPN solutions, too, but I never got access to any details with this. The real culprit here seems to be restricted cone NAT in the AFTR, plus apparently IPsec not working through DS-Lite. - There have been multiple reports that during peak hours there are significant connection drops. The impact varies from user to user as well as from ISP to ISP, apparently. Or as one user put it: "I solved the problem. I just don't even try to access IPv4-only web pages on saturday afternoons any longer." I don't have access to the AFTRs involved, so I can't reliably tell what's happening there, but from the descriptions I got it looks like some of them are actually running out of memory/CAM during peak hours and start to drop the connections. This is economically plausible, too, since the ISPs won't spend significant money on AFTR hardware until problems have already shown up. - First level support is frequently completely helpless when confronted with DS-Lite, or even IPv6 in general. The most annoying aspect here is that frequently it comes across that "it's a problem with IPv6" and "if you keep complaining they'll switch it off again for you" (i.e. they go back to IPv4-only connectivity without restricted cone NAT). All the information I have here is largely based on anecdotal reports, but enough of them for me to consider these problems anything but isolated cases. Cheers, Benedikt -- Benedikt Stockebrand, Stepladder IT Training+Consulting Dipl.-Inform. http://www.stepladder-it.com/ Business Grade IPv6 --- Consulting, Training, Projects BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/

3 4

Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 4 -NAT64 Benedikt Stockebrand
by Thorsten Trottier 05 May '16

05 May '16

Hello Benedikt, I’m not a friend of NAT as well, but demonize NAT for any actions is a kind of overdo, isn’t it. We are living with NAT a long time now for better or for worse. A customer of mine (enterprise customer with hundreds of sites and thousands of employees) has setup his IPv6 project more than 4 years ago and plans to be finished 2020. Their project team produced hundreds of pages in planning strategy, timeline and migration. In one of their sub projects they saw NAT as a interim solution for their Webservice as best method. We implemented a redundant NAT64 solution based on Cisco Adress Family Translation. Now IPv6-only or Dual-stacked Users can hit the customers web service which is still IPv4 only. Of course not a low-cost solution, but for „political" and/or technical reasons a solid way. Best regards Thorsten > > > -----Ursprüngliche Nachricht----- > Von: ipv6-wg [mailto:ipv6-wg-bounces@ripe.net] Im Auftrag von ipv6-wg-request(a)ripe.net > Gesendet: Dienstag, 26. April 2016 12:00 > An: ipv6-wg(a)ripe.net > Betreff: ipv6-wg Digest, Vol 55, Issue 4 > > Send ipv6-wg mailing list submissions to > ipv6-wg(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/ipv6-wg > or, via email, send a message with subject or body 'help' to > ipv6-wg-request(a)ripe.net > > You can reach the person managing the list at > ipv6-wg-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific than "Re: Contents of ipv6-wg digest..." > > > Today's Topics: > > 1. Re: ipv6-wg Digest, Vol 55, Issue 2 (Benedikt Stockebrand) > 2. Re: ipv6-wg Digest, Vol 55, Issue 2 (Silvia Hagen) > 3. Re: ipv6-wg Digest, Vol 55, Issue 2 (Sander Steffann) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 25 Apr 2016 18:13:35 +0000 > From: Benedikt Stockebrand <bs(a)stepladder-it.com> > To: christian bretterhofer <christian.bretterhofer(a)gmail.com> > Cc: ipv6-wg(a)ripe.net > Subject: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > Message-ID: <87eg9th7zk.fsf(a)moa.stepladder-it.com> > Content-Type: text/plain > > Hi Christian and list, > > christian bretterhofer <christian.bretterhofer(a)gmail.com> writes: > >> I think the basic work for ISPs in concern to IPv6 is covered. > > well, depends on the ISP in question. To me it looks a lot like many are still struggling to get the necessary knowledge and experience to their tech and support crowd---not necessarily with the people actively involved in the RIPE community, but at least with the big ones. > > A customer recently asked one of the large players here in Germany if they were interested in a contract that would have allowed my customer to outsource some IPv6-related tasks---or rather, to outsource some tasks that were also expected to be supported via IPv6. They were turned down with the explanation "we don't have the necessary manpower to operate this". > >> But i miss the topics to be addressed if you want to migrate from a >> IPv4 Microsoft Active domain using company to an system where most >> server in an enterprise could by just IPv6 only and use technologies >> like NAT46 ( SIIT-DC ) or similar to still make IPv4 only windows >> clients happy. > > Now I've taken a bit of a look at these things, but then I'm not exactly a Microsoft guy. From all I've seen, going for NAT64 and such is generally a bad idea. Instead, ensure that IPv6 is provided wherever it is needed and then make your servers dual stacked. > > Yes, that frequently involves upgrades on various servers nobody really wants to touch, but the very reasons why nobody wants to touch them are the reasons why you actually clean that stuff up. > >> Switching an enterprise with location around the global from a "we >> donot route any IPv6 traffic across our WAN Links" "most servers have >> IPv6 disabled" to >> We start IPv6 routing partially and enable partial IPv6 support on >> servers in a Microsoft ADS environment seems not covered in most IPv6 >> covering websites and presentations. > > That may be because your approach is unnecessarily painful. You want to get IPv6 up and running in the network infrastructure first, then make your servers dual-stacked and then deal with the clients. > > At least that's the "strategic" outline of an approach. Beyond that it's really a lot of detail work to do on an individual basis. > >> Maintaining dual stack for the datacenters is just painfull and there >> should be a "single" device in the form of NAT46/SIIT/SIIT-DC in front >> of each server area. I am not sure that Active directory is ready for >> that. > > Nonononono, don't do that. Whenever something goes wrong with that "single device", you'll have a serious disruption of service, not everything works through it, and you'll never ever get a chance to get rid of it in the long run because there'll always be that one last server that depends on it, or might depend on it but nobody knows for sure. > > Yes, that means that you need to have all your servers dual stacked, and yes, that's some serious extra workload in a data center context, but anything else is quite likely way worse. > > > Cheers, > > Benedikt > > -- > Benedikt Stockebrand, Stepladder IT Training+Consulting > Dipl.-Inform. http://www.stepladder-it.com/ > > Business Grade IPv6 --- Consulting, Training, Projects > > BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/ > > > > ------------------------------ > > Message: 2 > Date: Mon, 25 Apr 2016 18:35:28 +0000 > From: Silvia Hagen <silvia.hagen(a)sunny.ch> > To: Benedikt Stockebrand <bs(a)stepladder-it.com>, christian > bretterhofer <christian.bretterhofer(a)gmail.com> > Cc: "ipv6-wg(a)ripe.net" <ipv6-wg(a)ripe.net> > Subject: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > Message-ID: <F1D4404E5E6C614EB9D3083F4D15A7E70129FFFA@hex02> > Content-Type: text/plain; charset="iso-8859-1" > > That would be a great panel discussion with some diverse speakers on the panel :-) > > Silvia > > -----Urspr?ngliche Nachricht----- > Von: ipv6-wg [mailto:ipv6-wg-bounces@ripe.net] Im Auftrag von Benedikt Stockebrand > Gesendet: Montag, 25. April 2016 20:14 > An: christian bretterhofer > Cc: ipv6-wg(a)ripe.net > Betreff: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > > Hi Christian and list, > > christian bretterhofer <christian.bretterhofer(a)gmail.com> writes: > >> I think the basic work for ISPs in concern to IPv6 is covered. > > well, depends on the ISP in question. To me it looks a lot like many are still struggling to get the necessary knowledge and experience to their tech and support crowd---not necessarily with the people actively involved in the RIPE community, but at least with the big ones. > > A customer recently asked one of the large players here in Germany if they were interested in a contract that would have allowed my customer to outsource some IPv6-related tasks---or rather, to outsource some tasks that were also expected to be supported via IPv6. They were turned down with the explanation "we don't have the necessary manpower to operate this". > >> But i miss the topics to be addressed if you want to migrate from a >> IPv4 Microsoft Active domain using company to an system where most >> server in an enterprise could by just IPv6 only and use technologies >> like NAT46 ( SIIT-DC ) or similar to still make IPv4 only windows >> clients happy. > > Now I've taken a bit of a look at these things, but then I'm not exactly a Microsoft guy. From all I've seen, going for NAT64 and such is generally a bad idea. Instead, ensure that IPv6 is provided wherever it is needed and then make your servers dual stacked. > > Yes, that frequently involves upgrades on various servers nobody really wants to touch, but the very reasons why nobody wants to touch them are the reasons why you actually clean that stuff up. > >> Switching an enterprise with location around the global from a "we >> donot route any IPv6 traffic across our WAN Links" "most servers have >> IPv6 disabled" to >> We start IPv6 routing partially and enable partial IPv6 support on >> servers in a Microsoft ADS environment seems not covered in most IPv6 >> covering websites and presentations. > > That may be because your approach is unnecessarily painful. You want to get IPv6 up and running in the network infrastructure first, then make your servers dual-stacked and then deal with the clients. > > At least that's the "strategic" outline of an approach. Beyond that it's really a lot of detail work to do on an individual basis. > >> Maintaining dual stack for the datacenters is just painfull and there >> should be a "single" device in the form of NAT46/SIIT/SIIT-DC in front >> of each server area. I am not sure that Active directory is ready for >> that. > > Nonononono, don't do that. Whenever something goes wrong with that "single device", you'll have a serious disruption of service, not everything works through it, and you'll never ever get a chance to get rid of it in the long run because there'll always be that one last server that depends on it, or might depend on it but nobody knows for sure. > > Yes, that means that you need to have all your servers dual stacked, and yes, that's some serious extra workload in a data center context, but anything else is quite likely way worse. > > > Cheers, > > Benedikt > > -- > Benedikt Stockebrand, Stepladder IT Training+Consulting > Dipl.-Inform. http://www.stepladder-it.com/ > > Business Grade IPv6 --- Consulting, Training, Projects > > BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/ > > > > > ------------------------------ > > Message: 3 > Date: Mon, 25 Apr 2016 19:45:27 +0100 > From: Sander Steffann <sander(a)steffann.nl> > To: Silvia Hagen <silvia.hagen(a)sunny.ch> > Cc: christian bretterhofer <christian.bretterhofer(a)gmail.com>, > "ipv6-wg(a)ripe.net" <ipv6-wg(a)ripe.net> > Subject: Re: [ipv6-wg] ipv6-wg Digest, Vol 55, Issue 2 > Message-ID: <0831019F-B2A2-40DB-99E4-9CAA526D1581(a)steffann.nl> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > >> Op 25 apr. 2016, om 19:35 heeft Silvia Hagen <silvia.hagen(a)sunny.ch> het volgende geschreven: >> >> That would be a great panel discussion with some diverse speakers on >> the panel :-) > > I have been doing some enterprise stuff as well recently. If there is going to be such a panel I would love to participate! :) > > Cheers, > Sander > >

2 1

what is v6-only?
by Bajpai, Vaibhav 05 May '16

05 May '16

Hello, What does v6-only mean? a) A client only has v6 address and can only route to v6 destinations b) A client only has v6 address but can route to dual-stack destinations using a network translator (such as NAT64) IIRC, IETF SSIDs are named: 'v6 only + nat64’. Personally when someone says v6-only I presume a), but lately I have seen people say v6-only although they mean b). PS: Sorry for a silly question Best, Vaibhav =================================== Vaibhav Bajpai www.vaibhavbajpai.com Room 91, Research I School of Engineering and Sciences Jacobs University Bremen, Germany ===================================

5 4

IPv6 WG Agenda
by Jen Linkova 03 May '16

03 May '16

Hi IPv6-Enthusiasts ;) I'm sure most of you have noticed that already, but the agenda for IPv6 WG sessions @ RIPE72 has been published: https://ripe72.ripe.net/programme/meeting-plan/ipv6-wg/ See you in Copenhagen soon! -- SY, Jen Linkova aka Furry on behalf of IPv6 WG Chairs

1 0

RIPE72 IPv6 WG: call for presentations
by Jen Linkova 20 Apr '16

20 Apr '16

Dear IPv6 Enthusiasts ;) I know that 23 of May 2016 when RIPE72 will start looks so away but we (IPv6 WG Chairs) like to plan ahead! If you would like to present at IPv6 WG session or just have any suggestions on the agenda (what we should or should not be talking about) - please email ipv6-wg-chairs(a)ripe.net >From presenters we need the following information: - a tentative title of your talk; - short summary - how much time you need (I'd recommend allowing 5 mins for questions). For the last few meetings we filled all the agenda slots quite earlier and unfortunately had to reject a number of interesting talks because they were submitted too late. So don't be shy! If you *might* be able to present but not sure yet - also let us know. -- SY, Jen Linkova aka Furry on behalf of IPv6 WG Chairs.

3 2

New on RIPE Labs: 10,000 LIRs with IPv6 Resources
by Mirjam Kuehne 29 Feb '16

29 Feb '16

Dear colleagues, This week, we saw the 10,000th Local Internet Registry (LIR) received IPv6 addresses. The first block of IPv6 addresses was allocated from IANA to the RIPE NCC in 1999, so we have been distributing IPv6 addresses for 17 years. In this new article on RIPE Labs we track the policy developments that have made it progressively easier for LIRs to get the IPv6 they need: https://labs.ripe.net/Members/nathalie_nathalie/10-000-lirs-with-ipv6-resou… Kind regards, Mirjam Kuehne RIPE NCC

2 1

[training] RIPE NCC Training Courses April-June 2016
by Training Services 29 Feb '16

29 Feb '16

Dear colleagues, Our training team travels the RIPE NCC service region to deliver training courses to our members without any additional cost. Over the next few months, we'll be in Budapest, Tirana, Manchester, Lisbon, Bologna, Munich, Tallinn, Moscow, Vienna, Valletta, Reykjavik. Visit the following page to register and to check which training courses we are giving in your area: https://lirportal.ripe.net/training/courses The RIPE NCC delivers the following training courses: - LIR Training Course - RIPE Database Training Course - Basic IPv6 Training Course - DNSSEC Training Course - 2 days Advanced IPv6 Training Course - 2 days BGP Operations and Security Training Course For more information visit: https://www.ripe.net/support/training/courses With kind regards, Rumy Spratley-Kanis Training Services Manager

1 0

Internet question for opensubscriber.com
by Jack 15 Feb '16

15 Feb '16

Hello, I just need a bit of help, I would like to send the person who is authorised to make changes to opensubscriber.com a link to be added to this page: http://www.opensubscriber.com/message/ipv6-wg@ripe.net/17177495.html or to a resource page. I think it will be a great addition to the resources on the internet. The resource is an in-depth infographic filled with data of how the internet has evolved and had an impact on the transport industry. It also has a great internet timeline to show some of its milestones. This is the link to the graphic: https://www.locator.co.uk/vans. Let me know what you think? Also if this is not the correct email address to send this to, can you please let me know or forward this message on to the correct person? Thank you for your time, Jack ALL GREEN PR LIMITED, Kemp House, 152 City Road, London EC1V 2NX Remove me from Jack's list

1 0

IETF I-D: "Operational Implications of IPv6 Packets with Extension Headers"
by Fernando Gont 10 Feb '16

10 Feb '16

Folks, We have revised our IETF I-D "Operational Implications of IPv6 Packets with Extension Headers". The I-D is available at: <https://tools.ietf.org/html/draft-gont-v6ops-ipv6-ehs-packet-drops-01> Your feedback will be appreciated. If possible, please send your comments to: <draft-gont-v6ops-ipv6-ehs-packet-drops(a)tools.ietf.org> and CC <v6ops(a)ietf.org>. P.S.: You can find a number of pointers to articles and other related work on this topic here: <http://blog.si6networks.com/2015/12/the-controversial-ipv6-extension-header…> Thanks! Best regards, -- Fernando Gont e-mail: fernando(a)gont.com.ar || fgont(a)si6networks.com PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1 -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

2 2

New on RIPE Labs: Evaluating IPv4 and IPv6 Packet Fragmentation (by Geoff Huston)
by Mirjam Kuehne 29 Jan '16

29 Jan '16

Dear colleagues, Please find a new article on RIPE Labs contributed by Geoff Huston: Evaluating IPv4 and IPv6 Packet Fragmentation: One of the more difficult design exercises in packet-switched network architectures is that of the design of packet fragmentation. In this article, I’d like to examine IP packet fragmentation in detail and look at the design choices made by IP version 4, and then compare that with the design choices made by IP version 6. https://labs.ripe.net/Members/gih/evaluating-ipv4-and-ipv6-packet-fragmenta… Kind regards, Mirjam Kuehne RIPE NCC

1 0