- ipv6-wg - mailman.ripe.net

Fwd: RFC 9288 on Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers
by Fernando Gont 19 Aug '22

19 Aug '22

Hi, FYI. RFC 9288, "Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers" (available at: https://www.rfc-editor.org/rfc/rfc9288) FWIW, IMO most of the value is in the analysis of what protocols/features use what EHs, and what would break (if anything) if packets with EHs are dropped. These other two are useful for context: * RFC 9098, "Operational Implications of IPv6 Packets with Extension Headers" (https://www.rfc-editor.org/rfc/rfc9098.html) * RFC 7872, "Observations on the Dropping of Packets with IPv6 Extension Headers in the Real World (https://www.rfc-editor.org/rfc/rfc7872.html). Thanks! Cheers, Fernando -------- Forwarded Message -------- Subject: RFC 9288 on Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Date: Thu, 18 Aug 2022 16:21:47 -0700 (PDT) From: rfc-editor(a)rfc-editor.org To: ietf-announce(a)ietf.org, rfc-dist(a)rfc-editor.org CC: rfc-editor(a)rfc-editor.org, drafts-update-ref(a)iana.org, opsec(a)ietf.org A new Request for Comments is now available in online RFC libraries. RFC 9288 Title: Recommendations on the Filtering of IPv6 Packets Containing IPv6 Extension Headers at Transit Routers Author: F. Gont, W. Liu Status: Informational Stream: IETF Date: August 2022 Mailbox: fgont(a)si6networks.com, liushucheng(a)huawei.com Pages: 33 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-opsec-ipv6-eh-filtering-10.txt URL: https://www.rfc-editor.org/info/rfc9288 DOI: 10.17487/RFC9288 This document analyzes the security implications of IPv6 Extension Headers and associated IPv6 options. Additionally, it discusses the operational and interoperability implications of discarding packets based on the IPv6 Extension Headers and IPv6 options they contain. Finally, it provides advice on the filtering of such IPv6 packets at transit routers for traffic not directed to them, for those cases where such filtering is deemed as necessary. This document is a product of the Operational Security Capabilities for IP Network Infrastructure Working Group of the IETF. INFORMATIONAL: This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF-Announce and rfc-dist lists. To subscribe or unsubscribe, see https://www.ietf.org/mailman/listinfo/ietf-announce https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist For searching the RFC series, see https://www.rfc-editor.org/search For downloading RFCs, see https://www.rfc-editor.org/retrieve/bulk Requests for special distribution should be addressed to either the author of the RFC in question, or to rfc-editor(a)rfc-editor.org. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. The RFC Editor Team Association Management Solutions, LLC _______________________________________________ IETF-Announce mailing list IETF-Announce(a)ietf.org https://www.ietf.org/mailman/listinfo/ietf-announce

2 1

New on RIPE Labs: Deploying IPv6-Mostly Access Networks
by Anastasiya Pak 02 Aug '22

02 Aug '22

Dear colleagues, Dual stack is the most common way of deploying IPv6 in access networks. A recent standard defines IPv6-mostly access networks, providing IPv4 connectivity only for legacy devices while allowing modern devices to run IPv6-only. My colleague Ondřej Caletka explored the deployment of IPv6-Mostly Access Networks. Read his article on RIPE Labs: https://labs.ripe.net/author/ondrej_caletka_1/deploying-ipv6-mostly-access-… Best regards, Anastasiya Pak Marketing & Communications Officer RIPE NCC

1 0

Call for presentations IPv6 WG @RIPE85
by Jetten Raymond 25 Jul '22

25 Jul '22

Hello All, RIPE 85 will take place from 24-28 Oktober 2022 in a hybrid format in which online and onsite participants can interact with each other using a common platform. The onsite event will take place in Belgrade Serbia. For both cases you can register here: https://ripe85.ripe.net/attend/register/ The IPv6 Working Group session is scheduled for Wednesday 26 Oktober from 12:00 . 13:00 (UTC+1) We still have some time in our session. We are looking for presentations - please email : ipv6-wg-chair (at) ripe.net if you'd like to present. Please also state if you intend to be online or onsite, and the duration of your presentation, and a short description of it. Once we have decided on the agenda, we'll contact the presenters. Hope to see many of you, On behalf of the IPv6-WG Benedikt, Jen, Ray For Internal Use Only

1 0

Minutes from RIPE84 IPv6 WG
by Jetten Raymond 25 Jul '22

25 Jul '22

Dear IPv6 WG list members, Here are the minutes from the IPv6 WG session from RIPE 84 in Berlin and online. A very big thank you to Gerardo and Ulka from the RIPE NCC. If you have any comments or remarks please let us know as soon as possible. We plan to publish the minutes at latest 2 weeks from now. Thanks, The IPv6 co-chairs IPv6 Working Group Minutes Date: Thursday, 19 May 11:00 - 12:30 (UTC+2) Chaired By: Benedikt Stockebrand, Jen Linkova, Raymond Jetten Scribe: Gerardo Viviers Welcome, Etiquette, Approving Minutes Working Group Co-Chairs Raymond Jetten, Working Group Co-Chair, welcomed everyone to the session and went over some rules of engagement. There were no questions or comments. IPv6 and the Windows 10 Firewall Wilhelm Boeddinghaus, system.de This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/100-Boeddinghaus-R… Wilhelm did an in-depth analysis of how IPv6 is handled by the Windows 10 Defender Firewall software. The presentation conclusions provided some advice on how to best configure the firewall to provide good security for IPv6. Alvaro Vives, RIPE NCC, asked if there were improvements to the default firewall rules in Windows 11. Wilhelm said that he didn't think so, but he had not yet looked into Windows 11, and that he didn't expect the rules to be any better and maybe they should be proposed by the community. Christian Bretterhofer, Andritz AG, asked if there is a tool which allows users to see the firewall rules. Wilhelm replied that the Microsoft administration interface displays the rules. Most of the outgoing rules are not needed, because everything outgoing is allowed. He suggested that there might be some other firewall tools which were better. Kurt Kayser, Kurt Kayser Konsultation, commented that on the slides, the link local prefix was /64 and not /10. Wilhelm explained that this prefix size was mentioned in the Microsoft environments and simply took it over. Jan Zorz, 6connect, asked if Wilhelm thinks it's still a good idea to have a central firewall and not rely on the Windows 10 firewall. Wilhelm explained that you cannot rely on the Windows 10 firewall, but you must use it anyways. The central firewall does not protect your LAN. To ensure a secure environment, we need to use all the firewalls and packet filters available. Kostas Zorbadelos, CANAL+ Telecom, said that a default rule set is a problem, and asked Wilhelm if he had a suggestion for what the default ruleset should be. Wilhelm answered that it was difficult to come up with a real new default ruleset, because it is application centred. It depends on where the PC is used - in a loose environment or in a strict environment. Maybe the community can come up with a better firewall rule set. Maria Matejka, CZ.NIC, mentioned that one problem is a too-open firewall, and another is a too-closed firewall. The area of too closed and too open overlaps. We can't find a solution to having the firewall not too open and not too closed. Rule confirmations pop up frequently and home users click without thinking about it. Wilhelm replied that home users usually don't know much about packets and ports, so they don't understand what is right or wrong. Maybe the enterprise admins can make better rules for their environment, as they have the knowledge. Jen Linkova, Google, mentioned she is not a Windows user, but wondered if the firewall rules related to Neighbor Discovery might be useful for VMs on the same device. Wilhelm replied that he didn't think so. The VM packets don't need to be sent outside. Virtualisation is an enterprise feature and should be dealt with by the enterprise administrators. IPv6 Deployment Status: Update and Remaining Challenges Paolo Volpato, SID and Huawei Technologies This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/114-IPv6_Status_Pa… Paolo presented on the status of IPv6 deployment around the world, pointing out how the statistics need a more refined interpretation to approach a true status. Christian Bretterhofer, Andritz AG, asked when companies in China would get access to IPv6 and open connectivity. His experience in China was difficult and the ISPs offered only a /64 IPv6 prefix. Paolo said that the plan was to have a good percentage of IPv6-only networks in China by 2030. He added that the issue of open connectivity could not be addressed in the current session. Maximilian Wilhelm, Cloudflare, commented that he felt IPv6 is a second-class citizen on Paolo's platform and asked when will IPv6 be on par with IPv4. Paolo answered that he is confident IPv6 is not a second-class citizen and if there is something to be fixed, he will pass on any messages to the headquarters for support. Jad el Cham, RIPE NCC, asked about IPv6 policies that have a good impact on IPv6 deployment. Paolo replied that certain policies in the USA have triggered some questions about IPv6 deployment. He added that his personal view was that the expectations are high and he doesn't believe that the proposed dates are realistic. Paolo suggested looking at countries like India, China, and Brazil, along with the EU. He expects that 2030 might be the flag year in which we might actually transition networks to IPv6. Maximilian Emig, aiticon GmbH, mentioned that Paolo's employer, Huawei, has been pushing the "New IP" proposal, which has received extensive press coverage. He asked Paolo to elaborate on how it fits with IPv6. Paolo mentioned he did not have an official answer. His personal opinion is it was a mistake, and it is not related to IPv6. Just Another Measurement of Extension Header Survivability (JAMES) Justin Lurman, ULiege, and Eric Vyncke, Cisco This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/32-JAMES-RIPE84.pdf Justin Lurman provided an overview of how IPv6 packets using Extension Headers are processed or dropped on the public Internet. There were no questions or comments. IPv6 Addressing Inside a VPN Tunnel Between Endpoints With Rotating Prefixes Matthias Scheer, AVM This presentation is available here: https://ripe84.ripe.net/wp-content/uploads/presentations/59-ripe84_ipv6wg_v… Matthias Scheer presented on the challenges encountered by networks attempting to route IPv6 within VPNs, when the IPv6 prefixes assigned to the endpoints are rotated. Christian Betterhofer, Andritz AG, asked if there was any chance to update the Fritz 7582, specially the Wireguard support. Matthias replied that Wireguard support is available. He suggested to go to website and try out the beta, which is quite safe. Anže Jenšterle, AS211776, commented that Wireguard prefers IPv6 in DNS resolution only and this depends on how the resolver code is written. Jen Linkova, Google, mentioned that strictly speaking RFC 4193 does not recommend, it says certain addresses "CAN" be used. The language is not "SHOULD". Jen added that the default address selection is called "default" for a reason. Jan Zorz, 6connect, pointed out that Matthias mentioned the problem of rotating prefixes. Jan asked Matthias that if he came across ISPs that do this, he should point them to RIPE 690. Jan also mentioned that RFC 9096 talks about ways to improve the reaction of CPEs to IPv6 renumbering events. Gert Doering, congratulated AVM on working on IPv6 by default on their CPEs and on the work with IPv6 and VPNs. He mentioned that he liked the idea of using OSPFv3 to cope with renumbering events. Matthias remarked that he removed some slides that dealt with this topic due to time constraints. David Lamparter, OpenSourceRouting and NetDEF, replied to Jan Zorz's comment on RIPE 690 saying that he has customers that request prefix rotations. The RIPE document is not important for him. He applauded AVM's work on solving the prefix rotation problem. Matthias agreed that it was a good idea to continue the dialogue and find a solution together. Round Up and Thanks Working Group Co-Chairs The Working Group Co Chairs thanked the attendees for joining the session. For Internal Use Only

1 0

Join our Upcoming Open House on the IPv6 Skills Gap
by Alastair Strachan 14 Jun '22

14 Jun '22

Dear colleagues, We are organising an Open House on the IPv6 skills gap. The event will take place on Wednesday, 29 June from 10:00-11:30 UTC. Lack of adequate know-how remains a roadblock for IPv6 transition. Join us for a discussion on the challenges of building IPv6 skills. We'd love to hear your thoughts and suggestions! Register for free at: https://www.ripe.net/participate/forms/apply/openhouse-ipv6skills-29-june-2… <https://www.ripe.net/participate/forms/apply/openhouse-ipv6skills-29-june-2…> I hope to see many of you at there! Best regards, Alastair Strachan RIPE NCC Communtiy Development Officer

1 0

IPv6 Addressing Considerations (IETF Internet-Draft)
by Fernando Gont 02 Jun '22

02 Jun '22

Hi, We have published a revision of our IETF Internet-Draft "IPv6 Addressing Considerations". It is available at: https://datatracker.ietf.org/doc/html/draft-gont-v6ops-ipv6-addressing-cons… It discusses a lot of practical considerations regarding IPv6 addressing, so we'd love to hear from you if there's any that we missed or that you think we got wrong. Abstract IPv6 addresses can differ in a number of properties, such as scope, stability, and intended usage type. This document analyzes the impact of these properties on aspects such as security, privacy, interoperability, and network operations, with the goal of providing guidance about IPv6 address usage. Additionally, it identifies challenges and gaps that currently prevent systems and applications from leveraging the increased flexibility and availability of IPv6 addresses. Thanks! Regards, -- Fernando Gont SI6 Networks e-mail: fgont(a)si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492

1 0

IPv6 Guide
by Jens Link 20 May '22

20 May '22

Hi, about a month ago I was asked on Twitter if I new any good and current books ob IPv6. Apparently there is nothing current[1]. I came up with the idea of starting an OpenSource Guide on IPv6. I created a git repo: https://gitlab.com/jenslink/ipv6guide and also have (sponsored) hardware to run website, mailing list, ... There is not much yet, but I'll reserved a couple of hours per week for it starting in June. The project is hosted in gitlab (because they have IPv6) and will be written in markdown. For now I'd prefer to start with an English version and maybe add translations later. All we need is people to create, review and edit content. That means we need your help if you have some time to spare. If you have any question, just ask. I'm also around the RIPE meeting for the rest of the week. Jens [1] Which might not be a problem, Gert Doering just recycled an 11year old presentation with very little changes. -- ---------------------------------------------------------------------------- | Delbrueckstr. 41 | 12051 Berlin, Germany | +49-151-18721264 | | http://blog.quux.de | jabber: jenslink(a)quux.de | --------------- | ----------------------------------------------------------------------------

6 11

Ipv6 adress policy Musings
by Jetten Raymond 18 May '22

18 May '22

Dear IPv6 list members. The Address policy working group has asked for our input on the current address policies. Please have a look at the large list of questions, and please do participate in the discussion on the Address Policy working group list https://www.ripe.net/ripe/mail/archives/address-policy-wg/2022-May/013541.h… Rgds The ipv6 wg co chairs For Internal Use Only

1 0

RIPE 84 IPv6 WG Agenda
by Jetten Raymond 11 May '22

11 May '22

Hello All, Here is the current agenda for the RIPE 84 meeting in Berlin next week (also online). The IPv6 WG session will be on Thursday 19 May 2022 from 11:00 - 12:30 CET Co Chairs, * welcome, etiquette etc, acceptation of the minutes 5 min. Wilhelm Boeddinghaus * "IPv6 and the Windows 10 Firewall" (25 min incl Q&A) Paolo Volpato * "IPv6 Deployment Status: Update and Remaining Challenges". (20 min incl Q&A) Justin Lurman & Eric Vyncke * "Just Another Measurement of Extension header Survivability (JAMES)" (10 min incl Q&A) Eric van Uden Or collegue * IPv6 in the field Feld, KPI-results / and Or naming challenges IPv6 inside VPN (25 min incl Q&A) Co Chairs * round up, thanks 5 min Welcome onsite, or online ! Raymond Jetten Senior Technology Specialist Production Cloud Services, Networks and connectivity Interconnectivity & Content Elisa Oyj Vuolteenkatu 2 33100 Tampere +358 45 6700 139 raymond.jetten(a)elisa.fi<mailto:raymond.jetten@elisa.fi> www.elisa.fi<http://www.elisa.fi/> Lisätietoa henkilötietojen käsittelystä ja tietosuojasta Elisalla https://elisa.fi/tietosuoja Mer information om Elisas hantering av personuppgifter och dataskydd https://elisa.fi/tietosuoja More information on personal data management and data protection at Elisa https://elisa.com/dataprotection ********************************************************************************************* For Internal Use Only

1 0

Second call for presentations IPv6 WG @RIPE84
by Jetten Raymond 12 Apr '22

12 Apr '22

Hello All, RIPE 84 will take place from 16-20 May 2022 in a hybrid format in which online and onsite participants can interact with each other using a common platform. The onsite event will take place in Berlin. For both cases you can register here: https://ripe84.ripe.net/attend/register/ The IPv6 Working Group session is scheduled for , Thursday 19 May from 11:00 . 12:30 (UTC+1) We still have some time in our session. We are looking for presentations - please email : ipv6-wg-chair (at) ripe.net if you'd like to present. Please also state if you intend to be online or onsite, and the duration of your presentation, and a short description of it. Once we have decided on the agenda, we'll contact the presenters. Hope to see many of you, On behalf of the IPv6-WG Benedikt, Jen, Ray

1 0

Last call and final reminder for nominations to the 2022 Rob Blokzijl Award
by Carsten Schiefner 14 Mar '22

14 Mar '22

[Apologies for cross-posting to various RIPE lists] Dear IPv6 WG members - this is the last call and final reminder for nominations to the 2022 Rob Blokzijl Award that will be accepted until this Friday, 18th March, at 23:59 UTC. In seeking nominations for this prestigious award, which was created to celebrate Rob's contributions to the development of the Internet, the Award Committee (https://rob-blokzijl-foundation.org/2021/11/22/2022-award-committee/) is interested to receive nominations of those who have reflected Rob's approach in either a technical or operational capacity. Please give some consideration to nominating individuals - but also teams and groups of people! - in your own community and/or the wider industry in the RIPE region who, in your opinion, deserve to be recognised for their work to make the internet and/or internet community better. To specifically have this emphasised again after some according queries: nominations of teams and groups of people are very well possible and wished for as well in case their collective work would match the criteria of the call as laid out! The Award Committee is particularly interested to receive nominations of contributors who, in addition to their own contributions, have also supported and enabled others anywhere in the world. Also, the Award Committee would like to encourage those making nominations to consider not only the community members in the later stages of their careers or who are widely known but also those who may have contributed greatly in the springtime of their career or discreetly for the greater good or who may be considered to be part of an unrepresented group. And last but not least: those of you who previously have made a nomination other than Wilfried Woeber, the 2018 awardee, may want to consider resubmitting a nomination. The complete details of the call and the nomination process can be found at: https://rob-blokzijl-foundation.org/2021/11/25/call-for-nominations-2022/ Best wishes and kind regards Carsten (on behalf of the Award Committee)

1 0

Call for presentations for ripe 84
by Jetten Raymond 07 Mar '22

07 Mar '22

Hello All, RIPE 84 will take place from 16-20 May 2022 in a hybrid format in which online and onsite participants can interact with each other using a common platform. The onsite event will take place in Berlin. For both cases you can register here: https://ripe84.ripe.net/attend/register/ The IPv6 Working Group session is scheduled for , Thursday 19 May from 11:00 . 12:30 (UTC+1) We are looking for presentations - please email : ipv6-wg-chair (at) ripe.net if you'd like to present. Please also state if you intend to be online or onsite, and the duration of your presentation, and a short description of it. Once we have decided on the agenda, we'll contact the presenters. Hope to see many of you, On behalf of the IPv6-WG Benedikt, Jen, Ray

1 0

New on RIPE Labs: One Bit to the Left - An IPv6 Success Story
by Ewan Mackie 02 Mar '22

02 Mar '22

Dear colleagues, Back in December 2020, for the second time since we started allocating IPv6, the RIPE NCC granted a request for a subsequent /29 allocation. As moments like this are good indicators of how growth and demand for IPv6 is developing, we reached out to NetCologne GmbH to take a look back and learn more about their IPv6 story. The full interview is available here on RIPE Labs: https://labs.ripe.net/author/ewan-mackie/one-bit-to-the-left-an-ipv6-succes… <https://labs.ripe.net/author/ewan-mackie/one-bit-to-the-left-an-ipv6-succes…> Kind Regards, Ewan Mackie RIPE NCC

1 0

Hijacking unused address space for a private infrastructure - any legal consequences?
by Vasilenko Eduard 24 Feb '22

24 Feb '22

Hi all, Could somebody speak on the legal consequences of hijacking unused address space? Imagine the situation that some vendor would push many Carriers to use FC/8 by cutting a rather big block out of it (/28 for each Carrier). This address space should have a registry. It is an IANA property till then. But: 1. Nobody is using it - nobody would be hurt. 2. This prefix would be excluded from the Internet (by routing and filtering) 3. FC/8 is assumed to be used for the closed domain (the purpose of usage is very similar). Just nobody decided how exactly. Maybe /28 is not how IANA and IETF would want to split it in the future. People could ask "why not GUA"? The answer is: it is difficult to get yet another /28 GUA from RIR just for the infrastructure. /28 goal has the technical roots by itself. It is the sort of technical solution. Could such LIR/Carrier have any pressure from any RIR or IANA itself? Is any restriction in the LIR agreement? Any legal consequences? (that would push for renumbering). Of course, I am aware what may happen if Carrier would need to connect infrastructure with different Carrier or Cloud Provider Without proper random prefix generation and registry to guarantee uniqueness. The technical side is very clear for me. I am just very ignorant on the legal side. Disclaimer: This question is not related to Huawei, not at all. Eduard

3 8

Re: [ipv6-wg] Hijacking unused address space for a private infrastructure - any legal consequences?
by JORDI PALET MARTINEZ 24 Feb '22

24 Feb '22

Hi Eduard, I think we need to first understand that addresses aren't a property. If you get allocated or assigned resources by a RIR, they do not belong to you, you just have a yearly license to use them, and (typically) while the need is justified. Similarly, they aren't an IANA property, it is just the central registry that allocates the to the 5 RIRs. By the way, obtaining any prefix length, from any RIR, if justified is not difficult. And that justification for IPv6 is not usually a problem. If there are cases where the actual policy doesn't work, in any RIR (most of them have basically the same text), we should work in improving the policy. I'm not really sure legally something can be done ... Saludos, Jordi @jordipalet El 24/2/22 15:01, "ipv6-wg en nombre de Vasilenko Eduard via ipv6-wg" <ipv6-wg-bounces(a)ripe.net en nombre de ipv6-wg(a)ripe.net> escribió: Hi all, Could somebody speak on the legal consequences of hijacking unused address space? Imagine the situation that some vendor would push many Carriers to use FC/8 by cutting a rather big block out of it (/28 for each Carrier). This address space should have a registry. It is an IANA property till then. But: 1. Nobody is using it - nobody would be hurt. 2. This prefix would be excluded from the Internet (by routing and filtering) 3. FC/8 is assumed to be used for the closed domain (the purpose of usage is very similar). Just nobody decided how exactly. Maybe /28 is not how IANA and IETF would want to split it in the future. People could ask "why not GUA"? The answer is: it is difficult to get yet another /28 GUA from RIR just for the infrastructure. /28 goal has the technical roots by itself. It is the sort of technical solution. Could such LIR/Carrier have any pressure from any RIR or IANA itself? Is any restriction in the LIR agreement? Any legal consequences? (that would push for renumbering). Of course, I am aware what may happen if Carrier would need to connect infrastructure with different Carrier or Cloud Provider Without proper random prefix generation and registry to guarantee uniqueness. The technical side is very clear for me. I am just very ignorant on the legal side. Disclaimer: This question is not related to Huawei, not at all. Eduard -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/ipv6-wg ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

1 0

Announcing the Updated IPv6 Fundamentals E-Learning Course
by Pedro Vaz 20 Jan '22

20 Jan '22

Dear colleagues, Our updated IPv6 Fundamentals course is now live and available in the RIPE NCC Academy. The course aligns more with the IPv6 Fundamentals Analyst exam and has a fresh new look. We hope to see more network operators following best practices and developing their understanding of IPv6 policies through the course. The course consists of interactive modules and activities which help learners apply concepts using tools and realistic scenarios. You can find out more about the new IPv6 Fundamentals online course in the RIPE NCC Academy at: https://academy.ripe.net/ipv6-fundamentals I would like to thank everyone who participated in the course development process, for testing the exam, reviewing the course material and testing the activities. Having the involvement of the community is a major strength of our courses, and we thank all of our volunteers. If you have any questions or feedback, you can reach us at <exams at ripe.net>. Kind regards, Pedro Vaz Senior Technical Training and Development Officer

1 0

Announcing the Updated IPv6 Fundamentals E-Learning Course
by Pedro Vaz 20 Jan '22

20 Jan '22

Our updated IPv6 Fundamentals course is now live and available in the RIPE NCC Academy. The course aligns more with the IPv6 Fundamentals Analyst exam and has a fresh new look. We hope to see more network operators following best practices and developing their understanding of IPv6 policies through the course. The course consists of interactive modules and activities which help learners apply concepts using tools and realistic scenarios. You can find out more about the new IPv6 Fundamentals online course in the RIPE NCC Academy at: https://academy.ripe.net/ipv6-fundamentals I would like to thank everyone who participated in the course development process, for testing the exam, reviewing the course material and testing the activities. Having the involvement of the community is a major strength of our courses, and we thank all of our volunteers. If you have any questions or feedback, you can reach us at <exams at ripe.net>. Kind regards, Pedro Vaz Senior Technical Training and Development Officer

1 0

FYI: NCCoE Releases Draft Project Description for IPv6 Transition
by Jaap Akkerhuis 04 Jan '22

04 Jan '22

[NCCoE stands for the National Cybersecurity Center of Excellence] Some people on this list might be interested in this work. See the announcement: <https://content.govdelivery.com/accounts/USNIST/bulletins/2ffde66>. jaap

1 0

Minutes from the IPv6 WG @ RIPE 83
by Jetten Raymond 24 Dec '21

24 Dec '21

Hello, Here are the minutes from RIPE 83, if you have any comments or remarks, please let us know before 20.12 so we can have them published. RIPE 83 RIPE IPv6 Working Group Minutes Date: 25 November, 13:00-14:00 (UTC+1) Chairs: Raymond Jetten, Benedikt Stockebrand Scribe: Suzanne Taylor Status: Draft Welcome, Administrative Matters Raymond Jetten, Working Group Co-Chair Raymond Jetten, Working Group Co-Chair, welcomed everyone to the session and went over some rules of engagement. There were no questions or comments. Building IPv4 Islands for Fun and Profit Nico Schottelius, ungleich This presentation is available at: https://ripe83.ripe.net/wp-content/uploads/presentations/86-ripe83-ipv4-isl… Nico discussed the technical details of how to set up IPv6-only networks that need to incorporate IPv6-incompatible devices (such as x-ray or ultrasound scanners, LoraWAN gateways, printers, power plants) by setting up IPv4 "islands" for those devices. Benedikt Stockebrand commented that there are many different approaches to this issue and that if this particular method doesn't work, then attendees should be encouraged to reach out on the mailing list rather than simply give up on deploying IPv6. Nico said he fully agreed. Michael Richardson, Sandelman Software Works, thanked Nico for his explanation and said he had also been doing something similar. He said he thought another name is needed, however, other than "islands". Nico said he was open to other suggestions. Raymond suggested that ideas could be discussed on the mailing list. There were no further questions or comments. To ULA or not ULA Nico Schottelius This presentation is available at: https://ripe83.ripe.net/wp-content/uploads/presentations/87-ripe83-to-ula-o… In his second presentation, Nico gave an overview of ULAs (unique local addresses), which are used in community networks and other use cases but aren't generally visible on the Internet. He explained how his company has been asked to run a ULA registry and asked for opinions about how - and whether there was consensus - to support community projects by running a ULA registry. Jordi Palet Martínez, Moremar - The IPv6 Company, said that the right way to have a registry is to revive the ULA-Central work, which he tried already in the IETF and with the RIRs. He said there is possibly a need for a global policy on running a central IANA registry or coordination for that among the RIRs, but that it didn't work. He offered to continue working on that if there were community support. Nico said that was an interesting approach and that there were also recent discussions around where to register IP space for aerospace technology and that this could be a way to go, or that the RIRs could have a subsection for ULA community space. He said he would reach out to Jordi after the meeting. Niall O'Reilly, speaking as a "ULA user", asked Nico whether he imported registrations from SixXS to the new registry. Nico responded that everything had been imported and that some have already been deleted because they saw old information in the registry. Marco Hogewoning, RIPE NCC, said that the EU Cybersecurity Strategy suggests a possible sunset clause for IPv4 if insufficient progress is made with IPv6 and asked what the RIPE community thought could be done other than avoiding legislation to force a particular technical choice. He asked whether the community, for example, would advise forcing the use of IPv6 or discouraging the use (or forcing the disuse) of IPv4. He commented that this strategy is focuses on the market and not just the public sector. Nico said that is a difficult question. He said the market is already at play, given the increasing price of IPv4 and that some governments are going IPv6-only. He said that an RIR like the RIPE NCC can encourage IPv6 deployment, and that he sees a role for open-source solutions to support this shift and enable bottom-up development and innovation. Rüdiger Volk, my UNorganized self, said he remembered when Internet number resources were essentially available for free and the one registry was funded by the US federal government. He said that, in order to support communities that were outside of the very small Internet at the time that wanted to install TCP/IP locally or regionally with a limited view to interconnect globally, volunteers started to hand out things and get centrally registered space and create sub-registries. Essentially, he said, the RIPE NCC registry grew from there. He said he felt that if the address space you're using has enough free resources for everyone to be globally unique, then you should do that - but if the current ICANN anchored registry system doesn't offer a way for all communities to adequately address their needs, that should be a trigger to question how to do that. He said that, in some ways, the precursor to ULA was the RFC 1918 space, but it was meant to just be local and was not meant to require a registry (unless your enterprise network isn't connected to anything else and runs as a very closed system, in which case a local registry might be used). Nico said he saw Rüdiger's point and said that perhaps this work should be a community/volunteer effort. He said this topic already came up on the IETF mailing list, along with the usual question of who would pay for the project. He said the idea of handing out GUA (global unique addresses) was also discussed on the IETF mailing list, which he thought was good, as it would offer uniqueness along with global addressability. He added that sponsoring the address space is one thing, but sponsoring the work was another thing and being recognised, a third consideration. He encouraged anyone interested in contributing to the project to contact him. Peter Hessler, speaking as an "open source enthusiast", asked how much space the community should request from the RIPE NCC if it were to group together and form a LIR to request and manage IPv6 address space. Nico said you can start with a /32 and simply request another as needed, because the addresses don't need to be consecutive. Raymond added that you can get a /29 without any justification. Michael Richardson said he had been a proponent of a non-connected IPv6 space for a long time and that he had first come across this before in using it in a data centre through VPNs as a management network. He said that in his experience, these inevitably leak and when they do, you don't know who to tell. He said this was also why he doesn't like ULA random. He said that the value of Whois is high and provides a feeling that no one will come and do something terrible to you because you're using the address space. He also said the possibility of reverse DNS really matters in IPv6 space. For those reasons, he said he would like to have a registry but was agnostic as to whether it should be a /29 of carefully managed global address space that is unannounced in RPKI, or ULA central or fd/8 if that were ever to work. He said there should be a nominal, one-time fee to register the space. He said he oftens sees a need for this in equipment chassis and gave the example of a networked fishing boat. He said he would rather it wasn't RFC1918 but IPv6, and if there were too much paperwork, you could use 1.1 or 11 network because 1918 is on the other interface and using NAT, so you don't know what is there. He said engineers don't use IPv6 because they think they can't get it and don't use ULA random because they need something different for every boat (in the example), which is correct, but he said it should be within the network you own. He said the community needs to enable this and that a small registration fee should make it your own in perpetuity. Benedikt said that one use case that tends to be forgotten about, as most in the community are LIRs, is having a provider aggregated addresses and wanting to maintain some independence from your ISP, ULAs can be very helpful in renumbering. He said there's a big difference between IPv4 and IPv6 in that IPv6 was designed to support multiple addresses per interface, and this can be very useful. He also cautioned against starting a separate address space that is sort of connected with people using ULAs across the Internet via tunnels where they really shouldn't. Raymond closed the queue to further questions in the interest of time. RIPE-554bis Jan Žorž, 6connect This presentation is available at: https://ripe83.ripe.net/wp-content/uploads/presentations/73-RIPE554bis-RIPE… Jan gave some background and history on updating RIPE-554 and RIPE-554bis, which provides guidance on how to procure IPv6-capable equipment and software for enterprises. He explained which updates were deemed necessary, such as adding fundamental RFCs like "IPv6 over Ethernet" and removing BOUNDv6, as it no longer exists. There are new requirements for hosts and enterprise/ISP switches, and some other changes for routers, CPEs, mobile devices, load balancers and software. He stressed the need to publish an update to RIPE-554 as soon as possible and asked the group whether there was consensus on RIPE-554bis. Blake Willis, Zayo, asked whether RFC8950/RFC5549 BGP tunnel signalling was within the document's scope. Jan replied that it included IPv6-specific things and he would need to look into it. Sander Steffann, 6connect and RIPE-554bis co-author, said he was also not certain. Jan said he did not think RFC8950 was included but that they could consider it for the next version, as they didn't want to expand the scope of this version since it would take too long to update it. Éric Vyncke, Cisco and IETF but speaking mainly as an "IPv6 evangelist", said he couldn't find in the draft RIPE-554bis document Jan's reference during his presentation to not using a /64 and RFC8200 now including atomic/overlapping fragments. Jan said the RFC8200 was in the section on requirements for host equipment, and that it's basically the same document, just updated. Sander said he thought he found the section that Éric was referring to, which was from RFC7608 (IPv6 prefix length recommendations for forwarding), which mentions that prefix lengths longer than /64 must be supported in forwarding. Éric said the other two RFCs mentioned were removed from the RIPE-554bis document and that the presentation had not been updated to reflect the most recent Google doc. Christoph Berkemeier, DB Station & Service AG, asked whether Jan was aware of automated or semi-automated test scripts/environments for the recommendations. Jan responded that this was a mistake many people were making, and that the document was meant to be used as a template. He said that, for example, "if support for tunnelling and duo-stack is required, the device must support basic transition mechanisms for IPv6 hosts and routers" then it could be technically possible to build a script to test this, but you would need to include everything you want and need, which would be complicated. He said that you need to take the parts of the document that apply to your situation. But, he said, if someone wanted to build something like that, then he would be happy to include it. Sander said that Blake Willis was referring on the chat to the University of New Hampshire's independent testing lab. Jan said there are asterisks on some of the requirements in the draft policy that indicate they are being tested. Jan asked the collective whether there was consensus. Benedikt said that no one would complain if they wanted to do the work. Raymond said he was happy to move forward but suggested leaving the mailing list open until the following Wednesday for any other potential objections to consensus, which Jan agreed to. Jan and Raymond thanked everyone for their hard work. Raymond thanked the scribe and said that there had been no comments on the minutes from RIPE 82, which had been online for some time, so declared them approved. He said that he hoped to see everyone at a meeting in person soon and closed the session. Rgds, Ray

7 24

Ripe 554 bis = ripe 772 has been published
by Jetten Raymond 14 Dec '21

14 Dec '21

Hello members of the list, We have a new document published: Requirements For IPv6 in ICT Equipment https://www.ripe.net/publications/docs/ripe-772 A big thanks to the authors and all involved ! The IPv6 wg co-Chairs For Internal Use Only

1 0

RIPE554-bis now published as RIPE772
by Tim Chown 14 Dec '21

14 Dec '21

Hi, Many thanks to the RIPE support team, 554bis is now published: "Requirements For IPv6 in ICT Equipment” https://www.ripe.net/publications/docs/ripe-772 I wonder how long before the next refresh... Best wishes, Tim

1 0

RIPE554-Bis consensus
by Jetten Raymond 03 Dec '21

03 Dec '21

Dear List members, The time has come, to declare consensus on RIPE554-Bis https://docs.google.com/document/d/10HsfHDOIhUPIvGk9WP0azJiIsMVzQ49RsqWfnbN… Big thanks to all list discussion participants, participants at the RIPE83 IPv6 Working Group session for their input, and most of all to Merike Käo, Jan Žorž, Sander Steffann, Tim Chown, Tim Winters for doing a lot of work. I will contact the RIPE NCC shortly to get this new document published. Raymond Jetten Senior Technology Specialist Production Cloud Services, Networks and connectivity Interconnectivity & Content Elisa Oyj Vuolteenkatu 2 33100 Tampere +358 45 6700 139 raymond.jetten(a)elisa.fi<mailto:raymond.jetten@elisa.fi> www.elisa.fi<http://www.elisa.fi/> Lisätietoa henkilötietojen käsittelystä ja tietosuojasta Elisalla https://elisa.fi/tietosuoja Mer information om Elisas hantering av personuppgifter och dataskydd https://elisa.fi/tietosuoja More information on personal data management and data protection at Elisa https://elisa.com/dataprotection ********************************************************************************************* For Internal Use Only

1 0

RIPE 554 Bis to consensus...
by Jetten Raymond 03 Dec '21

03 Dec '21

Hello IPv6 Working Group! Thanks for the great discussions on the IPv6 WG during RIPE83. We are ready to get consensus on the new RIPE554 document, so here is your very very last chance to make changes by commenting it on this list. If no dramatic changes have come up we will approve the document on Friday 3.12 Link to the live draft: https://docs.google.com/document/d/10HsfHDOIhUPIvGk9WP0azJiIsMVzQ49RsqWfnbN… Cheers, The Ripe IPv6 WG chairs, Jen, Benedikt, Raymond Raymond Jetten Senior Technology Specialist Production Cloud Services, Networks and connectivity Interconnectivity & Content Elisa Oyj Vuolteenkatu 2 33100 Tampere +358 45 6700 139 raymond.jetten(a)elisa.fi<mailto:raymond.jetten@elisa.fi> www.elisa.fi<http://www.elisa.fi/> Lisätietoa henkilötietojen käsittelystä ja tietosuojasta Elisalla https://elisa.fi/tietosuoja Mer information om Elisas hantering av personuppgifter och dataskydd https://elisa.fi/tietosuoja More information on personal data management and data protection at Elisa https://elisa.com/dataprotection ********************************************************************************************* For Internal Use Only

2 2

RIPE NCC Open House: Building Your Own Test Labs. Wednesday, 8 December - 1100-1230UTC
by openhouse＠ripe.net 02 Dec '21

02 Dec '21

Dear colleagues, Are you interested in deploying IPv6, but need to learn more about how it works? Do you want to try out a technology before putting it into production? Maybe you need to just test something out? Then join us at our upcoming event RIPE NCC Open House: Building Your Own Test Labs, taking place on Wednesday, 8 December. Read more about the Open House event here: https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-bu… <https://www.ripe.net/participate/meetings/open-house/ripe-ncc-open-house-bu…> We will talk to two experts - Ondrej Caletka and Max Stucchi - about the different choices you should make when you want to build your own test labs. Should you use hardware or virtual machines? Which software is best for a certain purpose? Do you want to run your labs in the cloud? The experts will look at different labs they developed and analyse their choices. We will of course open the mic for your questions. You can ask questions on topics like: • Why was a certain solution used? • How much time does it take to develop? • What security issues should you be aware of Take this opportunity to learn more about building test labs and share your experiences as well. Register at: https://meeting-registration.ripe.net/meeting-pub/registration?0&meetingId=… <https://meeting-registration.ripe.net/meeting-pub/registration?0&meetingId=…> I look forward to seeing you online. Alastair Strachan RIPE NCC

1 0

Re: [ipv6-wg] Latest draft for RIPE554-bis
by Eric Vyncke (evyncke) 26 Nov '21

26 Nov '21

Tim*2, Sander, Jan, and Merike, First of all, thank you for taking the pen to update this document. As you kindly asked for comments, here are some - page 2: 'fairly recent' won't age well ;-) - page 4: all requirements are limited to performance, but should it also include telemetry/monitoring ? Or is it implicit in the list of RFC ? - page 4: what about systems to handle VMs and containers ? - page 4: mobile devices have a *big difference* with normal host though as they often have multiple interfaces active at the same time. - page 4: should we assume that Wi-Fi access points are 'normal layer-2 switches' ? - page 6: I am surprised to see RFC 8415 DHCPv6 client as mandatory... - page 6: if not mistaken RFC 8200 now includes RFC 5722 and RFC 8021 (so no need to add the latter in the requirements) - page 7: same surprise to see all DHCP-related requirements - page 7 and other: nice to list some MIB but I would expect some YANG modules as well for enterprise/ISP devices - page 9: should Jen's RFC 9131 be added as optional ? Hope this helps -éric PS: the attached PDF has the same comments in the text. On 02/11/2021, 16:05, "ipv6-wg on behalf of Tim Chown via ipv6-wg" <ipv6-wg-bounces(a)ripe.net on behalf of ipv6-wg(a)ripe.net> wrote: Hi, Attached below is the latest draft for RIPE554-bis, the update to Requirements For IPv6 in ICT Equipment. The authors have incorporated feedback received on and off list, and believe the current draft is a candidate to be considered towards publication. We have a slot in the upcoming RIPE meeting to present and discuss the latest changes, but further list feedback would be welcome now. Is it ready to ship? If not, why not? The original version can be found at https://www.ripe.net/publications/docs/ripe-554 Best wishes, Tim

7 27