montevideo microsoft intro ipv6 en windows · windows xp sp2 ipv6 capabilities • limited support:...

IPv6 en Windows

Ignacio CattivelliIgnacio Cattivelli

Juan Jackson

Pablo García

D l St k A hit tDual Stack ArchitectureApplicationApplication

Layer

Tcpip.sysTcpip6.sys

TCP/UDP TCP/UDP

IPv6 IPv4

Network Interface Layer

• In Windows XP and Windows Server 2003

(c) 2006‐2008 Microsoft Corporation

slide 2 February 22, 2008

• Netsh int ipv6 [install|uninstall]

Windows XP SP2 IPv6 Capabilities

• Limited Support:– Not on by default, must enable IPv6: netsh int ipv6 install– Basic native IPv6 capability, ISATAP, 6to4, Teredop y, , ,– Autoconfiguration & well‐known DNS IPs (FEC0)– Netsh int ipv6 commands required for config– ipconfig route ping and ping6 tracert pathping netstatipconfig, route, ping and ping6, tracert, pathping, netstat– IE 6.0, IE7.0, telnet client, ftp clients– Filesharing via WebDAV only (e.g. over HTTP)N t t d• Not supported:– DHCPv6 client, PPPv6 client– AD client protocols (RPC, LDAP, Kerb)– File sharing using IPv6 (SMB, NetBT)– IPHLPRAPI IPv6, e.g. can’t add IPv6 routes via API



Wi d S 2003 SP2 IP 6 C bilitiWindows Server 2003 SP2 IPv6 Capabilities

• Limited Support:• Limited Support:– Windows XP SP2 IPv6 functionality, but also…

– SMB client and server using native IPv6S c e a d se e us g a e 6• Client won’t ping dest first with IPv6 enabled

– Telnet Server

– RPC, Simple TCP/IP Services

• Not supportedA ti Di t P t l LDAP K b t– Active Directory Protocols: LDAP, Kerberos, etc

– SMB file sharing over IPv6 tunnel interfaces (e.g. ISATAP, 6to4)

– FTP ServerFTP Server– IPHLPAPI IPv6, can’t add IPv6 routes via API– Many command line tools that show or use explicit IP addresses



Install IPv6 protocol for Windows Server 2003:

1 L t th t ith t th t h• 1.Log on to the computer with a user account that has privileges to change network configuration.

• 2.Click Start, click Control Panel, and then double‐click , ,Network Connections.

• 3.Right‐click any local area connection, and then click PropertiesProperties.

• 4.Click Install. • 5.In the Select Network Component Type dialog box, click5.In the Select Network Component Type dialog box, click

Protocol, and then click Add. • 6.In the Select Network Protocol dialog box, click Microsoft

TCP/IP i 6 d th li k OKTCP/IP version 6, and then click OK. • 7.Click Close to save changes to your network connection.

Install IPv6 protocol for Windows XP with SP2:

• 1 L t th t ith t th t h i il t• 1.Log on to the computer with a user account that has privileges to change network configuration.

• 2.Click Start, click Control Panel, and then double‐click Network C tiConnections.

• 3.Right‐click any local area connection, and then click Properties. • 4.Click Install. • 5.In the Select Network Component Type dialog box, click Protocol,

and then click Add. • 6 In the Select Network Protocol dialog box clickMicrosoft TCP/IP6.In the Select Network Protocol dialog box, click Microsoft TCP/IP

version 6, and then click OK. • 7.Click Close to save changes to your network connection. • Alternately from the Windows XP desktop click Start point to• Alternately, from the Windows XP desktop, click Start, point to

Programs, point to Accessories, and then click Command Prompt. At the command prompt, type netsh interface ipv6 install.

Dual IP Layer Architecture Traffic Typesy yp

ApplicationApplicationLayer

Transport Layer (TCP/UDP)

IPv6 IPv4


IPv6 IPv4



IPv6 over IPv4

TCP/IP Protocol Architect re /IP 6TCP/IP Protocol Architecture w/IPv6TCP/IP Protocol Architecture

TCP/IP Protocol Suite

Application Layer

OSI Model LayersArchitecture

Layers

FTPTelnet HTTP RIPngDNS SNMPApplication LayerPresentation Layer

Session Layer

TCP UDPTransport Layer

Session Layer

Transport Layer

IPv4/IPv6MLD

Internet LayerNetwork LayerND

ICMPv6

Network InterfaceLayer

Data Link Layer

Physical LayerEthernet Token Ring PPP 1394



Physical Layer

IPv6 TerminologyNeighbors

IPv6 Terminology

Host

Subnet Router

Host

Intra‐subnet Routeror Layer 3 switch

Bridge or Layer 2 Ethernet Switch

LAN segmentg

Link, Router Advertisement <prefix>::/64

Subnet, for example a floor <prefix>::/62 has 4 links

dd l b

Network, for example <prefix>::/56 for one building’s IPv6 connection to ISP

Additional subnets



LIR/ISP prefix allocation: /48 or /56 for “end‐site”, “end‐user”

Types of IPv6 AddressesTypes of IPv6 Addresses• UnicastUnicast

– Address of a single interface– Delivery to single interfacee e y to s g e te ace

• Multicast– Address of a set of interfacesAddress of a set of interfaces– Delivery to all interfaces in the set

• AnycastAnycast– Address of a set of interfaces– Delivery to a single interface in the sety g

• No more broadcast addresses

Unicast IPv6 AddressesUnicast IPv6 Addresses

• Global addresses• Link‐local addressesLink local addresses• Site‐local addresses

Global AddressesGlobal Addresses• Address scope is the entire IPv6 Internet

– Equivalent to public IPv4 addresses

• Defined in RFC 3587• Structure

– Global Routing Prefix– Subnet ID– Interface ID

64 bits45 bits 16 bits

Interface IDSubnet ID001 Global Routing Prefix

Link Local AddressesLink‐Local Addresses• Address scope is a single link

– Equivalent to APIPA IPv4 addresses

• FE80::/64 prefixFE80::/64 prefix• Used for:

Si l b t t l fi ti– Single subnet, routerless configurations– Neighbor Discovery processes

10 bits 64 bits54 bits

1111 1110 10 Interface ID000 . . . 000

Site Local AddressesSite‐Local Addresses• Address scope is a single site

– Equivalent to private IPv4 addresses

• FEC0::/10 prefixFEC0::/10 prefix• Used for intranets that are not connected to the IPv6 InternetIPv6 Internet

• Recently deprecated but supported for current limplementations


1111 1110 11 Interface ID


Subnet ID1111 1110 11 Interface IDSubnet ID

Zone IDs for Link‐Local and Site‐Local Addresses

• Link‐local and site‐local addresses are ambiguous– Multiple links (common)Multiple links (common)

– Multiple sites (uncommon)

• Zone ID is used to identify a specific link or sitey p– Link‐local address

• Zone ID is typically set to the interface index of the sending interface

– Site‐local address• Zone ID is typically 1 unless multiple sites are used

• Examples:• Examples:– ping fe80::2b0:d0ff:fee9:4143%3

– tracert fec0::f282:2b0:d0ff:fee9:4143%2

Example of IPv6 addressesExample of IPv6 addresses

T l d t 6t 4 T li P d I t fTunnel adapter 6to4 Tunneling Pseudo‐Interface:Connection‐specific DNS Suffix . : redmond.corp.microsoft.comIP Address. . . . . . . . . . . . : 2002:9d3b:9dd5::9d3b:9dd5

Tunnel adapter Automatic Tunneling Pseudo‐Interface:Connection‐specific DNS Suffix . : redmond.corp.microsoft.comIP Address : fec0::f70f:0:5efe:157 59 157 213%1

Site Local Address

IP Address. . . . . . . . . . . . : fec0::f70f:0:5efe:157.59.157.213%1IP Address. . . . . . . . . . . . : 3ffe:8311:ffff:f70f:0:5efe:157.59.157.213IP Address. . . . . . . . . . . . : fe80::5efe:157.59.157.213%2

GlobalDefault Gateway . . . . . . . : fe80::5efe:157.56.253.8%2

Link Local Address

Global Address

Address

Ipconfig /allIpconfig /all

IpconfigIpconfig

Automatic Tunneling TechnologiesAutomatic Tunneling Technologies

• 6to4– Allows IPv4/IPv6 hosts to communicate across the IPv4 Internet using public IPv4 addressesInternet using public IPv4 addresses

• Teredo (IPv6 NAT Traversal)Allows IPv4/IPv6 hosts to communicate across the IPv4– Allows IPv4/IPv6 hosts to communicate across the IPv4 Internet across NATs

• ISATAPISATAP– Allows IPv4/IPv6 hosts to communicate across a private IPv4 intranet

Práctico configuración de:Práctico, configuración de:

• 1 – Configurar dirección IP

• 2 – DNS2 DNS

• 3 – DHCP

• 4 – Internet Information Server

• 5 – Herramientas de diagnóstico5 Herramientas de diagnóstico

D l IP L A hit tDual IP Layer ArchitecturelApplicationLayer

TCP/UDP

Tcpip.sys

IPv6 IPv4


• Next‐Generation TCP/IP stack in Windows (c) 2006‐2008 Microsoft Corporation

slide 21 February 22, 2008Vista/Server “Longhorn”

IPv6 Security Considerations: Transition IPv6 Security Considerations: Transition Technologies (ISATAP)Technologies (ISATAP)

•• ISATAP: IntraISATAP: Intra‐‐Site Automatic Tunnel Addressing Protocol Site Automatic Tunnel Addressing Protocol –– Easy IPv6 deployment within a site* without upgrading routersEasy IPv6 deployment within a site* without upgrading routers

–– Encapsulates IPv6 packets in IPv4 (protocol 41)Encapsulates IPv6 packets in IPv4 (protocol 41)

Wi h li i ISATAP d lWi h li i ISATAP d l•• Without explicit ISATAP server deployment Without explicit ISATAP server deployment –– Only link local ISATAP addresses configured Only link local ISATAP addresses configured

–– Reach ability limited to that of only the underlying IPv4 addressReach ability limited to that of only the underlying IPv4 addressReach ability limited to that of only the underlying IPv4 addressReach ability limited to that of only the underlying IPv4 address

–– ISATAP addresses are not registered in DNSISATAP addresses are not registered in DNS

–– Does not trigger AAAA DNS queriesDoes not trigger AAAA DNS queries

–– ISATAP address derived completely from IPv4 addressISATAP address derived completely from IPv4 address•• No more info exposed than already exposed by underlying IPv4 address No more info exposed than already exposed by underlying IPv4 address

C i d i hi i l l b bl ki IP 4 l 41 hC i d i hi i l l b bl ki IP 4 l 41 h•• Contained within a site completely by blocking IPv4 protocol 41 at the Contained within a site completely by blocking IPv4 protocol 41 at the edge firewall or routeredge firewall or router

b f l l f i d iISATAP can be safely left ON on Windows Vista*Site refers to a network that may be protected for access from outside by edge firewmechanisms but has homogenous security/management implementation inside

IPv6 Security Considerations: Transition IPv6 Security Considerations: Transition Technologies (6to4)Technologies (6to4)

•• 6to46to4•• 6to46to4–– Enables two sites and/or hosts connected by global routeable IPv4 Enables two sites and/or hosts connected by global routeable IPv4

Internet to communicate using IPv6Internet to communicate using IPv6–– Encapsulates IPv6 traffic in protocol 41 IPv4Encapsulates IPv6 traffic in protocol 41 IPv4

•• Without explicit 6to4 router deploymentWithout explicit 6to4 router deploymentFor hosts without public IPv4 addresses disabled by defaultFor hosts without public IPv4 addresses disabled by default–– For hosts without public IPv4 addresses, disabled by defaultFor hosts without public IPv4 addresses, disabled by default

–– For hosts with public IPv4 addresses, enabled butFor hosts with public IPv4 addresses, enabled but•• 6to4 address completely derived from underlying IPv4 address6to4 address completely derived from underlying IPv4 address•• No additional information exposed that is not already exposed by the No additional information exposed that is not already exposed by the underlying IPv4 addressunderlying IPv4 address

•• Contained within a site completely by blocking IPv4 protocol Contained within a site completely by blocking IPv4 protocol 41 at the edge firewall or router41 at the edge firewall or router

6to4 can be safely left ON on Windows Vista6to4 can be safely left ON on Windows Vista

IPv6 Security Considerations: Transition IPv6 Security Considerations: Transition Technologies (Teredo)Technologies (Teredo)

•• TeredoTeredo–– Enables two hosts behind NATs to communicate using IPv6Enables two hosts behind NATs to communicate using IPv6–– Encapsulates IPv6 packets in UDP/IPv4 packetsEncapsulates IPv6 packets in UDP/IPv4 packets–– Primarily a consumer technologyPrimarily a consumer technology

•• Teredo does not pose security risks for enterprisesTeredo does not pose security risks for enterprisesFor domain joined machines disabled by defaultFor domain joined machines disabled by default–– For domain joined machines, disabled by defaultFor domain joined machines, disabled by default

–– For nonFor non‐‐domain joined machines, completely blocked bydomain joined machines, completely blocked by•• Blocking IPv4 traffic with source or destination UDP port of 3544 at the Blocking IPv4 traffic with source or destination UDP port of 3544 at the edge IPv4 firewall oredge IPv4 firewall or

•• Blocking DNS queries to teredo.ipv6.microsoft.comBlocking DNS queries to teredo.ipv6.microsoft.com

–– Not discoverable by DNS, neither causes AAAA queries to be Not discoverable by DNS, neither causes AAAA queries to be y , qy , qissuedissued

montevideo microsoft intro ipv6 en windows · windows xp sp2 ipv6 capabilities • limited support:...

Documents