IPv6 IMPLEMENTATION IN VNPT - VNIX-NOGtẬp ĐoÀn bƯu chÍnh viỄn thÔng viỆt nam vietnam posts and telecommunications group ipv6 implementation in vnpt 1 vŨ xuÂn nhÀn 11/2016

TẬP ĐOÀN BƯU CHÍNH VIỄN THÔNG VIỆT NAMVIETNAM POSTS AND TELECOMMUNICATIONS GROUP

IPv6 IMPLEMENTATION IN VNPT

1

VŨ XUÂN NHÀN 11/2016NOC – VNPT Net


Contents

• 6PE/6VPE model

• IPv6 implementation in VNPT• Service models

• IPv6 allocation

• IPv6 CPE

• IPv6 security threats

• Problems

11/29/2016 VNNIC NOG 2


6PE/6VPE model

• Transporting IPv6 traffic in IPv4 based MPLS network

• No change in core MPLS network, only in PE/ASBR

• Enable inet6 label-unicast, inet6-vpn, inet6-mvpn, ipv6-tunneling…

11/29/2016 VNNIC NOG 3


6PE/6VPE model

11/29/2016 VNNIC NOG 4

ASBR-IXP

(6PE)

VN2

ASBR-NIX

(6PE)

eBGPDualStack DOMESTIC

PEERINGS

APPsServer

WebServer

BRAS

MANE

DSLAM/SWITC

H

PE/BNG (6PE)

CPEeB

GP

DualStack

APPsServer

WebServer

UPSTREAMS/PEERINGS

RR Inet & VPN

iBGP

Server IPv6

Server IPv6

RR IPv6

PE/BNG (6PE)

MANE

CPE

VPN


Contents

• 6PE/6VPE model


• IPv6 allocation

• IPv6 CPE


• Problems

11/29/2016 VNNIC NOG 5


IPv6 implementation in VNPT

• Target• Dual-stack: 2016-2019

• Pure IPv6: from 2020

• Services• ILL (Internet Leased Line), IPv6 transit

• IPv6 L3VPN

• HSI (High Speed Internet)

• 4G/LTE (dual-stack)

• Hosting/Email server…

11/29/2016 VNNIC NOG 6


Service models: ILL, IPv6 transit

11/29/2016 VNNIC NOG 7

ASBR-IXP

(6PE)

VN2

ASBR-NIX

(6PE)

eBGPDualStack

DOMESTIC

APPsServer Web

Server

MANE

PE (6PE)

CPE

eBGP

DualStack

APPsServer

UPSTREAMS/PEERINGS

Server IPv6

Server IPv6

RR IPv6

PE (6PE)

CPE

CE

DSLAM/SWITCH


Service models: IPv6 L3VPN

11/29/2016 VNNIC NOG 8

VN2MANE

PE (6PE)

CPE

RR IPv6 VPN

PE (6VPE)

CPE

CE

DSLAM/SWITCH

PE (6VPE)

PE (6VPE)

VPN

VPN

VPN


Service models: HSI

11/29/2016 VNNIC NOG 9

ASBR-IXP

(6PE)

VN2

ASBR-NIX

(6PE)

eBGPDualStack

DOMESTIC

APPsServer

WebServer

BRAS

MANE

DSLAM/SWITCH

PE/BNG (6PE)

CPEeB

GP

DualStack

APPsServer

WebServer

UPSTREAMS/PEERINGS

RR Inet & VPN

iBGP

Server IPv6

Server IPv6

RR IPv6

PE (6PE)

Radius

MANE

DSLAM/SWITCH

CPE


IPv6 Allocation

• Total: /32

• Loopback: /128

• Connected IP: point-to-point /126 or /127. /64 for each router

• Broadband subscribers:• N*/40 for each province

• N*/64 for each subscriber

• /40-/45 aggregated before being advertised

11/29/2016 VNNIC NOG 10


IPv6 Allocation

• Unique Local Address (fc00::/7) or Global unicast IPv6 for Internal IP addresses?

11/29/2016 VNNIC NOG 11


IPv6 Allocation schemes for broadband subscribers• 01*/64 for each subscriber?

• 01*/64 WAN and N*/64 LAN for each subscriber?

• DHCPv6 IA_NA, NDRA and DHCPv6 PD

11/29/2016 VNNIC NOG 12


IPv6 Allocation schemes for broadband subscribers: Radius attributes

11/29/2016 VNNIC NOG 13


IPv6 Addressing: DHCPv6 IA_NA and DHCPv6 PD

11/29/2016 VNNIC NOG 14


IPv6 Addressing: NDRA and DHCPv6 prefix Delegation

11/29/2016 VNNIC NOG 15


IPv6 Addressing: NDRA

11/29/2016 VNNIC NOG 16


IPv6 Addressing: DHCPv6 prefix Delegation

11/29/2016 VNNIC NOG 17


IPv6 Allocation schemes for broadband subscribers• VNPT uses:

• DHCPv6 PD

• NDRA and DHCPv6 PD

• Other ISPs

11/29/2016 VNNIC NOG 18


IPv6 for L3VPN

• Unique Local Address (fc00::/7)?• Cannot be routed in internet

• NAT may needed!

• More secured

• Global unicast?• Address overlapping

• Multihoming

11/29/2016 VNNIC NOG 19


IPv6 supported CPE

• GPON Huawei, ZTE

• GPON VNPT Technology

• AON?

• EMS: Remotely IPv6 enable?

11/29/2016 VNNIC NOG 20


Contents

• 6PE/6VPE model


• IPv6 allocation

• IPv6 CPE


• Problems

11/29/2016 VNNIC NOG 21


IPv6 security threats

• Reconnaissance in IPv6

• Neighbor Discovery Issues

• L3 Spoofing in IPv6

• DHCPv6 Threats

11/29/2016 VNNIC NOG 22


Reconnaissance in IPv6

• Attackers use site-local multicast addresses (FF05::2 all-routers, FF05::FB mDNSv6, FF05::1:3 all DHCP servers) or link-local multicast addresses (FF02::1 all nodes, FF02::2 all routers)

• Reconnaissance preventing• Block FEC0::/10 (deprecated site-local addresses)

• Permit mcast to FF02::/16 (link-local scope)

• Permit mcast to FF0E::/16 (global scope)

• Block all mcast

11/29/2016 VNNIC NOG 23


Neighbor Discovery Issues

• Fake IPv6 router sends out RA packets. New client may receives fake RAs then connects to the fake IPv6 router.

• Attacker sends fakes Neighbor advertisements. Clients send all packets to the attacker.

• Attacker listens for ICMPv6 DAD packets and sends a response that this IPv6 address already exists.

11/29/2016 VNNIC NOG 24


Neighbor Discovery Issues: Mitigation

• Block ICMPv6 RA from hosts

• Secure Neighbor Discovery (for ND and DAD issues)

11/29/2016 VNNIC NOG 25


L3 Spoofing in IPv6

• Tool for Protecting Against L3 Spoofing: uRPF

11/29/2016 VNNIC NOG 26


DHCPv6 Threats

• Rogue DHCPv6 client and servers on the link-local multicast address (FF02::1:2)

• Rogue DHCPv6 servers on the site-local multicast address (FF05::1:3)

• Mitigation:• DHCPv6 authentication

• ACL to block DHCPv6 traffic (UDP 546, 547)

11/29/2016 VNNIC NOG 27


IPv6 security threats: Protect ISP’s network• Well tested IPv6 filter for router’s loopback

• Well tested IPv6 filter for customer facing interfaces

• IPv6 DDoS and DDoS Mitigation

11/29/2016 VNNIC NOG 28


Protect ISP’s network: protect RE

• Permit inet6 BGP peers

• Police DHCP, icmp, UDP traceroute, TCP established

• Discard others

11/29/2016 VNNIC NOG 29


Protect ISP’s network: protect ISP

• Permit inet6 BGP peers

• Police icmp, UDP traceroute

• Discard connections to Internal IP adds

• Permit others

11/29/2016 VNNIC NOG 30


Contents

• 6PE/6VPE model


• IPv6 allocation

• IPv6 CPE


• Problems

11/29/2016 VNNIC NOG 31


Problems

• Radius, VISA, LDAP

• Billing

• DNS

• IPv6 security

• IPv6 contents

11/29/2016 VNNIC NOG 32


11/29/2016 VNNIC NOG 33

Discussion

Documents

IPv6 IMPLEMENTATION IN VNPT - VNIX-NOGtẬp ĐoÀn bƯu chÍnh viỄn thÔng viỆt nam vietnam posts and telecommunications group ipv6 implementation in vnpt 1 vŨ xuÂn nhÀn 11/2016