Microsoft PowerPoint - [200909] 02_IPv4-IPv6轉移機制介紹.ppt

Size: px

Start display at page:

Download "Microsoft PowerPoint - [200909] 02_IPv4-IPv6轉移機制介紹.ppt"

棱窥蔚
7 years ago
Views:

1 CHT-TL 測試實驗室 CHT-TL Testing Laboratory All Copyright Reserved 目錄簡介 / 雙 IP 機制 (Dual Stack) 通道機制 (Tunneling) 位址協定轉換機制 (Translator) RFC 5211-An Internet Transition Plan 導入行動準則建議 All Copyright Reserved 2 69

2 目錄簡介 / 雙 IP 機制 (Dual Stack) 通道機制 (Tunneling) 位址協定轉換機制 (Translator) RFC 5211-An Internet Transition Plan 導入行動準則建議 All Copyright Reserved 3 69 All Copyright Reserved 4 69

3 為何需要機制全球發展現況 2015 年 ( 預估 ) All Copyright Reserved 5 69 網路與服務 Servers Networks Clients All Copyright Reserved 6 69

4 IETF ngtrans(v6ops) Working Group Next Generation Transition (ngtrans) working group of the IETF Replaced by V6OPS working group overall goal : assisting the transition to All Copyright Reserved 7 69 Dual Stack NGTrans v6ops Tunneling Translator All Copyright Reserved 8 69

5 Dual stack allow and to co-exist in the same devices and networks. Tunneling enable network edge devices to interconnect over incompatible networks. Translation allow -only devices to communicate with -only devices All Copyright Reserved 9 69 RFC > RFC 4213 / Dual Stack Dual Stack All Copyright Reserved 10 69

6 RFC 2529 RFC 3056 RFC 3053 / 6 over 4 6 to 4 Tunnel Broker All Copyright Reserved RFC 2765;RFC 2766 RFC 2767 RFC 3142 Apps BIS Stack NAT-PT SIIT Apps BIS Stack TCP/UDP-Relay Host Host All Copyright Reserved 12 69

7 目錄簡介 / 雙 IP 機制 (Dual Stack) 通道機制 (Tunneling) 位址協定轉換機制 (Translator) RFC 5211-An Internet Transition Plan 導入行動準則建議 All Copyright Reserved RFC 4213 obsoletes RFC2893 RFC 4213 Basic Transition Mechanisms for Hosts and Routers, Oct.,2005 RFC 4213 defines two mechanisms that hosts and routers may implement in order to be compatible with hosts and routers. Dual IP layer (Dual stack) Configured tunnels Other transition mechanisms, including other tunneling mechanisms, are outside the scope of this document All Copyright Reserved 14 69

8 (1/2) Dual IP Layer Operation (dual stack) Both and are directly supported / nodes for nodes to remain compatible with -only nodes operated in one of three modes: stack enabled and stack disabled stack enabled and stack disabled both stacks enabled. All Copyright Reserved (2/2) Applications TCP/UDP IPV4 IPV6 Device Driver V4/V6 V4/V6 network network Routing Protocols TCP/UDP IPV4 IPV6 Device Driver V6 V6 network network V4 V4 network network All Copyright Reserved 16 69

9 目錄簡介 / 雙 IP 機制 (Dual Stack) 通道機制 (Tunneling) 位址協定轉換機制 (Translator) RFC 5211-An Internet Transition Plan 導入行動準則建議 All Copyright Reserved Mechanism to carry packets over infrastructure Encapsulate in Tunnel endpoints are explicitly configured All implementations support this Tunnel endpoints must be dual stack nodes The address is the endpoint for the tunnel All Copyright Reserved 18 69

10 Island Networks Island Dual-stack node Tunnel Dual-stack node H Payload H H Payload H Payload All Copyright Reserved infrastructure domain domain over tunnel node / router / router node All Copyright Reserved 20 69

11 infrastructure Host A domain Host B / node over tunnel / router node All Copyright Reserved infrastructure / node over tunnel / node All Copyright Reserved 22 69

12 RFC All Copyright Reserved tunneling over the internet requires heavy manual configuration Network administrators are faced with overwhelming management load Getting connected to the world is not an easy task for beginners The Tunnel Broker approach is an opportunity to solve the problem The basic idea is to provide tunnel broker to automatically manage tunnel requests coming from the users Benefits Stimulate the growth of interconnected hosts Allow to early network providers the provision of easy access to their networks All Copyright Reserved 24 69

13 Tunnel broker automatically manages tunnel requests coming from the users The Tunnel Broker fits well for small isolated sites, especially isolated hosts on the Internet Client node must be dual stack (/) The client address must be globally routable (no NAT) All Copyright Reserved DNS 伺服器 (3) 使用者隧道終點 / dual stack host (1) 隧道代理 (4) over 隧道網路 (2) 隧道伺服器隧道終點 All Copyright Reserved 26 69

14 CHT-TL Testing Laboratory All Copyright Reserved 27 Interconnection of isolated domains in an world No explicit tunnels No scaling issues The egress router of the 6to4 site must Have a dual stack (/) Have a globally routable address Implement 6to4 The site uses the 6to4 TLA (0x2002) for the site prefix All Copyright Reserved 28 69

15 x0002 V4 Addr SLA Interface ID ::/ Address SLA Interface Identifier bits bits Site creates a 48 bit prefix using its gateway router s s public address 2002:A:B :A:B:C:D::/48::/48 for address A.B.C.D 例如, 位址的 6to4 位址首碼是 2002:836B:1::/48 All Copyright Reserved to4 Site Each site with at least one global address (1) (1) 6to4 Router Internet Header 6to4 Router 2002:(1):xxx 2002:(2):yyy 6to4 Site With global address (2) Payload (1) Header (2) Header 2002:(1):xxx 2002:(2):yyy Payload All Copyright Reserved 30 69

16 6to4 relay router 6to4 Site Island Internet 6to4 gateway routers 6to4 Site All Copyright Reserved to4 host to 6to4 host 應用案例一 All Copyright Reserved 32 69

17 Between two 6to4 sites 應用案例二 Destination Address: 2002:V4ADDR-B::26 Destination Address V4ADDR-B Packet Header Encapsulated Packet 6to4 client 6to4 router (gatew ay) 6to4 router (gatew ay) 6to4 client 2002:V4ADDR-B::26 Internet address V4ADDR-B address 2002:V4ADDR-B::1 All Copyright Reserved 機制的安全弱點 Vulnerabilities 6to4 routers must accept packets from ALL 6to4 relay routers It's not possible to know if the relay router is "Trusted" or even existent 6to4 relay routers have to accept packets from 6to4 routers and native hosts without any checks Threats DoS/DDoS against 6to4 components may result in unavailability 6to4 routers/relay routers may be used or "reflected" DDoS attacks "Service theft": unauthorized usage of relay router services Local broadcast attacks Neighbor Discovery attacks All Copyright Reserved 34 69

18 RFC4214 -> 5214 CHT-TL Testing Laboratory All Copyright Reserved 35 The primary function of ISATAP is to allow hosts that are multiple hops away from an router to participate in the network by automatically tunneling packets over to the next-hop address. Example: ISATAP host communicates with host (no ISATAP support). The ISATAP host is isolated in an network whereas the host is in a network Infrastructure HOST B ISATAP Supported ISATAP HOST Network All Copyright Reserved 36 69

19 Construction of ISATAP address ISATAP interface identifier can be combined with any 64-bit prefix (including 6to4 prefixes) to form an RFC 2373 compliant globally aggregatable unicast address. address inside EUI-64 interface identifier ::0:5EFE:A.B.C.D for address A.B.C.D The 0:5EFE portion is formed from the combination of the Organizational Unit Identifier (OUI) that is assigned to IANA, and a type that indicates an embedded address (FE). Prefix ISATAP Prefix 64-bits Specially constructed EUI64 Interface ID Interface Identifier 64-bits ISATAP Address Format All Copyright Reserved EUI-64 Format Interface Identifier e TYPE TSE TSD 24-bits OUI 40-bits Extension ID If TYPE = 0xFF and TSE = 0xFE, TSD contains legacy EUI48 (TSE = 0xFF reserved by IEEE). If TYPE = 0xFE, TSE and TSD together contain embedded address. address is: routing prefix is: 3FFE:1A05:510:2412 ISATAP address is: 3FFE:1A05:510:2412:0:5EFE: All Copyright Reserved 38 69

20 (1/2) Simple Deployment Scenario of ISATAP (Hosts.) The Automatic Tunneling Pseudo-Interface uses the link-local ISATAP address assigned to the interface as a source, and uses the last 32 bits in the source and destination addresses (corresponding to the embedded addresses) as the source and destination addresses FE80::5EFE: HOST A Header Data ISATAP Supported Src = FE80::5EFE: Dst = FE80::5EFE: Infrastructure Header Header Data Src = Dst = HOST B ISATAP Supported FE80::5EFE: Header Data Src = FE80::5EFE: Dst = FE80::5EFE: All Copyright Reserved (2/2) Simple Deployment Scenario of ISATAP (Routers ) ISATAP HOST Network in HOST Network ISATAP 3FFE:3600:8:: FFE:1A05: :5EFE: FFE:1A05: :5EFE: Header Header Data Header Data Src = 3FFE:1A05: :5EFE: Dst = 3FFE:3600:8::1 Src = Dst = Header Data Src = 3FFE:1A05: :5EFE: Next = 3FFE:1A05: :5EFE: Dst = 3FFE:3600:8::1 All Copyright Reserved 40 69

21 RFC4380 CHT-TL Testing Laboratory All Copyright Reserved 41 機制的架構與元件 All Copyright Reserved 42Source: 69

22 應用案例 All Copyright Reserved 43Source: 69 目錄簡介 / 雙 IP 機制 (Dual Stack) 通道機制 (Tunneling) 位址協定轉換機制 (Translator) RFC 5211-An Internet Transition Plan 導入行動準則建議 All Copyright Reserved 44 69

23 RFC 2765 CHT-TL Testing Laboratory All Copyright Reserved 45 SIIT (Stateless IP/ICMP Translation algorithm) Allows -only hosts to talk to hosts Translation on IP packet header (including ICMP headers) in separate translator boxes in the network without requiring any per-connection state in those boxes. Use -translatable address (0::ffff:0:a.b.c.d) Most option fields can not be translated Requires one temporary address per host All Copyright Reserved 46 69

24 header Ver IHL Service Type Total Length ICMPv4 header Identification Flags Offset Type Code checksum TTL Protocol Header Checksum Ver Traffic Class Payload Length Flow Label Next Header Hop Limit fragment header (O)( Next Header header Rev Fragment Offset R M Identification SIIT Type ICMPv6 header Code checksum (1) SIIT 的優點 : 1. Stateless, 轉換是針對 packet, 與 flow 無關 (2) SIIT 的缺點 : 1. Not be able to use -AH 2. Multicast address could not be mapped All Copyright Reserved CHT-TL Testing Laboratory All Copyright Reserved 48

25 (1/3) Allows -only hosts to talk to hosts and vice-versa similar to NAT in network Stateful translation Requires at least one address per site Traditional NAT-PT Sessions are unidirectional, outbound from the v6 network Bi-directional directional-nat-pt Sessions can be initiated from hosts in v4 network as well as the v6 network A DNS-ALG (application level gateway) must be employed to facilitate name to address mapping All Copyright Reserved All Copyright Reserved (2/3) Limitations all requests and responses pertaining to session should be routed via the same NAT-PT router A number of fields have changed meaning in and translation is not straightforward Ex. Option headers Applications that carry the IP address in the high layer will not work. In this case ALG need to be incorporated to provide support for these applications. Lack of end-to-end security Bottleneck

26 (3/3) NAT-PT 的優點 : 1. 對使用者來說是通透性的, 用戶端不需要其他設定 NAT-PT 的缺點 : 1. 同一個 Session( 連線 ) 的封包必須經過同一個 NAT-PT router, 2. 所用的 protocol translation 演算法無法完全地轉換所有的資訊, 會造成資訊的流失. 3. 應用層若包含 IP 資訊將無法被轉換, 除非透過 Application Level Gateway(ALG) All Copyright Reserved NAT for 之問題與解決現況彙整代號問題簡述過去的解決方案失敗原因目前進行中的解決方案 1-a 1-b 1-c 1-d 1-e 1-f 1-g 1-h 2-a 2-b 2-c 2-d 3-a 3-b 3-c 3-d 3-e 4 ALG 處理加密資料不用 port number 的協定 Binding timout 問題 Header 欄位不同分割封包的處理 SCTP and multihoming Mobile IP 議題處理 multicast traffic network topology 受限單點瓶頸與攻擊點 Binding timout 問題相關 DOS 攻擊 Address selection 將 Record 轉給別的應用要 A 給 AAAA record Multi-addressed nodes Secure DNS 議題對應用發展的影響新增一個 transport layer gateway NAT-PT as a proxy Draft: v4-v6 multicast gateway Draft:NAT-PT DNS ALG solutions 分散式 NAT-PT+DNS-ALG Draft:NAT-PT DNS ALG solutions Draft:NAT-PT DNS ALG solutions Stateless 改為 Stateful 將 DNS-ALG 變為 DNSSEC server 過於複雜過於複雜 Obsoleted 只解決部分問題過於複雜過於複雜只解決部分問題過於複雜 draft-a Scalable - Transition Architecture Need for an address-portborrowing-protocol draft-modified Network Address Translation - Protocol Translation draft- Rapid Deployment on infrastructures draft-simplified Network Address Translation - Protocol Translation draft-carrier Grade NAT Behavioral Requirements draft-prefix-specific and Stateless Address Mapping (IVI) draft-nat64_dns64 draft-nat for -Only Hosts draft-dual-stack lite broadband deployments post exhaustion draft-- Coexistence and Transition Requirements for solutions draft-softwires Network Address Translation (SNAT) dratf_shimmed _ Address Network Translation Interface (SHANTI) All Copyright Reserved 52 69

27 DNS ALG FTP ALG CHT-TL Testing Laboratory All Copyright Reserved ALG 是對應於特定應用程式的代理人, 用來讓 V6 node 可以和 V4 node 互相溝通有些應用程式會把網路位址存在封包的 payload 中, 可是 NAT-PT 本身並無法得知 payload 裡存的是什麼 ALG 可以協助 NAT-PT 來達到這個功能 All Copyright Reserved 54 69

28 DNS-ALG (1/2) 在沒有 DNS-ALG 的情況下,NAT-PT 只能做到 v6 建立連線到 v4,v4 無法透過 NAT-PT 向 v6 建立連線 V4 to v6 的連線之所以需要 DNS-ALG 的協助, 是因為一開始,v4 node 並不知道 NAT-PT 會給 v6 node 的替代 v4 address All Copyright Reserved NAT-PT operations with DNS-ALG ( ) Network Network DNS-ALG UA1 DNS1 + DNS2 UA2 NAT-PT DNS Query (AAAA) DNS Query (AAAA) DNS Query (A) 1.4 DNS Response (A) DNS Response (AAAA) DNS Response (AAAA) 1.9 ICM Pv6 M essage (M AC Address Query) 1.10 ICM Pv6 M essage (M AC Address Response) 1.11 Packet ARP M essage (M AC Address Query) ARP M essage (M AC Address Response) Packet All Copyright Reserved 56 69

29 NAT-PT operations with DNS-ALG ( ) Network Network UA1 DNS1 DNS-ALG + NAT-PT DNS Query (A) DNS2 2.2 DNS Query (A) 2.1 UA DNS Query (AAAA) 2.5 DNS Response (AAAA) DNS Response (A) DNS Response (A) ARP M essage (M AC Address Query) ICM Pv6 M essage (M AC Address Query) ARP M essage (M AC Address Response) 2.10 Packet ICM Pv6 M essage (M AC Address Response) 2.14 Packet All Copyright Reserved FTP-ALG FTP control message 中會攜帶 IP address 以及 TCP port 資訊,FTP-ALG 可以支援 NAT-PT 使得 FTP 在 application level 的轉換沒有問題在 RFC2428 中建議利用 EPRT 和 EPSV 兩個指令分別替代 PORT 和 PASV 指令 All Copyright Reserved 58 69

30 雙協定堆疊 (Dual Stack) 技術優缺點比較表 / 雙協定堆疊 (Dual Stack) 轉移技術優點容易設置與易懂端點對端點連線模式未遭破壞雙堆疊主機可與其它雙協定堆疊主機純主機或純主機互連缺點擴展性 (scalability) 差因為每個節點需 1 個位址及 1 個位址系統複雜度及負擔增加, 需維持 2 個 IP 協定個別的 routing table 及相關網管資訊無法提供純主機與純主機的互通 All Copyright Reserved 穿隧 (Tunneling) 技術優缺點比較表 / 穿隧 (Tunneling) 轉移技術優點節點對節點的連線方式未遭破壞利用現有網路, 可降低成本缺點需要網路架構無法解決位址不足的問題封裝及解封裝增加網路額外負擔需要人工的設定與維護, 增加網管者沈重的工作負擔 All Copyright Reserved 60 69

31 轉換 (Translation) 技術優缺點比較表 / 轉換 (Translation) 技術 NAT-PT 優點 NAT-PT 可建構在與網路交界位置, 提供純與純間的通訊, 免除將主機升級為雙 IP 協定堆疊的麻煩 NAT-PT 的運作對 end-user 而言幾乎是透通的 All Copyright Reserved 缺點經由 NAT-PT 處理的 session, 在整個 session 過程中, 所有封包均需流經此 NAT-PT 因此 NAT-PT 轉換器可能成為網路運作的瓶頸點, 會危及整體網路運作需借助 DNS-ALG FTP- ALG 以及各種應用程式 ALG(Application Layer Gateway) 方能處理封包酬載中位址的轉換, 達成應用層雙向互連目錄簡介 / 雙 IP 機制 (Dual Stack) 通道機制 (Tunneling) 位址協定轉換機制 (Translator) RFC 5211-An Internet Transition Plan 導入行動準則建議 All Copyright Reserved 62 69

32 RFC An Internet Transition Plan Organizations: Should prepare servers for network services Organizations: Must prepare servers for network services May prepare for internal connection trial Organizations: Must prepare servers for network services Should prepare for internal connection All Copyright Reserved ISP responses to exhaustion (1/3) 啟動回收機制優點 : 當位址用罄時, 或可解決短期需求缺點 : 效果可能不佳, 依賴此方案將使 ISP 陷入風險之中, 亦無法滿足長期發展之需求建置 CGN (Carrier grade NAT), 雙層 NAT 優點 : 可解決位址不足問題缺點 : 許多應用不適合於雙層 NAT; 網管 / 查測不易 ; CGN 易成訊務 / 資安瓶頸點 ; 擴展性受限 ; 發展停滯 All Copyright Reserved

33 ISP responses to exhaustion (2/3) 將網路與服務 IP dual stack 化優點 : 解決位址不足問題 ; 單一網路與服務同時滿足 & 用戶, 網路與服務共享, 整體成本有效降低 ; 缺點 : 自然汰舊換新僅能達到點狀分佈, 有些環境 dual 有些沒有, 反而增加整體導入複雜度, 而一次大規模 IP dual stack 成本又高 ; 新建網路, 與網路獨立優點 : 不影響既有網路與服務 ; 導入問題相對單純 ; 新服務之研發亦不會受到既有網路之限制缺點 : 需同時建置兩套網路與服務平台, 導入成本大幅增加, 降低業者導入意願 ; 兩個網路的服務無法直接共享代表業者 : NTT East/West All Copyright Reserved ISP responses to exhaustion (3/3) Shared address solution (SAS) 建置 CGN, 雙層 NAT 之改良版, 嘗試與結合, 但只用一層 NAT 即可達到一個 public 位址為許多用戶共用的目標關鍵點 : 在大部分的 proposals 中,Port 被拿出來作為用戶區別之用優點 : 大部分既有適用於單層 NAT 之應用不受影響 ; 可解決位址不足問題 ; 與結合, 發展持續缺點 : 因 Port 另有用途, 將使部分應用受到影響 ;CGN 易成訊務 / 資安瓶頸點 ;UPnP 應用會受到影響 ;IPS/IDS 機制將受到影響代表業者 :Comcast All Copyright Reserved

34 Port distribution & reservation 因為 SAS 將 Port 拿出來作為用戶區別之用, 因此用戶及應用不能再隨意的使用 port number, 而須由 ISP 來管控與分配 How long an application session is ongoing and requiring port stability? 統計發現, 一個用戶使用的 port number 範圍遠高於平均使用的 port number 數目 ISP 如何管控分配與保留 Port 給用戶將是 Shared address solution 的成敗關鍵 All Copyright Reserved 導入行動準則建議 Three Types of Transition Mechanisms Dual Stack Tunnelling Translator No single mechanism applies to all situations Dual Stack 為建議之機制, 設備汰換時, 可將功能列入考量 ( 實際運作時, 可考慮是否要啟用 ) 除設備考量外, 軟體應用服務及 OS 也需注意功能支援網路導入基本原則 :Dual stack where you can, Tunneling where you must, Translation where you have no other solutions. 網路設備逐步 IP dual stack, 先形成點狀分佈, 善用 tunneling 技術將點互連, 再逐步由點而面服務導入基本原則 : Dual stack where you can, independence each other where you must, Translation where you have no other solutions. 新建服務平台要求必須支援 IP dual stack access 既有服務平台若為獨立系統, 與其他平台無介接, 則可優先考慮以 IP dual stack 方式導入若既有服務平台與其他平台介接且複雜, 則建議將既有服務平台 mirror 成兩套, & user 彼此分開 All Copyright Reserved 68 69

35 CHT-TL Testing Laboratory All Copyright Reserved

財金資訊-80期.indd

財金資訊-80期.indd IPv6 / LINE YouTube TCP/IP TCP (Transmission Control Protocol) IP (Internet Protocol) (node) (address) IPv4 168.95.1.1 IPv4 1981 RFC 791 --IP IPv4 32 2 32 42 IP (Internet Service Provider ISP) IP IP IPv4