that is why rabobank has ipv6 - ripe 74 · rabobank ip space 145.72.0.0/16 (65.000 addresses)...

34
External facing IPv6 Friso Feenstra Netw0rk Specialist That is why Rabobank has IPv6

Upload: others

Post on 24-Jul-2020

0 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

ExternalfacingIPv6

FrisoFeenstraNetw0rkSpecialist

ThatiswhyRabobankhasIPv6

Page 2: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

WhyIPv6

2

2014investigation:•  IsIPv6necessaryforourcorporatewebsites(www.rabobank.nl)•  IsIPv6necessaryforourinternalnetwork

Page 3: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

WhyIPv6

3

2014investigation:•  IsIPv6necessaryforourcorporatewebsites(www.rabobank.nl)•  IsIPv6necessaryforourinternalnetwork

Myexpectation:NO!!!!NoIPv6

Page 4: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

WhyIPv6

4

2014investigation:•  IsIPv6necessaryforourcorporatewebsites(www.rabobank.nl)•  IsIPv6necessaryforourinternalnetwork

Myexpectation:NO!!!!NoIPv6

internaladdressing:private(17millionaddresses)

externaladressing:RabobankIPspace

145.72.0.0/16(65.000addresses)

InternetforofficeNAT44toproviderIPspace

Migrationcoststimeandmoney

MigrationRisk

Page 5: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

WhyIPv6

5

2014investigation:•  IsIPv6necessaryforourcorporatewebsites(www.rabobank.nl)•  IsIPv6necessaryforourinternalnetwork

Myexpectation:NO!!!!NoIPv6

internaladdressing:private(17millionaddresses)

externaladressing:RabobankIPspace

145.72.0.0/16(65.000addresses)

InternetforofficeNAT44toproviderIPspace

Migrationcoststimeandmoney

MigrationRiskStillinvestigationfor

AretherereasonsforIPv6forRabobank?

Page 6: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

6

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

Page 7: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

7

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

Currentlynoproblem:WebsitesrelevantforRabobank

bankingwillbereachablethroughIPv4forthecomingyears

Page 8: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

8

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

Currentlynoproblem:WebsitesrelevantforRabobank

bankingwillbereachablethroughIPv4forthecomingyears

ButwhataboutfinancialwebsitesincountrieswithlittleIPv4space???

Page 9: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

9

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

Forthecomingyearsnoproblem:CommunicationwithNAT

orproxyinDMZ

Page 10: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

10

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

Page 11: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

11

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

CustomersconnectedthroughISP’s(KPN,

Vodafone,Ziggo,etc.)

Page 12: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

12

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

CustomersconnectedthroughISP’s(KPN,

Vodafone,Ziggo,etc.)

ISPshaveIPv4spaceforexisting

customers

Page 13: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

13

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

CustomersconnectedthroughISP’s(KPN,

Vodafone,Ziggo,etc.)

ISPshaveIPv4spaceforexisting

customers

Newcustomers?Newnetworks?

Page 14: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6Newcustomers?Newnetworks?

14

•  Newnetworks–newcustomers•  G3/G4•  Wifi•  Newarea’s•  Mergers

•  IPv4NATisusedassolution•  Expensivesolution•  Notforallcustomers•  Recoveryafterdisruption

•  Alternative:IPv6+IPv4NAT•  BecauseallmaincontentisavailableonIPv6

Page 15: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6Newcustomers?Newnetworks?

15

•  Newnetworks–newcustomers•  G3/G4•  Wifi•  Newarea’s•  Mergers

•  IPv4NATisusedassolution•  Expensivesolution•  Notforallcustomers•  Recoveryafterdisruption

•  Alternative:IPv6+IPv4NAT•  BecauseallmaincontentisavailableonIPv6

Somoreandmorecustomerswillbebehind

NATifwedon’tact.

Page 16: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6Newcustomers?Newnetworks?

16

•  Newnetworks–newcustomers•  G3/G4•  Wifi•  Newarea’s•  Mergers

•  IPv4NATisusedassolution•  Expensivesolution•  Notforallcustomers•  Recoveryafterdisruption

•  Alternative:IPv6+IPv4NAT•  BecauseallmaincontentisavailableonIPv6

Somoreandmorecustomerswillbebehind

NATifwedon’tact.

Isthataproblem???

Page 17: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6MorecustomersbehindIPv4NAT.Problem??

17

Page 18: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6MorecustomersbehindIPv4NAT.Problem??

18

•  SecurityOperationsCentre“ThemajorityoftheSOCtoolingforprotectionofcustomertrafficbecomesunreliableofunusable”Reason:ToolingisoftenbasedonIPaddresses,forinstanceblockingoneIPaddressleadstoblockingwholegroupsofcustomers

Page 19: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6MorecustomersbehindIPv4NAT.Problem??

19

•  SecurityOperationsCentre“ThemajorityoftheSOCtoolingforprotectionofcustomertrafficbecomesunreliableofunusable”Reason:ToolingisoftenbasedonIPaddresses,forinstanceblockingoneIPaddressleadstoblockingwholegroupsofcustomers

•  Transactionmonitoring,withingFEC(FinancialEconomicCrime)“IPaddressisoneofthemoreimportantpillorsfordetectionofPhishing”“Manysecuritycomponentswillloseeffectiveness”

Page 20: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6MorecustomersbehindIPv4NAT.Problem??

20

•  SecurityOperationsCentre“ThemajorityoftheSOCtoolingforprotectionofcustomertrafficbecomesunreliableofunusable”Reason:ToolingisoftenbasedonIPaddresses,forinstanceblockingoneIPaddressleadstoblockingwholegroupsofcustomers

•  Transactionmonitoring,withingFEC(FinancialEconomicCrime)“IPaddressisoneofthemoreimportantpillorsfordetectionofPhishing”“Manysecuritycomponentswillloseeffectiveness”

•  VCM(VirtualChannelMonitoring),withinFEC“Morethen15%customerstrafficbehindproviderNATisnotacceptable”

Page 21: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

21

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

Page 22: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

22

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

ButoncetherewillbeIPv6-only:•  Features

•  Applications•  Websites

Thatweneed!!!

Page 23: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

23

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

ButoncetherewillbeIPv6-only:•  Features

•  Applications•  Websites

Thatweneed!!!

WhenisthisgoingtohappenWhenwillweknowthis

HowmuchleadtimedowehaveIsthisenough

Page 24: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

24

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

ButoncetherewillbeIPv6-only:•  Features

•  Applications•  Websites

Thatweneed!!!

WhenisthisgoingtohappenWhenwillweknowthis

HowmuchleadtimedowehaveIsthisenoughExpectation:

2018-2025

Page 25: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

25

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

ButoncetherewillbeIPv6-only:•  Features

•  Applications•  Websites

Thatweneed!!!

WhenisthisgoingtohappenWhenwillweknowthis

HowmuchleadtimedowehaveIsthisenoughExpectation:

2018-2025

.5–1yearinadvance

Page 26: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Investigation:WhyIPv6

26

• WhathappenswithIPadressesfor•  Websites•  Thirdparties•  Customers

•  IfwestayonIPv4willwemisssomething•  Canweposponemigrationforthecomingyears:•  Otherpartiescangettheexperience•  Bugsanderrorhavebeensolved•  Wehavemoretime•  Bestpractisescanbedeveloped

ButoncetherewillbeIPv6-only:•  Features

•  Applications•  Websites

Thatweneed!!!

WhenisthisgoingtohappenWhenwillweknowthis

HowmuchleadtimedowehaveIsthisenoughExpectation:

2018-2025

.5–1yearinadvance NO!!!

Page 27: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Approach

27

•  ExternalfacingIPv6project•  StartedQ2-32015•  IPv6untilexternalLoadBalancer•  Multipledepartmentsinvolved•  Networking(tooling,trainingandtechnicalaspects)•  SecurityOperationsCentre(monitoring,DDOSmitigation,IPDS,etc.)•  VCM(rapporting,fraudprevention,anti-physing),etc.

•  Projectperdepartmentfordepartmentacvititieswithgovernanceprojectforcommunicationandtimelines

•  Finishedwww.rabobank.nlè2a02:cc4:2000::10

•  IPv6internalproject•  Plannedtostartin2017•  Threelevels(network,platform,applications)•  Targetnetwork+platformèdualstack;applicationsispossibleIPv6

Page 28: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

TopologyformainexternalfacingRabobankwebsites

28

InternetIPv4IPv6

EK4&6

ExternalLoadBal.

4&6

DDOSIPDS4&6

ContentInspection

4&6

InternalLoadBal.

4&6

ContentProcessing

4

Page 29: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

TopologyformainexternalfacingRabobankwebsites

29

InternetIPv4IPv6

EK4&6

ExternalLoadBal.

4&6

DDOSIPDS4&6

ContentInspection

4&6

InternalLoadBal.

4&6

ContentProcessing

4

Twoloadbalancers?

IPv4&IPv6sessionstate!

Page 30: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

TopologyformainexternalfacingRabobankwebsites

30

InternetIPv4IPv6

EK4&6

ExternalLoadBal.

4&6

DDOSIPDS4&6

ContentInspection

4&6

InternalLoadBal.

4&6

ContentProcessing

4

Twoloadbalancers?

IPv4&IPv6sessionstate!

Internetpeering

SSLoffloadingX-forwardRFC7239

Page 31: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

TopologyformainexternalfacingRabobankwebsites

31

InternetIPv4IPv6

EK4&6

ExternalLoadBal.

4&6

DDOSIPDS4&6

ContentInspection

4&6

InternalLoadBal.

4&6

ContentProcessing

4

Twoloadbalancers?

IPv4&IPv6sessionstate!

Internetpeering

SSLoffloadingX-forwardRFC7239

Cleartext

Page 32: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

TopologyformainexternalfacingRabobankwebsites

32

InternetIPv4IPv6

EK4&6

ExternalLoadBal.

4&6

DDOSIPDS4&6

ContentInspection

4&6

InternalLoadBal.

4&6

ContentProcessing

4

Twoloadbalancers?

IPv4&IPv6sessionstate!

Internetpeering

SSLoffloadingX-forwardRFC7239

Cleartext

TriggersIPDS

Defense

Page 33: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

TopologyformainexternalfacingRabobankwebsites

33

InternetIPv4IPv6

EK4&6

ExternalLoadBal.

4&6

DDOSIPDS4&6

ContentInspection

4&6

InternalLoadBal.

4&6

ContentProcessing

4

Twoloadbalancers?

IPv4&IPv6sessionstate!

Internetpeering

SSLoffloadingX-forwardRFC7239

Cleartext

LTMIPv4SNAT

Page 34: That is why Rabobank has IPv6 - RIPE 74 · Rabobank IP space 145.72.0.0/16 (65.000 addresses) Internet for office NAT44 to provider IP space Migration costs time and money Migration

Q&A??

34