1 / 87

IPv4 過渡至 IPv6 轉換機制與策略建議 移轉技術分項

IPv4 過渡至 IPv6 轉換機制與策略建議 移轉技術分項. 移轉技術分項 20110221. Ver. 20090505.01. 簡報內容. IPv4 為何往 IPv6 發展 IPv6 簡介 IPv4/IPv6 移轉技術 IPv4 過渡至 IPv6 轉換機制與策略建議. IPv4 為何往 IPv6 發展. IPv4 是網路的獨一識別碼 數位化 ->IP 化 -> 系統整合 All_IP-> IoT 其實是類似的概念 IPv4 最常被比喻成 電話號碼 個人的身分證號碼. 電話號碼是否不夠用過 ?.

wattan
Télécharger la présentation

IPv4 過渡至 IPv6 轉換機制與策略建議 移轉技術分項

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. IPv4過渡至IPv6轉換機制與策略建議移轉技術分項IPv4過渡至IPv6轉換機制與策略建議移轉技術分項 移轉技術分項 20110221 Ver. 20090505.01

  2. 簡報內容 • IPv4為何往IPv6發展 • IPv6簡介 • IPv4/IPv6移轉技術 • IPv4過渡至IPv6轉換機制與策略建議

  3. IPv4為何往IPv6發展 • IPv4是網路的獨一識別碼 • 數位化->IP化->系統整合 • All_IP-> IoT 其實是類似的概念 • IPv4最常被比喻成 • 電話號碼 • 個人的身分證號碼

  4. 電話號碼是否不夠用過? • 北市、縣及基隆市電話升碼自87年1月1日全面實施? • 為何大家不採用電話撥到社區總機再轉分機?這樣就不需要升碼了阿?(NAT) • 可能的答案 • 各社區各自為政，影響連線可靠度？ • 電話號碼代表了一個單位或個人，共用將來爭議大？

  5. 偵辦網路犯罪作業程序

  6. 主要國家IPv4位址配發狀況 統計至2011年1月

  7. IPv4過渡性的延伸NATCarrier-Grade NAT Shin Miyakawa , Ph.D. NTT Communications Corporation

  8. Examples of # of concurrent sessions

  9. 如果每個人可分配的session少於15

  10. NAT的極限 • 一個IP可以用65536個同時通訊連線。 • 一個IP分配給100戶家庭，一個家庭僅剩餘655個session. • 排隊可以解決問題，問題是誰排後面。

  11. 現有成本相對低的長期解決方案 • 呼籲大家不要用iPhone智慧手機? • 積極投資IPv4 NAT-NAT-NAT 解決方案 • IPv6?? • DNS(Bind9-2004)… • WinServ2003… • WinXP… • IPv6是一個L3的協定 • IPv4/IPv6可以跑在同一條網路線上

  12. IPv4與IPv6的迷思 • IPv6會取代IPv4? • 錯!會共存至少10年 • 既然會共存，我就不需要管? • 錯!..有人會用IPv6連線，至少要會查IP… • IPv6的路由器比較貴? • 錯!買到不支援的還比較難。 • 我的單位沒有IPv6 • Hmm…微軟自動幫你建好Tunnel(真是貼心的資安漏洞)

  13. IPv6簡介 • IPv6(128bits) vs IPv4 (32bits) • 標準模組化全配功能 vs 額外擴充功能

  14. IPv6的發展(1/2) 1992年，IETF之IPv4的Address空間不足的問題開始被檢討 。 1994年，下一代的網際網路協定開始被提案，CATNIP (Common Architecture for the Internet)、TUBA (TCP/IP with Bigger Addresses)、SIPP (Simple Internet Protocol Plus)三個提案中出線。 1995年，SIPP被更名為IPv6，IPv6的規範將被RFC1752(The Recommendation for the IP Next Generation Protocol)公開。

  15. IPv6的發展(2/2) 1998年，IPv6之位址架構與通訊協定之規範分別在RFC2373 (IP Version 6 Addressing Architecture)與RFC2460 (Internet Protocol Version 6(IPv6) Specification)公開。 1999年，全球第一個業界團體(共有42個單位加盟)成立了「IPv6 Forum」。ARIN 將全球第一個之IPv6 Prefix：2001:400::/35授予給ESnet。 2002年，全球各區域性的Internet Registry RIR(Regional Internet Registries)實施新的「IPv6 Address Allocation and Assignment Global Policy」。

  16. IPv4與IPv6比較 (1/2)

  17. IPv4與IPv6比較 (2/2)

  18. IPv6 位址表示法 (native) • IPv6使用128Bit的位址空間，也就是最高可有2^128的位址空間，以16進位(2^4)表示，可寫成32組十六進位數字 • 如二進位0010在十六進位中即為2 • 0010 0000 0000 0011 即為2003 • 用以下位址為例 • 20030000000000B30000000000001234 (太長容易記錯) • >2003:0000:0000:00B3:0000:0000:0000:1234(分為八段，以冒號分隔) • >2003:0:0:B3::1234(簡寫) • 簡寫規則: • 每16Bits如開頭之4bit表示為0，即可省略 • 若16Bits全為0，則可簡寫為0 • 若連續完整之16Bits段落皆為0000，則可全省略，簡寫為::，但以一次為限

  19. Basic Address Types • Unicast (點對點傳輸) • Address of a single interface • Delivery to single interface • for one-to-one communication • Multicast (群播傳輸) • Address of a set of interfaces • Delivery to all interfaces in the set • for one-to-many communication • Anycast (多點備援傳輸) • Address of a set of interfaces • Delivery to a single interface in the set • for one-to-nearest communication • Nearest is defined as being closest in term of routing distance

  20. Link-Local Global Site-Local Unique-Local Unicast Address Scoping • Global Scope: • 可在Internet上互連之位址空間，其位址稱為Global Unicast Addresses • Link Local Scope: • 所有在同一個Layer2網路下的Host所使用的位址空間，其位址稱為Link-Local Addresses • Unique-Local Scope • (類似IPv4的Private Address) : • 所有在一個網路管理機制下之私用網路位址空間，其位址稱為 Unique-Local Addresses

  21. Unicast Address Structure 舉例2003:0:0:B3::1234/64 • 網路位址部份 2003:0:0:B3 • Interface 位址部份: • 非簡寫樣式 :0:0:0:1234 • 簡寫樣式 ::1234 Network位址基本上由網路設備發送

  22. Network ID 設定與配送機制 採用Neighbor Discovery (ND)，播放Router Advertisement DHCPv6 – Prefix-Delegation 手動設定 Tunnel Server 系統自動產生或指定 (IPv4下) VPN Server (IPv4 and/or IPv6)

  23. IPv6 Prefix 表示法 • IPv6完全使用 /X 取代IPv4 Subnet mask之表示方式 X 可由0至127 • 例如: • 2003:1234:3344::34ff:2314/64 代表了Network ID部份為 64bit • 2003:1234:3344::34ff:2314/60 代表了Network ID的部份為60bit • 2003:1234:3344::34ff:2314/127 代表了Network ID的部份為127bit

  24. Interface ID 產生方式 採用modified EUI-64 演算法，經由MAC Address計算出Interface 位址 作業系統自動產生隨機位址 手動設定 Tunnel Server系統自動產生或指定 經由加密機制產生之虛擬位址(IPv6 IPSec) DHCPv6伺服器指定(Stateful)

  25. EUI64 address

  26. 由MAC Address 產生Interface ID • First three octets of MAC is Company-ID • Last three octets of MAC is Node-ID • 將 FFFE置入Company ID與Node-ID間 • Company ID 2進位表示法之第7碼為Univeral/Local-Bit，設為1表示Global Scope 如: MAC Address為 00-C0-3F-BB-93-91，則 • Company ID 為00-C0-3F, Node ID為BB-93-91 • 00-C0-3F-FF-FE-BB-93-91 • Company ID 2進位表示法為00000000 11000000 00111111 • 將第7bit改為1，為00000010 11000000 001111111 • 重組為02-C0-3F • Interface ID為 2C0:3FFF:FEBB:9391

  27. Global Unicast Address 分配表(部份) 詳細內容請至 http://www.ripe.net/rs/ipv6/stats/index.html

  28. 1111111010 0 interface ID 10 bits 54 bits 64 bits Link-Local Address • Meaningful only in a single link zone, and may be re-used on other links • Link-local addresses for use during auto-configuration and when no routers are present • Required for Neighbor Discovery process, always automatically configuration • An IPv6 router never forwards link-local traffic beyond the link • Prefix= FE80::/64

  29. Unique-Local Address • 同一個Unique local address不能重複使用 • 等同於 IPv4 private address space • 取代原有定義的IPv6 Site-Local Addresses • L flag代表assignment policy. 目前只有L=1被使用 • Global ID長度40-bit,並隨機產生. • Prefix= FC00::/7 L=1 表示Local L=0 保留中 1111110 L Global ID subnet ID interface ID 40 bits 16 bits 64 bits 7 bits

  30. flags scope group ID 11111111 8 4 4 112 bits IPv6 Multicast Addresses • Scope field • 0: reserved • 1: Interface-Local • 2: Link-Local • 3: reserved • 4: Admin-Local Scope • 5: Site-Local • 8: Organization-Local • E: Global • Others: reserved Ex: FF02::1 區域網路中所有的節點 FF02::2 區域網路中所有的路由器

  31. maximum 65535 octets minimum 20 octets IPv4 Header Data Field IPv4 PDU maximum 65535 octets Fixed 40 octets 0 or more IPv6 Header Extension Header Extension Header Transport-level PDU IPv6 PDU IPv6相對於IPv4的模組化標頭

  32. IPv6 Header與IPv4 Header 比較 IPv6 Packet Header IPv4 Packet Header Traffic Class 8 Ver 4 IHL 4 Service Type 8 Ver 4 Flow Label 20 Total Length 16 Next Header 8 Hop Limit 8 Payload Length 16 Flags 3 Offset 13 Identification 16 TTL 8 Protocol 8 Header Checksum 16 Source Address 32 Source Address 128 Destination Address 32 Destination Address Options + Padding 32 bits Destination Address 128

  33. 24 31 0 bits 4 8 16 Changed Removed Ver IHL Service Type Total Length Identifier Flags Fragment Offset Time to Live Protocol Header Checksum 32 bit Source Address 32 bit Destination Address Options and Padding Summary of Header Changed • Streamlined (六個欄位被移除) • Fragmentation fields moved out of base header • IP options moved out of base header • Header Checksum eliminated • Header Length field eliminated • Length field excludes IPv6 header • Alignment changed from 32 to 64 bits • Revised (三個欄位被重新命名) • Time to Live ’ Hop Limit • Protocol ’ Next Header • Precedence & TOS ’ Traffic Class • Addresses increased 32 bits ’ 128 bits • Extended (新增一個欄位) • Flow Label field added

  34. 40 octets 0 or more IPv6 Header Extension Header Extension Header Transport-level PDU IPv6 PDU general form IPv6 extension header • Hop-by-hop options header • Routing header • Fragment header • Authentication header • Encapsulating security payload header • Destination options header 34

  35. IPv6 封包延伸標頭的例子

  36. Dualstack TCP/IP Protocol Suite MIP ICMPv6 引用自TCP/IP Fundamentals for Microsoft Windows Chapter 2

  37. ICMPv6

  38. 為何需要Transition機制? 全球發展 現況 2015年 (預估)

  39. IP網路與服務 Servers Networks Clients IPv4 IPv4 IPv6 IPv4 IPv6 IPv6 IPv6 IPv4 IPv4 IPv6 IPv6 IPv4 IPv6 IPv4 IPv6 IPv4 IPv6 IPv4

  40. Dual Stack NGTrans v6ops Tunneling Translator Next Generation Transition

  41. Transition mechanism • Dual stack • allow IPv4 and IPv6 to co-exist in the same devices and networks. • Tunneling • enable network edge devices to interconnect over incompatible networks. • Translation • allow IPv6-only devices to communicate with IPv4-only devices

  42. Tunneling 6over4 • RFC 2529 • RFC 3056/ 5569 • RFC 3053 IPv4 IPv6 IPv6 6to4/6RD IPv4 IPv6 IPv6 Tunnel Broker IPv4 IPv4/ IPv6 IPv6

  43. Translator • RFC 2765；RFC 2766/ Draft… • RFC 2767 • RFC 3142 IPv6 NAT-PT/NAT64 IPv4 SIIT IPv4 Apps IPv4 Apps BIS BIS IPv6 Stack IPv6 Stack TCP/UDP-Relay IPv6 Host IPv4 Host IPv6 IPv4

  44. Applications Routing Protocols TCP/UDP TCP/UDP IPV4 IPV4 IPV6 IPV6 DeviceDriver DeviceDriver Dual Stack Mechanisms V6 network V4/V6 network V4 network

  45. IPv4/IPv6移轉技術 ISP與ISP之間 ISP核心網路 ISP傳輸網路 使用者端 ISP A Company or Home • EGP路由協議 • MP-BGP4 • IGP路由協議 • RIPng • OSPFv3 • Integrated IS-IS • 6PE/6VPE • ISP至客戶線路 • Dual Stack • Tunnel • Tunnel Broker • 6to4/6RD

  46. Routing in IPv6 (1/3) • As in IPv4, IPv6 supports IGP and EGP routing protocols: • IGP for within an autonomous system are • RIPng (RFC 2080) • OSPFv3 (RFC 2740) • Integrated IS-ISv6 (draft-ietf-isis-ipv6-07.txt)(2007/10/04) • EGP for peering between autonomous systems • MP-BGP4 (RFC 4271, RFC 4760 and RFC 2545) • IPv6 still uses the longest-prefix match routing algorithm

  47. Routing in IPv6 (2/3) • RIPng • RIPv2, supports split-horizon with poisoned reverse • RFC2080 • IS-ISv6 • Shared IGP for IPv4 & IPv6 • Route from A to B same for IPv4 & IPv6 • Separate SPF may provide SIN routing • OSPFv3 • « Ships in the Night » routing • Need to run OSPFv2 for IPv4 • Route from A to B may differ for IPv4 & IPv6

  48. Routing in IPv6 (3/3) • BGP4+ • Added IPv6 address-family • Added IPv6 transport • Runs within the same process - only one AS supported • All generic BGP functionality works as for IPv4 • Added functionality to route-maps and prefix-lists

  49. 6PE/6VPE

  50. RFC 4213 Configured Tunnel IPv4 Networks IPv6 Island IPv6 Island IPv4 Tunnel Dual-stack node Dual-stack node IPv6 H Payload IPv4 H IPv6 H Payload IPv6 H Payload

More Related