Ok, June 8 we have IPv6 day coming.... this will be a test day world wide.
But we need to prepare for the use of it anyway in the near future.
So far I am a complete know-no regarding this issue and I'll bet I am not the only one!

I think we need to build a checklist / tuturial / Wiki on what to do to make our MT-ROS networks ready for the IPv6 future ahead.

Searching on "IPv6" in MT domain gives me loads of forum posts already but it seems most are related to guys already playing with it and having specific questions related. But I need basic, general advice on implementation. Just a start up guide. I am sure more specific questions will arise thereafter!

First some initial questions:
Does IPv6 package work on all routerboards?
Does it need any further package to come along?
After uploading and installation, what is next step?
Do I loose IPv4 compatibility after install of IPv6?
Where do I change settings in ROS? Only in "IP" menu and submenu items or also on other chapters?
Is it enough to only change my border gateway, and leave LAN IPv4?
If my LAN needs to be migrated, what does that mean for routers owned by my clients? What does it mean for their PC's (and Mac's, smartphone's, I-pad's etc)

In other words: How many lions and bears on the road to IPv6????

The biggest problem you run into is how you get their /48 or /56 or /64 on the lan interface since we have no DHCPv6-PD or even DHCPv6

/125, /124, /123

No different than V4 with exception to the fact that you have alot more addresses.
Set routers statically and use OSPF-V3 to route.

Why use DHCP anything, when auto config works perfectly fine?

IPV6 is an internet unto itself.

Why use DHCP anything, when auto config works perfectly fine?

To delegate prefixes to your end users?

/125, /124, /123

No different than V4 with exception to the fact that you have alot more addresses.
Set routers statically and use OSPF-V3 to route.

Why use DHCP anything, when auto config works perfectly fine?

IPV6 is an internet unto itself.

Well clearly you don't have much experience with IPv6, For a start you shouldn't use smaller than a /64 even for PtP links for sanity and computability.

DHCP is needed for A) stateful lists of computers on network, B) PD to give end users their v6 address for their lan - You can API it if the CPE is ROS but every other router is using DHCPv6-PD

I really don't know about /64s everywhere. It does lead to some problems, and is incredibly wasteful.
http://blog.ioshints.info/2011/05/ipv6- ... stion.html
Quick link to one reason /64s can end up being a very bad thing until TOR switch vendors catch up with features we've had for IPv4 forever. I'm not aware of any TOR that can do ND PPS rate limiting like they can do for ARP. Even then ND records tend to have long lifetimes, and the address space is just vast.

But this is probably getting off topic for the thread, it's just all very interesting stuff and now is a great time to jump into IPv6. Rudy, just like this forum is a bad place to ask "hey, what is this wireless thing I keep hearing about" there are much better places to learn about IPv6 fundamentals. There are lots of primers around, just Google for them. HE (Hurricane Electric) also has a neat program to get you going with a tunnel to get your own IPv6 space into your network and start playing around - not to be used for customers, but great for labs to start out with.

Anything smaller than a /64 runs into more problems than it creates, If an attacker has access to layer 2 core then you have problems, at the access level you should be running it over PPP anyway which means the ND attack is for lan's. Almost all large players are doing /64 for PtP links and infact the RFC's recommend it.

There is infact an RFC on why not to use /127's on PtP links
http://tools.ietf.org/html/rfc3627

Which is also open to a pingpong attack

As just one example there is a heck of a lot of metro-e going around for bigger links, you can't run all access layers via PPP.

There's also shared hosting environments, for example. Or even dedicated, rented services where someone hosts more than one server for you on a shared network between the servers. That someone now has to worry about their switching infrastructure if they also give you IPv6 connectivity.

And so on. Point being that the RFC saying no link should be smaller than a /64 might not be ideal for all use cases. At least until the vendors catch up and IPv6 features are comparable to what we have with IPv4 (nudge, nudge, Mikrotik).

Beccara explains the basics very well in this video: http://www.tiktube.com/?video=pLeJ3hmld ... vElmopoIG=

As just one example there is a heck of a lot of metro-e going around for bigger links, you can't run all access layers via PPP.

There's also shared hosting environments, for example. Or even dedicated, rented services where someone hosts more than one server for you on a shared network between the servers. That someone now has to worry about their switching infrastructure if they also give you IPv6 connectivity.

And so on. Point being that the RFC saying no link should be smaller than a /64 might not be ideal for all use cases. At least until the vendors catch up and IPv6 features are comparable to what we have with IPv4 (nudge, nudge, Mikrotik).

There are some specific cases where shorter than /64 is needed but they are rare and the risks of going shorter are such that until someone has working and detailed experience of v6 they shouldn't even be aware of it, It break's alot and is also more of an issue when working with /127 links due to address lengths which forces use of DNS etc.

The biggest problem you run into is how you get their /48 or /56 or /64 on the lan interface since we have no DHCPv6-PD or even DHCPv6

"DHCPv6-PD"?? What stands "PD" for?

hmm, I was hoping on some info on where to start;

1. Install IPv6 package
2. ??? then what, how does dummy proceed to get IPv6 on the road?
3. ?
etc.

This might look like silly stupid question but I'll bet many of us have no idea on how to implement IPv6.
I am hoping a basic tutorial can be setup to print in a Wiki Manual

I looked at the tiktube video of Becarra that normis pointed at, but the sound is so weak I can't hear what is being said, with all volume controls of this PC open! So its not a lot of use...

DHCPv6-PD is prefix delegation.

If you have MT as the CPE then you have it a bit easier than those that dont. It's a little hard to point you in the right direction without knowing your network setup a bit better, if you just wanna play with it on your home connection then grab a tunnel from www.tunnelbroker.net and follow the guide in the wiki to use 6to4 to tunnel it, play around with setting it up on your lan and move on from there

Also do you have your own IP allocation from an RIR? If so it's easy to get your own v6 allocation

With IPv6 your best to start at the edge where you hook upto your upstream provider and work back, do you have a bgp interconnect with them? Is it just static routes etc etc??

Also do you have your own IP allocation from an RIR? If so it's easy to get your own v6 allocation

With IPv6 your best to start at the edge where you hook upto your upstream provider and work back, do you have a bgp interconnect with them? Is it just static routes etc etc??

Well, I'm just have a static routed network I'm afraid. No time and manpower to go into more sophisticated routing etc. yet.
Anyway, I do own a full /24 network but also have 6 adsl lines with dynamic IP addresses.
At the edge of my network either masquerade-nat (adsl lines) takes place or client to public src-nat in the connections to symmetric (with my public /24 network)

Inside my network it is all static routes towards several AP networks from where the connected CPE's src-nat to the clients LAN's. (And often client has yet another wifi router that does do nat)

Would this make it simple? (OH, now you're telling me it is too simple a setup anyway....! Can be, you're probably right. But a man can only do so many things at a time..... )

Hmmmm, Thats a tricky setup to do, There is no NAT in IPv6 so your DSL lines are useless. You could get a /48 from a tunnel broker and use that depending on where you are in the world and how close to HE's PoP.

If I were you I would stick a 6to4 tunnel on your edge router and hand out /64's from that, You can statical route them to the AP's.

But first off I've grab a tunnel for your home connection and play around with that

There is no NAT in IPv6 so your DSL lines are useless.

??? 80% of internet users have dsl lines? You are telling they can't use IPv6?
My adsl lines are nothing different from the ones any normal neighbour gets from same IP. Instead of several home devices I spread the capacity to several customers....

Yes but you are using them in such a way that you can't with v6, There is no NAT which means you need whoever is supplying you with the DSL needs to route the v6 space to you. You can't masq with v6 like you are doing with v4 right now

Let me think:
I have a home with 4 PC's, all connected wired or wireless to adsl router provided by ISP. This wifi router has a NAT firewall so all local LAN adresses are translated to the PPoE (or dhcp assigned) address by the ISP.
This is what most people have.

Now, instead of 4 PC's I have one router behind this adsl/wifi/router that collects traffic from several users and also keeps a routing table to route back to clients (for management purpose.)

Imho the adsl/router is now just connected to one device (my router) instead of 4 PC's but all the rest is all the same? So I do not understand why my setup now would give a problem? If I am ´doomed´ for this, I won't be the only one!

In your post you have stated you have 6 dsl lines which you split traffic out over and use NAT to hide the client IP's behind the ISP given IP of the dsl line you are going out over.

If this is correct then you have a problem, There is no NAT in v6 and as such no way to load balance without a BGP interface across each of the DSL lines.

Perhaps a diagram would help explain your setup better?

Well, simply said:

Bunch of clients enter with their LAN IP's in rb1000.
This rb1000 connects (for now) to 3 adsl modems.
Each adsl modem is in bridge mode, so the PPoE interface is on the rb1000 where the interface thus recieves an IP from ISP.

In rb1000 I have PCC loadbalancing with policy routing.
In firewall NAT I have set masq. rules on each pppoe-out interface. So traffic leaving to each adsl modem (its not a router anymore since it is bridged) leaves that interface with the IP of that interface.

From the point of one adsl line it only means that traffic presented to that LAN side of that adsl-modem has the IP of the device on LAN side of it.
What would now be the difference if this device is a router with 4 PC's in a LAN or a router with many more PC's in several LAN's where this router also send some traffic to other ADSL line?

As far as data packet concerns coming from client, it hits the rb1000, is routed to an interface and its src IP is replaced by the pppoe IP before it travels further on the internet.

In normal situation data packet comes from client, hits the adsl router, get an IP from the pppoe interface and travels further on the internet. I do not see what the different is?
(If there is, sorry for my lack of understanding, but I don't see it..?)

Ok better understanding now, With v6 their is a fundamental change in how IP's are handed out on clients lan.

In the case of a home user with say 4 devices they currently get 192.168.0.x/24 address which are then NAT'ed behind <Random Public IP>

The same home user when they get v6 gets a public IP on each device internally, So they dont get a 192.168.0.x/24 IP it's a 2403:d200:2000:4000:<Client Mac>/64 IP.

This means in your case that the IP's you hand to a client have to come from your ISP unless you run a tunnel and even then you may need 1 tunnel per DSL line and split your clients up into pools, There is no NAT under v6 so you can't hide them

OK, also some better understanding now from this end...

So, what you are saying, that IPv6 has no NAT but that each clients PC (in both mine or standard adsl client situation) gets its own full IP address which than also has its mac embedded?
So basically all IP-devices in the world become ´visible´ on the worldwide network?
djee, what repercussions would that have on security? Now most private device at least are ´hidden´ behind a nat firewall. But you say that will be gone?
I have to consume this...

It takes a verrrry long time to do an IP scan on a /64 so scan based hacks are almost out which leaves the same attack vectors we have with v4 as XSS and dumb users clicking spam links.

But yes, under v6 every device gets a public routable IPv6 address

Best thing to do is to start to conceptualize IPV6 and worry about the symantics later.
First off, I would recommend thinking of IPV4 as Hexidecimal (ie FF:FF:FF:FF = 255.255.255.255).
Now IPv6 is simply 4 hex digits 8 times as oppose to ipV4 being 2 Hex digits 4 times (ie ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff).

Aside from symantics, IPV6 is really not that much different than IPV4.

This will start you out with regards to how to get it up and running.
Web servers, and dns servers are also simply to get up and running.

I really do not care about symantics, as long as it works.
As far as smaller than /64 being more secure, a symply trace route will expose your address routing anyhow, but perhaps I will investigate the security issues.

I still can not see IPV6 being any less secure than IPV4 is currently.

As far as delivery of address space to the client, I am also perplexed, aside from giving them a subnet and have them self confgure their own routers.

As an ISP you control the addressing assigned to the clients outer interfaces, but are there not legal ramifications and liabilties in having control of a clients internal addressing schemas?

I as an ISP have no interest in getting overly involved in a clients internal networking choices.

That part is simple(Handing them to the client), Rudy's problem is that he is using normal DSL lines bonded/balanced and NAT'ing the current v4 traffic. An approach that wont work under v6

If rudy is doing the nating then he just has to run dual stack.

I have Natted, as well as Public unNatted IPV4 as well as a dual stack IPV6.

IPV6 must be viewed as another internet (Internet 2.0).
Completely incompatable to IPV4 (Internet 1.0).

It just happens to work over the same Physical media.
So when setting up IPV6 it must be tackled by completely ignoring the IPV4 setup (with some exceptions [not going there]).

Translating I would NEVER recommend, as it creates a reliance upon methodologies which WILL fade into oblivion.

As far as symantics and security issues they should never be ignored, however, all specifications for everything are created by people who disagree with details of the final outcome ( not everyone involved in IPV6 development agrees fully with all details of how IPV6 ultimately works ).

As a person deploying IPV6, one does not have to completely agree to all the details either.


BTW what is the 4digit hexidecimal part called in V6 ( an octet?).
To me an octet is a single base 8 digit ( a single octal digit ).

If he was running a single DSL line you would be correct but he states he is running 6 and NAT'ing as data goes out each line, this wont work under v6

As far as smaller than /64 being more secure, a symply trace route will expose your address routing anyhow, but perhaps I will investigate the security issues.

I still can not see IPV6 being any less secure than IPV4 is currently.

It's not. Some problems are new, some are old ones in a new dress coming back. Some are due to the fact that vendor hardware is behind on some features.

Cisco Press has a very good book out called "IPv6 Security". Some chapters are Cisco centric for their devices, but most of it is just a fairly nice summary of general protocol issues and their workarounds as of about half a year ago.

End users most definitely are just as safe. Stateful firewalls still work fine. NAT technically hides some address schemes, but with 90% of all end user devices running either 192.168.0.0/24, 192.168.1.0/24, or 10.0.0.0/24 that isn't worth much.

When I had stated

So when setting up IPV6 it must be tackled by completely ignoring the IPV4 setup (with some exceptions [not going there]).

Here is an example:
He can bond 2 dsl lines, but also create a virtual bridge over IPV4 to a machine Not on his physical network.
That virtual bridge CAN bridge IPV6 because the virtual bridge is like a physical media.
To do this you simply need to colocate a router or PC in a server rack.

IPV6 is merely the sum of its parts.
I agree that no one should ignore the symantics or security details.

IPV6 is all too often over complicatedly described, and this cause confusion, when in fact it is not at all complicated.

To be a bit more precise:

I have one symmetric 20/20Mb line with /24 private network. In one rb1000 src-nat takes place to translate LAN ip address of users into public ones.

Than in same rb1000 some users are already routed out to another rb1000 (so before they are given an public IP) to be distributed over now 3, but later 5 adsl lines. (All with adsl router/modem in bridge mode, so this 2nd rb1000 has the pppoe interfaces with the dynamic IP addresses. Masq. src-nat takes place on these interfaces so clients traffic leaves here with the dsl ISP assigned IP address.)

[Clients using the adsl are low capacity (and cheap) contract clients. (I use the adsl lines because here 50Mb of download cost a fraction of the 20Mb I pay now for the symmetric.)]

The symmetric part of my network will be the least of my problem I understand.
But all the clients that are routed out the first rb1000 to get a dsl gateway in the 2nd rb1000 are going to be more of a problem.
I still have a peplink7 (7WAN port) loadbalancer that I was planning to use instead of this 2nd rb1000 since it can have all the 5 adsl lines attached and it did perform well before (some years ago).
But I am afraid now this loadbalancer ends up in the bin after migration to IPv6?

How are business or other big institutes going to handle the migration if they have 2 or more dsl lines to serve all their LAN devices? Like on a campus, students don't all get private public addresses now, they are all behind NAT firewalls?
To be honest, I think the bulk of internet connected devices worldwide are behind NAT firewalls. And many bigger networks (offices, internet café's, etc) also use more than one dsl provider, just for the capacity. They all do load balancing. How is this go to be done?

"Tunnels"? What do we mean with setting up "tunnels" to do the translation?
fewi mentioned the default address ranges that most users have on their local networks. Does that remark counts for all the networks assigned for private use? I use 172.xxx.xxx.xxx range?

Al this might come fairly easy on you guys. But I think I am a bit of a dummy with only some very basic IP-network knowledge, but by far an out of the ordinary small wisp. I'll bet most small network operators are in the same boat as me, we just know how to route in IPv4 and have small networks running. It seems a lot of us need to start reading in IPv6 to get some more understanding or we are going to be doomed....
That's all I need, more stuff to learn.....

hmm, I was hoping on some info on where to start;

1. Install IPv6 package
2. ??? then what, how does dummy proceed to get IPv6 on the road?
3. ?
etc.

This might look like silly stupid question but I'll bet many of us have no idea on how to implement IPv6.
I am hoping a basic tutorial can be setup to print in a Wiki Manual

You get nothing if your ISP is not co-operative and has IPv6 support available for you.
If they refuse to give you native IPv6 then you need 6to4 tunnel to some IPv6 tunnel provider.
That one is tricky as well because they do not want to deal with IPv6 rookies, but their policy is to treat you one. For me it took 6 months to get IPv6 subnet assigned to me.
Now I do have IPv6 working, but I get not much out of it as IPv6 enabled services are few and give me no advantages over IPv4 counterparts. Also, some of IPv6 services are not happy with my IPv6 and state it as not being IPv6 at all. ROS IPv6 support and tool base is so weak that I am unable to find where is the issue.

Wiki already have several tutorials on how to set up ipv6 network. One of the examples in the manual that might be helpful
http://wiki.mikrotik.com/wiki/Manual:My ... v6_Network

BTW what is the 4digit hexidecimal part called in V6 ( an octet?).
To me an octet is a single base 8 digit ( a single octal digit ).

double word comes to mind when i see 4 bytes