IPv6 Solutions on Juniper Networks

Performance without compromise

www.juniper.net Apr-03 Page 1

Copyright © 2003 Juniper Networks, Inc. http://www.juniper.net

IPv6 solution on Juniper Networks IPv6 solution on Juniper Networks MM--series and Tseries and T--seriesseries

Internet routers Internet routers

Ahmed [email protected]

April 2003

IPv6 Implementation

IPv6 examples and Case Studies

Agenda



http://www.juniper.net Copyright © 2003 Juniper Networks, Inc. 3

IPv6 Qualified RouterWhat means really Dual Stack?

Addressing & ForwardingRouting Protocols Service RichnessOperational Efficiency

IPv4

IPv6


PE 1PE 1

IPv6 Addressing

Dual IP addressing on the same interfaceNeighbor discoveryICMPv6

interfaces {ge-0/1/0 {unit 0 {family inet {address 157.168.0.5/24;}family inet6 {address 8028:20::1/64;}

}}}

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP

CECE––B3B3CECE––C1C1




Autogeneration of EUI 64-bitInterface Addresses for IPv6

Stateless auto-configuration Node starts by appending its interface ID (EUI-64) to the link-local network prefix, fe80::/64

Sends router solicitation

Receives prefix from router advertisement

BenefitsSimplifies host configuration

Broadens client coverageRouter Solicitation via ND

Router Advertisement via ND

Host IP information configured

dynamically


IPv6 Qualified Router for ISPsWhat means really Dual Stack?


IPv4

IPv6




Routing Protocols

Static routingMay be used with customer sites

IGPIPv6 unicast can be routed by RIPng, OSPFv3, or ISISCurrent ISIS backbone don’t need IGP upgradeCurrent OSPF backbone need to:

Migrate to IS-ISOr add/deploy OSPFv3

BGP-MPJust add the IPv6 routing in existing M-BGP set-upCan use same designCan be set-up over v4 or v6

Just add v6 routing over BGP/v4 sessions (next-hop!)Use BGP over v6 in case of IPv6 deployment in IPv4 tunnels

Separating BGP sessions for v4 and v6 may also have some advantagesMonitoring, flexibility…


PE 1PE 1

Static Routingexample

routing-options {rib inet6.0 {

static {route 8028:10::1/128

next-hop 8028:25::2;}

}}

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP





PE 1PE 1

RIPng Routingexample

protocols {ripng {

group igp {neighbor ge-0/1/0.0;

}}

}

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP



Area 3

OSPFv3

Major changes to accommodate: Address size General protocol semantics

Addressing semantics removed from OSPF packets and LSAs

New LSAs for IPv6 addresses & prefixesOSPF runs on per-link, not per-subnetFlooding scope for LSAs generalizedAuthentication removed

BenefitsOther functions remain the same (e.g. SPF calculation, area support, etc.)Familiarity - widely deployed IGP

Area 2AS1

Area 1

AS2




PE 1PE 1

OSPFv3example

interfaces {so-0/0/0 {unit 0 {family inet {address 10.19.6.2/24;}family inet6 {address 9009:6::2/64;}

}}

lo0 {unit 0 {family inet {address 10.245.71.6/32;

}family inet6 {address feee::10:255:71:6/128;

}}}}

protocols {ospf3 {area 0.0.0.2 {interface so-0/0/0.0;interface lo0.0 {passive;}

}}}

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


so-0/0/0.0


PE 1PE 1

External M-BGPexample

interfaces {ge-0/1/0 {unit 0 {family inet {address 11.19.1.2/24;}family inet6 {address ::11.19.1.2/126;}

}}}

routing-options {autonomous-system 100;}

protocols {bgp {group ebgp_both {type external;local-address 11.19.1.2;family inet {unicast;}family inet6 {unicast;}peer-as 1;neighbor 11.19.1.1;

}}}

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


ge-0/1/0




E-BGP Peering over IPv6Link Local Addresses

E-BGP Peering over IPv6 LLA

BGP4+ Peering Using IPv6 Link-local Address

draft-kato-bgp-ipv6-link-local-00.txt

Allows use of link-local address for direct peering connections instead of using global addresses

How it works

Link local addresses can be auto-generated or manually configured

Benefits

Simpler administration

Flexibility

NSPIXP6 uses link local address

AS1

AS2

E-BGP


Multicast Routing

Performance and scaling for IPv6 multicast clearly important

PIMv2 to support for IPv4 and IPv6

Multicast Listener Discovery (MLD) protocol to discover the presence of multicast listeners

Derived from IGMPv2Uses ICMPv6 message type instead of IGMP message typesMPDv2 is required for PIM-SSM





Addressing & ForwardingRouting ProtocolsService RichnessOperational Efficiency

IPv4

IPv6


IP Services

Routers must be able to perform intelligent IPv6 packet handling

Filtering – Selective forwarding and discarding Monitoring - Sampling, counting, logging, etc.QoS - Policing, shaping, queuing, profiling, etc.Forwarding – Directing packets based on any header information

All classification and packet handling must be done in hardware to truly minimize performance impact

IP services and performance must not be mutually exclusive




IP2 ServicesFiltering & Policing

0 %

20 %

40 %

60 %

80 %

100 %

120 %

Increasing Number of Packet FiltersIncreasing Number of Packet Filters

Packet ForwardingPacket Forwarding

Internet Processor II ASICCPU-based router

Packet filteringDoS attack prevention

Comprehensive security

E.g. Source Address Filters

PolicingInterface-level rate limiting

E.g. Bandwidth - limits bps

E.g. Maximum burst size

Predictable performance with rich IPv6 services


IP-II enables significant functionality with applications to network management

SecurityMonitoringAccounting

IP-IIIP-II

Multiple rules may be specified.Multiple rules may be specified.

Filter SpecificationFilter Specificationfilter Limit-Customer-A {

policer Lim {if-exceeding {

bandwidth-limit 1m;burst-size-limit 100k;

}then discard;

}term 1 {

from {source-address {

3ffe:1002:6411::/48;}

}then {

policer Lim;accept;

}}

}

All IPv6 Packets Handled By RouterAll IPv6 Packets Handled By RouterMicrocodeMicrocode

Filters and route lookup are part of Filters and route lookup are part of same programsame program

PacketHandlingPrograms

Log,syslogCount,Policer,

Loss-priority,Forwarding-class

CompileCompile

IPv6 Filtering

••IPv6 source address field IPv6 source address field ••IPv6 destination address field IPv6 destination address field ••TCP/UDP source port field TCP/UDP source port field ••TCP/UDP destination port fieldTCP/UDP destination port field••Next header field Next header field ••Traffic class fieldTraffic class field••Packet lengthPacket length••ICMP packet type and codeICMP packet type and code••SourceSource--classclass••DestinationDestination--classclass

SilentSilentDiscardDiscard

ForwardForward

TCP ResetTCP ResetOr ICMPOr ICMP

UnreachableUnreachable

RoutingRoutingInstanceInstance

Next TermNext Term




PE 1PE 1

Flexible bandwidth

firewall {family inet6 {filter LimitCE-A2{policer LimCE-A2 {if-exceeding {bandwidth-limit 1m;burst-size-limit 100k;}then discard;}term 1 {from {source-address {3ffe:1411:2205::/48;

}}then {policer LimCE-A2;accept;}}

}}}

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


3ffe:1411:2205::5


Security

Security on routers is more important than everfor customer and infrastructure protection

On-going DoS work in IPv4 to be extended to IPv6

Hardware-based packet handling, filtering optimize key security actions

SNMPv3 improves router authentication




Source Address Verification

uRPF can be configured per-interface/sub-interfaceSupports both IPv4 and IPv6Packet/Byte counters for traffic failing the uRPF checkAdditional filtering available for traffic failing check:

police/rejectCan syslog the rejected traffic for later analysis

Two modes available:Active-paths:

uRPF only considers the best path toward a particular destination

Feasible-paths:uRPF considers all the feasible paths. This is used where routing is asymmetrical.


PE 1PE 1

Source Address Verification

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


3ffe:1541:2305::/48

so-0/0/0.0

ge-0/1/0

3ffe:1411:2205::5

Attack with

Source address

= 3ffe:1411:2205::5

uRPF

3ffe:1411:2205::/48*[BGP/170]

>via so-0/0/0/0.0




PE 1PE 1

Real-time DoS Identificationwith Destination Class Usage

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


3ffe:1541:2305::/48

so-0/0/0.0

ge-0/1/0

policy-options {community victim members 100:100;policy-statement set-dest-classterm 1 {from {protocol bgp;community victim;}then {destination-class dcu-victim;accept;}

}}}

interfaces {so-2/0/1 {unit 0 {family inet6 {address feee::10:255:73:2/128;accounting {destination-class-usage;}}

}}}

routing-options{forwarding-table{export set-dest-class;}}


PE 1PE 1

Real-time DDoS Identification

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


3ffe:1541:2305::/48

so-0/0/0.0

ge-0/1/0




PE 1PE 1

Real-time DDoS Identification

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


3ffe:1541:2305::12

so-0/0/0.0

ge-0/1/0

BGP updateBGP update3ffe:1541:2305::12/1283ffe:1541:2305::12/128Community 100:100Community 100:100


QoS

IPv6 header includes traffic class and flow labelTraffic class function = DSCPLargely undefined flow label identifies a traffic flow that needing special handling, I.e. voice, video, etc.

IPv6 routers must be able to use traffic class and flow label without incurring performance cost




VPNs

VPNs are a valuable serviceProvider managed IPv4 VPN models have been successfulEstablished VPN technologies used for IPv4 must be carried over to IPv6Services offered as part of a VPN, I.e. QoS, will still be required for IPv6VPN management must be able to support IPv4 and IPv6 traffic


L3 VPN over MPLS

PP

PP

PP PE 2 PE 2

VPN AVPN ASite 3, IPv6Site 3, IPv6

VPN AVPN ASite 1, IPv6Site 1, IPv6

VPN BVPN BSite2, IPv4Site2, IPv4

VPN BVPN BSite 1, IPv4Site 1, IPv4

PE 1PE 1

PE 3PE 3

VPN AVPN ASite2, IPv6 Site2, IPv6

CECE––A1A1

CECE––B1B1

CECE––A3A3

CECE––A2A2

CECE––B2B2

PP

VPN BVPN BSite3, IPv4Site3, IPv4

CECE––B3B3CECE––C1C1VPN CVPN C

Site 1, IPv4Site 1, IPv4 VPN CVPN CSite 2, IPv4Site 2, IPv4

CECE––C2C2

Static Static RoutesRoutes

OSPF OSPF RoutingRouting

EE--BGPBGP






IPv4

IPv6


Network Management

IPv6 Management must be integrated in existing management systemsSNMP over v6 with IPv6 MIBsIntuitive CLIIPv6 AccountingAPIs (e.g. XML) for OSS integration

Reduce latency between new vendor feature/service and OSS integrationOperational efficiency hinges on OSS integration

Router operations over IPv6telnet, ssh, ftp, ping, traceroute…




Robustness and Reliability

Common support of features, services on every interface across all platformsSame approach for hardware-based packet handling as IPv4

Performance is criticalMaintaining SLA agreement for IPv4 while operating IPv6

Separation of routing and control planesGraceful restart mechanisms

BGP, OSPF, IS-IS, RSVP, LDP…

Linear software releases continuity to ensure common support and evolution


Integration of non IPv6 capable routers

IPv6 in IPv4 tunnels GRE or IP-IP TunnelsOnly possible:

with performance (hardware tunneling)at small scale for manageability

Connecting IPv6 Islands with IPv4 MPLSRequires MPLS capable routers in the core




PE 1PE 1

IPv6 in IPv4 tunnels

PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


RRv4v4 RRv4v4

RRv4v4 RRv4v4

interfaces {so-0/0/0 {unit 0 {family inet {address 100.255.3.2/24;}

}}gr-1/0/0 {unit 0 {tunnel {source 100.255.3.2;destination 100.255.2.1;}family inet6 {address 9009:6::2/64;}

}}}

so-0/0/0.0100.255.3.2100.255.2.1


Connecting IPv6 Islands with IPv4 MPLS (1)

IPv6

MPLSIPv6 IPv4

IPv6IPv6PE1

PE2

IETF Draft as defined in draft-ietf-ngtrans-bgp-tunnel-04.txt

Connecting IPv6 Islands across IPv4 Clouds with BGPAlso known as “6PE”

PEs run Dual Stack MP-BGP over IPv4PE and CE exchanges IPv6 routesMPLS LDP/RSVP LSPs are set up using IPv4

BenefitsLeverages existing MPLS infrastructureRequires IPv6 support only on PE router




PE 1PE 1


PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


RRv4v4 RRv4v4

RRv4v4 RRv4v4

interfaces {so-0/0/0 {unit 0 {family inet {address 100.255.3.2/24;}family inet6;family mpls;

}}ge-0/1/0unit 0 {family inet6 {address 8002::1/126;}

}}lo0 {unit 0 {family inet {address 10.245.71.6/32;}family mpls;

}}}routing-options {autonomous-system 100;}

so-0/0/0.0100.255.3.2100.255.2.1

ge-0/1/0


PE 1PE 1


PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


RRv4v4 RRv4v4

RRv4v4 RRv4v4

protocols {rsvp {interface so-0/0/0.0;}mpls {ipv6-tunneling;label-switched-path to_PE1 {to 10.245.72.6;

}interface so-0/0/0.0;}bgp {group to_PE1 {type internal;local-address 10.245.71.6;family inet6 {labeled-unicast {explicit-null;}}export red-export;neighbor 10.245.72.6;

}}ospf {traffic-engineering;area 0.0.0.0 {interface so-0/0/0.0;interface lo0.0 {passive;}

}}

so-0/0/0.0100.255.3.2100.255.2.1

ge-0/1/0




PE 1PE 1


PP

PP

PP

PE 2 PE 2

PE 3PE 3

CECE––A1A1

CECE––A2A2

PP


RRv4v4 RRv4v4

RRv4v4 RRv4v4

# protocols (next)

ripng {group to_CE-B3 {export red-import;neighbor ge-0/1/0.0;

}}}

policy-options {policy-statement red-export {term 1 {from protocol ripng;then accept;

}term 2 {then reject;

}}policy-statement red-import {from protocol bgp;then accept;}}

so-0/0/0.0100.255.3.2100.255.2.1

ge-0/1/0.0

IPv6 Implementation

IPv6 examples and Case Studies

Agenda




Juniper Networks IPV6 deploymentin R&E and ISPs

Americas EMEA APAC


Case 1: direct connection to IPv4+ IPv6 services

LAN

POSATMGigE…

Switch

Switch

Metropolitan, Regional or

National

NetworkSwitch

BGP

RIPv6

6bone

IPv6Service

IPv4 + IPv6 addresseson each interface

IPv4+ IPv6

IPv6 direct peering

interfaces {ge-0/1/0 {

unit 0 {family inet {address 192.168.0.5/24;

}family inet6 {address 8028:20::1/64;

}}

}so-0/0/0 {

unit 0 {family inet {address 204.146.35.1/30;}family inet6 {

address 8028:25::1/64;}}

}lo0 {

unit 0 {family inet {

address 192.168.5.1/32address 127.0.0.1/32;

}family inet6 {

address 8028:5::1/128;address ::1/128;

}routing-options {

routing-options {autonomous-system 100;

}}

protocols {ripng {


}}bgp {

group NREN-4-6 {local-address 204.146.35.1;family inet6 {

unicast;}family inet {

unicast;}peer-as 64595;neighbor 204.146.35.2;

}}

}




Case 2: remote connectionto IPv6 service

LAN

POSATMGigE…

Switch

Switch

Metropolitan, Regional or

National

NetworkSwitch

BGP withv6 addresses

RIPv6

IPv6 Service

IPv4 + IPv6 addresseson each interface

IPv4+ IPv6

6bone

IPv6 in IPv4 tunnel

IPv6 direct peering

interfaces {ge-0/1/0 {

unit 0 {family inet {address 192.168.0.5/24;}family inet6 {address 8028:20::1/64;}}

}so-0/0/0 {

unit 0 {family inet {address 204.146.35.1/30;}}

gr-1/0/0 {unit 0 {tunnel {source 204.146.35.1; # so-0/0/0.0destination 195.150.10.34;

}family inet6 {address 8028:25::1/64;

}}

}lo0 {

unit 0 {family inet {address 192.168.10.1/32address 127.0.0.1/32;

}family inet6 {address 8028:5::1/128;address ::1/128;

}routing-options {

rib inet6.0 {static {route 8028:10::1/128 next-hop 8028:25::2;

}}

protocols {ripng {


}}bgp {

group peering-v6 {type external;local-address 8028:5::1; # Loopbackpeer-as 64595;neighbor 8028:10::1;

}}

}


Pan-European Research Networking

10 Gb/s backbone with Juniper M160s

WDM optical technology

30 R&E connected organizations

European connectivity to over 3000 R&E institutions

http://www.dante.net/geant/

RedIRIS

Aconet

Belnet

UNICOM-BCARNet

CYNET

CESNET

Forskningsnettet

EENet

FUNET

RENATER

DFN

GRNET

HUNGARNET

RHnet

HEAnet

IUCC

GARR

LATNETLITNET

RESTENA

SURFnet

UNINETT

POL-34

RCTS

RoEduNet

SANET

ARNES

SUNET

SWITCH

UKERNA

Multicast

IP Premium

VPN

IPv6




IPv6 Available Features

Available on all M-series and T-series platforms

IS-ISOSPFv3MP-BGP over v4/v6RIPngStaticIPv6 VPN (RFC2547bis)PIM v2MLD

Forwardingin hardwareAddressing

Link, site, globalStateless autoconfiguration

Neighbor discoveryIPv6 Packet FilteringEUI 64 AutogenerationUnicast RPFFBF and CBF for IPv6Destination/Source Class Usage

Common supportICMPv6SNMP over v6 + MIBsIP applications

Ping, telnet, ssh, ftp…Transition

Configured tunnelsDual stackTransport IPv6 in MPLS

Addressing & Forwarding

Operations & Transition

Routing Protocols

Now

Copyright © 2003 Juniper Networks, Inc. http://www.juniper.net

Thank You

http://www.juniper.net

Documents

IPv6 Solutions on Juniper Networks