Wednesday, January 22, 2014

An IPv6 Success Story (Galois)

The following article was contributed by Paul Heinlein, a systems administrator at Galois. Paul attended my full day IPv6 training course at USENIX LISA and just a couple of months later sent me a report of his successful deployment of IPv6. So I asked if he'd like to contribute an article on the topic.

It's great to hear of IPv6 success stories like this. (And of course, I'm glad folks are finding my courses useful). Significantly, his network is already seeing a very substantial amount of IPv6 traffic!

(A note: the version of iptables in Redhat Enterprise Linux6/CentOS 6 has fixed the stateful IPv6 inspection capability. We use it successfully at Penn).

You can find the slides from my IPv6 training course on my website.

-Shumon Huque



An IPv6 Success Story

Paul Heinlein


Galois is a software-engineering firm located in Portland, OR that specializes in the hard problems of computing trust and assurance.

One of our IT goals for 2014 is enabling IPv6 on all our current IPv4 subnets. I was pleased to see Shumon's full-day IPv6 tutorial on the LISA '13 schedule. I hoped he could fill the gaps in my limited
experience with IPv6 and provide me the knowledge I'd need to configure our network hardware and applications.

Full-day technical tutorials can sometimes test my patience, but Shumon's presentation moved quickly while remaining clear. I came away from the day thinking that I had enough basic knowledge to plan and implement our IPv6 rollout.

Returning to Portland, I had to upgrade upgrade a couple core switches and apply to our ISP for a netblock prior to enabling it on our network, but once the hardware was in place, everything went reasonably well.

Shumon's overview had done exactly what I'd hoped it would: allow me to interpret the various bits of vendor-specific and application-specific documentation and assemble a reasonable roll-out plan.

Our DMZ and client networks are now fully IPv6 enabled. (Internal development networks will take a bit more time due to VPN-related complexity.)

Along the way, I learned a couple things Shumon didn't explicitly cover in his presentation.

First, make sure that reverse DNS pointers are in place for any mail server before enabling IPv6. gmail (among others) will reject messages from any mail server without reverse DNS pointers in place.

Second, the ip6tables that ships with RHEL/CentOS 5 has a limited ability to do stateful packet inspection. The generic rule allowing packets from established or related sessions does not work:

   # this is broken in RHEL/CentOS 5
   -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

(We've only got one CentOS 5 machine in our DMZ, so this issue hasn't impacted us in any major way.)

Third, it was a lot of fun! Nearly all our DMZ services (NTP, DNS, Jabber, e-mail, www, ssh, host-based firewalls) needed updated configurations, so I learned a bunch. The day after I did the initial rollout, one of our engineers came into the office, turned off IPv4 on his Mac, and tested what percentage of Google result links he could follow. (He thought about 5%, though he said the queries he chose probably resulted in a higher success rate than might be normal.)

Finally, I've been mildly surprised at the quantity of IPv6 packets traversing our border firewall. Over the past week, IPv6 has comprised 38% of overall inbound traffic and 11% of outbound. The numbers are similar when scoped to the past month.

I'd like to express my thanks to Shumon for the talk and the LISA organizers for putting it on the schedule!

  -- Paul Heinlein <heinlein@galois.com>

18 comments:

  1. Your post is helping me a lot. Its really nice and epic. Thanks a lot for the useful info on this topic. You did it so much well. I love to see more about GB WhatsApp. Keep sharing and updating. Also share more posts with us. Thank you.

    ReplyDelete
  2. The most difficult of all professional assignments fall under the domain of finance assignment help. It is imperative that for managerial accounting homework help or accounting assignment help, understudies rely only on the best and most reliable assignment help website in the whole world, i.e. www.greatassignmenthelper.com.

    ReplyDelete
  3. Get a nice game plan on your web shopping with these markdown codes and offers. New methodologies just added for December at Amazon UK, ao.com, Sainsburys and anything is possible beginning there.
    By: horse riding gloves

    ReplyDelete
  4. This article is really helpful and good Thanks for sharing with us.Alicante Private Transfers Discount Code

    ReplyDelete
  5. For some understudies, this term can end up being a piece irritating yet hard to #1 Essay Writing Service in UK perform. An instructor can convey any sort of assignment to understudies. Like, it very well may be as an exposition, lab report, contextual analysis, research paper, or a few different arrangements. Generally, they end up being more diligently for understudies perusing in universities or the people who way to deal with higher auxiliary levels in the schools.

    ReplyDelete

  6. Really, you always claim that good students are typically very satisfied with their courses. I know this because I have been reading your blog for a long time, and I have noticed that you consistently post factual information. Because I trust list of research topics in human resource management service just as much as you do, When things are tough, it always helps me.

    ReplyDelete
  7. When implemented properly, artificial intelligence (AI) and machine learning (ML) allows businesses to convert products, services, and processes by automating greatly what is done manually by engineering teams.

    ReplyDelete
  8. can I watch a league of their own by simply change the setting of IPV6? or still I've to use VPN to browse the banned website in my country?

    ReplyDelete
  9. When appropriately used, machine learning (ML) and artificial intelligence (AI) enable enterprises to transform their products, services, and business processes by dramatically automating tasks that were previously completed manually by engineering teams. Take my online exam.

    ReplyDelete
  10. The article is useful and keep sharing such knowledgeable articles. Our team offers high quality made outfits such as the crow trench coat at low prices .

    ReplyDelete
  11. Long-term results for ideal ground stabilization, including SOIL MODIFICATION in Houston, Texas, more durability and load-bearing capacity, are produced by lime SOIL MODIFICATION services in USAn services in Houston. The addition of binding agents like fly ash will strengthen the stabilised soil.

    ReplyDelete
  12. Dubai gaming competition TakeMiddle East esports in Dubai part in a series of exciting battles with opponents from around the globe that will astound you. A thrilling experience that you won't soon forget is guaranteed thanks to our excellent servers and knowledgeable referees. Make a space reservation and start planning right away!

    ReplyDelete
  13. Hasten will complete the job on schedule, safely, and using high-quality products while making sure the outcomes exceed your requirements.

    ReplyDelete
  14. You can get help with this from acb. We have experience in this subject, thus we are totally qualified. Trade finance in Dubaihas established a reputation as one of the most dependable companies when it comes to providing commercial loans. Dubai trade financing Why not immediately? Contact Back to Back LC transactions in Dubai
    us as soon as possible! We also developed a strong reputation as one of the most trustworthy names in the commercial financing sector. Why not wait? Get in touch with us as soon as possible!

    ReplyDelete
  15. I really enjoy reading your blog!! It is so appreciated.

    ReplyDelete
  16. So when it comes to financing your next vehicle purchase with auto financing calgary, you can trust us for hassle-free service and award-winning customer care!

    ReplyDelete