Organizations that believe Internet Protocol version 6 (IPv6) is not in their future cannot simply ignore it, as this article explains with a touch of irony, while this article ends with the warning: “the question is not when you should begin managing IPv6, but what should you be doing right now!”.
This article from the American Registry for Internet Numbers (ARIN) describes the business case for IPv6. This document from the Internet SOCiety (ISOC) describes some of the global trends that are driving deployment of IPv6. This article goes even further, explaining why IPv4 will not be in your future.
Organizations that believe the Internet of Things (IoT) is in their future should read this article. Even organizations that abandoned earlier efforts to transition to an IPv6-only network (such as Microsoft) will eventually make such a transition.
Even though you may have decided that your organization, network, or enclave does not need to deploy IPv6 at the present time, you cannot safely and securely ignore IPv6. IPv6 is quite likely already present on your network. As a case in point, if you have ever watched a YouTube video, you have used IPv6. If you used a cellphone to view this web page, IPv6 was used when connecting to the IPv6 Knowledge Base website, as this article explains.
The title of this article 7 points your security team needs to know about IPv6 (but probably doesn’t) speaks for itself.
The presentation Security in an IPv6 World (Myth and Reality) and the detailed series of 10 IPv6 Security Myth articles:
#1 I'm Not Running IPv6 So I Don't Have to Worry
#2 IPv6 Has Security Designed In
#3 No IPv6 NAT Means Less Security
#4 IPv6 Networks are Too Big To Scan
#5 Privacy Addresses Fix Everything
#6 IPv6 is Too New to be Attacked
#7 96 More Bits, No Magic
#8 It Supports IPv6
#9 There Aren't Any IPv6 Security Resources and
#10 Deploying IPv6 is Too Risky
discuss the risks of ignoring IPv6 and the benefits of taking action to minimize those risks.
This article Common Misconceptions about IPv6 Security (video available here) touches on the same myths and adds some new ones:
IPv6 is more/less secure than IPv4
IPv6 is IPv4 with longer addresses
IPsec makes IPv6 more secure than IPv4
Address scanning is impossible in IPv6
No NAT makes IPv6 insecure.
The articles It’s fake news and It’s fake news (cont) along with an article asserting that quantum computing successfully merges IPv4 and IPv6 to form IPv5 provide yet another perspective on IPv6. (By the way, this article explains why there was no IPv5.)
This article describes tools and techniques that can detect the presence of IPv6 on your network. The presence of undetected IPv6 on networks has long been recognized as a concern, as shown by this Federal Information Notice and this warning about Malware Tunneling in IPv6, both issued by the United States-Computer Emergency Readiness Team (US-CERT) in 2005.
The specific steps necessary to disable or uninstall IPv6 on many routers and operating systems are described in articles in the IP Transport section. As a minimum the National Institute for Standards and Technology (NIST) recommends that organizations not yet deploying IPv6 should block all incoming and outgoing IPv6 traffic (native and tunneled) on the organization's perimeter border routers or firewalls. (See Section 6.9 of NIST Special Publication 800-119, Guidelines for the Secure Deployment of IPv6, December, 2010.) These tunneling mechanisms include 6over4, 6to4, IPv6-in-IPv4, ISATAP, and tunnel brokers (which all typically use protocol 41) and the TEREDO tunneling mechanism (which typically uses UDP port 3544 to establish its tunnel). In addition, border routers or firewalls should block packets with a source or destination address prefix of 192.88.99.0/24 (the default prefix for public 6to4 anycast gateways).
Sites running a Postfix version 2.2 (or later) mail transfer agent (MTA): You must
include the following in your /etc/postfix/main.cf:
inet_protocols = ipv4
Without this line, Postfix defaults to using IPv6 for mail delivery, and when that fails
Postfix will stop trying. Postfix will not use IPv4 without it.
Internet Protocol version 6 (IPv6) is not backwards compatible with IPv4, so networks must be changed to deploy IPv6.
This IPv6 Knowledge Base Initial Introduction provides an overview of the structure of the Defense Research and Engineering (DREN) IPv6 Knowledge Base. The IPv6 Knowledge Base consists of nine major sections, with links to those sections appearing in the column on the left side of every IPv6 Knowledge Base article:
- An overview of the General Information section
- An overview of the Deployment section
- An overview of the IP Transport section
- An overview of the Infrastructure section
- An overview of the Network Management section
- An overview of the Security section
- An overview of the Applications section
- An overview of the Testing section
- An overview of the IPv6 and IoT Frequently Asked Questions (FAQ) section.
1. The General Information section contains articles covering a wide variety of information about IPv6, from policy and standards to what to do if an organization is not going to deploy IPv6, as follows:
- The IPv6 Knowledge Base Initial Introduction article you are currently reading provides an overview of the structure and scope of the IPv6 Knowledge Base.
- An IPv6 Not Needed Here!?! article briefly describing the actions that should be taken by organizations that have decided not to deploy IPv6.
- A United States (US) IPv6 and IoT Policy, Guidance, and Best Practices article providing a list of policy, guidance and best practices documents issued by organizations inside the United States.
- A Non-United States IPv6 and IoT Policy, Guidance, and Best Practices article providing a list of policy, guidance and best practices documents issued by organizations outside the United States.
- An Overview of Lessons Learned Deploying IPv6 article providing high-level summaries and discussions from multiple points of view of lessons learned deploying IPv6 by various United States (US) Department of Defense and other US Federal government departments and agencies, private organizations, and academia (both in the US and around the world), as well as for the home and Small Office/Home Office (SOHO) user.
- An IPv6 and IoT Networking Standards article providing a general overview of the documents that define networking standards and the organizations that develop and publish them.
- An IPv6 and IoT Points of Contact article listing communities and public forums involved in IPv6 and IoT planning and deployment efforts.
2. The Deployment section contains articles discussing various aspects of deploying IPv6, including:
- A Before you Begin article about things to consider before planning an IPv6 deployment.
- An Overview of Process which provides planning material, information about the approaches used to deploy IPv6 by organizations of all types (US Federal government departments and agencies, Internet Service Providers, businesses, and academic institutions), all sizes (from international enterprises to small businesses and individual users), and locations (in the US and around the world), and in-depth information on management, planning, and deployment processes.
- An IPv6 “Boiler Plate” Acquisitions Language article providing an overview of US and European regulations governing the acquisition process and examples of language developed by various organizations to be used in solicitations and acquisition documents.
- An IPv6 Training and Learning article providing information on training available at no cost or from commercial entities and free sources for learning about IPv6, and a limited amount of tutorial information.
- An IPv6 Transition Mechanisms article providing a quick overview of the various IPv6 transition mechanisms that are available.
- An IPv6 Software article that identifies many software products that either support IPv6 or are IP-protocol neutral.
- An IPv6 in the Home and Small Office/Home Office (SOHO) article about the IPv6 deployment process in the Home and SOHO.
3. The IP Transport section contains articles about the specifics of enabling and (when required) disabling IPv6 in many different computer operating systems (several versions of Linux, Apple macOS and OS X, Microsoft Windows, and UNIX, as well as others) and router firmware (Nokia [formerly Alcatel-Lucent], Extreme Networks, Cisco, and Juniper).
4. The Infrastructure section contains articles about the specifics of installing and configuring software that supports IPv6 infrastructure services, such as web, email, DNS, and DHCP servers. It also contains articles about selected infrastructure topics, such as cloud, VPN, and Microsoft Windows services/servers.
5. The Network Management section contains articles about planning for and deploying wide-area, enterprise, and site networks that support IPv6, guidance and examples for obtaining IPv6 address allocations, guidance and examples for Address Plans, recommended management practices, and troubleshooting tips and techniques.
6. The Security section contains articles about best practices, general and specific (Check Point, Cisco, Juniper, and several versions of software based) router and firewall firmware configuration guides, Internet Protocol Security, Trusted Internet Connection, and Windows Internet Connection Sharing.
7. The Applications section contains articles providing guidance for and examples of developing, enabling, and testing applications software to support IPv6, specifics of configuring and using IPv6 web browsers, and describing IPv6 support in selected applications such as Java and Kerberos.
8. The Testing section contains articles about IPv6 product and network test techniques in general, formal IPv6 product test programs and the testing results they provide, and IPv6 network testing results.
9. The IPv6 and IoT Frequently Asked Questions (FAQ) section provides information about topics of interest to people new to IPv6 and IoT, including information about this IPv6 Knowledge Base and other websites that provide general information about IPv6 and IoT, information about the deployment status of IPv6, and information about developing or enabling applications to support IPv6.
The General Information section provides individuals and organizations interested in discovering more about the general subject of deploying IPv6 with information such as: existing official policy, guidance and standards for Internet Protocol version 6 (IPv6), contacts for national organizations and government bodies that are actively deploying IPv6, and the experiences of those who have already deployed IPv6 in their organizations. Please explore the web pages shown in the General Information section in the column to the left, and in the other sections following the General Information section.
IPv6 Knowledge Base Initial Introduction
United States (US) IPv6 and IoT Policy, Guidance and Best Practices
Non-United States IPv6 and IoT Policy, Guidance, and Best Practices
Overview of Lessons Learned Deploying IPv6
This Defense Research and Engineering Network (DREN) 4 Performance Work Statement (PWS) was originally issued in Dec 2019, in order to continue providing state-of-the-art Wide Area Networking (WAN) services as a follow-on to the services provided under the DREN III PWS. The contract was awarded in May 2021 and will enable further expansion of the DREN WAN capability.
This DREN 4 PWS [PDF version] (Dod PKI required) provides details about the services and capabilities available under the contract.
Purpose
The Software-Defined Networking (SDN) knowledge base provides a concise, yet comprehensive overview of the many technologies subsumed under the broad topic SDN, and collects in one place the lessons-learned by many individuals and companies that have deployed SDN or associated software architectures such as Network Functions Virtualization (NFV). The SDN knowledge base also provides supplemental information for those already using or planning to use SDN or associated software architectures.
Where to Begin
A first-time visitor to the SDN knowledge base might want to begin by reading the Introduction, What is a Software-Defined technology, and What is Virtualization sections at the beginning of the Software-Defined Overview article and then explore the Frequently Asked Questions article.
SDN and Internet Protocol version 6 (IPv6)
There are 5 layers (or 4 if you don’t count the physical layer) in the Internet Protocol suite (also known as TCP/IP) that defines the conceptual model for the Internet. Updating the networking infrastructure at a site already connected to the Internet to include SDN along with associated software architectures, or deploying a networking infrastructure including SDN and associated software architectures at a site not previously connected to the Internet, does not require any changes at the Internet Protocol (IP) or lower layers nor does it create any IP packet format incompatibilities.
Consequently, a decades-long coordination effort between and among sites on the Internet is not needed (in stark contrast to the on-going world-wide IPv4 to Internet Protocol version 6 (IPv6) Internet transition, where such coordination efforts are essential). Such updates and deployments are already taking place at individual sites and can continue to occur in the United States and around the world in an uncoordinated fashion.
Because IPv4 has been the only IP for many years, existing software typically supports IPv4 (although this is less likely for software developed after 2016). Unless otherwise noted, specific software products mentioned in this Overview support IPv4 and have been informally determined, based on users’ experiences and developers’ statements, to also support IPv6. (Such lack of support for IPv6 by SDN software products is rare.)
An added benefit of such updated or newly-deployed infrastructure is that it will be able to support IPv6, and it is important that SDN support IPv6, as this article explains.
SDN and the Internet of Things (IoT)
SDN is an enabler of the IoT, as explained in this 2016 article.
SDN and DREN
Some user sites on the Defense Research and Engineering Network (DREN) started updating their existing local networking infrastructure to include SDN architecture in 2012. CenturyLink, Inc. offered SDN and NFV services to DREN since January 2017. In 2021, Verizon Business Network Services LLC began providing networking infrastructure and services to DREN, including a variety of SDN services .
To contribute an article to the SDN knowledge base, or to correct/update an existing article, please contact sdn-team [at] dren.mil.