[music]
Now, just like IPv4, there are numerous ways to get them
and there honestly might even be ways that I'm not going to list here.
I'm going to list definitely the most popular and the most
common ways to do this, but that's not to say there aren't others.
First and foremost is what I'm hoping is the obvious, which is simply
static address assignment. You go to a device, you give it a static address.
Again, if this is Windows, Mac, Linux, Cisco, it's all pretty straightforward.
For most of those it's going to be a GUI to just put in an IPv6 address.
Really, really a piece of cake, nothing to it.
Your other choice, and this of course is brand new with IPv6,
and we're going to spend a bit of time on this.
Not to worry. We'll go through configuration and everything.
Again, like I said, I'm going to do the configuration on Cisco routers.
But the fact of the matter is that almost all devices,
functionally they all do the same thing. It's just a matter of syntax.
The Stateless Address Auto Configuration.
Somebody looked at this and basically said, do we really need DHCP?
If you've been looking at the networking world in general as of late,
I know Cisco-- and not just Cisco, although they're using it sort
of as their tag line lately.
All of the vendors are doing this whole--
Cisco's calling it the Internet of everything.
Other vendors-- I've heard terms like all-to-all connectivity and, whatever.
The idea is smart devices, right?
Look, I'll go all the way to the refrigerator in your house,
active RFID tags in warehouses, sensors on equipment along production lines.
Tracking a product from the time it's created all the way
to the time it's put on a shelf in a store. All of these things.
This is where things are headed, right?
Cisco's actually shown some presentations at Cisco Live and such,
where they'll have sensors-- I think they did it-- I could be incorrect here.
I believe it was Walmart, but they did sensors under the parking spots
in a retail store - like I said, I believe it was Walmart -
to find out if there was a car parked in that spot.
Why? Well, depending on the number of cars in the parking lot,
can give the manager a pretty good indicator,
hey, do I have enough registers open?
You know, there's 800 cars in the parking lot, and I've got 2 cashiers?
I've got a problem - almost guarantee it.
I've got 10 cars in the parking lot, and 8 cashiers working -
might be a little overstaffed right now.
Maybe I can have them-- give them something fun to do.
I don't know. Clean the bathrooms or something. I don't know. I'm just saying.
The point is-- and look, we all know it's not an exact science.
Of course it's not, you know? There could be 10 people in each of those cars,
or there could have been 1 person in each of those cars.
Depending on the number of people in those cars,
those 10 cars could have had 10 people or a hundred people.
It's not exact, but you know it's not 1,000 people,
and you know it's not 2 people, unless some of them drove a car,
walked home, got another car, you know.
So the whole point is this, though: lots and lots of of devices,
sensors, triggers, inventory scanners, all this kind of stuff that,
at the end of the day, all they need is network connectivity.
So if you think about it from that perspective, what do they need?
They need an address, a prefix length - we don't call it a subnet
mask anymore, we call it a prefix length now -
and, well, almost everything needs to talk off of its own segment anymore,
so a default gateway. Now if you think about those three items,
wow, that's real simple isn't it? Let's see.
The actual network portion of the address -
remember that, just like IPv4, IPv6 is going to be split into three sections.
You're going to have network, probably subnet, and host.
Now the difference is-- and we'll get into this a bit later with routing and such.
The difference is, generally speaking, your company
should get say like a /48 with IPv6,
and you split that up into /64's for your subnetting.
So at the end of the day, really all your client networks should be /64s
But that's not really our discussion right now. The point is this.
There's one device on that segment that's not going to be a scanner.
It's not going to be a parking lot sensor. It's not going to be any of those things.
It's going to be, well, the router. The way off that segment.
There's one thing that he certainly knows.
That is, what is the prefix and the prefix
length for that segment. He's got to know that.
So why can't he just send that out to the clients?
There you go. Part one of what we needed to know taken care of.
Really two parts depending how far you want to break it down.
He now knows the prefix and he knows the prefix length.
So he knows, for example, that it's 2001:db8:100:10::/64. He knows that.
Okay, what else do you need? A host portion.
Great, I believe I just had a discussion on
the last slide about using your MAC address.
Or if you don't like to use the MAC address, do what Windows does,
pseudo randomly pull it out of thin air.
Like I said, they have a process. I'm making fun a little bit,
but hey look, on the Cisco router you can use something called a CGA,
which is a cryptographically generated address.
You can actually have it generate your address portion randomly off
of a seed of an RSA key.
So let your cryptography engine generate the random, basically is
what it comes down to.
So, you know, I don't care how he gets his host portion.
That's the point though. We're not giving him the host portion.
You see that word, stateless? That's what that means. I'm not giving the client.
I'm not giving the sensor, the warehouse monitor, the video camera, the IP phone -
whatever it is. I'm not giving it it's address.
I'm giving it the prefix and the length.
He makes up the host portion on his own,
and he does DAD, like we just discussed, to make sure it's unique.
Boom. He's got an address.
He's got a network portion from the router,
the prefix length from the router, and the host portion from thin air.
It really doesn't matter what. Randomly generated like I said. It doesn't matter.
He has a unique /64 host portion. Now, there
was one more piece of information he needed.
He needed the default gateway. Well, here's a shocker. You're ready?
Hopefully you're sitting down wherever you're at.
If you're driving or something while you're listening, don't let this startle you.
He uses the router that gave him the prefix
information. Whoa, shocking isn't it? I know.
He already knows who the router is.
This is all sent through something called a router advertisement message.
So he already knows who the router is,
and that's who he's going to use as his default gateway.
Now, we can set priority on that if there's two routers on a segment.
We can get into a whole lot of advanced stuff,
but that's the basic idea behind stateless address auto configuration.
Now, if you're listening to this, one thing you might be thinking is,
well what about my DNS server? Lots of things need a DNS server.
Yes, well, you could statically set that on all those devices.
I know what you're thinking again.
Well, what if I'm setting this up for, I don't know,
a Starbucks or a Panera Bread or whatever,
some place that's going to have public WiFi?
I don't need to track their addresses. I don't need a DHCP server, and a pool,
and a database, and track what clients I gave what addresses to.
I don't care. These people come and go every ten minutes.
I mean, unless they're at Starbucks, then, you know, they buy one coffee
and they think that entitles them to the table for 6 to 12 hours,
and they'll sit there all day and do their work because I guess they
can't afford an office or something. I don't
know. I'm making fun. I'm joking again.
I'm not really. You know they do it. I'm just saying.
But in any case-- no, seriously, the point is it's very short term, theoretically.
I don't need to keep track of that - not my problem.
Stateless slack here is perfect for that kind of an environment,
but it's lacking, okay?
You can't expect somebody to say, oh I need to check my Facebook status,
what is the IPv6 address of Facebook?
Oh darn, you know, I had it right here the other day.
The point is, hopefully you can understand, even more than IPv4, the need for DNS here.
Nobody's going to be remembering 128-bit IPv6 hexadecimal
addressing for sites. It's not going to happen.
We don't remember 32-bit IPv4 addresses for most sites.
I mean, you might have a couple or something that you know, but,
generally speaking, we pretty heavily rely on DNS.
Now, all of these sensors and devices and everything I've mentioned
so far, see they don't need to surf the web. They're not trying to get to Facebook.
They're not trying to get to Ford or Chevy or Toyota or-- they're
not looking for a new car. They're not out there trying to surf the web.
They're getting a job done. They know who they need to contact.
They've been preprogrammed with who to contact,
probably through some sort of cloud service,
and all they need to know is how to contact that cloud service.
That cloud service gives them all the rest of the config they need - done.
And SLAAC is perfect for that.
I just hear people hear all this a lot and go,
yeah, I hear what you're saying but what about the TFTP server for my phones
and my wireless access points? What about the DNS server for my clients?
Because again, this is a public WiFi, and I don't really want to run
DHCP, but I need them to know the DNS server. I'm glad you asked.
Because that's exactly what stateless DHCPv6 is for.
By the way, I put it in parentheses here, DHCPv6 Lite.
I've seen it listed that way in some documentation, particularly from Cisco.
I've seen it a couple other places, just wanted to throw it out there.
Almost every place lately I've seen it called stateless DHCPv6,
so I think the big trend is everybody's going to call it that.
But if you get some older documentation or maybe an older book or
something, you might see it listed that way.
Just wanted you to know they're the same thing, if you do see that term somewhere.
Basically what this is, is take all the advantages of stateless
that we just talked about above, lightweight, no database to track,
none of that, very simple.
But I do need to give you DHCP options.
The basic idea here is I'm not giving host portion.
That DHCP server will not have a scope.
Okay, maybe that wasn't the best way to say it.
It won't have an address range for the scope,
let's put it that way, better way to say it.
You're going to have a scope because that's sort of exactly
what you're going to do is you're going to set up the options.
Now, some DHCP servers may let you get away with just doing that as
server options and literally not need a scope. So maybe you do, maybe you don't.
The fact of the matter is, however that DHCP server lets you do the options.
So you need to give out a TFTP server? There you go.
You need to give out a DNS server? There you go. That's how you do it.
Stateless DHCPv6 is an ability to add DHCP options to slack.
So that's what it lets you have - the best of both worlds there.
You're not handing out host portions. So
basically, I'm giving you all of your options,
your prefix length - I'm giving you all of that.
The only thing that you're not getting with
these first-- well, I say first two options.
These two options - options 2 and 3 together here.
The only thing you're not getting is a host portion.
And since I'm not giving you a host portion,
then I don't need to track which host has been given to which MAC address.
Hence, no database. See, I still have no DHCP database.
So these two things together, this is what would be perfect in,
like I said, your public WiFi hotspots.
Maybe your company offers guest access to wireless
just for Internet access, that sort of thing.
I already used the examples Starbucks, Panera
Bread, whoever it is that has a public WiFi.
This is perfect for those kind of places, because why should I keep
a database tracking what MAC address was given to what hosts?
I don't care. They're going to be there ten minutes and they're gone.
Okay? Now, if any of those things I just said don't work for you
in your environment, well then we just simply move on. We have a list.
How about full-blown DHCPv6?
There you go. We still have full-blown DHCP and I can give you the
host portion, I have a database, I can track it.
So if you're sitting there going, well yeah,
but if the FBI shows up or whoever, and they want to know who had what address,
at what time, and this and that, and I need to be able to show them,
well then there you go - its fine. Step up to DHCPv6, log your leases, back them up.
Keep that database then. That's fine.
That just means that we're handing out the host portion as well.
That's literally all it adds over the first
two options there-- or the two options above.
You pick up the database and therefore you have trackability
and accountability, but that means you also have a database to track.
So that's certainly an option. We'll take a look at it when we get to configuration,
but that's another way that they can get addresses.
There is one fundamental difference, before you look at this and go,
oh, so I don't have to change anything from what I know about
IPv4 to IPv6. I can just keep using DHCP.
Yes, you can. There is one little thing you want to be aware of though.
The RFCs for DHCP do not allow for the handing out of the router.
So you can hand out your DNS, all those other options,
but not the default gateway or the router.
Those have to be learned through router advertisement messages
that are basically what slack uses up above.
So there is not-- and we'll see this when we get into the configuration.
I'll show you on the Cisco device.
I'll use one of our Cisco routers as a DHCPv6 server, and I'll just
show you right in there that handing out the router, not an option.
It's not one of the available options, so we'll see that.
Now, your next choice, this is a fun one and I'll set it up and
I'll show it to you, but this is one of those technologies that I
look at and it's really cool and I see what they were doing with it,
and then on the flip side I look at it and go, but who's going to use it?
You know, it's one of those things, I think it's really cool.
Let me give you the basic idea, and that is,
generally speaking, it would probably be a service provider type setup.
It wouldn't have to be, it could be the core of your network, whatever.
But basically, the idea is one router or device is the DHCP server.
Another device comes online and requests not an address from
DHCP, they request a prefix from DHCP.
So just as an example, let's say you're a company and you set up your
CE router, your router going to the provider,
to get a prefix delegation address from your service provider.
So your service provider then gives you this address for prefix delegation
and they'll generally give you something like a /48, so a /48 prefix length.
You then take that prefix that you got from the provider.
Within your network, you then split that up into subnets like /64s.
You then enumerate your entire internal
address space off of this prefix delegation.
Now again, so far it sounds cool. Service provider gives me a /48, I take that /48,
I split it up into as many subnets as I need.
And by the way, in case you haven't actually done the math yet,
if the service provider gives you a /48 and you split that up into
/64s, that gives you 16 bits that are subnet.
Or essentially, the entire fourth field of the IPv6 address,
the entire fourth field becomes subnet.
2 to the 6 is 65,536, so that basically gives you 65,536 usable subnets.
That should cover your entire company. I really don't care how big you are.
If it doesn't, I really got to ask how you're doing your subnetting.
And I suppose if it really, really, really, really didn't,
then you might have to get two /48s.
But that's the basic idea behind how this whole thing's supposed to work.
So you take this /48 you get from your service provider through DHCP,
you subnet out to, well, up to 65,000 subnets, and you make all these /64s.
So there you go. Your entire address space is dynamically allocated.
Now let me tell you where this was supposed to go.
The idea behind this was supposed to be,
okay, well for whatever reason you're upset with your service provider.
You're done with them, you've had it with them, you're going to somebody else.
Okay, so you go sign up with another service provider,
they then send you a completely different /48 through prefix delegation,
and this is where the cool slash I don't know
who's going to do this, comes into play.
What that would do is that would then instantly re-enumerate your
entire inside network with whatever prefix they just gave you.
Now, the cool is you just switched service providers without even
blinking an eye and, wham, everything just automatically moves on its own,
and we're all happy.
But the problem is we're making a couple assumptions here,
that every single device on your network is actually pulling its address from DHCP
and/or stateless auto-config. What about printers? What about servers?
What about network management equipment?
What about things that we generally give a static address to?
They would still be statically on the wrong prefix if you had set them up manually.
Or you could make the argument, okay, well everything has to be DHCP now.
Okay, then how are you going to find it when it moves?
Now you're going to rely on dynamic DNS. Wonderful. Where are the DNS servers?
Who owns those? Where are all those entries?
You see, my point is I'm not saying it can't work and I'm not saying
it's not going to work and I'm not saying any of that.
I'm just saying I see some potentially large problems with this idea
that we're just going to move from one service provider to the other,
and just let that completely re-enumerate the inside of our network.
Now, the reason this was done - just to let you know - is, originally
there was going to be what they referred to as strict aggregation with IPv6.
In other words, the original idea was no service provider
would ever be allowed to advertise anything longer-- and this is
a little old now, so I could be a little bit
off on the numbers here, so I apologize.
You may want to look this up if you really want exact numbers,
but I want to say it was a /32, might have been a /24.
Basically, no service provider ever shall advertise anything to the
Internet, into BGP, longer than a /24 or 32, whatever it was.
And then there was, no regional authority should ever advertise anything
longer than a /16. The cool part of that would have meant that--
just to throw this out there, I'm stationed in the United States
or North America, so we're under the North American numbering authority here.
Depending where you are in the world,
you have your own regional authority, but the idea would be that,
like, for example, from North America, where I am right now,
to get to all of South America, Australia,
Africa, Asia, Europe, to get to every other numbering authority,
we would literally have had one route. One route gets me to all of Europe.
Once it gets to Europe, well then of course you guys are
breaking it down by your service providers and all that. That was the idea.
That was the idea. But then, you know, you start hitting-- and again that's sort of--
the reason I'm going there with prefix delegation is, the idea was
that if you move from one service provider to another,
you had to go to their address space because they had to do strict aggregation.
So as you switch service providers,
you h am right now, to Australia, Africa, Asia, Europe, to get to every other numbering authority, we would literally have had one route. One route gets me to all of Europe. Once it gets to Europe, well, then of course you guys are breaking it down by your service providers and all that. That was the idea. That was the idea. But then you start hitting, and again, the reason I'm going there with prefix delegation is the idea was that if you move from one service provider to another, you had to go to their address space because they had to do strict aggregation. So as you switch service providers, you had no choice but to switch to their prefixes. And a lot of side effects came out of this. As much as they tried to plan this whole thing out and as cool as all of that sounds, reality comes in and you get people going, well, that means if I switch service providers, I have to re-enumerate my whole network. Right. No, I'm not doing that. So here's what I'm going to do. I'm just going to enumerate my whole inside network and then I'll just do NAT on the outside. And then all I have to do is change my outside router and I can still move from service provider to service provider and not re-enumerate my inside network. And I just have to change the outside and we'll just keep doing NAT like we always have. And then you have everybody in the IPv6 world going, whoa, no, no, no, no, no, no, no, no, stop, stop. That's exactly what we don't want you doing. We didn't write all this, so you could keep using NAT. I mean, if we wanted to keep using NAT, we maybe could have fixed up IPv4. NAT's gotten us as a crutch through a lot of stuff. We maybe could have kept NAT-ing. No, this is not what we're supposed to be doing. And everybody kept saying, we're just going to do NAT then. Because you know what? Yeah, it breaks the end-to-end connectivity model, but we're not really heading towards anything that wants to do that. And of course, the product vendors are sitting back there going, no, no, no, no, no, no, we're developing products that need that, that we want to be able to ultimately sell these guys. So we can't have them doing NAT. So, you know, there's this whole, you're not supposed to use NAT anymore. And all these companies were coming back saying, well, we're just going to stick with NAT then. Because we're not going to change all of our printers and our servers and our DNS servers and our network management. And we're not going to go change all this just because we want to change service providers. You know, we want our own prefix range. Why can't customer A, you know, why can't company A own a slash 48 and then carry that from service provider to service provider just like we do with IPV4 today? Because let's face it, that's what we're doing today, right? Most of your companies out there. Now I realize some of you may be from small to mid-sized companies and maybe this is not applied to you. But a lot of companies out there do in fact own their own IPV4 address space. And if they switch providers, they just announce it out through BGP through a different provider. The problem is that means that they have to allow slash 24s to be advertised into BGP for the internet. And of course they're looking at that on IPV6 going, holy cow. So we need to start allowing customers to advertise slash 48s out into the internet. And basically, you know, public pushback was basically, well, you have a choice. You can either A, allow us to own address space and allow us to use BGP to advertise that out to the internet just like we do with IPV4 today. Or we're all going to switch over to NAT and there's really no point in you pushing this whole IPV6 thing anyway. That's pretty much the pushback from how I've heard it anyway. It's not like I was in all these meetings or anything, you know. But this is the basic feedback as I've heard it. And basically they cracked and they said, fine. And I don't know if it's a 100% official or anything like that. But strict prefix summarization is pretty much dead in the IPV6 internet. Now there'll always be providers like, you know, you go with small company home, you know, things like that. There of course always providers signed address space. And they probably always will be, you know, but for your larger companies. Because not to mention the fact when all of this was being said, all of this, all of this throw one more monkey wrench into the whole thing. What about companies that are multinational? They're global. And not just between multiple countries on the same continent either. So now all of a sudden you're telling me that I've got a company in, you know, three different numbering authorities and they have three different address spaces. How's that going to work? So again, it sounded like a really good idea. Keep the internet routing tables much smaller. But at the end of the day, the fact of the matter is it's not going to happen. We're going to end up with slash 48's. Our BGP tables are going to be just as big, if not bigger, than they are in IPV4. And of course, you know, everybody's kicking and screaming, oh no, it's going to get huge. Yeah, yeah, it's true. It's going to. But the flip side of that is you have to look back at it and go, yeah, but memory is getting cheaper and CPU's are getting faster. And we just have to make sure that our internet routers are capable of handling a large IPV6 routing table because that's how it's going to end up having to be. So since we don't really have strict prefix summarization anymore, I really, really, really see less and less of a need for this whole prefix delegation that I'm describing. Because if you own your slash 48, you switch providers, you're not changing your internal numbering. Everything stays the same. You wouldn't have gotten it through DHCP to begin with. You would have just owned it. In fact, you'd be advertising it out through BGP. So that's why I said, you know, the niche market for this prefix delegation will look at it just so you've seen it because I don't know, you know, maybe you're sitting there listening to it going, yeah, yeah, I hear all of that. But this would work really good inside of my company to hand out, you know, prefixes to remote locations. There I could possibly see a use for it certainly. Because in those cases, your internal DNS servers aren't going to change. Your internal, you know, your internal servers and stuff, you know, your data center and all that, they're all static. They're not going to change that. But maybe for remote sites or something. So I see it as a useful feature. You just got to really watch and think through where you would want to use it versus where you wouldn't. But again, in the next section, we'll be getting into a lot of these things that I've talked about. And, you know, this was just some general overview of IPv6 technologies will certainly loop back to most of this stuff in the upcoming lessons as we go through. We can figure it and this is, don't look at this section as our outline for the course either. That's posted with the course material. You know, we're going to be hitting other things too. You know, we got security, routing protocols, all sorts of stuff that I want to get us into.