- ipv6-wg - mailman.ripe.net

[news] Announcing the IPv6 Security Expert Exam and E-Learning Course
by Sandra Bras 15 Sep '21

15 Sep '21

Dear colleagues, Our second IPv6 exam certification - IPv6 Security Expert is now live. We have also launched a new e-learning course on IPv6 Security in the RIPE NCC Academy that is aligned with the exam. With the uptake in IPv6 adoption, we hope to see more network operators taking the necessary security precautions when using IPv6 and following best practice. The course consists of 17 modules and 7 lab activities, which will help you apply concepts learned and using actual tools and realistic scenarios. You can find out more about the IPv6 Security Expert certification here: https://www.ripe.net/support/certified-professionals/ipv6-security-expert-e… <https://www.ripe.net/support/certified-professionals/ipv6-security-expert-e…> And take a look at the IPv6 Security online course in the RIPE NCC Academy at: https://academy.ripe.net <https://academy.ripe.net/> I would like to acknowledge everyone who has participated in the exam and course creation process, from answering our job task analysis survey to testing the exam and reviewing the course material to testing the lab activities. Having the involvement of the community is one of the strengths of our exams, and we thank all our volunteers. If you have any questions or feedback, you can reach us at <exams(a)ripe.net <mailto:exams@ripe.net>>. Best regards, Sandra Bras Assistant Manager Learning and Development RIPE NCC

1 0

RIPE-554-bis
by Azael Fernandez A. 08 Sep '21

08 Sep '21

Hi, I have been following the presentation in May and the messages in this list, and since 2018 I have asked *Jan *if you were planning to update this document. So I am very delighted to see that it is happening. By reviewing the new version I would suggest, in the case of the RFCs that are in the category of Standards Track, to have the indication of Standard, for example when updating the IPv6 Basic specification it would be better to write it in the following way: IPv6 Basic specification [RFC8200 or STD 86] and better to also have the reference to the RFC made obsolete by standard tracks for example, in this case: IPv6 Basic specification [RFC8200 or STD 86] (made obsolete RFC 2460), the main reason is that in almost all the datasheets, the original or previous RFC are still mentioned. Finally, I found a writing error in the mandatory support for CPE equipment, it says RFC7094, and it should be RFC*7084.* BEST, Azael

2 1

New on RIPE Labs: Managing DNS Over IPv6 Only
by Alun Davies 02 Sep '21

02 Sep '21

Dear colleagues, Paul de Weerd and Florian Obser share a short use case looking at why and how the team recently switched the management interfaces for the RIPE NCC DNS servers over to IPv6 only. Read more on RIPE Labs: https://labs.ripe.net/author/paul_de_weerd/managing-dns-over-ipv6-only/ Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

New on RIPE Labs: IPv6 Support on the PlayStation 5
by Alun Davies 30 Aug '21

30 Aug '21

Dear colleagues, In a new guest post on RIPE Labs, Tore Anderson takes a look at how IPv6 capability has come on with the arrival of the next generation of gaming consoles: https://labs.ripe.net/author/toreanderson/ipv6-support-on-the-playstation-5/ Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

RIPE 82 IPv6 WG minutes published
by Jetten Raymond 15 Jun '21

15 Jun '21

Dear list members, The minutes from the RIPE 82 IPv6 Wg session have now been published. https://www.ripe.net/participate/ripe/wg/active-wg/ipv6/minutes/ipv6-workin… Rgds, your IPv6 wg co-chairs, Jen, Benedikt and Ray

1 0

WebinarIPv6 Mythology
by Maysa de Freitas Souza 08 Jun '21

08 Jun '21

Hi all, IPv6 Mythology webinar will happen on 09/06 at 4pm ART (UTC-0300). Linkedin event link: https://www.linkedin.com/events/edgeunowebinar-ipv6mythology680338496503682… Thanks and Best Regards

1 0

New on RIPE Labs: Two Articles on IPv6
by Alun Davies 04 Jun '21

04 Jun '21

Dear colleagues, Ahead of 6 June, we’ve published two RIPE Labs articles covering two important topics in IPv6. Looking into IPv6 adoption in 2021, Stephen Strowes and colleagues examine the difference between average IPv6 capability per country over a few days in June 2020 versus the most recent similar averages for 2021: https://labs.ripe.net/author/stephen_strowes/ipv6-adoption-in-2021/ And on the topic of IPv6 security, Alvaro Vives looks at the security challenges that come with IPv6 and talks about how our IPv6 security course helps people and organisations get prepared to keep the future Internet secure: https://labs.ripe.net/author/alvaro_vives/securing-the-future-of-ipv6/ Kind regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

RIPE82 IPv6 Working group session Minutes
by Jetten Raymond 04 Jun '21

04 Jun '21

Dear members of the IPv6 Working Group, Below are the draft minutes from the RIPE 82 virtual meeting, Thanks to the RIPE NCC for these, If you have any comments or remarks please let us know before 10.6.2021 IPv6 Working Group Minutes - RIPE 82 Thursday, 20 May 10:30 - 12:00 (UTC+2) WG Chairs: Benedikt Stockebrand, Jen Linkova, Raymond Jetten Scribe: Adonis Stergiopoulos Status: Draft Welcome / Agenda The Chairs This presentation is available at:  https://ripe82.ripe.net/wp-content/uploads/presentations/39-_RIPE82_IPv6WG_… The minutes from RIPE 81 were approved. There were no questions or comments. WG Chair Re-selection The Chairs Jen Linkova was selected for another three years as co-chair of the working group. An Update on Fragmentation Loss Rates in IPv6 Geoff Huston This presentation is available at: https://ripe82.ripe.net/wp-content/uploads/presentations/17-huston-ipv6-v6f… Lars Prehn (MPII) asked how many vantage points his team measured from, and if it was really the end hosts that failed, or if there might just be few misconfigured “choke” routers close to the vantage point through which most traffic for the American-based devices passed. If that was the case, the numbers might just reflect the fraction of devices routed via those routers. Geoff said they used four server points and, looking closer at Canada and the USA, different networks had different loss rates, so it was far more likely that this was close to the edge, not close to them. They also measured entire continents, hence they were finding that the “choke” points were not close to them and it was more likely that they were closer to the user, or in the network at that last-hop access network. Richard Patterson (Sky) asked if the tests included atomic fragments. Jen clarified that during the presentation, Geoff mentioned that his team used two fragments, initially a larger one and then a smaller one, so it was just one packet with a fragment header but no subsequent fragment. Geoff said this was coming up. In about a month's time, they would have some data available. Ivan Beveridge (Independent) asked about fragmentation and if they considered that some firewalls set MSS around 1,380. If that was tunnelled, for example due to DDoS-mitigation, they might see some issues. Geoff said yes, but some seemed to go at 1,400. If a firewall set an MSS down that low, this could create issues and it would be a bizarre thing to do. David Schweizer (NetDEF) asked if they had done any tests with fragment sizes less than 1,200. Geoff said 1,200 was the smallest size they had used. Oliver Gasser (Max Planck Institute for Informatics) asked what the baseline drop rate for IPv6 was. Geoff said this was a talk for another time, but from what he remembered, the base rate was 2%. Christian Bretterhofer (Independent) asked for an example configuration for ISPs and enterprises to show how to make this work. Geoff said it was simple - they should not drop fragments and ask their router vendors not to drop packets with extension headers. Jan Žorž (6connect) asked what people inside their particular countries coud do to make this better and how to approach this issue. Geoff said he didn’t know, since equipment had changed and improved over the last five years. Alex Le Heux (Independent) asked if they would publish this data with per-AS granularity. Geoff said yes, and they could be found on the link in the presentation. Marek Barczyk (SUT Computer Center) asked if they considered testing drop rate of fragmented vs packets with other IPv6 options that triggered a slow path. Geoff responded that he had not considered extension header options other than a null fragment, but he would be willing to test any if people wanted to use them on the network. RIPE554-bis Tim Chown The presentation is available at: https://ripe82.ripe.net/wp-content/uploads/presentations/66-ripe82-ipv6wg-r… Jordi Palet Martinez (Independent) referred to slide three of the presentation and asked why only MAP/DS-Lite and not 464XLAT and lw4o6 were used. He volunteered to contribute to this or any other parts of the document. Tim said that Jordi had contributed a lot on this particular topic in the IETF. He thought 464XLAT would be in there but he was unsure about a lightweight lw4o6. He asked Jodie to post this on the list, as it would be mentioned along with NAT64 and DNS64. Jan Žorž (6connect) said this was just the current version of the document. They wanted to publish it as soon as possible, since many people were using it. If anyone wanted to add additional sections, they were happy to update it after the current version had been published. MAP-E Residential Deployment and the Issues Encountered Yannis Nikolopoulos This presentation is available at: https://ripe82.ripe.net/wp-content/uploads/presentations/78-ripe82-yanodd-m… Blake Willis (Zayo Europe) asked what the driver was that pushed them to switch from MAP-T to MAP-E and if this was attributed to services module requirements. Yannis said they had only ever tried MAP-T in a very brief trial six years ago, and they did not really switch from MAP-T to MAP-E. After they tested both in the trials, they decided to go ahead with MAP-E. Jan Žorž (6connect) asked what the top three operational issues were with lw4o6 that put them off this path. Yannis said the CPE and the AFTR, as the AFTR could not scale well to a large number of subscribers. Also, the vendor could not put up the extra development effort because there was no interest from other operators. He could not recall a third issue at that moment. Richard Patterson (Sky) asked for more information on the issues with anycasting the BR and the limitations with policy-based routing that required the ASR99 to be dedicated. Yannis said a potential issue was that an ICMP IPv6 packet that was too big might be sent to the wrong BR if it was anycasted. About the policy-based routing, since MAP-E was implemented as a routing mechanism in Cisco, they put a limit to a specific number of PBR that can be implemented on the box. The limitation was that it can be either one or two per direction. Jordi Palet Martinez (Independent) referred to slide 24 of the presentation where Yannis talked about S46 RFC8026. He thought it was much better to use RFC 8585, which also included support for 464XLAT. He had much more success in several broadband deployments (GPON, DSL, cellular broadband and just cellular) than all the other options. He said he was also now working on a deployment for 25 million subscribers. Yannis thanked Jordi for the suggestions. Sia Saatpoor (Logius) asked about the activation of IPv6 and the use of stimulation. He thought the major role and responsibility for the use of IPv6 lay with the government. In the Netherlands, the highest ICT policy body of the government had decided that all digital Dutch governments must be accessible through IPv6 by the end of 2021. Sia asked what was the role of the government in Greece or other parts of Europe in stimulating the industry. Yannis said he could only talk about the Greek government. It was currently not too far behind, but operators were running part of the governmental network, so they were trying to push IPv6 as much as they could. He was not aware of a Greek government-specific initiative at this point. Kostas Zorbadelos (Independent) asked if software mechanisms were the way forward, or if should they stick to CGN (for the IPv4 path) in dual-stack deployments. Yannis replied that he really hoped software mechanisms were still the way to go. IPv6 Deployment Status Paolo Volpato This presentation is available at: https://ripe82.ripe.net/wp-content/uploads/presentations/64-RIPE-82-Fioccol… Christian Bretterhofer (Andritz AG) said that many people did not find any business reason to adopt IPv6. He asked if there were any reasons to adopt IPv6. Paolo answered that this was one of the most interesting and critical questions. Unfortunately, there was no definitive answer, and this was also part of the discussion. He advised Christian to look at the use cases and spend more time reading through their draft. Some operators had moved to IPv6 for innovation reasons, enabling new applications even if they were not here yet. There was also some kind of consensus that 5G and IoT were two cases demanding IPv6, but that was not entirely true. Another motivation, which was still somewhat unclear, was the role of governments and national authorities’ actions in favour of IPv6 deployment. He added that there were cases, two of them were in the USA and China, where federal and government agencies had demanded not just support for IPv6, but potentially having only IPv6-based applications. Veronika McKillop (UK IPv6 Council) said that the introduction of IPv6 did not immediately relieve the pressure on the IPv4 address pool, and dual-stack did not help with this problem. Only IPv6-only deployment helped with the IPv4 address shortage. She noted that it would be worth clarifying this on the relevant slide. Paolo agreed and said he would update the materials. Happy Eyeballs Considered Harmful Jens Link The presentation is available at: https://ripe82.ripe.net/wp-content/uploads/presentations/80-he.pdf Jordi Palet Martinez (Independent) said that he had described this problem a long time ago and it was the reason he had proposed it in the IETF (“Reporting of Happy Eyeballs v2 Failures<https://www.ietf.org/archive/id/draft-palet-ietf-v6ops-he-reporting-00.txt>”), so that ISPs knew something was broken. Jens agreed and replied that other people saw the same problem. Blake Willis (Zayo Europe) asked if the community was aware of a tool, site or application that users could use to catalog IPv6 problems. Or was that ecosystem hopelessly fragmented too? His question was not answered. Christian Bretterhofer (Andritz AG) asked if there was a browser plugin to show Happy Eyeball problems like IPvFoo. Jens replied that he was not aware of a plugin and he suggested talking to the browser windows. Alexander Azimov (Yandex) asked whether the adoption of NEL (Network Error Logging) was solving this kind of problem. Jens replied that it might be. He then asked if it was enabled somewhere and if it was analysed should it be enabled. Gert Doering (Independent) said another example they saw was that Apache-ACLs were not right for IPv4 and browsers were randomly flip-flopping IPv4 and IPv6, and that user reports were inconclusive. End of session. On behalf of the IPv6 WG co-chairs, Raymond For Internal Use Only

1 0

RIPE-554-bis
by christian bretterhofer 27 May '21

27 May '21

Just a question: Why are there no Firewalls? -- --- best regards Christian Bretterhofer

4 3

RIPE554-bis - on agenda Thursday
by Tim Chown 17 May '21

17 May '21

Hi, The work on updating RIPE554 will be presented on Thursday at the IPv6 WG meeting. This is the document specifying "Requirements For IPv6 in ICT Equipment” last revved in 2012. You can see the current state of the proposed new version of the doc at: https://docs.google.com/document/d/10HsfHDOIhUPIvGk9WP0azJiIsMVzQ49RsqWfnbN… and a PDF is also attached along with the current draft of Thursday’s slides. We’re largely focused on an update to the current document given the previous version is almost 10 years old and not, at this stage at least, expanding the scope. Comments to the list are welcome, be they general or on specific requirements in the text. Tim

1 0