Upload File

journey to ipv6 a real-world deployment for mobiles j...• cgn performs nat/pat 44 and nat/pat 64...

  • Home
  • Documents
  • Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent
38
Journey to IPv6 A Real-World deployment for Mobiles APRICOT 2017 – February 2017

Upload: vandiep

Post on 20-Jun-2018

222 views

Category:

Documents


1 download

Report

TRANSCRIPT

Page 1: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

Telstra Unrestricted Copyright Telstra©

JourneytoIPv6AReal-WorlddeploymentforMobilesAPRICOT2017– February2017

Page 2: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

JeffSchmidt- TechnologyTeamManager,TelstraWirelessNetworkEngineering

ManagingtheTechnicalLeadforWirelessIPv6deploymentandWirelessMobileIPEdge/CoreArchitecture

IntroductionInstructional Slide

Page 3: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

1. WhyIPv6?

2. BusinessandTechnicalconsiderations

3. NetworkArchitectures

4. AddressingandSubnetting

5. DeploymentModel

6. OurExperience

7. Q&A

Agenda

Page 4: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

WhyIPv6?

Page 5: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

TrafficgrowthanddeviceperpersonNetworkreadinessfornewtechnologies:• Internet-of-Things• VoLTE/IMS• ViLTE• ManagementandBackhaul

IPv4public/privateaddressdepletionReductioninnetworkinefficiencies

WhyIPv6?

Page 6: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

Source- https://www.google.com/intl/en/ipv6/statistics.html

IPv6GlobalTraffic

Page 7: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

BusinessandTechnicalConsiderations

Page 8: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

BusinessandTechnicalConsiderations

DepletingpublicandprivateIPv4addressrange

Page 9: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

BusinessandTechnicalConsiderations

Non-interworkingprivateIPv4addressrangesduplicatedbetweendomains,thatnowrequireinterworking

10.0.0.0 10.0.0.0

10.0.0.0 10.0.0.0

Page 10: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

ContinualinvestmenttoextendIPv4resourcesvsIPv6tofutureproofournetwork

BusinessandTechnicalConsiderations

NAT

IoT

$

$or

Page 11: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

AsIPv4addressesdeplete,itwillbemoreexpensivetoextendIPv4resources

Dual-StackisaneffectivetransitiontechnologybutdoesnotsolvetheIPv4depletionproblem

IntroducingIPv6:

- ReduceddependencyonNAT

- Removetheneedforregionalisation

- PushesapplicationstomovetoIPv6

BusinessandTechnicalConsiderations

Page 12: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

NetworkArchitectures

Page 13: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

• CGNperformsNAT/PAT44andNAT/PAT64PATsubstantiallyreducesPublicandPrivateIPv4address

demand,butdoesnotpreventIPv4addressdepletion.

IPv6ImplementationCentralisedCGN

Internet

IPCore/Edge

Internet

CGNAT BR

Region1

Region2

NAT/PAT44PrivateIPv4toPublicIPv4

CGNAT BR

NAT/PAT64PublicIPv6toPublicIPv4

Backhaul

EPG

Backhaul

EPG

Page 14: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

IPv6ImplementationTrafficFlow

IPv4PublicInternet

CarrierNetwork(IPv4+IPv6)

IPv6PublicInternetIBR

NAT64PublicIPv6toPublicIPv4

NativeIPv6

RadioNetwork(IPv4transport)

EPG

Single–BearerIPv6onlyuserplane

IPv6

Page 15: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

RunningmultipleAPNs

InternetRadio Network Carrier Network

IPv4

eNodeB

GGSN/EPG

IPv6 APN

IPv4v6 APN

IPv4 APN

IPv4v6

IPv6

IBRNAT44 / NAT64

DNS64

DNS-DS

CreatemultiplerealAPNsthatsupportsIPv4,IPv6,andIPv4v6individually

Page 16: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

RunningaSingleAPN

InternetRadio Network Carrier Network

IPv4

eNodeB

GGSN/EPG

IPv4v6 APN

IPv4v6

IPv6

IBRNAT44 / NAT64

DNS-DS

CreateasinglerealAPNthatsupportsbothDSandSS

Page 17: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

IPv6ImplementationSecurity

IPv4PublicInternet

CarrierNetwork(IPv4+IPv6)

IPv6PublicInternetCGNAT BR

NAT44/64TranslationStatefulfirewall

UntrusttoTrustBlockalltrafficoriginatingfrominternet

TrusttoUntrustAllowalltraffic

RadioNetwork(IPv4transport)

EPG

FirewallApplication

IPv6

IPv6NativeStatefulfirewall

UntrusttoTrustBlockalltrafficoriginatingfromInternet

TrusttoUntrustAllowalltrafficoriginatingfromIPv6handsetrangesonlyAllowDNStrafficBlockallinfrastructurerangesBlockallVoLTEranges

APNACL

AdvertiseonlyhandsetrangestoCarrierNetworkBlocktrafficwithIPrangesnotconfiguredontheEPG

Page 18: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

InfrastructureCloudIPv6

L3FabricEVPN

InternetProviderCoreNetworkMPLS

PE

DCGateway

ToR

vCGN

BR

vEPC

Page 19: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

HowmuchtrafficwilluseIPv6?

Page 20: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

464XLATArchitectureforMobiles

CarrierCore

UserEquipment/MobilePhone

IPv6

IPv4 CLATFunction

PLAT(NAT64)

IPv6Internet

IPv4Internet

CLAT>IPv4hostaddressforXLATE(clat4)

[192.0.0.4/32]IPv6hostaddressforXLATE[2001:db8:aaaa::464/128PLAT-SideXLATEIPv6Prefix

[2001:db8:bbbb::/96]

PLAT>IPv4pool

[192.0.2.1–192.0.2.100]PLAT-SideXLATEIPv6Prefix

[2001:db8:bbbb::/96]

IPv4SRC192.0.0.4IPv4DST

198.51.100.1

IPv6SRC2001:db8:aaaa::464

IPv6DST2001:db8:bbbb::198.51.100.1

IPv4SRC192.0.2.1IPv4DST

198.51.100.1StatelessNAT64

[RFC6145]

StatefulNAT64

[RFC6146]

198.51.100.1

2001:db8:ca7e::d007

Page 21: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

AddressingandSubnetting

Page 22: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

3GPPcurrentlydictateseachUEtoreceivea/64

Futurereleasesmayrequirea/60withDHCP-PDforsingleAPNtethering

4x/44perAPNperEPG=4Mprefixes

YouwillprobablyalsoneedasimilarrangeforVoLTE APNs

KEY:makesureitisastructuredsubnetting schemasoitisconsistentnationallyandacrosstheentireorganisation.

AddressingandSubnetting

Page 23: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

InfrastructureAddressing:

/64perVLAN– Keepitsimple!

PrivateorPublic– butremembertouseafirewallandpoliciestoavoidadvertisingtheinfrastructureouttotheinternet!

NATisnotasecurityfeature!

AddressingandSubnetting

Page 24: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

DeploymentModel

Page 25: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

SP1 SP2/SP3 SP4Dual-StackSS+NAT64+DNS64+CLATSS/DS+NAT64+DNS-HD+CLAT

1. Everycarrierwillhaveauniquesetofcircumstancesthatdictateswhichtransitionmethodtheywilluse.Thereisnostandardwayofdoingthis.

2. Youmustdeterminewhichisthebestmethodforyournetwork.

Inanymethod,remembertoensureyouhavealong-termstrategyfortheeventualdeploymentofnativeSingleStackIPv6!

CarrierExamples

Page 26: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

TwoexistingAPNs– oneforHandsets,oneforMobileBroadbandandTethering

or

464XLAT+NAT64+DNS64fortheHandsetAPNonly

IPv6enabledDNSforallotherAPNs

DifferentAPNsfordifferentpurposes

Telstra.WAP

Telstra.Internet

NAT64/DNS64

464XLAT Internet

DNS-DS/NAT44 Internet

Page 27: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

HSSConfiguration

PDPContextid=IPv4v6

MMEConfiguration

DAF=set

EPGConfiguration

PDPTYPE=IPv4v6

EPGwillthenalsohavethefollowingasaminimumwithineachAPN:

-IPv6HandsetRange

-IPv4HandsetRange

-2xIPv4DNSNameServers,2xIPv6DNSNameServers

PacketCoreConfiguration

Page 28: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

Android4.3+supports464XLAT.Werecommendusinganythingthatis4.4.4+or5.1+

Dependingonyoursetup,eitherPDPselectionisbasedontheUEortheNetwork.

InternationalRoamingoverIPv6workstoday!ButwerecommendtheAPNRoamingProtocoltobesettoIPv4onlyforthenexttwoyears.

UERequirementsandSettings

Page 29: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

• InformedFrontofHouseandprovidedtraining,aswellasEnterprisesupportandsalespersonnel

• UpdatedinternalKnowledgeBase

• BriefedOperationsandprovidedtraining• Createdmoderatedforumwithofficialdetailsonthenetworkchange

• ProvideddirectemailcontacttoTelstraEngineering• Contactedthetechnicalcommunityviamailinglistsandpublicforums

beforelaunch

LaunchConsiderations

Page 30: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

OurExperience

Page 31: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

iPadDual-StackCarrierSettings

SignificantIPv6takeup oniPadssincecarrierupdatewasmadeavailablewithDual-Stack.

UpdatemadeviaiOSpatch.UsersarenotimmediatelyawareIPv6isavailableontheiriPads.Transparentmigration.

IPv6takeupoccurswheniPadsarepatchedtothelatestversion

SingleStackwillcomelaterthisyear

OurExperience

Page 32: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

OurExperience

01/07/16

01/08/16

01/09/16

01/10/16

01/11/16

01/12/16

01/01/17

NSW QLD SA VIC WA Total

telstra.wap - IPv6 Usage

Page 33: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

APN– IPv4v6,HLR/HSS– IPv4v6LegacydevicesconfiguredwithIPv4onlyarenotimpactedNewdevicesconfiguredwithIPv4v6obtainsbothaddressesandiscurrentlygrowingsignificantlyExistingdevicesconfiguredwithIPv6onlyobtainsIPv6only

CGNATNAT64ALGs:ftp,sip,pptp,rtsp,h323

BYOdeviceandexistingservices

Page 34: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

SomeapplicationsfailwithIPv6– evenwith464XLAT.Routingissues?

VPNsarearealproblem– butisitacarrierproblemoranapplication/serverproblem?

HTTP/HTTPSworksverywell

SSHisnotamajorproblem

IPv6isfasterinsomecases– smallerBGPtable,noNATetc.

Majorappsworkverywell– especiallyfromthemajorcontentproviders

IPv4vsIPv6

Page 35: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

Engagethecommunityearlysotheyknowwhat’scoming.Theywillappreciateyouarestilldevelopingandtheywillwanttobepartofthejourney!

Wereceivesupportemailthroughourcontactpointsandreplyassoonaspossible.Don’tkeepyourcustomerswaiting

Skiptheredtape– letcustomersengageengineeringdirectly

Keepmanagementhappy!ReportSIOandbandwidthusage!

CustomerSupport

Page 36: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

Q&A

Page 37: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

CONTACT

Page 38: Journey to IPv6 A Real-World deployment for Mobiles j...• CGN performs NAT/PAT 44 and NAT/PAT 64 PAT substantially reduces Public and Private IPv4 address demand, but does not prevent

JeffSchmidtTechnologyTeamManagerTelstraWirelessNetworkEngineering

[email protected]

SunnyYeungSeniorTechnologySpecialistTelstraWirelessNetworkEngineering

[email protected]

Contact


Lab 5.3.8 Configuring PAT with SDM and Static NAT using

Implementing the Carrier Grade NAT on Cisco IOS XR Software€¦ · Carrier Grade Network Address Translation (CGN) is a large scale NAT that is capable of providing private IPv4

CARRIER GRADE NAT (CGN) AND CRIME ATTRIBUTION ONLINE · IPv4-address attribution without CGN Web Server 193.58.4.34 Internet CONTENT provider IPv4 Private 192.168.1.2 IPv4 Public

Cgn Overview

NAT PAT Overview

1 Franchise of CGN Research Labs Pvt.Ltd, India. CGN Research Labs LLC, USA

Franchise of CGN Research Labs Pvt.Ltd , India. CGN Research Labs LLC, USA

ASA 8.3(x) Dynamic PAT with Two Internal …Create two NAT/PAT rules; this examples creates NAT rules for these network objects:OBJ_GENERIC_ALLOBJ_SPECIFIC_192-168-1-0 2. Add Network

ASA NAT PAT examples.pdf

IPv4 Services NAT/PAT

CGN SCALEOUT - A10 Networks

Nat’s Cat DECODABLE • 25 A Reading A–Z Decodable Book …The fat cat liked to nap on Nat’s lap. If the fat cat wanted a pat, he would tap on Nat. Nat would pat him. Nat s Cat

Carrier-grade NAT (CGN) Solution - data.proidea.org.pl · Fortinet Confidential November 7, 2012 Carrier-grade NAT (CGN) Solution with FortiGate . [email protected]

CGN Observations & Recommendations

Deployment Guide: Carrier Grade NAT (CGN - A10 Networks

Nat and Pat - speldsa.org.au

CGN a Driver for IPv6 Adoption - IPv6 Training · Universal Plug and Play (UPnP) NAT Port Mapping Protocol (NAT-PMP) Port Control Protocol ... (increased vulnerability to DDoS) Very

day 17.1 nat pat .PPT

Scaling IP Addressescontents.kocw.net/KOCW/document/2016/wonkwang/jinchanyong/5.pdf · •Discuss characteristics of NAT and PAT ... NAT overload will work. ... –It is also the

IPv4 to IPv6 Transition and Deployment · 2018. 10. 18. · IPv4/IPv6 coexistence & transition •Carrier Grade NAT (CGN) –Dual-Stack Lite • IPv4 to IPv4 over IPv6 • Documented

Cisco ASR 9000 シリーズアグリゲーションサービスルータ …...tos（CGN）149 traceroute（CGN）151 traffic-class（CGN）154 ubit-reserved（CGN）156 vrf（CGN）158

Subnetting, NAT & PAT

Journey to IPv6: A Real-World deployment for Mobiles · IPv6 Implementation Centralised CGN pCGN performs NAT/PAT 44 and NAT/PAT 64 n PAT substantially reduces Public and Private

Lab 1.1.6 Troubleshooting NAT and PAT – Instructor …itt.century.edu/.../pdf/knet-ESCJBTQpCAkxgVNw/CCNA4_lab_inst_1_1… · ... refer to Lab 1.1.4a Configuring NAT. Step 2 Save

Lab 5.3.8 Configuring PAT with SDM and Static NAT using Cisco IOS Commands

Technical Whitepaper on Carrier Grade ... - ZTE Corporation · Technical Whitepaper on Carrier Grade NAT (CGN) 2 ZTE Confidential & Proprietary address and a public network address

day 17.1 nat pat (2).ppt

NAT Box-2-Box High Availability feature on · NAT Box-2-Box High Availability feature on ISR ... •Box-2-Box High Availability feature •NAT-HA Solution ... Dynamic NAT and PAT

CGN Inventory Kit

Tunneling, CGN and 6RD

Ch. 1 – Scaling IP Addresses NAT/PAT and DHCP CCNA 4 version 3.0

HITRON CGN USER’S GUIDE

NAT and PAT

Configuring NAT and PAT Chapter 18 powered by DJ 1

Chapter 11: Network Address Translation · PAT is also known as NAT overload. ... There are two basic tasks to perform when configuring static NAT translations: ... A NAT pool named