Are we there yet? American baseball legend Yogi Berra once said, “We’re lost, but we’re making good time.”  As funny as that sounds, he made a great point.  If you don’t know where you are going, how do you know how far you’ve gone or how far it is to your destination?  Similarly, if you don’t have a good idea of what success looks like you might not be aiming in the right direction and putting effort toward those activities that will result in the achievement of the goal. The same concern holds true for the journey from IPv4 to IPv6.  Virtually all enterprise organizations ..read more

In my blog A /48 for Every Site and For Every Site a /48 (Parts 1 and 2), the title itself attempts to capture and summarize a general but critical IPv6 address planning principle: When designing an address plan, assign at least a /48 to every site. But is a single /48 always enough for every site? And if not, what prefix size would be and how would the assignment of a larger prefix impact the overall address plan? To recap briefly, recall that for most network engineers and architects the word “site” has very tangible associations with specific physical network locations: data centers, campus ..read more

Part 1 Part one of this article discussed how it was previously believed that IPv6 scanning was nearly impossible.  But it is trivial to scan IPv6 addresses that are on the local link, in DNS, easily guessed, or found using other creative methods.  IPv6 addresses can also be found in other places and then used for active scanning. IPv6 Hitlists and Target Generation Algorithms (TGAs) People have been creating lists of Internet-reachable IPv6 addresses for years.  This is akin to the early ARPANET /etc/hosts (or yellow pages) for the IPv6 Internet.  The IPv6 Hitlist Service ..read more

As IPv6’s popularity has grown and its usage on the Internet has increased, it has caught the attention of attackers.  Typically, targeted attacks begin with reconnaissance to first identify the victim.  Then active network scanning and exploring leads to exploitation of the target.  This is followed by the attacker maintaining access, covering their tracks, and leveraging that access to pivot to additional targets.  With the finite limits of IPv4 addresses and their high density and utilization, reconnaissance of all public IPv4 addresses is commonplace.  However, IPv ..read more

Many organizations are migrating away from traditional three-tier, spanning-tree datacenter and campus LANs to the newer EVPN-VXLAN architecture. This architecture is very flexible and allows for numerous implementation design options, however, the most common deployment is a leaf-spine, or Clos, design – so much so that leaf-spine EVPN-VXLAN LANs are the new de facto standard for datacenter and campus LANs alike. There are many benefits to EVPN-VXLAN designs, including scalability, optimization for east-west traffic, virtual machine mobility, easier segmentation, simpler automation, all links ..read more

IPv6 Extension Headers Review IPv6 is different from IPv4 in many ways. Of course, IPv4 and IPv6 addresses are obviously different (32 versus 128 bits, decimal versus hexadecimal are examples), but these protocols also have different protocol header formats. Similar to the IPv4 option fields, IPv6 packets can utilize “Extension Headers” to extend the functionality of the protocol, without having to completely change the IPv6 protocol header every time we want to add new functionality. These extension headers can be used “optionally” and are placed between the IPv6 header and the upper-layer pr ..read more

The IPv6 Flag Day Conundrum Early in the development of IPv6, it was determined that there wasn’t going to be a “flag day” when everyone on the entire Internet would switch from IPv4 directly to IPv6. That was one of the characteristics that made the dual-stack strategy of running IPv4 and IPv6 simultaneously on hosts and networks appealing. The advantage of running both protocols in parallel is that end nodes and applications could have a very smooth and gradual deployment of IPv6. Once IPv6 deployment was ubiquitous, then IPv4 could start to be decommissioned. Fast forward to today and there ..read more

One of the hardest challenges for any person or organization is to get proficient in IPv6 with a network that isn’t running IPv6 at all. But it’s not advisable to implement IPv6 in production without carefully planning the configuration. So how do you adopt and deploy IPv6 confidently when you haven’t really had any hands-on experience with it? An IPv6 lab is the way to address skills gaps, gain experience with IPv6, and learn and observe how IPv6 works on all the platforms you run within your environment. There are several strategies you can use to build an IPv6 lab: Build a physical lab env ..read more

Using DHCP Option 108 to Disable IPv4   Achieving IPv6-Only Networks Some large enterprises are now considering how to configure an IPv6-only network environment. They have a desire to reduce the OPEX costs of maintaining two protocols simultaneously and realize the simplicity of running a single protocol in the environment. They recognize that IPv6 addressing, operationally speaking, is much simpler than IPv4 subnetting. With IPv6-only, enterprises can avoid the complexity and cost of buying, operating, and troubleshooting NAT/CGN/LSN systems. Organizations reduce their dependence on inc ..read more

My fellow Infoblox IPv6 Center of Excellence (CoE) author and longtime friend, Cody Christman, wrote an article on “The True Cost of IPv4”. His article discussed the tangible costs of purchasing public IPv4 addresses on the open market and the hidden costs of the added complexity of using Network Address Translation (NAT). He points out how we often overlook the CAPEX and OPEX costs of “the way we have always done things” and take it for granted that IPv4 constraints are just “the cost of doing business”. After reading his article I started to wonder if we could actually estimate some of these ..read more