Notes for IPv6

Terrance Lee

Transition Mechanisms for IPv6 Hosts and Routers

(RFC 2893)

Purpose and Approaches

• Interoperation of an IPv4/IPv6 node with another IPv4/IPv6 node or an IPv4-only node

• Dual Stacks• Configured Tunneling

Host-to-Router, Router-to-Router• Automatic Tunneling

IPv4-Compatible IPv6 Addr. (::v4addr)

Host-to-Host, Router-to-Host

Techniques Used in Transition

• Configured TunnelingIPv4 tunnel endpoint addr is determined by configuration information

• Automatic TunnelingIPv4 tunnel endpoint addr is determined from the IPv4-compatible destination addr

• IPv4 Multicast TunnelingIPv4 tunnel endpoint addr is determined using Neighbor Discovery

Check Packet Length for Tunneling (1/2)

If (IPv4 path MTU – 20) <= 1280

if packet length > 1280 bytes

send IPv6 ICMP “packet too long”

with MTU = 1280; Drop packet

else

Encapsulate; don’t set Don’t Fragment

flag in the IPv4 header

endif

Check Packet Length for Tunneling (2/2)

Elseif packet length > (IPv4 path MTU – 20) send IPv6 ICMP “packet too big” with MTU = (IPv4 path MTU – 20); Drop packetelse Encapsulate and set the Don’t Fragment flagendif

endif

IPv4 Header Construction (1/2)

• Version: 4• Header Length: 5• Type of Service: 0 (Might be changed)• Total Length: Payload length from IPv6 header

plus length of IPv6 and IPv4 headers• Identification: Generated uniquely• Flags: As specified before• Fragment Offset: Set as necessary

IPv4 Header Construction (2/2)

• Time to Live: Implementation specific

• Protocol: 41

• Header Checksum: Calculate the checksum

• Source Address: IPv4 address of encapsulating node

• Destination Address: IPv4 address of tunnel endpoint

Configured Tunneling

• The tunnel endpoint addr is determined from configuration information

• IPv6/IPv4 hosts that are connected to datalinks with no IPv6 routers MAY use a default configured tunnel to reach an IPv6 router.

Automatic Tunneling Operation

• Perform automatic tunneling if the destination IPv6 addr is IPv4-compatible with prefix 0:0:0:0:0:0/96

• The automatic tunneling module MUST NOT send to IPv4 broadcast or multicast destinations

Ingress Filtering

• Invalid IPv6 addresses after de-capsulationmulticast, broadcast, ::0.0.0.0, ::127.0.0.1

• IPv6 link-local address for an IPv4 virtual interface: FE80::/64 || Interface Identifier

• Link-local addresses are used by the routing protocols operating over the tunnels

• Interface Identifier = 0:0:0:0:v4addr• Need ingress filter for packet filtering

Transmission of IPv6 over IPv4 Domains without Explicit Tunnels

(6over4)

(RFC 2529)

Purpose and Approaches

• Specifies frame format of IPv6 packets and the method of forming IPv6 link-local addresses over IPv4 multicast domains

• Specifies contents of Source/Target Link-Layer Address option used in Router Solicitation, Router Advertisement, Neighbor Solicitation, Neighbor Advertisement, Redirect messgaes

• Uses IPv4 multicast as a “virtual Ethernet”

Motivation

• Allow isolated IPv6 hosts to become fully functional IPv6 hosts by using an IPv4 domain that supports IPv4 multicast as their virtual local link

• Does not require IPv4-compatible addr or configured tunnels

• Known as “6over4” or “virtual Ethernet”

Maximum Transmission Unit

• The default MTU for IPv6 packets on an IPv4 domain is 1480 octets.

• MTU may be varied by a Router Advertisement containing an MTU option or by manual configuration

• The IPv4 DF bit MUST NOT be set if the IPv6 MTU proves to be too larger for some intermediate IPv4 subnets

Frame Format

• Protocol type = 41 (IPv6 packets tunneled inside IPv4 frames) for outer IPv4 header

• If there are IPv4 options, then padding should be added to the IPv4 header such that the IPv6 header starts on a boundary that is a 32-bit offset from the end of the datalink header

• Recommended default TTL = 8

Link Local Address

• Prefix: FE80::/64

• Link Local Address: FE80::0:0:V4ADDR

• The “Universal/Local” bit is zero (i.e., the Interface Identifier is not globally unique)

Address Mapping – Unicast (1/2)

• RFC 2461 “Neighbor Discovery for IP Version 6” describes the procedure for mapping IPv6 addr into IPv4 virtual link-layer addr

Type Length Zeros IPv4 Address

Address Mapping – Unicast (2/2)

• Type:

1 for Source Link-Layer addr

2 for Target Link-Layer addr

• Length:

1 (in units of 8 octets)

• IPv4 Address:

The 32 bit IPv4 addr in network byte order

Address Mapping – Multicast (1/2)

• IPv4 multicast must be available

• An IPv6 multicast destination addr DST MUST be transmitted to the IPv4 multicast addr of Organization-Local Scope taken from the block 239.192.0.0/16

Address Mapping – Multicast (2/2)

• DST 14, DST 15:

Last two bytes of IPv6 multicast addr

• OLS:

Configured Organization-Local Scope addr

block. Should be 192.

239 OLS DST14 DST15

Transition Issues

• A site may choose to start its IPv6 transition by configuring one IPv6 router to support “6over4” on an interface connected to the site’s IPv4 domain, and another IPv6 format on an interface connected to the IPv6 Internet.

• During transition, routers may need to advertise at least two IPv6 prefixes, one for the native LAN (e.g., Ethernet) and one for “6over4”.

Connection of IPv6 Domains via IPv4 Clouds

(6to4)

(RFC 2893)

Purpose and Approaches

• Interoperation of IPv6 sites over the IPv4 network without explicit tunnel setup

• Communication of isolated IPv6 sites with native IPv6 domains via relay router

• Treats the wide area IPv4 network as a unicast point-to-point link layer

• The site needs a globally unique IPv4 addr• Can coexist with Firewall and NAT

Terminologies (1/2)

• 6to4 pseudo interface: 6to4 encapsulation point

• 6to4 prefix: 2002::/16 (The site addr prefix: 2002:V4ADDR::/48)

• 6to4 router: An IPv6 router supporting a 6to4 pseudo interface

• 6to4 site: A site running IPv6 internally using 6to4 addresses

Terminologies (2/2)

• Relay router: A 6to4 router configured to support transit routing between 6to4 addresses and native IPv6 addresses

• 6to4 exterior routing domain: a routing domain interconnecting a set of 6to4 routers and relay routers. It is distinct from an IPv6’s interior routing domain and all native IPv6 exterior routing domains

Sending Rule for 6to4 Router (1/2)

• If the final destination is a 6to4 addr, it will be considered as the next hop

• If the final destination is not a 6to4 addr and is not local, the next hop indicated by routing will be the 6to4 addr of a relay router

Sending Rule for 6to4 Router (2/2)

• If the next hop IPv6 addr for an IPv6 packetdoes match the prefix 2002::/16, anddoes not match any prefix of the local sitethen

apply any security checksencapsulate the packet in IPv4 with IPv4 dest addr = the NLA value V4ADDR extracted from the next hop IPv6 addrqueue the packet for IPv4 forwarding

De-capsulation Rule

• For an incoming IPv4 packet with protocol type 41, a 6to4 router performs:

Apply any security checks

Remove the IPv4 header

Submit the packet to local IPv6 routing

Stateless IP/ICMP Translation (SIIT)

(FRC 2765)

Purpose and Approaches

• Interoperation of an IPv6-only node with an IPv4-only node

• IPv6 node somehow acquires an IPv4 addr.

• The temporary IPv4 addr. is used as an IPv4-translated IPv6 addr.

• Stateless IP/ICMP translation

Applicability and Limitation

• IPv6 node sees an IPv4-mapped addr. for the peer

• IPv6 node uses an IPv4-translatable addr. for its local addr. for that communication

• Only ESP transport mode (IPsec) is relatively easy to make work through a translator

• Does not work for multicast packets

Addresses

• IPv4-mapped: 0::ffff:a.b.c.d (refers to an IPv4 node)

• IPv4-compatible: 0::0:a.b.c.d (refers to automatic tunneling)

• IPv4-translated: 0::ffff:0:a.b.c.d (refers to an IPv6-enabled node)

• 0::ffff:0:0:0/ 96 is chosen to checksum to zero to avoid any changes to the transport protocol’s pseudo header checksum

Translating from IPv4 to IPv6

IPv4 Header

Transport Layer Header

Data

IPv6 Header

Fragment Header

(Not always)

Transport Layer Header

Data

Translating IPv4 Headers to IPv6 Headers(1/5)

• Version: 6• Traffic Class: Always set to zero or, by

default, copied from Type of Service and Precedence field

• Flow Label: 0• Payload Length: Total length value from

IPv4 header, minus the size of the IPv4 header and IPv4 options, if present

Translating IPv4 Headers to IPv6 Headers(2/5)

• Next Header: protocol field copied from IPv4 header

• Hop Limit: TTL value copied from IPv4 header

• Source Address: low-order 32 bits: IPv4 source addrhigh-order 96 bits: ::ffff:0:0/96 (IPv4-

mapped prefix)

Translating IPv4 Headers to IPv6 Headers(3/5)

• Destination Address:

low-order 32 bits: IPv4 destination addr

high-order 96 bits: 0::ffff:0:0:0/96 (IPv4-translated prefix)

• IPv4 options are ignored (not translated)

• Error if an un-expired source route option is present

Translating IPv4 Headers to IPv6 Headers(4/5)

• If a fragment header is needed (DF bit is not set or the packet is a fragment)

• IPv6 Fields

Payload Length:

Total length value from IPv4 header + 8 (fragment header) – IPv4 header length

Next Header: Fragment Header (44)

Translating IPv4 Headers to IPv6 Headers(5/5)

• Fragment Header Fields– Next Header: Protocol field copied from IPv4 header

– Fragment Offset: Fragment Offset copied from IPv4 header

– M Flag: More Fragment bit copied from IPv4 header

– Identification:

Low-order 16 bits: copied from the ID field in the IPv4 header

High-order 16 bits: set to zero

Translating UDP over IPv4

• Un-fragmented UDP IPv4 packets

Calculate the checksum if the checksum field is zero

• Fragmented UDP IPv4 packets

First fragment: Drop the packet, generate a system management event

Other fragments: Drop the packet

When to Translate

• Assume the translator knows the pool of IPv4 addresses that are used to represent internal IPv6-only nodes

• CPU translates ICMPv4 to ICMPv6

Translating from IPv6 to IPv4

IPv4 Header

Transport Layer Header

Data

IPv6 Header

Fragment Header

(if present)

Transport Layer Header

Data

Translating IPv6 Headers into IPv4 Headers(1/6)

• Version: 4

• Internet Header Length: 5 (no IPv4 options)

• Type of Service and Precedence: By default, copied from the Traffic Class (all 8 bits) or always set to zero

• Total Length: Payload Length value from IPv6 header + size of the IPv4 header

Translating IPv6 Headers to IPv4 Headers(2/6)

• Identification: All zero• Flags:

More Fragment = 0Don’t Fragment = 1

• Fragment Offset: All zero• Time to Live: Hop Limit value copied from

IPv6 header (Decrement TTL and check if zero after translation)

Translating IPv6 Headers into IPv4 Headers(3/6)

• Protocol: Next Header field copied from IPv6 header• Header Checksum: Computed once the IPv4 header i

s created• Source Address:

If the IPv6 source addr is an IPv4-translated addrUse the low-order 32 bits for IPv4 addr

elseSet to 0.0.0.0 (to avoid completely dropping)

Translating IPv6 Headers to IPv4 Headers(4/6)

• Destination Address: Low-order 32 bits of the IPv6 destination address

• IPv6 hop-by-hop options header, destination options header, or routing header (with Segments Left field equal to zero) are ignored with Total Length adjusted

• Routing header with a non-zero Segments Left field: Error

Translating IPv6 Headers to IPv4 Headers(5/6)

• IPv6 packets with Fragment header

Total Length: Payload length value from IPv6 header – 8 (Fragment header) + size of IPv4 header

• Identification: Copy from the low-order 16 bits of the ID field in the Fragment header

Translating IPv6 Headers to IPv4 Headers(6/6)

• Flags:

More Flag = M flag in the Fragment header

Don’t Fragment Flag = 0

• Fragment Offset: Copied from the Fragment Offset field in the Fragment header

• Protocol: Next Header field copied from Fragment header

When to Translate

• Receives an IPv6 packet with an IPv4-mapped destination address

Network Address Translation – Protocol Translation

(NAT-PT)

(RFC 2766)

Purpose and Approaches

• Interoperation of an IPv6-only node with an IPv4-only node

• Does not mandate dual stacks or tunneling

• Uses a pool of globally unique v4 addresses for assignment to v6 nodes on a dynamic basis

• Combines SIIT and NAT

Terminologies (1/2)

• NAT: translation of an IPv4 addr into an IPv6 addr and vice versa

• Traditional NAT-PT: allows hosts within a v6 network to access hosts in the v4 network. Sessions are unidirectional, outbound from the v6 network. (Two variations: Basic NAT-PT and NAPT-PT)

Terminologies (2/2)

• Bi-Directional NAT-PT: Sessions can be initiated from hosts in either v4 or v6 network.

• Protocol Translation (PT): Detailed in SIIT• Application Level Gateway (ALG): An

application specific agent that allows a v6 node to communicate with a v4 node and vice versa. Some applications carry network addresses in payloads. NAT-PT is application unaware.

Basic Traditional NAT-PT (1/2)

• Assume IPv6 Node A (FEDC:BA98::7654:3210) wants to communicate with IPv4 Node C (132.146.243.30)

• Node A creates a packet withSrc Addr: FEDC:BA98::7654:3210Dst Addr: PREFIX::132.146.243.30(PREFIX::/96 is advertised in the stub domain by the NAT-PT and packets addressed to this PREFIX is routed to the NAT-PT)

Basic Traditional NAT-PT (2/2)

• For session initiation packet, an address (e.g., 120.130.26.10) is allocated by the NAT-PT

• The packet is silently discarded if it is not a session initiation packet and there is no established state for the session

NAPT-PT Operation (1/4)

• Allow multiple v6 nodes to communicate with v4 nodes using a single v4 address

• Example

IPv6 Node A creates a packet with

Src Addr: FEDC:BA98::7654:3210

Src TCP Port: 3017

Dst Addr: PREFIX::132.146.243.30

Dst TCP Port: 23

NAPT-PT Operation (2/4)

• At NAPT-PT box, translated intoSA = 120.130.26.10, Src TCP Port = 1025DA = 132.146.243.30, Dst TCP Port = 23

• Inbound NAPT-PT sessions are restricted to one server per service assigned via static TCP/UDP port mapping.

• Example: IPv6 Node A may be the only HTTP server (port 80) in the v6 domain

NAPT-PT Operation (3/4)

• IPv4 Node C sends a packetSA = 132.146.243.30, Src TCP Port = 1025DA = 120.130.26.10, Dst TCP Port = 80

• At NAPT-PT box, translated intoSA = PREFIX::132.146.243.30, Src TCP Port = 1025DA = FEDC:BA98::7654:3210, Dst TCP Port = 80

NAPT-PT Operation (4/4)

• DNS queries and responses are processed by CPU

• Some static binding for v4 and v6 addresses

Translating IPv4 Headers to IPv6 Headers

• Same as in SIIT apart fromSA :

The low-order 32 bits = IPv4 SA.The high-order 96 bits = PREFIX

DA:NAT-PT retains a mapping between th

e IPv4 destination addr and the IPv6 addr of the destination node

Translating IPv6 Headers to IPv4 Headers

• Same as in SIIT apart fromSA:

The NAT-PT retains a mapping between the IPv6 SA and an IPv4 address from the pool of IPv4 addressesDA:

The low-order 32 bits of the IPv6 DA is copied to the IPv4 DA

TCP/UDP/ICMP Checksum Update from IPv4 to IPv6 (1/2)

• UDP checksums, when set to a non-zero value, and TCP checksum should be recalculated to reflect the addr change from v4 to v6 (Incremental adjustment is possible)

• In NAPT-PT, TCP/UDP checksum should be adjusted

• When the checksum of a v4 packet is set to zero, NAT-PT must evaluate the checksum in its entirety for the v6-translated packet

TCP/UDP/ICMP Checksum Update from IPv4 to IPv6 (2/2)

• Reassemble fragmented UDP packets with zero checksum before evaluate the checksum for the v6-translated packet

• ICMPv6 uses pseudo-header in checksum evaluation

• There might be source and destination address translations in payload of ICMP packets

TCP/UDP/ICMP Checksum Update from IPv6 to IPv4

• TCP/UDP checksum should be recalculated to reflect the address change from v6 to v4 (Incremental adjustment is possible)

• For UDP packets, the checksum may optionally be changed to zero

• Remove the v6 pseudo header in checksum calculation of v4 ICMP header (Checksum adjustment algorithm is possible)