Shulou(Shulou.com)06/01 Report--

In recent years, with the rapid development of the Internet, the consumption rate of IP addresses is amazing. According to IANA estimates, IPv4 addresses are about to be completely consumed. Today, IPv6 has become a thing that China's information industry has to do.

The Origin of IPv6

IPv6 is the next version of the Internet protocol. It was originally proposed because with the rapid development of the Internet, the limited address space defined by IPv4 will be exhausted. In order to expand the address space, it is planned to redefine the address space through IPv6. However, as IPv6 begins to enter the design stage, designers no longer simply aim at solving the problem of shortage of address space, but provide a new routing architecture that is more efficient, more secure and can better support different services and mobility characteristics, which is called the ultimate goal of IPv6.

Why deploy IPV6

Limitations of IPv4:

1. Limitations of address space: the crisis of IP address space has been around for a long time and is the main driving force for upgrading to IPv6.

two。 Security: IPv4 has no security at the network layer, and security has always been considered to be the responsibility of the layer above the network layer.

3. Automatic configuration: the configuration of IPv4 nodes is complex, leaving many ordinary users at a loss as to what to do.

4.NAT: destroys Internet's end-to-end network model.

5. Because the IPv4 address assignment is disorganized and unhierarchical, network devices need to maintain large routing table entries.

6.IPv4 packet header is too complex, so that the efficiency of network node processing is not high.

Benefits of IPV6:

1. Larger address space

The most obvious feature of IPv6 is its huge address space. In IPv4, the address bits are 32 bits, that is, the total address size is 4294967296. In IPv6, the address bit size is 128 bits, and the address space allowed is 218 or 340 282 366 920 938 463 463 374 607 431 768 211 456 (3.4 × 1038) possible addresses.

two。 More efficient routing infrastructur

Now the routing structure of the Internet based on IPv4 is flat on the backbone. In other words, the routing table of the routers on the Internet backbone can not reflect the hierarchical relationship between ISP. The IP address space allocated between geographically adjacent ISP is discontiguous. For example, the address space allocated by an ISP accessing the Internet backbone from Asia may be contiguous with an ISP accessing the Internet backbone from Europe. This display makes it difficult to achieve route summarization on the backbone network, and makes the routing table of the Internet backbone network become larger and larger. Recent data show that the routing entries of routers on the backbone network have exceeded 100000, so that routing efficiency will become more and more inefficient, and backbone routers will become more and more unbearable.

IPv6 considers this problem from the point of design, the address assignment of IPv6 will be more strict than that of IPv4, and this allocation takes into account the hierarchical relationship between ISP from the very beginning. The effect is that the summary of route entries can be easily realized on the backbone routes of IPv6, and the number of route entries on IPv6 backbone routers will be greatly reduced. Therefore, IPv6 will be a more efficient routing infrastructure.

3. Better security

To achieve private communication on public media such as the Internet, security services are needed to protect data from viewing or modification during transmission. Although there is an IPv4-based standard (that is, IPSec) to provide secure transmission of packets, it is only optional. In IPv6, IPSec support is a protocol requirement. This requirement provides a standards-based solution for the network security requirements of devices, applications, and services and facilitates interoperability between different IPv6.

4. Mobility

Mobile IPv6 allows IPv6 nodes to become mobile (arbitrarily changing their location on the IPv6 network) while still maintaining existing connections. With mobile IPv6, the mobile node is always reachable through a permanent address. The connection is established using a specific permanent address assigned to the mobile node, and the connection is maintained no matter how many times the mobile node changes its location and address.

5. Better quality of service (QoS)

A new field called flow label (Flow Lable) is used in the IPv6 header to define how traffic is processed and identified. At the same time, a traffic type (Traffic Type) field is defined in the packet header of IPv6, which can be used to distinguish different business flows. The combination of flow types and flow tags can provide a powerful QoS for IPv6.

6. The packet head is simple, and the future new technology expansion can be realized by extending the packet head technology.

Summary of the changes of IPv6 relative to IPv4

We can compare IPv4 and IPv6 headers to see why IPv6 is more powerful than IPv4, as shown in the following figure:

In IPv4, all packet headers are in 32-bit (bit) units, that is, the basic length unit is 4 bytes. The above picture shows the header format of IPv4. In IPv6, the header is in 64-bit (bit) units, and the total length of the header is 40 bytes. The header format of IPv6 is shown in IPv6 above.

Comparing the two header formats, IPv6 has made great improvements to IPv4: first, six fields of IPv4 header are deleted: IP header length (Header Length), type of service (Service Type), identification (Identification), flag (Flag), flag offset (Fragment Offset) and header checksum (Header Checksum). Second, three control fields in IPv6 are renamed and redefined under some conditions: length (Length), type of service (Service Type), and time to live (Time to Live). Finally, two new fields are added: priority (Priority) and flow identification (Flow Label).

IPv6 defines the following fields for its header

Version: length is 4 bits, for IPv6, this field must be 6

Flow control: the length is 8 bits, which is equivalent to the TOS field in IPv4 and specifies the type of service to be used.

Flow label: data that is 20 bits long and is used to identify the same business flow. The intermediate forwarding router adopts the same forwarding behavior for the same source and destination traffic data to improve the forwarding efficiency.

Load length: the length is 16 bits, including the byte length of the packet load, which means that the length of the IPv6 extension header is included when calculating the load length

Next header: similar to the IPv4 protocol field, indicates whether the upper layer is TCP or UDP

Hop limit: 8 bits in length, similar to TTL in IPv4, but the hop limit is specified by the upper layer protocol

Source address: IP address changed to 128bit, indicating the sender address

Destination address: 128 bits, indicating the recipient's address, which can be a unicast, multicast, or any on-demand address

Basic terminology of IPv6

In order to better understand the related concepts of IPv6, let's first understand the basic terminology of IPv6 network. Some of them are easily confused with the concept of IPv4, so we should pay attention to distinguish them. Here is the simplest IPv6 network, as shown in the figure:

1. Local area network segment: it is part of the IPv6 link, consisting of a single medium and bounded by layer 2 switching equipment.

two。 Link: one or more local area network segments bounded by a router. IPv6 has defined many link layer technologies, including some typical LAN technologies (such as Ethernet, token Network, and FDDI), as well as some WAN technologies (such as Point-to-Point Protocol PPP, frame Relay, and ATM).

3. Subnet: in IPv6, one or more links that use the same 64-bit IPv6 address prefix are called subnets, which is different from subnets in IPv4. A subnet is also known as a network segment. A subnet can be divided into several parts by an internal subnet router. The internal subnet router can provide forwarding and configuration functions for each link in the subnet.

4. Adjacent node: a node connected to the same link. This is a very important concept, because IPv6's neighbor node discovery mechanism has the function of resolving the link layer address of the neighbor node, and can detect and monitor whether the neighbor node is reachable.

5. Link MTU: the maximum transmission unit (MTU) that can be sent on a link. For a link that uses a variety of link layer technologies, the link MTU is the smallest link MTU of all link layer technologies that exist on the link.

6. Path MTU (PMTU): in an IPv4 network, special settings are required to enable PMTU so that packets are not fragmented and reinstalled on the passing router. In the IPv6 network, by default, there is only slicing behavior in the source node and reinstallation behavior in the target node. PMTU is the smallest link MTU of all links from the source to the destination. Link MTU is the link layer payload of the maximum length that can be sent on this link.

The following figure shows the discovery process of PMTU in IPv6

IPv6 address representation

1. Preferred format of IPv6

In fact, the 128bit address of IPv6 is divided into segments every 16 bits, and each segment is converted into a 4-bit hexadecimal number separated by a colon. This representation is called the colon hexadecimal representation. The following is a binary 128bit IPv6 address.

0010000000000001000001000001000000000000000000000000000000000001

0000000000000000000000000000000000000000000000000100010111111111

It is divided into segments every 16 bits.

0010000000000001 0000010000010000 0000000000000000 0000000000000001

0000000000000000 0000000000000000 0000000000000000 0100010111111111

Convert each segment to a hexadecimal number and separate it with a colon

2001:0410:0000:0001:0000:0000:0000:45ff

This is the preferred format defined in RFC2373

two。 Compressed representation

There are many zeros in the above IPv6 address, and some even have zeros in a paragraph, which means it is troublesome. In fact, unnecessary zeros can be removed. For "unnecessary zeros", in the above example, the 0410 in the second paragraph is omitted from the beginning 0, not the end 0, so after the compressed representation, this segment is 410, which is a convention in an IPv6 address representation; for the middle 0 in a segment, such as 2001, is not omitted; for the case where all the numbers in a segment are 0, leave a 0. According to these principles, the above address can be expressed in the following form:

2001:410:0:1:0:0:0:45ff

This is still troublesome. In order to make it easier to write, RFC2373 stipulates that when there are one or more consecutive 16-bit zero characters in an address, a: (double colon) can be used to shorten the address length, but only one:: is allowed in an IPv6 address. It is important to note that when using a compressed representation, you cannot compress the valid zeros within a segment.

For example, FF02:30:0:0:0:0:0:5 compression cannot be represented as FF02:3:5, but rather as FF02:30::5. To determine how many bits zero:: represents, you can calculate the number of blocks in the compressed address, subtract it from 8, and then multiply the result by 16.

For example, the address FF02::2 has two blocks ("FF02" block and "2" block), which means that the other six 16-bit fast (a total of 96 bits) have been compressed.

Therefore, the above address can be expressed as follows:

2001:410:0:1::45ff

3. IPv6 address prefix

A prefix is part of an address, which is either a fixed value or the identification of a route or subnet. As the prefix of the IFv6 subnet or route identity, the identification method is similar to the representation of the subnet mask by the number of 1s in IPvv4, and the IPv6 prefix is represented by the "address / prefix length" representation.

For example, 23EO:0:A4::/48 is a routing prefix and 23E0:0:A4::/64 is a subnet prefix. In IPv6, the number of bits used to identify subnets is always 64, so the 64-bit prefix is used to identify the single subnet in which the node resides. For any prefix less than 64 bits, it is either a routing prefix or an address range that contains part of the IPv6 address space. According to this definition, FF0::/8 is used to represent a range of addresses, while 3FFE:FFFF::/32 is a routing prefix.

IPv6 address Typ

There are three address types for IPv6

1. Unicast: unicast addresses are used to communicate from one source to a single destination. A single interface has a unicast address identifier. Packets sent to a unicast address are passed to the interface identified by that address.

two。 Multicast: multicast addresses are used to identify multiple interfaces. Multicast addresses are used to communicate from one source to multiple destinations, and data is transferred to multiple interfaces.

3. Anycast: anycast addresses identify multiple interfaces. Using the appropriate routing topology, packets addressed to an anycast address are delivered to a single interface, the nearest of the interfaces identified by that address. The "nearest" interface refers to the nearest routing distance. Anycast addresses are used to communicate from one source to one of multiple destinations, and data is transferred to a single interface.

The IPv6 address always identifies the interface, not the node. A node is identified by a unicast address assigned to one of its interfaces.

RFC3513 does not define any type of broadcast address and instead uses an IPv6 multicast address. For example, the subnet of IPv4 and the limited broadcast address are replaced by the reserved IPv6 multicast address FF02::1.

IPv6 unicast address

The following address types are unicast IPv6 addresses:

Global unicast address

Link-local address

Site local address

Special IPv6 address

Compatibility address

1. Global unicast address

Global unicast addresses are equivalent to the public network addresses of IPv4, and they are globally routable and accessible in the IPv6 part of the Internet (called IPv6 Internet). The global unicast address is commonly referred to as the IPv6 public network address.

The structure of the global unicast address is shown in the following figure:

As shown in the figure above: the address with 001 as the first three bits is called an aggregable global unicast address, and the meanings of each field are as follows

TLA ID: top-level aggregation identifier, which identifies the highest level of the routing hierarchy and is managed by the Internet Authority for assigned numbers (IANA). IANA is responsible for assigning TLA ID to regional Internet registries, and regional Internet registries assign each TLA ID to large, permanent ISP.

Currently, IANA is responsible for the allocation of IPv6 addresses, which is mainly implemented by three local organizations:

* RIPE-NCC (www.ripe.net) in the European region

* INTERNIC (www.internic.net) in North America

* APNIC (www.apnic.net) in Asia Pacific

RES: reserved for future extension of the length of TLA ID or NLA ID

NLA ID: a next-level aggregation identifier that allows ISP to establish a multi-level addressing structure in its own network

SLA ID: site aggregation identifier, which is used by each individual organization to identify subnets in its own site

Internet ID (interface ID): the last 64 bits represent the interface ID, which is equivalent to the node ID or host ID in IPv4

two。 Local unicast address

There are two types of unicast addresses used locally:

Link-local address: used between neighbors on the link and the neighbor discovery process that defines how nodes on the IPv6 subnet interact with hosts and routers.

It can only be used between nodes connected to the same local link and cannot be routed between subnets within the site.

Note: IPv6 routers will never forward link-local traffic out of the link

Site local address: used to organize communication between different nodes within the same site on the Intranet.

Note: an updated version of the Internet Protocol Version 6 (IPv6) Addressing Architecture (Internet Protocol version 6 (IPv6) addressing Architecture) standard has now been released as an Internet draft, which prohibits the use of site-local addresses. This new Internet draft on the IPv6 addressing standard will phase out RFC3513. The reason for the prohibition stems from the fact that there is no address shortage in IPv6, and to avoid damage to the end-to-end model, which is the biggest flaw in the use of NAT in IPv4's network.

3. Special IPv6 unicast address

The following is a special IPv6 address:

(1) No address specified

An unspecified address (0 / 0 / 0 / 0) indicates that the address is missing, which is equivalent to the unspecified address 0.0.0.0 of IPv4. An unspecified address is usually used as the source address of a packet to verify the uniqueness of the temporary address. An unspecified address is never assigned to an interface or used as a destination address.

(2) Loopback address

The loopback address (0VOVOVULO) identifies a loopback interface. Using this address, a node can send packets to itself; this address is equivalent to the loopback address 127.0.0.1 of IPv4. Packets addressed to loopback addresses are never sent on the link and are not forwarded by the IPv6 router.

4. Compatibility address

To facilitate the transition from IPv4 to IPv6, the following addresses are defined:

(1) addresses compatible with IPv4

IPv4-compatible addresses, 0:0:0:0:0:0:w.x.y.z or:: w.x.y.z (where w.x.y.z is a dotted decimal representation of a public IPv4 address) for use by IPv6/IPv4 nodes that use the IPv6 Internet to communicate. The IPv6/IPv4 node is a node that uses both IPv4 and IPv6 protocols. When the IPv6 node wants to access the IPv4 node, you can use this address as the destination address of the IPv6 node to access the IPv4 node. The NAT/PT gateway only needs to take the low 32 bits out as the destination address of the IPv4 packet. This method of IPv6 address composition requires that each IPv6 node has a corresponding IPv4 address.

(2) IPv4 mapped address

IPv4 maps the address, 0:0:0:0:0:FFFF:w.x.y.z or:: FFFF:w.x.y.z, to represent a node that uses only IPv4 as an IPv6 node. IPv4 mapped addresses are used only as internal representations. IPv4 mapped addresses are never used as source or destination addresses for IPv6 packets. IPv6 in Windows Server 2003 and Windows XP does not support IPv4 mapped addresses.

3) 6to4 address

6to4 is the tunneling technology described in RFC3056. When using 6to4, encapsulate IPv6 traffic with IPv4 headers before sending IPv6 traffic over the IPv4 network. The global address prefix used by 6to4 is 2002:WWXX:YYZZ::/48, where WWXX:YYZZ is both the next level aggregation Identifier (NLA ID) part of the global address and the colon-separated hexadecimal representation of the public IPv4 address (w.x.y.x) assigned to the site or host. The full 6to4 address of the 6to4 host is 2002:WWXX:YYZZ: [SLA ID]: [Interface ID]. Unlike IPv4-compatible addresses, 6to4 runs the IPv4 protocol on the public network.

It is worth noting that compatible addresses are not just the ones listed above. As RFC's definition of compatible addresses is still in the process of further improvement, there will be more address types.

IPv6 Multicast address

The so-called multicast means that a single packet sent by a source node can be accepted by the member nodes of a specific multicast group. The concept of multicast should be clear in the following aspects:

* any node can be a member of a multicast group

* A source node can send packets to a multicast group

* all members of the multicast group receive packets destined for the group

* Multicast addresses cannot be used as source addresses or appear in any routing header in IPv6 packets

In an IPv6 network, a multicast address is identified by a specific prefix, up to 1 in the first 8 bits, as shown in the following figure:

The Flags field has 4 bits. Currently, only the last bit is used (the first 3 bits must be set to 0). When the position is 0, it indicates that the current multicast address is a permanently assigned multicast address assigned by IANA, for example:

FF00:0:0:0:0:0:0:0

FF01:0:0:0:0:0:0:0

……

FF0E:0:0:0:0:0:0:0

FF0F:0:0:0:0:0:0:0

The multicast addresses listed above are reserved and can never be assigned to any multicast group.

When the value is 1, the current multicast address is a temporary multicast address (not permanently assigned). Multicast addresses that are not permanently assigned make sense only in a given range.

For example, a group that has a non-permanent site-local multicast address FF15:0:0:0:0:0:0:101 at a site has nothing to do with groups in a different site that use the same group identifier, nor does it have anything to do with groups that use the same group identifier to assign non-permanent addresses in different ranges.

Scope is used to limit the range of multicast data streams sent in the network. This field occupies 4 bits. RFC2373 defines this field as follows:

0: reserved

1: node local scope

2: link-local ran

5: local site scope

8: organize the local scope

E: worldwide

F: reservation

Other values are not defined

As shown in the following figure, showing node local scope, link local scope, site local scope

IPv6 anycast address

Anycast address is an address type unique to IPv6, which is used to identify a set of network interfaces (usually belonging to different nodes). The router sends a packet with an anycast address to the nearest network interface. Suitable for One-to-One-of-Mary (one-to-one group) communication situation. The receiver only needs to be one of a set of interfaces. For example, mobile users need to access the nearest receiving station because of their different geographical location. Only in this way can the early geographical location of mobile users be free from too many restrictions.

Anycast addresses are assigned from the unicast address space, using any format of the unicast address. Just look at the address itself, the node can not distinguish between anycast address and unicast address. Therefore, the node must be explicitly configured to indicate whether it is an anycast address. Currently, anycast addresses are used only as destination addresses and are assigned only to routers.

One of the uses of anycast addresses is to identify a group of routers that belong to an organization that provides Internet services. Such addresses can be used as direct addresses in the IPv6 routing header, allowing packets to be delivered through a specific family of aggregation addresses. Other possible uses are to identify a group of routers connected to a particular subnet. The strict definition of anycast address is still under discussion, but the following features are clear:

(1) Anycast address cannot be used as the source address of an IPv6 packet

(2) Anycast addresses cannot be assigned to IPv6 hosts, but only to IPv6 routers

IPv6 interface identifier

The last 64 bits of a unicast IPv6 address are the interface identifier, which is unique to the 64-bit prefix of the IPv6 address. There are several types of IPv6 interface identifiers:

(1) A 64-bit interface identifier derived from an extended unique identifier (EUI-64) address.

(2) randomly generated interface identifiers change over time to provide some concealment.

(3) automatic configuration of full-state addresses (for example, interface identifiers assigned during dynamic host configuration protocol IPv6 version [DHCP6]).

Basic commands for IPV6

R1 (config) # ipv6 unicast-routing / / enable IPV6 routing on the router R1 (config-if) # ipv6 enable / / enable IPV6 under the interface will automatically generate a link-local address R1 (config-if) # ipv6 address 2001 Groupe 1Universe 64 / / specify an IP address After configuration, it automatically generates a link-local address R1 (config-if) # ipv6 address FE80:0:0:0:0123:0456:0789:0abc link-local / / manually specifies the link-local address R1 (config-if) # ipv6 address 2001-0410-0-0-eui-64 / / uses eui-64 format to automatically generate the low 64-bit R1 (config-if) # ipv6 unnumbered / / of the IPV6 address The interface uses the MAC address of another interface to generate the source address R1 (config-if) # ipv6 mtu 1500 / / configure the MTU value of the interface R1 (config-if) # ipv6 nd suppress-ra / / turn off the automatic prefix R1 (config-if) # no split-horizon / / turn off split horizon Note split horizon of IPV6 is turned off during the process Instead of displaying IPV6 show ipv6 interface E0 / / under the interface, the information of the IPV6 interface is displayed, including IPV6 address, link-local address, joined multicast address and requested node multicast address.

Note: serial port and loopback port will borrow the MAC address of Ethernet port to generate link-local address.

Static rout

R1 (config) # ipv6 route 2001 Groupe hand 64 e0 fe80::1234:abcd:1234:abcd (link local address of the next hop)

RIP

Use the UDP521 port in IPV6 and port 520 in IPV4

Use Multicast address: FF02::9

Operating radius 15 hops

R1 (config) # ipv6 unicast-routingR1 (config) # ipv6 router rip wolf / / must have a process number R1 (config-if) # ipv6 rip wolf enable / / must enter the RIPR1# show ipv6 routeR1# show ipv6 route ripR1# show ipv6 ripR1# show ipv6 rip database of the interface enabled under the interface

When the IPV6 is sent out by the originating router and the ingress plus 1.IPV4 is added at the egress interface, the Metricl value of the Mechl is added at the egress interface.

Split horizon of IPV6 is turned on (turned off during the process) of the entire router, IPV4 is turned on under the interface, and split horizon is turned off in HUB-spoke mode of frame Relay

OSPF

The OSPFV3 version is used in IPV6

R1 (config) # ipv6 router ospf 110R1 (config-router) # router-id 2.2.2.2 / / must manually specify the identity of an IPV4 address. R1 (config) # int s0R1 (config-if) # ipv6 ospf 110 area 0 / / cannot be automatically selected under the interface to declare R1 (config) # int lo0R1 (config-if) # ipv6 ospf 110 area 0 / / Loop is still a host route, 128 bits You can change the ringing show ipv6 route ospfR1 (config) # int s0R1 (config-if) # ipv6 ospf neighbor 2001 int s0R1 2 / / OSPF manually by changing the network type, while the neighbor does it under the interface, while the IPV4 does it under the process.

Is-is

R1 (config) # router isisR1 (config-router) # net 49.0001.2222.2222.2222.00R1 (config-router) # log-adjacency-changes all / / when the neighbor gets up, give a hint that R1 (config) # int s0R1 (config-if) # ipv6 router isis / / IPV4 ISIS is also enabled under the interface.

Redistribute direct connection

R1 (config) # router isisR1 (config-router) # redistribute connected / / redistribute R1 (config) # router isisR1 (config-router) # address-family ipv6 / / directly in the ISIS process in the IPV6 must enter this process R1 (config-router-af) # redistribute connected / / redistribute commands must be used in the address-family process

BGP

Use the TCP179 port, as in IPV4

R1 (config) # router bgp 3R1 (config-router) # no autosummaryR1 (config-router) # bgp router-id 3.3.3.3R1 (config-router) # no synchronizationR1 (config-router) # neighbor 2001 13 config-router 1 remote-as 1R1 (config-router) # address-family ipv6 / / enter the address-family process R1 (config-router-af) # neighbor 2001 13 config-router 1 activate / / activate under the address-family process Otherwise, it will not work. R1 (config-router-af) # network 3::/64R1# show bgp ipv6 neighborR1# show bgp ipv6 summary / / Note that bgp and ipv6 reverse the ringing show bgp ipv6 ringing clear ip bgp * / / the commands for clearing neighbors are the same as in IPV4.

IPV6 ACL

In IPV6, ACL can only be used to filter data flows, not routes.

In IPV6, ACL must be named, similar to IPV4 named access list

1. Standard access lists can be filtered based on source and destination

2. The extended access list can be filtered based on source address, destination address, transport layer protocol, source port, destination port, and other features.

In fact, IPV6 has no distinction between standard and extension, only extended, named ACL.

Case 1:

R1 (config) # ipv6 access-list wolfR1 (config) # deny ipv6 2001 141Groupe 1215 anyR1 (config) # permit ipv6 any anyR1 (config) # int s0R1 (config-if) # Ipv6 traffic-filter wolf out

Case 2: on R1, only routes for 2002, 1, 12, 12, and 64 are allowed to pass to R3

R1 (config) # ipv6 prefix-list wolf permit 2001:12::/64R1 (config) # ipv6 prefix-list wolf permit 2002:1::/64R1 (config) # ipv6 router rip xwxR1 (config-router) # distribute-list prefix-list wolf out Serial1R1 (config) # clear ipv6 rip xwx

In IPV6, the distribution list can only be followed by prefix, not ACL

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.