IPv6 deployment experience in a University campus network

Transcription

1

2 IPv6 deployment experience in a University campus network Quentin Hunin Network engineer 8 th IPv6 Council Belgium Diegem - November 2015

3 Agenda Some figures Current status Faced questions / issues Next steps Lessons learned

4 Some figures staff members students 6 geographical sites (Louvain-la-Neuve, Woluwe, Saint-Gilles, Mons, Tournai, Charleroi) Tens of partners depending on our IT (non-profits organizations, hospitals, schools, ) 4

5 Some IT figures 3 data-centers 500 servers 150 TB of storage 10 Gigabit connectivity towards research networks 1 Gigabit commercial connectivity 7 core L3 switches 500 access and distribution switches network outlets 800 access points supporting up to clients 5

6 Current status We get rid of the temporary IPv6 network /44 P.A. prefix from Belnet Global addressing plan IPv6 routing enabled in the core (OSPFv3) and at the edge with 2 BGP peerings Infra teams have native dual stack connectivity 6

7 Current status (cont d) Main DNS servers reachable and querying through IPv6 DHCPv6 server up and running IPv6 FHS features tested Speedtest server accessible through IPv6 Radius proxying with service provider done over IPv6 CEPH infrastructure running IPv6 only IPv6 enabled on WiFi (dual stack) 7

8 Faced questions / issues With management tools With client VPN When deploying IPv6 on WiFi 8

9 WiFi deployment IP/MAC tracking Controller interface à real time, no history Radius + DHCPv6 logs à don t provide the complete picture Cisco Prime Infrastructure à too expensive Syslogs sent by controller à a lot of info lost Neighbor binding table on router à resource consuming Radius accounting à IPv6 acct Call Station ID type not supported SNMP polling à not supported and not scalable Home made script polling controller through CLI over SSH 9

10 WiFi deployment addressing SLAAC or DHCPv6 or both? DHCPv6 not supported on Android Limited resources on controller 10

11 WiFi deployment DNS Through RA (RFC6106) or DHCPv6? 11

12 WiFi deployment done? IPv6 bandwidth - 1 day average 12

13 WiFi deployment done? 09/11/15 10/11/15 11/11/15 Nbr WiFi clients IPv6 bandwidth Total bandwidth 13

14 WiFi deployment done? Controller s CPU usage - 1 day average Max number of bindings in table: Max binding table usage: 38% Max number of global v6 IPs:

15 WiFi deployment first issue IPv6 exit router CPU usage - 1 day average 15

16 WiFi deployment first issue IPv6 access list belnet-in-ipv6-acl ( ) deny ipv6 any any routing-type 0 ( ) è Not supported in hardware è Bug in IOS version è Upgrade to plan 16

17 Infrastructures des réseaux du Système d'information (SRI) WiFi deployment second issue 17

18 WiFi deployment event log 18

19 WiFi deployment Wireshark 19

20 WiFi deployment root cause? Still under investigation Might be related to neighbor binding table / host tracking / Windows behavior 20

21 WiFi deployment third issue Configuration IP de Windows Carte réseau sans fil Connexion réseau sans fil : Suffixe DNS propre à la connexion... : Adresse IPv : 2001:6a8:3081:6f05:e917:211:5a70:3a7d Adresse IPv6 temporaire : 2001:6a8:3081:6f05:f0d7:e7ff:4212:70b Adresse IPv6 de liaison locale.....: fe80::e917:211:5a70:3a7d%13 Adresse IPv : Masque de sous-réseau : Passerelle par défaut : fe80::172:31:0:25%

22 WiFi deployment 1 hour later Configuration IP de Windows Carte réseau sans fil Connexion réseau sans fil : Suffixe DNS propre à la connexion... : Adresse IPv : 2001:6a8:3081:7f00:e917:211:5a70:3a7d Adresse IPv6 temporaire : 2001:6a8:3081:7f00:61e7:e28e:adda:4811 Adresse IPv6 de liaison locale.....: fe80::e917:211:5a70:3a7d%13 Adresse IPv : Masque de sous-réseau : Passerelle par défaut : fe80::172:31:0:25%13 fe80::172:31:0:24%

23 WiFi deployment new association 23

24 WiFi deployment new association 24

25 WiFi deployment 1 hour later 25

26 WiFi deployment 1 hour later 26

27 WiFi deployment RA Still under investigation Captures show RA leakage on the controller side Probably due to the AAA override feature 27

28 Next steps Implement first-hop security Enable IPv6 on client VPN infrastructure Work on monitoring and management tools Train IT staff Deploy VRRPv3 in DC Make more services reachable through IPv6 Deploy IPv6 on the wired network 28

29 Lessons learned It works and there are drivers to go but A lot of work and still a lot to do Time consuming Historical blocking factors First concern of operational teams is service quality Hardware and feature dependant still today Expect to detect bugs on more specific features Issues with monitoring and management tools Test, test and test 29

30

31