31–40 of 64 posts
What is special with this book? It is standard Cisco press book.
No one is talking about it, the rest of the comments are unrelated war stories about IPv6 deployment with have nothing to do with TFA.
Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not without NAT. Why? - Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. I’m not making this up- retail/gas/food industries oft…
The only "problem" here that is caused by IPv6 is the SD-WAN / multi-provider scenario. Even that is solvable. There are so many IPv6 addresses that your local router can have a unique routable range that it can hand out to the local network, "masking" the external internet provider addresses in the same way that IPv4 routing does it. That's not NAT, that's just routing. E.g. I have a customer that uses a non-RFC1918…
Neither does anyone using IPv4.
Does your customer use BGP for that public IPv6 range? Do they have cellular links? Can they load balance some traffic over two/three links? Can they direct certain protocols over different carriers?
Earlier quoted context omitted.
You have a static ip4 but not a static ip6? Or does bittrex not allow whitelisting an ip6?
Static IPv6 are rare by default because computers for end users should use IPv6 privacy extensions. In Ubuntu 16.04 LTS timeframe privacy extension was still broken a bit, so it did not work on every network adapter. Nowadays it just works, unless a crazy network gives you only /128. I have no idea about Windows and MacOS.
Whitelisting the /64 is then equivalent to whitelisting a single IPv4 address with a NATted network behind it, although since ISPs may use different IPv6 prefix lengths it might not be easy for users to know what they should use.
("ip ad" etc show the current address with prefix.)
Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not without NAT. Why? - Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. I’m not making this up- retail/gas/food industries oft…
I my experience, they all did. I'm not even sure how you could possibly deploy IPv6 without it, manually handing out prefixes?
> you could have 2-3-4 levels of routers/firewalls at a business.
It seems just a bad design, but I still don't see how IPv6 would not allow it.
> Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses
1. you don't need a static prefix to write a firewall rule: you can simply remove the dynamic prefix with a mask and match the EUI-64 suffix. For example with ip6tables it's something like this `::e2ab:8fff:fe12:3b6b/-64`.
2. All IPv6 devices do support SLAAC with a stable address mechanism, either EUI-64 or stable privacy address and you can use that in the firewall rule.
3. IPv6 privacy extensions, when enabled, don't preclude listening and accepting connection on the EUI-64 address. So, an inbound traffic firewall rule will just use the stable address: you shouldn't listen on a privacy address, they are for outbound connections.
> Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point? IPv6 shifts this decision to the client.
I honestly don't understand the difference with IPv4. You can have multiple addresses and do load balancing on the router with both.
> IPv6 shifts this decision to the client. This makes load balancing and policy based traffic routing
I can't comment on this because I never tried it, either on IPv4 or IPv6. On top of my head, I'd say it would be possible by updating the routes priorities with an RA, if you don't want or can't do a NAT66 with a ULA prefix.
> At the cost of not having dedicated unique public IPs but these places simply don’t need them.
Wrong! Everyone needs routable addresses, even if they don't know it because they need VoIP, video calls on webRTC, FTP, p2p file sharing, online games, etc. All of these barely manage to work in a NAT by using workarounds like ALGs, UpnP, NAT-PMP, relay servers and other atrocities that greatly complicate the network design and are a security nightmare.
Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not without NAT. Why? - Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. I’m not making this up- retail/gas/food industries oft…
> Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business.
You cannot do this with IPv4 either. Routing has to work. It works for both IPv4 and In But if you are saying, you add 2-3-4 layers of NAT, this is just crazy.
> Can’t just simply open a firewall rule on the main site router to forward say HTTPS to an internal service. Why? Not all ISPs give static IPv6 prefixes, not all PCs/servers/devices support DHCP6 for static leases, and then there’s IPv6 privacy addresses.
ISPs not providing static prefixes is a particular ISP problem, not an IPv6 problem. If your ISP cannot hand out static IPv4, you have a similar problem and tge workaround would be what? Dynamic DNS? Admittedly we had /32 and own ASN, but in remote offices where you don’t buy transit, you live on PA addresses (and of course they are static). From what I know, some ISPs don’t issue static prefixes to residential customers, but if you want to serve services from your prefix, use a stable prefix and a decent ISP.
Privacy addresses are intended for client-initiated traffic, so no matter how many privacy addresses your server has, the stable one is still there.
> WAN failover / multiple ISPs is hard. You have a fibre primary feed, and a secondary cellular/5G feed. Each has different IPv6 addresses. How do you ensure the right ISP is used at any given point?
By sending RA and expiring the old prefix on the failover. I admit, this is not an obvious solution and it may not be suitable for some edge cases.
Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not without NAT. Why? - Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. I’m not making this up- retail/gas/food industries oft…
The only "problem" here that is caused by IPv6 is the SD-WAN / multi-provider scenario. Even that is solvable. There are so many IPv6 addresses that your local router can have a unique routable range that it can hand out to the local network, "masking" the external internet provider addresses in the same way that IPv4 routing does it. That's not NAT, that's just routing. E.g. I have a customer that uses a non-RFC1918…
> Literally counterproductive in the case of Azure, where turning on IPv6 anywhere will break unrelated IPv4 functionality!
not just on azure; smartphones seem to be the only environment were v6 is doing its job (lots of smartphones need lots of addresses. ipv6 has a lot of addresses, problem solved) and i guess it's because they are most user-centric client-device imaginable, the actual users don't care at all and most importantly; expect things to occasionally fail.
Taken from a previous comment I’ve made re IPv6: IPv6 is fundamentally not ready for real world use within small/medium businesses and homes IMO. At least not without NAT. Why? - Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. I’m not making this up- retail/gas/food industries oft…
Before I start I must say, I built IPv6 only datacenters and enterprise networks. I am saying from experience. > Can’t just simply put one IPv6 router/firewall behind another. Not all IPv6 routers support DHCP-PD, and even if they did, you could have 2-3-4 levels of routers/firewalls at a business. You cannot do this with IPv4 either. Routing has to work. It works for both IPv4 and In But if you are saying, you add 2…
Is it? I'm behind two layers of nat and everything works fine.
Earlier quoted context omitted.
I’ve often wondered if ipv6s less human readable addresses is the primary cause. I dread using and interacting with ipv6, compared to ipv4. Sure ipv6 solves a lot of scaling challenges, but it is so much harder to grock at first glance.
It's a silly bikeshed, but I wish they'd gone for hyphens as separators rather than colons. There's something about [abcd-ef12-3456-7890-abcd-ef12-3456-7890] that's nicer to read than [abcd:ef12:3456:7890:abcd:ef12:3456:7890]
anecdote: a few years ago there was a quiz at one of the ripe-conferences where participants were asked to pick the one invalid ipv6 address out of four. iirc the success rate was even below what would result from a random-pick
Earlier quoted context omitted.
I’ve often wondered if ipv6s less human readable addresses is the primary cause. I dread using and interacting with ipv6, compared to ipv4. Sure ipv6 solves a lot of scaling challenges, but it is so much harder to grock at first glance.
For all of it's faults Port Address Translation (NAT) sure has a way of making the address size more manageable.
successfull technology indeed.