- ipv6-wg - mailman.ripe.net

Not standing as working group chair for another term
by Benedikt Stockebrand 26 Jun '23

26 Jun '23

Hi folks, as I've already said during the working group session in Rotterdam my term as WG chair ends at the next RIPE meeting. Since I find it increasingly difficult to make the WG chair role agree with my daily work profile (too much firefighting, too little of a routine daily schedule), Jen and Ray had to cover for me more often than I am happy with---thanks, and apology, to both of them. As a consequence however it doesn't make any sense if I stood for another term. We'll start the process of finding a successor for me before RIPE 87. If you are interested in taking over the role, and are willing to keep a pretty much daily eye on the mailing list and such, you may already want to think about volunteering for the job. And one more thing: That doesn't mean that I have lost interest in the WG, or in IPv6 as such---in fact, in my opinion we still have some serious work to do eliminating the hidden dependencies on Vintage IP before they bite us in the backside. More about that at RIPE 87 in Rome... Cheers, Benedikt -- Benedikt Stockebrand, Stepladder IT Training+Consulting Dipl.-Inform. http://www.stepladder-it.com/ Business Grade IPv6 --- Consulting, Training, Projects BIVBlog---Benedikt's IT Video Blog: http://www.stepladder-it.com/bivblog/

1 0

IPv6 WG minutes from ripe 86
by Raymond Jetten 13 Jun '23

13 Jun '23

Here are the minutes from the RIPE 86 IPv6 wg session, please let us know if you want anything edited, or they will be published in a week on the website. Date: 24 May 2023, 11:00 - 12:30 (UTC+2) Chairs: Benedikt Stockebrand, Jen Linkova, Raymond Jetten Scribe: Tayfun Ozaltin Status: 1. Welcome Jen Linkova, IPv6 WG Co-chair The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/8-RIPE-86-IPv6-WG.… Jen Linkova welcomed everyone and introduced the co-chairs. The RIPE 85 minutes were approved. 1. Advanced IPv6 Course Input Request Tayfun Ozaltin, RIPE NCC The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/105-RIPE-86-Slide-… Tayfun Ozaltin, RIPE NCC, asked for input on the advanced IPv6 e-learning course that was being developed. There were no questions. 1. Deploying IPv6 and/or CGNAT Rinse Kloek, Delta Fiber / Kindes The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/67-RPE86-IPv6-depl… Rinse explained how their company made a transition from IPv4-only to an IPv6 supporting network. He mentioned the challenges they had during the implementation. Yannis Nikolopulos, Cellmobile, asked who the vendor was and what the real story was behind the denial. Rinse answered that Nokia was the vendor and that they did not support MAP-E and MAP-T. After several rounds of discussions, Rinse could not convince them to support these transition techniques. Yannis asked about the details of the deployment scenario. Rinse replied that they were using CGNAT, so the user was getting an internal IP address, a 164 address, and they were planning to assign the customers a v6 prefix as well. Thomas Schäfer, LMU, asked about the number of users who were already using IPv6 in their network. Rinse answered that they currently had about 50 friendly users (test users). Thomas added that it would be better to bypass internal services with IPv6. Rinse agreed and said that IPv6 was the way to go and that they already had a plan for it. Branimir Rajtar, 5x9 Networks, asked if they had implemented IPv6 in the core network as well or if they used 6PE/6VPE. Rinse answered that everything was dual-stack since day one in both the core and access networks. Peter Hessler, Globalways GmbH, said that the community should encourage people to deploy IPv6 whenever they were ready for it. Brian Storey, Gamma Telecom Limited, asked how long it had taken to reach this state and how they envisioned documenting IPv6 for their customers. Rinse answered that they hope by the end of this year 20% of the users will be IPv6 enabled, and next year it may be 80-100%. Peter Head, Gigaclear, asked for more elaboration on why they filtered the DHCPv6 releases. They decided to follow it up offline. 1. Clear Guidance for Implementing IPv6 in Enterprises Wilhelm Boeddinghaus The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/123-RIPE86-IPv6-Wi… Wilhelm Boeddinghaus emphasized the need for clear guidance on IPv6 deployment phases, challenges, and steps, especially for enterprise IT departments. He asked the question, "Can we as the community provide this clear guidance to the enterprises?" Peter Hessler said that he liked the idea and mentioned that it would be hugely beneficial to a lot of enterprises. Marco Davids, SIDN Labs, asked if Wilhelm agreed with him that the working group should also work on getting IPv6 knowledge into schools and universities so that young students have at least some knowledge. Wilhelm agreed. He emphasized that students in universities were still learning IPv4, and we needed to educate young people about IPv6. An audience speaker said that it was not only enterprises but also ISPs who needed to learn about this. He claimed that even big ISPs do not know how IPv6 works. Wilhelm agreed but also claimed that enterprises had many more problems since their core business was not IT. Urban Suhadolnik, TU Graz, agreed with the previous comments about universities. Wilhelm emphasized once again that universities should involve themselves much more in this. Gert Doering, SpaceNet AG, agreed and thanked Wilhelm for bringing up enterprise problems regarding IPv6 transition into the meeting. He added that he would like to help with the new BCOP for enterprises. He said that it will not be easy to pick up and agree on the right solution, but that it should be tried. Wilhelm agreed and said we should also involve enterprise admins in our group. Benedikt Stockebrand said that since most IT people in academia didn't receive any network training at all, it was still the RIPE community's job to spread the word at a level that people without a proper IT background can handle. Jen contributed to this with another online comment indicating that as the adoption of IPv6 increases among enterprises, universities will offer more. Peter Hessler said that for some ISPs, it was not even an option to provide IPv6 connections to enterprises. An audience speaker thanked Wilhelm for his proposal, mentioning how important it was for enterprises. He also said that he would be open to writing, reviewing, and working on documents of the best resources for newcomers and beginners in IPv6 and TCP/IP. Jen mentioned another online comment. Markus said that his students were unwilling to learn IPv6 since they think nobody used it. Jen said that there were different approaches to this depending on the availability of IPv6 in each part of the world. Finally, Jen asked what the next action should be. Wilhelm said that he would send an email to the mailing list to start working on this with people who can contribute. 1. Implications of IPv6 Addressing on Security Operations Fernando Gont The presentation is available at: https://ripe86.ripe.net/wp-content/uploads/presentations/119-ripe86-fgont-i… Fernando Gont presented about the challenges of IPv6 security deployment. He also explained how IPv4 and IPv6 differ in terms of security implementations. Rinse Kloek mentioned that he conducted extensive CPE testing. One issue he encountered was that occasionally services were listening on local addresses, and if one copied the v4 test to the v6 test, it was possible to overlook this aspect. Fernando agreed and said testers did not know about ULA addresses. Benedikt Stockebrand suggested that leaving the IPv4 way of thinking would made things much easier. He added that not using dual-stack would simplify the way of working. Peter Hessler noted that a common mistake while translating IPv4 ACLs into IPv6, which was blocking ICMP as it should not be blocked in IPv6. Jen asked why it was important to care about the size of the prefix you block if it was someone else's network. Fernando answered that he experienced this in a meeting with a large content provider where they were just blocking a single IPv6 address instead of the /64. Fernando added that these kinds of things, which were obvious to this group, might not be obvious to the groups that were implementing rules in the networks. Jen added that with IPv4, it was much worse since you might be blocking many innocent users behind CGN just by blocking a single IPv4 address. 1. Conclusion & Thanks Benedikt Stockebrand announced that his term as the WG chair was ending with the next RIPE meeting, and that he did not want to go for another term. He asked the community if anyone was interested. As the last topic of the WG, Ondrej Caletka, RIPE NCC, asked everybody to test the IPv6-only network and try to identify any issues and report them to the vendors. Raymond , Benedikt, Jen. For Internal Use Only

1 0

Re: [ipv6-wg] Clear Guidance for Enterprises
by Gert Doering 04 Jun '23

04 Jun '23

Hi, On Sat, Jun 03, 2023 at 07:53:48PM +0000, Ole Troan (otroan) wrote: > Thought experiment. > IPv6 wasn?t invented. > Would we be able to make IPv4 continue to roll down the hill for another 25 years? Whether there's 3 or 4 layers of NAT won't matter much... everything that is not TCP or UDP won't survive, but since The Browser Oligopol seems to be set to move everything into QUIC anyway, we should be fine... It will nicely kill everything that is not Cloud or Rendezvous-Server- based, but there's quite a few parties outside that would consider this a feature. So yes. Gert Doering -- NetMaster -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279

1 0

(IETF I-D) Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-ietf-opsec-ipv6-addressing-00.txt)
by Fernando Gont 02 Jun '23

02 Jun '23

Folks, The IETF OPSEC WG has adopted our IETF I-D entitled "Implications of IPv6 Addressing on Security Operations". This is the same material I presented at the last IPv6 WG meeting in Rotterdam (https://ripe86.ripe.net/programme/meeting-plan/ipv6-wg/). The IETF-ID is available at: * TXT: <https://www.ietf.org/archive/id/draft-ietf-opsec-ipv6-addressing-00.txt> * HTML: <https://datatracker.ietf.org/doc/html/draft-ietf-opsec-ipv6-addressing> We have tried to make the document as practical as possible for anyone doing security operations. Your comments and suggestions will be highly appreciated. P.S.: Thanks to those of you that sent feedback for previous revision of this document, by the way! Regards, Fernando -------- Forwarded Message -------- Subject: New Version Notification for draft-ietf-opsec-ipv6-addressing-00.txt Date: Fri, 02 Jun 2023 07:26:18 -0700 From: internet-drafts(a)ietf.org To: Fernando Gont <fgont(a)si6networks.com>, Guillermo Gont <ggont(a)si6networks.com> A new version of I-D, draft-ietf-opsec-ipv6-addressing-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Name: draft-ietf-opsec-ipv6-addressing Revision: 00 Title: Implications of IPv6 Addressing on Security Operations Document date: 2023-06-02 Group: opsec Pages: 13 URL: https://www.ietf.org/archive/id/draft-ietf-opsec-ipv6-addressing-00.txt Status: https://datatracker.ietf.org/doc/draft-ietf-opsec-ipv6-addressing/ Htmlized: https://datatracker.ietf.org/doc/html/draft-ietf-opsec-ipv6-addressing Abstract: The increased address availability provided by IPv6 has concrete implications on security operations. This document discusses such implications, and sheds some light on how existing security operations techniques and procedures might need to be modified accommodate the increased IPv6 address availability. The IETF Secretariat

1 0

IPv6-mostly IPv6-only(with dns64/nat64) dual stack at RIPE-meeting
by Thomas Schäfer 27 May '23

27 May '23

Hi, during the closing plenary were considerations to remove the IPv6-only(with dns64/nat64) network/ssid the next time. I would vote for that. IPv6-mostly covers the traditional IPv6-only. Someone made the proposal to provide a real "ipv6 only" net/ssid instead (without nat64) My first thought was: Never, it will the people just frustrate. My second thought was: Let's try it! After the first shock - only 50% of the websites support IPv6 - we should provide tips for testing: - using public dns64 with own nat64 address space - VPN, the public ones like apple privacy relay, cloudflare warp ... - VPN, own organisation/company like eduvpn for NREN (e.g. DFN supports it, other institutes too, cisco anyconnect... -VPN personal, like wireguard/ipsec to AVMs fritzbox and others, openvpn NAS/ own setups Last but not least I propose to provide that special DNS-resolver: https://gitlab.com/miyurusankalpa/IPv6-dns-server It increases the amount of IPv6 capable destinations. Regards, Thomas

4 3

FW: [address-policy-wg] IPv6 policy - 2nd prioritisation and outcomes discussion webinar
by Raymond Jetten 27 Mar '23

27 Mar '23

Just to let the IPv6WG know, there is an ongoing discussion on the next steps in IPv6 policy work at the Address Policy working group please see below for details, and of course feel free to participate in this important matter. Rgds, Ray For Internal Use Only -----Original Message----- From: address-policy-wg <address-policy-wg-bounces(a)ripe.net> On Behalf Of Leo Vegoda Sent: tiistai 21. maaliskuuta 2023 23.48 To: address-policy-wg(a)ripe.net Subject: [address-policy-wg] IPv6 policy - 2nd prioritisation and outcomes discussion webinar At RIPE 85 we continued a review of the IPv6 policy that began at RIPE 83. Several areas for improvement were agreed. We promised to host an inter-sessional webinar to discuss priorities and the outcomes to work towards. We held the first webinar on Monday, 20 February 2023. You can read a summary of what was discussed on RIPE Labs. A full recording and minutes are published on the interim sessions page. - https://labs.ripe.net/author/leo_vegoda/next-steps-in-ipv6-policy-work/ - https://www.ripe.net/participate/ripe/wg/active-wg/ap/interim-sessions The second webinar will take place on Tuesday, 11 April at 13:30 UTC (15:30 CEST). If you want to help us set priorities and define the outcomes the community needs you are welcome to join. Join Zoom Meeting https://ripe.zoom.us/j/93730573273?pwd=eWJ1WEEzSzVSSEJNKy9JeXk0L3RqZz09 Leo Vegoda for the Address Policy WG co-chairs -- To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: https://lists.ripe.net/mailman/listinfo/address-policy-wg

1 0

Call for presentations IPv6 WG @RIPE86
by Raymond Jetten 27 Mar '23

27 Mar '23

Hello All, RIPE 86 will take place from 22-26 May 2023 in a hybrid format in which online and onsite participants can interact with each other using a common platform. The onsite event will take place in Rotterdam, Netherlands. For both cases you can register here: https://ripe86.ripe.net/attend/register/ The IPv6 Working Group session is scheduled for Thursday 25 May from 11:00 . 12:30 (UTC+1) (however it still may change) We are looking for presentations - please email : ipv6-wg-chair (at) ripe.net if you'd like to present. Please also state if you intend to be online or onsite, and the duration of your presentation, and a short description of it. Once we have decided on the agenda, we'll contact the presenters. Hope to see many of you, On behalf of the IPv6-WG Benedikt, Jen, Ray For Internal Use Only

1 2

(IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)
by Fernando Gont 05 Feb '23

05 Feb '23

Hi, All, Recently, I happened to participate in an IPv6 deployment meeting with some large content provider, and said meeting included a discussion about how to mitigate some attacks using block-lists. These folks argued that they ban offending IPv6 addresses as /128s, following IPv4 practices. So it seemed to me that some of the implications arising from the increased IPv6 address space were non-obvious to them. -- that has been the motivation for the publication of this document. * TXT: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt * HTML: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html Comments welcome! P.S.: The document is targeted at the IETF opsec wg (https://www.ietf.org/mailman/listinfo/opsec), but I'll be happy to discuss it on this mailing-list, off-list, or at the opsec wg mailing-list... Thanks! Regards, Fernando -------- Forwarded Message -------- Subject: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt Date: Thu, 02 Feb 2023 19:48:40 -0800 From: internet-drafts(a)ietf.org To: Fernando Gont <fgont(a)si6networks.com>, Guillermo Gont <ggont(a)si6networks.com> A new version of I-D, draft-gont-opsec-ipv6-addressing-00.txt has been successfully submitted by Fernando Gont and posted to the IETF repository. Name: draft-gont-opsec-ipv6-addressing Revision: 00 Title: Implications of IPv6 Addressing on Security Operations Document date: 2023-02-02 Group: Individual Submission Pages: 8 URL: https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt Status: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-addressing/ Htmlized: https://datatracker.ietf.org/doc/html/draft-gont-opsec-ipv6-addressing Abstract: The increased address availability provided by IPv6 has concrete implications on security operations. This document discusses such implications, and sheds some light on how existing security operations techniques and procedures might need to be modified accommodate the increased IPv6 address availability. The IETF Secretariat

1 0

New on RIPE Labs: IPv6 Policy Is a Community Self-Governance Success Story
by Alun Davies 30 Jan '23

30 Jan '23

Dear colleagues, The RIPE Address Policy Working Group invites the community to join the conversation on the next phase of IPv6 policy. In this new article on RIPE Labs, Leo Vegoda talks about the success of the policy so far and the process that is underway in order to determine whether there’s need for change: https://labs.ripe.net/author/leo_vegoda/ipv6-policy-is-a-community-self-gov… Best regards, Alun Davies RIPE Labs Editor RIPE NCC

1 0

Pv6 policy - prioritisation and outcomes discussion webinar
by Raymond Jetten 27 Jan '23

27 Jan '23

Dear IPv6-WG list members, Below an invite from the Address Policy Working Group, to an IPv6 address policy webinar. Kind regards, Ray From: Leo Vegoda <leo(a)vegoda.org> Date: Thu, 26 Jan 2023 at 10:14 Subject: IPv6 policy - prioritisation and outcomes discussion webinar To: <address-policy-wg(a)ripe.net> At RIPE 85 we continued a review of the IPv6 policy that began at RIPE 83. Several areas for improvement were agreed. We promised to host an inter-sessional webinar to discuss priorities and the outcomes to work towards. The identified areas for improvement include: - Better guidance on documentation requirements for large allocations - Simpler language for the HD-ratio - Make it easier for small networks to assign a few addresses to other organisations - Ensure allocations always fall on a nibble boundary If you wants to help us set priorities and define the outcomes the community needs you are welcome to join. Monday, 20 February 2023 at 13:00 UTC (14:00 CET). Join Zoom Meeting https://ripe.zoom.us/j/94307989734?pwd=YytnQm53SjJEWUtKemxQM3dGcjZmQT09 Meeting ID: 943 0798 9734 Passcode: 339420 Leo Vegoda for the Address Policy WG co-chairs For Internal Use Only

1 0