book

IPv6 Mandates: Choosing a Transition Strategy, Preparing Transition Plans, and Executing the Migration of a Network to IPv6

Name: IPv6 Mandates: Choosing a Transition Strategy, Preparing Transition Plans, and Executing the Migration of a Network to IPv6
Author: Karl A. Siil
ISBN: 9780470191194

by Karl A. Siil

March 2008

Intermediate to advanced

474 pages

14h 37m

English

Wiley

Read now

Unlock full access

Copyright
About The Author
Credits
Preface
Acknowledgements
Introduction
Overview of the BookHow This Book Is OrganizedWho Should Read this BookWhere Do You Go from Here?
I. Starting with the Basics
1. What Is IPv6?
1.1. Meet IPv61.2. Making the Transition from IPv4 to IPv61.3. Looking beyond IPv61.4. Who Should Read This Book?1.5. Why IPv6?1.5.1. Addressing Every PC, Cell Phone, and Toaster1.5.2. Easing Network Load1.5.3. Enabling the Future1.5.4. Eliminating Configuration Hassles1.5.5. Ensuring Quality of Service1.6. What Is Driving IPv6 Transition?1.6.1. Understanding IPv6 Federal Mandates1.6.2. Factoring in Microsoft Vista1.6.3. Introducing the NAv6TF1.7. Further Reading1.8. Testing Your Knowledge
2. Demystifying IPv6
2.1. What You'll Learn2.2. Exploring the IPv6 Header2.2.1. Comparing Modified Fields and Introducing New Fields2.2.2. What Fields Are Gone?2.2.3. Understanding Extension Headers2.3. Grappling with the Huge IPv6 Address Space2.3.1. Using Shortcuts to Represent IPv6 Addresses2.3.2. Expressing IPv6 Address Spaces2.3.3. So, How Big Is Big?2.3.4. Managing the Address Space World-Wide2.4. Benefiting from Auto-Configuration2.4.1. Auto-Configuring the Local Subnet2.4.2. Limiting Auto-Configuration to Reduce Risk2.5. Testing Your Knowledge
3. The Current IPv6 Landscape
3.1. What You'll Learn3.2. Casting Fresh Eyes on the OMB Mandate3.3. How Quickly Is IPv6 Being Adopted?3.3.1. Looking at the Historical Data3.3.2. Analyzing the Adoption Data for Annual Growth3.3.3. Analyzing the Compounding of the Adoption Rate3.3.4. Portending a Bumpy Road Ahead for IPv6 Adoption3.4. Announcing Two Major Transition Enablers3.5. Assessing the State of IPv6 Hacking3.5.1. Introducing the First IPv6 Attack Toolkit3.5.2. Dealing with Hacker Tools and Attack Kits3.6. Testing Your Knowledge

II. Planning Your Transition
4. Choosing When to Make A Transition and How
4.1. What You'll Learn4.2. Taking the FUD Out of IPv6 Transition4.3. Choosing an IPv6 Transition Strategy4.4. Choosing to Start Now and Move Slowly4.4.1. Moving Capabilities, Not Just Systems4.4.2. Looking Back at the Good Old Days4.4.3. Returning to the Here and Now4.4.4. Grasping the Big Picture for Your Organization4.4.5. Creating Site- and Function-Specific Plans4.4.6. Coordinating Plans across the Enterprise4.4.7. Connecting IPv6 Islands4.5. Choosing a Quick Transition for Later4.5.1. Accepting that IPv6 Is in Your Network Now4.5.2. Discovering IPv6 in Your Pre-Transition Network4.5.3. Planning the "Big-Bang"4.5.4. Curbing Unmanaged IPv6 Deployment until You're Ready4.5.5. Accounting for Existing Authorized IPv6 Infrastructure4.6. Rejecting the "Quick and Now" Transition Choice4.7. Selecting the Transition Mechanisms4.7.1. Describing the Playing Field of Different Device Types4.7.2. Understanding What Enables Your Transition Choices4.7.3. Reviewing the Basics of DNS4.7.4. Giving DNS a New Job4.7.5. Talking Realistically About Upgrading Applications4.7.6. Addressing Security Issues4.7.7. Considering Advanced IPv6 Capabilities during Transitions4.8. Deploying Native IPv64.9. Running Dual Stacks4.9.1. Having the Best of Both Worlds4.9.2. Mapping IPv4 Addresses to IPv6 Addresses4.10. Going Through Tunnels4.10.1. Adding a Layer to the Stack4.10.2. Introducing Protocol #414.10.3. Understanding the Routing of Tunneled Packets4.10.4. Terminating Tunnels at a Common Point4.10.5. Understanding Tunneling to a Common Point4.10.6. What about Tunneling IPv4 inside IPv6?4.10.7. Factoring MTU Issues into Tunneling4.10.8. Assessing the Security Requirements of Your Tunnels4.11. Considering IPsec4.11.1. Benefiting from Strong Authentication and Encryption4.11.2. Combining Two Big Changes to Ease the Pains of Both4.11.3. Being Comfortable the Workload Is Manageable4.12. Realizing a Hybrid Approach Is the Best4.13. Assembling the Jigsaw Puzzle4.13.1. Checking Reality on Future Pure IPv6 Networks4.13.2. Returning to the Example IPv6 Transition in Progress4.13.3. Meeting the Mandates as the First Order of Business4.13.4. Keeping the Old Stuff Running4.13.5. Adding in the New Native Stuff4.13.6. Wrapping It Up with Some Tunnels4.14. Choosing Your Options4.14.1. Checking Out Checklists4.14.2. CHECKLIST: Custom Needs Assessment4.15. Further Reading4.16. Testing Your Knowledge
5. Creating Your Transition Plans
5.1. What You'll Learn5.2. Approaching Your Planning Work5.3. Planning to Plan5.3.1. Determining Your Plan's Objectives5.3.2. Covering All the Bases in Your Planning5.3.3. Taking a Tip from Journalism5.3.4. Who Will Work on the Project?5.3.5. When Do You Need to Finish the Transition?5.3.6. Working with the OMB-Mandated Deadlines5.3.7. Getting and Using Appropriate Planning Tools5.3.8. Understanding the Costs of Rolling Your Own Tools5.3.9. Determining Where the Transition Will Happen5.3.10. Obtaining Service-Level Minima and Best Practices5.3.11. CHECKLIST: Planning Resources Inventory5.4. Creating a Comprehensive Plan5.4.1. Understanding the Project Triangle5.4.2. Knowing When More Resources Won't Help5.4.3. Documenting Your Assumptions5.4.4. Defining Where Plans Come Together with Dependencies5.4.5. Avoiding Scheduling Traps and Pitfalls5.4.6. Planning Enough, but Not Too Much5.5. Developing Plans within Plans5.5.1. Laying Out Your IPv6 Building5.5.2. Planning at Each Layer of the Network Stack5.5.3. Scoping the Boundaries between Plans5.5.4. Minimizing Overlaps in Plans5.6. Tracking and Adjusting the Plan5.6.1. Keeping the Original Plan in Sight5.6.2. Limiting Changes to the Baseline5.6.3. Keeping an Eye on the Time You're Spending5.6.4. Tracking Slips without Picking Nits5.6.5. Assessing How Much of a Slip Is Recoverable5.7. Finding Resources to Help with the Transition5.7.1. Seeking Guidance from OMB5.7.2. Engaging Professional Help5.8. Further Reading5.9. Testing Your Knowledge
6. Defining the Transition Preparation Steps
6.1. What You'll Learn6.2. Inventorying Your Assets and Capabilities6.2.1. Defining Your Inventory Goals6.2.2. Distinguishing Your Assets6.2.3. Distributing Your Inventory Work6.2.4. Inventorying Your Networks and Their Assets6.2.5. Inventorying Your Software Assets6.2.6. Documenting What Exists Now6.2.7. Knowing Your Inventory Is Correct6.2.8. Assessing Your Network's Capabilities6.2.9. Verifying that Your Required Capabilities Work6.2.10. CHECKLIST: Asset and Capabilities Inventories6.3. Defining the Post-Transition Configuration6.3.1. Determining How to Make an Asset IPv6 Capable6.3.2. Determining What You Need to Replace or Upgrade6.3.3. Maximizing What You Can Leave As Is or Swap6.3.4. Consolidating Systems Into a More Capable One6.3.5. Re-purposing Assets to Other Parts of Your Network6.3.6. CHECKLIST: Asset Disposition6.3.7. Confirming the New Configuration Satisfies Its Mission6.3.8. Documenting the New Configuration6.4. Communicating the Plan6.4.1. Why You Should Tell People What You're Going to Do6.4.2. Keeping Monitoring Organizations in the Loop6.4.3. Posting Contact Numbers for All Key Transition Staff6.5. Scheduling Transition Events6.5.1. Using Off-peak and Maintenance Times for Transition6.5.2. Working within a Predefined Maintenance Window6.5.3. Staying within Your Allotted Maintenance Time6.6. Staging Resources for a Speedier Transition6.6.1. Preparing Replacements and Upgrades for Installation6.6.2. Getting What's Needed Where It's Needed Ahead of Time6.6.3. Checking That Everything's Ready Before You Start6.7. Getting the Right Approvals6.7.1. Complying with Existing Procedures and Practices6.7.2. Making Sure You Have Approvals in Writing6.8. Testing Your Knowledge
7. Identifying Common Transition Preparation Tasks
7.1. What You'll Learn7.2. Provisioning Your IPv6 Address Space7.2.1. Developing an IPv6 Address-space Mindset7.2.2. Starting at the Top with RIRs7.2.3. Getting IPv6 Addresses from ISPs7.2.4. Using Addresses in 6to4 Space7.2.5. What Should You Do Until the Policy Dust Settles?7.3. Creating and Maintaining an IPv6 Numbering Plan7.3.1. Bidding Farewell to IPv4 Network-Numbering Headaches7.3.2. Enjoying Network-Architectural Freedom with IPv67.3.3. Numbering Your Networks7.3.4. Creating Interface Identifiers7.3.5. Managing Your Numbering Plan7.4. Getting External IPv6 Connectivity7.4.1. Finding Native Connectivity7.4.2. Going with Tunneled Connectivity7.4.3. Using 6to4 Relays7.4.4. Connecting Externally at Many Points7.5. Assessing Whether to Deploy IPsec with IPv67.5.1. Determining What Deploying IPsec Entails7.5.2. Getting to Know the Basics of IPsec7.6. Factoring in any Bandwidth Requirements7.6.1. Determining the Effect of Increased Header Sizes7.6.2. Estimating Other Packet Size Changes7.6.3. What Additional Traffic Can You Expect?7.7. Investigating More-Advanced IPv6 Capabilities7.7.1. Adopting the New Secure Auto-Configuration Features7.7.2. Introducing Mobile IPv67.8. Testing Your Knowledge
8. Defining the Transition Execution Steps
8.1. What You'll Learn8.2. Organizing the Transition Execution Activities8.2.1. Picking What to Switch Out and in What Order8.2.2. Identifying and Resolving Execution Dependencies8.2.3. Balancing Efficiency with Resilience8.2.4. Grouping Your Transition Activities8.2.5. Identifying Any Irreversible Steps8.2.6. Verifying Capabilities to Create Checkpoints8.2.7. Using Optional Work Items to Fill Spare Time8.3. Adopting the Expect-To-Revert Mindset8.3.1. Defining a Normal State for Your Network8.3.2. Knowing When to Revert8.3.3. Getting Back to a Normal State8.3.4. Regrouping and Trying Again8.4. Creating a Sample Transition Activity Schedule8.4.1. Plugging Known Values into the Activities Schedule8.4.2. Computing Your Activities' Revert Times8.4.3. Keeping Your Transition Schedules Manageable8.5. Making Sure Everything and Everyone Is Ready8.5.1. Backing Up Data and Configurations Before Starting8.5.2. Communicating the Details of Your Transition Activities8.5.3. Getting the Green Light for Your Transition Activities8.6. Testing Your Knowledge
9. Defining the Transition Verification Steps
9.1. What You'll Learn9.2. Testing the New Configuration9.2.1. Benefiting from Good Requirements9.2.2. Reviewing IPv6 Transition Terminology9.2.3. Including Verification in Your Transition Activities9.2.4. Separating Execution and Verification9.2.5. Verifying the Different Types of Capabilities9.2.6. Using Black-Box, White-Box, and Grey-Box Testing9.2.7. Verifying the Minimum Required Capabilities9.2.8. Verifying the Less-Required and Optional Capabilities9.2.9. Using Regression Tests to Expedite Verification9.2.10. Automating Your Verification Tests9.3. Recovering from Failure9.3.1. Determining the Cause of a Verification Failure9.3.2. Fixing Non-Critical Failures without Reverting9.3.3. Reverting from Backups9.4. Knowing When You Are Done9.4.1. Making Sure to Clean Up Any Loose Ends9.4.2. Communicating When Activities Are Complete9.5. Testing Your Knowledge
10. Factoring IPv6-Specific Risks and Limitations into Your Plans
10.1. What You'll Learn10.2. What Risks Are There with Your IPv6 Transition?10.3. Acknowledging That You Are a Pioneer10.3.1. Dealing with the Lack of IPv6 Lessons Learned Online10.3.2. Seeking Out Those Who Went Before You10.3.3. Publishing Your Experiences and Questions10.3.4. Creating an Enterprise Transition Knowledge Base10.4. Realizing That with Changes Come Bugs10.5. Summarizing Risks from Prior Chapters10.5.1. Re-Visiting Auto-Configuration10.5.2. Tunneling with Care10.5.3. Avoiding EUI-64 or Knowing Its Limits10.5.4. Looking for IPv6 ISPs10.5.5. Coping with ISP-Centric Addressing10.6. Recalling All the Things That IPv6 Didn't Change10.7. Analyzing Other Risks of IPv6 Features10.7.1. Understanding IPv6's Version of ICMP10.7.2. Reviewing the Limited Success of IPv4 Options10.7.3. Finding Risks in IPv6 Extension Headers10.7.4. What Should I Do with My Firewall Configurations?10.8. Understanding Mobile IPv6's Risks and Limitations10.8.1. Defining the Roles of Devices in Mobile IPv610.8.2. Establishing the Goals of Mobile IPv610.8.3. Extensions, Options, and ICMPv6 Messages, Oh My!10.8.4. What Other IPv6 Features Does Mobile IPv6 Require?10.8.5. Losing Traffic While Mobile Nodes Are Moving10.8.6. Regarding Accessibility of Home Agents10.8.7. Cracking the Books to Learn More10.9. Further Reading10.10. Testing Your Knowledge
III. Easing Your Transition
11. Knowing What Assets You Have
11.1. What You'll Learn11.2. Combining Inventory with Discovery11.3. Summarizing Chapter 6, "Defining the Transition Preparation Steps"11.3.1. Remembering the Goals of Your Inventory Work11.3.2. Having an Inventory Strategy11.3.3. Getting Sufficient Network Coverage11.3.4. Saving Your Results11.3.5. Keeping Your Inventory Current11.4. Deploying a Discovery Solution11.4.1. Benefiting from Automated Discovery Tools11.4.2. Listing the Asset Types Your Tools Need to Find11.4.3. Defining the Types of Automated Discovery Tools11.4.4. Creating a Known Baseline from Which to Inventory11.4.5. Knowing from Where to Look11.4.6. Setting the Bounds of What You Are Inventorying11.4.7. Being Careful in Your Discovery Activities11.4.8. Integrating Your Distributed Results11.4.9. Discovering IPv6 Assets from the IPv4 Side11.4.10. Finding the Right Tools for Your Inventory Work11.4.11. Assessing Emerging IPv6 Discovery Tools11.5. What Discovery Tools Are Out There?11.5.1. Lumeta's IPsonar11.5.2. Nmap11.5.3. SolarWinds' LANsurveyor11.5.4. Xprobe11.5.5. Other Tools11.6. Managing Your Discovered Assets11.6.1. Distinguishing Asset Management Tool Types11.6.2. Feeding Discovery Results to Management Tools11.6.3. Extracting Asset Data from Support Systems11.7. What Asset Management Tools Are Out There?11.7.1. BlueCat Networks' Proteus11.7.2. BT INS' IPControl11.7.3. Internet Associates' IPal11.7.4. The Big Boys11.8. Growing Your Own Tools11.9. Testing Your Knowledge
12. Selecting an Enterprise Transition Strategy
12.1. What You'll Learn12.2. Choosing Between the Chicken and the Egg12.2.1. Defining the Sides of the Deployment Stalemate12.2.2. Understanding What's Behind MIS/IT's Lack of Urgency12.2.3. Seeing the Problem from the Edges' Point of View12.2.4. Getting the IPv6 Transition Rolling12.3. Revisiting the Backbone-First Transition12.3.1. Understanding the U.S. Government's Position12.3.2. Starting Your Transition with the Network Backbone12.3.3. Appreciating the Motivator That Is Ubiquitous IPv612.3.4. What's Next, After the Backbone Transition?12.4. Examining the Edges-First Transition Strategy12.4.1. When Else Is the Edges-First Strategy a Better One?12.4.2. Enabling Adoption without Ubiquitous IPv612.4.3. Renumbering Devices When the Backbone Is Ready12.5. Combining the Two Transition Strategies12.6. Testing Your Knowledge
13. Using Pilot Programs to Facilitate Your IPv6 Transition
13.1. What You'll Learn13.2. Creating a Successful IPv6 Pilot13.2.1. Identifying a Project or Need13.2.2. Defining Your Pilot's Goals Before Starting13.2.3. Differentiating Ad Hoc Versus Official Pilots13.3. Scoping the Pilot13.3.1. Identifying Assets for the Pilot13.3.2. Mitigating Scope Creep13.4. Monitoring the Pilot13.4.1. Measuring the Right Things13.4.2. Changing the Pilot Mid-Stream13.5. Assessing the Impact of Potential Failure13.5.1. Making Everyone Accept That the Pilot Could Fail13.5.2. Planning for the Failure Case13.6. Drilling Down on Software Pilots13.6.1. Describing IP Addresses in Software Applications13.6.2. What Else Must Change in the Application?13.6.3. Finding Information on Porting Applications to IPv613.7. Looking at a Real-Life Pilot and Its Results13.7.1. Assessing the Pilot's Applicability to the Organization13.7.2. Setting the Pilot's Goals13.7.3. Simplifying Development to Reduce Complexity13.7.4. How Did the Pilot Turn Out?13.8. Testing Your Knowledge
IV. Managing After Transition
14. Understanding That Your Network Isn't New
14.1. What You'll Learn14.2. Welcoming IPv6 into Network Operations14.3. Teaching Your New Network Some Old Tricks14.4. Incorporating Multicast into Network Maintenance14.5. Addressing Some of the Old Security Risks14.5.1. Handling the Application Flaws That Are Still Present14.5.2. Hiding Potentially Flawed Devices in the Address Space14.6. Assessing IPv6's Denial of Service Risks14.6.1. Using IPsec to Curb Certain Denial of Service Attacks14.6.2. Adopting Flow Labels as they Become Better Defined14.7. Growing Your Network with IPv6 in Mind14.7.1. Learning What Performance Means with IPv614.7.2. Deploying New Capabilities14.8. Testing Your Knowledge
15. Managing IPv4 and IPv6 on the Same Network
15.1. What You'll Learn15.2. Mixing Protocol Families on Networks15.3. Managing Your IPv4 and IPv6 Communities as One15.3.1. Describing Dual-Stack Systems Using Superposition15.3.2. Keeping Track of All Those Different Addresses15.3.3. Providing ISP Connectivity to Both Communities15.4. Separating IPv4 and IPv6 Communities as Needed15.4.1. Defining and Enforcing Community Perimeters15.4.2. Using Network Topology to Define Security Policy15.4.3. Remembering the Importance of Path MTU15.4.4. Making a Case for Proxied Path MTU Discovery15.5. Factoring Protocols into Application Acquisition15.6. Testing Your Knowledge
16. Maintaining Eternal Vigilance
16.1. What You'll Learn16.2. Logging What You Can't Control16.2.1. Keeping Watch on IPv6 Just Like You Did with IPv416.2.2. Reviewing Advanced Logging and Analysis Products16.2.3. Adapting Advanced Logging Tools to IPv616.2.4. Surveying the IPv6-Capable Advanced Logging Tools16.2.5. Choosing How to Protect Systems You Can't Watch16.3. Reviewing Configurations Periodically16.3.1. Using Transition-Planning Processes for Daily Tasks16.3.2. Keeping Current on IPv6 Security Problems and Fixes
A. Answers to the Testing Your Knowledge Questions
A.1. Chapter 1: What Is IPv6?A.2. Chapter 2: Demystifying IPv6A.3. Chapter 3: The Current IPv6 LandscapeA.4. Chapter 4: Choosing When to Make the Transition and HowA.5. Chapter 5: Creating Your Transition PlansA.6. Chapter 6: Defining the Transition Preparation StepsA.7. Chapter 7: Identifying Common Transition Preparation TasksA.8. Chapter 8: Defining the Transition Execution StepsA.9. Chapter 9: Defining the Transition Verification StepsA.10. Chapter 10: Factoring IPv6-specific Risks and Limitations into Your PlansA.11. Chapter 11: Knowing What Assets You HaveA.12. Chapter 12: Selecting an Enterprise Transition StrategyA.13. Chapter 13: Using Pilot Programs to Facilitate Your IPv6 TransitionA.14. Chapter 14: Understanding That Your Network Isn't NewA.15. Chapter 15: Managing IPv4 and IPv6 on the Same NetworkA.16. Chapter 16: Maintaining Eternal Vigilance

Content preview from IPv6 Mandates: Choosing a Transition Strategy, Preparing Transition Plans, and Executing the Migration of a Network to IPv6

About The Author

Karl Siil is a Senior Research Engineer, Development and Program Manager on SRI International's C4ISR team. He leads SRI's development efforts in Information Assurance for the Engineering and Systems Division. Karl has more than 25 years of experience in Information Technology and has been fortunate enough to be part of the industry's growth and change in numerous capacities, including network management, software development, and computer and network security. He is a subject matter expert both in IPv6 and the OMB-mandated federal transition and has spoken on IPv6 and the importance of well-managed transition at SecureGOV, CSI, RSA Europe, and AFCEA conferences. Karl has also participated in numerous IPv6 panels for government and industry organizations. Before joining SRI, Karl was a founding member and Chief Architect for Lumeta Corporation. Karl enjoyed a seven-year career at Lumeta during which he created and managed the company's Professional Services Organization, designed Lumeta's flagship IPsonar product, and established the IPv6 Internet Mapping Project to track IPv6 adoption worldwide. Prior to Lumeta, Karl spent more than a decade working for Bell Laboratories (now AT&T Laboratories) developing secure operating systems, consumer services, and next-generation networking platforms. Karl holds a BE in electrical engineering from The Cooper Union and an ME in electrical engineering from Manhattan College. He currently lives in Princeton, NJ with his wife ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Deploying IPv6 in Broadband Access Networks

Publisher Resources

ISBN: 9780470191194Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

IPv6 Mandates: Choosing a Transition Strategy, Preparing Transition Plans, and Executing the Migration of a Network to IPv6

by Karl A. Siil

About The Author

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.