Understanding IPv6

The structure of the 128 bit IPv6 address does not need the NAT method of remapping one IP address space into another by modifying network address information in the IP header of in-transit packets.

IPv6 uses both auto-configuration methods and the Neighbor Discovery Protocol (NDP) to resolve addresses and discover neighbors and routers so NAT is not required.

IPv6 uses one of two types of auto-configuration of the device addresses, stateful or stateless address autoconfiguration (SLAAC). SLAAC allows devices to generate their own IPv6 addresses without requiring a central server like IPv4 networks that use DHCP. Devices can generate their own address by basing the interface identifier on the device MAC address. This combines with the network prefix received from the router advertisement message that includes network configuration information.

DHCPv6, which is DHCP with the v6 extension, is an alternative that can still be used in IPv6 networks for more advanced configuration options, such as DNS server assignments and additional parameters.

IPv6 supports stateful and stateless auto-configuration (SLAAC). Stateful auto-configuration requires some human intervention because it needs a DHCPv6 server for the installation and administration of nodes. The DHCPv6 server maintains state information so the server knows how long each address is in use and when it might be available for reassignment.

Stateless auto-configuration (SLAAC) is suitable for small organizations and individuals. It can automatically configure IPv6 host parameters on an IPv6 host without the need for manual configuration or a DHCP server. Each host determines its addresses from the contents of received router advertisements and using the IEE EUI-64 standard to define the network ID portion of the address, to assume uniqueness of the host address on the link. For more information see IPv6 Stateless Address Auto-configuration (SLAAC).

IPv6 multicast routing uses multicast groups that logically-group devices that are interested in receiving the multicast traffic. These groups are associated with a specific multicast address, which is typically in the range of 244.0.0.0 to 239.255.255.255 (IPv4) or the IPv6 range starting with the prefix ff00::/8.

Routers in an IPv6 network must be configured to support multicast routing and enable an IPv6 multicast routing protocol like Protocol Independent Multicast (PIM) for IPv6. Routers in the network use the multicast routing protocol to determine how to forward multicast packets based on multicast group membership. Packet forwarding occurs to interfaces where devices have joined the corresponding multicast group interested in receiving the traffic. With IPv6, multicast boundaries can constrain traffic within specific boundaries or domains of the network to control propagation.

IPv6 routing routes traffic through the network much the same as IPv4 using network routing protocols, routing tables and the principles of packet forwarding, but it introduces enhancements such as larger address space, simplified header formats, and improvements in routing protocols to accommodate modern network requirements.

It removes NAT and uses Neighbor Discovery Protocol (NDP) to resolve addresses and discover neighbors and routers.

Flow labeling is a 20-bit part in the IPv6 header. It is intended to identify packets belonging to the same flow or traffic stream. Flow labeling provides routers and network devices with a way to recognize and classify packets that are part of the same flow, such as packets that belong to a specific real time audio or video stream. This allows for more efficient handling of packets within the network.

Despite potential benefits, flow labeling adoption is currently limited. There is a lack of standardized QoS mechanisms and policies on how to make use of this field. Flow labeling depends on widespread support and consistent implementation across network devices and protocols but it not implemented this way at present.

IPv6 includes built-in support for authentication and privacy features to enhance security and protect network. Two key mechanism for authentication and privacy are Secure Neighbor Discovery (SEND) and Internet Protocol Security (IPsec).

Secure Neighbor Discovery (SEND) is an extension of NDP. It introduces cryptographic mechanisms for neighbor and routing authentication to ensure devices can authenticate the identity of neighboring devices and routers before establishing communication. This provides protection against various attacks such as neighbor spoofing and address theft. It also includes mechanisms for securing IPv6 address autoconfiguration to prevent unauthorized devices from obtaining valid IPv6 addresses on the network.

Internet Protocol Security (IPsec) is a suite of protocols used to secure IPv6 communications at the IP layer. IPsec originally defined two protocols for securing IP packets, Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides both data integrity and anti-replay services. ESP provides encryption and authenticates data. It can also includes Internet Key Exchange (IKE), which is used to generate shared security keys that establish security associations (SAs). A special router or firewall sitting between two networks usually handles the security associations needed for the encryption/decryption process to negotiate a security level between the two entities.

It can establish secure tunnels between IPv6 hosts or networks, encrypting all traffic passing through the tunnel and providing protection against eavesdropping and tampering. If implemented in transport mode, only the payload of IP packets is encrypted. If implemented in tunnel mode, the entire IP packet including the original IP header is encapsulated and encrypted. IPsec is widely supported in IPv6-capable devices, and is commonly used to secure communication over IPv6 networks, particularly enterprise and VPN environments.

Peer-to-peer (p2p) works better on IPv6 because unlike IPv4, it does not require using NAT, and therefore does not experience issues resulting from broken NAT implementations. The increased complexity required to resolve NAT-driven communication issues can also degrade performance.

Voice over IP (VoIP) on IPv6 benefits from the enhanced security in the IPsec protocol, which encrypts data at the network layer. It also experiences greater transmission speed than what IPv4 provides, and has more flexibility in endpoint access. VoIP benefits from the vast number of IPv6 addresses available that allow for globally unique IPv6 addresses. IP telephony terminals can be plug-and-play on any network, and mobile terminals can access VoIP servers remotely from anywhere at any time.

Existing IPv4 network infrastructure components might not be IPv6-compatible. This can result in costly changes to upgrade components or replace all or some of enterprise hardware. It takes time and effort to train IT professionals on how to implement and manage IPv6 networks.

An IPv6 website or network cannot be seen by or communicated with by an IPv4 network without a gateway. IPv4 and IPv6 do not directly communicate with each other without the aid of either a gateway or other network configuration changes like dual-stacking the two protocols within the same network or deploying IPv6 tunneling to route traffic.

Most modern operating systems (Windows, Linux, MacOS) include IPv6 compatibility, but some Internet of Things (IoT) devices, older systems, and legacy network devices might require updates or replacement.

Organizations need to determine if the return on investment justifies the cost of converting to an all IPv6 infrastructure if your network components cannot accommodate v6 addresses. Research your current infrastructure components to determine what is required to implement the network configuration that suits your use case.

Alternatively, you can migrate to IPv6 infrastructures through a staged approach. See How enterprises can migrate from IPv4 to IPv6 for more information.

IPv6 and IPv4 networks cannot see or communicate with each other unless some gateway exists to allow for this. Your DNS server needs to be capable of providing name resolution for these more complex IPv6 addresses.

Specific network topology and configuration instructions and recommendations are outside the scope of this article. Consult with your IT network administrator or service provider for how to equip your network to allow communication between both IP protocols.

You can dual-stack IPv4 and IPv6.

Internal only or publicly routable, for individual nodes or different nodes, for broadcast or point-to-point communication on the same LAN/VLAN.

There are six types of IPv6 addresses:

• Global unicast - Addresses that are routable on the Internet and the equivalent of the public IPv4 addresses. The prefix typically ranges from 2000-3FFF.

• Unicast - Addresses used to identify the interface of an individual node.

• Anycast - Addresses used to identify a group of interfaces on different nodes.

• Multicast - Address used to define multicast that send a single packet to multiple destination at one time.

• Link local - Addresses used inside an internal network (not routed over the Internet), are self-assigned to all interfaces with the IPv6 protocol enabled. It is non-routable but can use for all point-to-point communications on the same LAN/VLAN (broadcast domain). It begins with fe80 as the prefix group.

• Unique local - Addresses used for private networks (not routed over the Internet), and are the equivalent of the IPv4 addresses 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Assign either a global unicast address for publicly-accessible systems or use unique local addresses for private internal-only interfaces. When assigning publicly-accessible IPv6 addresses, research the security implication for your network and implement appropriate security measures as part of your IPv6 implementation.

IPv6 security resources:

• IPv6 Security Guide: Do you have a blind spot?
• IPv6 Security Guidance
• Internet Society: IPv6 Security

IPv6 supports stateful and stateless auto-configuration (SLAAC).

Stateful auto-configuration requires some human intervention. It needs a DHCPv6 server for the installation and administration of nodes. The DHCPv6 server maintains state information so the server knows how long each address is in use and when it might be available for reassignment.

Stateless auto-configuration (SLAAC) is suitable for small organizations and individuals. SLAAC can automatically configure IPv6 host parameters on an IPv6 host without needing an IT admin to manually configure or use a DHCPv6 server to assign the IP address. Each host determines its addresses from the contents of received router advertisements and using the IEE EUI-64 standard to define the network ID portion of the address, to assume uniqueness of the host address on the link. For more information see IPv6 Stateless Address Auto-configuration (SLAAC).