Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Of course, I realize the need to go to IPv6 out on the open Internet since we are running out of addresses, but I really don't understand why there is any need to use it on an internal network. I have done zero with IPv6, so I also wonder: Won't modern firewalls do NAT between internal IPv4 addresses, and external IPv6 addresses?

I was just wondering since I have seen so many people struggling with IPv6 questions here, and wonder why bother?

share|improve this question

11 Answers 11

up vote 41 down vote accepted

There is no NAT for IPv6 (as you think of NAT anyway). NAT was an $EXPLICATIVE temporary solution to IPv4 running out of addresses (a problem which didn't actually exist, and was solved before NAT was ever necessary, but history is 20/20). It adds nothing but complexity and would do little except cause headaches in IPv6 (we have so many IPv6 Address we unabashedly waste them). NAT66 does exist, and is meant to reduce the number of IPv6 addresses used by each host (it's normal for IPv6 hosts to have multiple addresses, IPv6 is somewhat different than IPv4 in many ways, this is one).

The Internet was supposed to be end-to-end routable, that is part of the reason IPv4 in invented and why it gained acceptance. That is not to say that all address on the Internet were supposed to be reachable. NAT breaks both. Firewalls add layers of security by breaking reachability, but normally that it's at the expense of routability.

You will want IPv6 in your networks as there is no way to specify an IPv6 endpoint with a IPv4 address. The other way around does work, which enables IPv6-only networks using DNS64 and NAT64 to access the IPv4 Internet still. It's actually possible today to ditch IPv4 all together, though it's a bit of hassle setting it up. It would be possible to proxy from IPv4 internal addresses to IPv6 servers. Adding and configuring a proxy server adds configuration, hardware, and maintenance costs to the network; usually much more than simply enabling IPv6.

NAT causes it's own problems too. The Router has to be capable of coordinating every connection running through it, keeping track of endpoints, ports, timeouts, and more. All that traffic is being funneled through that single point usually. Though it's possible to build redundant NAT routers, the technology is massively complex and generally expensive. Redundant simple routers are easy and cheap (comparatively). Also, to re-establish some of the routability, forwarding and translating rules have to be established on the NAT system. This still breaks protocols which embed IP addresses, such as SIP. UPNP, STUN, and other protocols were invented to help with this problem too - more complexity, more maintenance, more that could go wrong.

share|improve this answer
24  
The router the NAT was running on is what separated the networks, that router will still separate the networks, nothing has changed except the router has to be programmed correctly for IPv6. Routable yes, not necessarily reachable (firewall rules will likely block most traffic). –  Chris S May 26 '11 at 19:26
6  
@Tomtom: Anyone who thinks they need it doesn't know they need a firewall instead. There is literally no problem that NAT is the best solution for, other than problems caused by scarcity of addressing. There is no scarcity of addressing in IPv6 (yet!). It might well be in development, but that doesn't mean it's not a stupid idea :) –  growse May 26 '11 at 21:32
4  
@JimB - as far as I'm aware there's been at least 4 different IPv6 NAT proposals that have been in development and all of them have failed. Given that that page is almost 3 years old, I'm going to guess that by now it's failed too –  Mark Henderson May 26 '11 at 21:41
10  
I know this will sound offensive, so I'm apologizing up front, but if you aren't the cook stay out of the kitchen. People understand if they work on their own car they might break something that causes a world of damage... Same goes for computer security, if you don't know how, you'll likely end up doing more harm than good. You do have a point, that NAT makes some levels of security easier (most notably and almost exclusively that your internal network isn't Internet routable). Even on most NAT routers today this is only a default setting, and the "security" provided by NAT can be disabled. –  Chris S May 27 '11 at 3:23
5  
Lets not start bandying around words like 'SECURITY' without a sensible discussion about vulnerabilities and threats. What specific vulnerability does NAT protect? What specific 'attacks' are you talking about? Are they the same attacks that the rest of the professional world mitigates with a stateful firewall? If so, NAT's not really buying you much. –  growse Feb 15 '13 at 14:29

The only good reason to go IPv6 internally is to be ready when the world switches to IPv6, and I think that's a pretty bad reason, given the rate of adoption. Since most internal IPs won't be externally reachable, it wouldn't be a big deal to translate the rest.

My corporation will probably never switch to IPv6 internally. It would require a fundamental shift in policy so massive I can't honestly conceive how it could come about. A lot of people would have to get killed, and a lot of inexplicable hiring choices would have to be made. Likewise, any attempt by individual business units to switch to IPv6 on their LANs would be squashed with prejudice by the corporate networking overlords based on interoperability and maintainablity concerns (we allow a lot of leeway locally, but not that much.)

Basically, if switching to IPv6 was painless, we'd have done it years ago.

share|improve this answer
14  
"My corporation will probably never switch to IPv6 internally." <- that's a pretty bold and perhaps naive statement IMHO. –  EEAA May 26 '11 at 20:00
3  
@erika: They will when it becomes difficult to get hardware that supports IPv4. Until then, no. There is no business case for it. They'd be more likely to ditch internal networking entirely, and host their entire business in the cloud somewhere. –  Satanicpuppy May 26 '11 at 20:05
3  
What happens when Google or some other external service drops support for IPv4. Not being able to connect to people outside of your network will be a problem in the future. –  Zoredache May 26 '11 at 20:40
2  
@zoredache: We're talking internal support here. Even now, it's not hard to bridge IPv4 to IPv6, as long as you don't need every machine to be available externally. Hell, our current hardware supports that. –  Satanicpuppy May 26 '11 at 20:44
2  
Remember that all windows boxes since vista run dual stack out of the box. There is no reason NOT to let it stay on as implemented –  Jim B May 26 '11 at 21:39

Couple of reasons:

  • IPv6 doesn't support broadcasting. It is replaced with multicasting. Broadcasting enables one node to send traffic to all nodes on a subnet. Management of broadcast domains is a major issue with keeping large IPv4 networks running fast and smoothly. Multicasting requires that nodes that want to receive "broadcast"-style actually "sign-up" for it, so the network isn't flooded with traffic that hits all hosts.

  • IPv6 supports IPsec style encryption natively.

  • IPv6 supports autoconfiguration. It's possible for hosts behind a router to configure themselves without the need for DHCP, although you still need a DHCP server to hand out DHCP options such as DNS server, TFTP server, etc.

share|improve this answer
1  
IPv6 allows renumbering of an entire subnet with almost no complication. It also allows merging of subnets. It has incredibly granular control over multicast traffic... there are even more reasons but its been forever since I took my IPv6 course. –  Matthew May 26 '11 at 20:43
2  
These are all popular myths, here's the bit more info: IPv6's multicasting is mandatory for basic functionality: for example to do a IPv4's ping broadcast equivallent you ping6 to FF02::1 for all regular nodes, and FF02::2 for all routers. IPv6's IPSec does not change ANYTHING from IPv4. You don't get any security for free. Still gotta configure all the modes, and deal with key distribution. IPv6's autoconfiguration is utter junk; by default it's as insecure as MAC<->IPv4, and it does NOT hand out DNS. If you want DNS you gotta install DHCPv6, so no gain there. –  Marcin Jun 15 '11 at 3:18
    
I consider the 3rd point a weakness of ip6. How many times have you checked to see whether a machine had received an IP as part of the troubleshooting process? That part just got more difficult. –  Joel Coel Jun 20 '11 at 23:41

IPv6 does offer some potential real-world improvements over IPv4, such as a simpler auto-configuration and auto-discovery mechanism, it's also safer in the sense that it becomes unfeasible for malware to replicate across a network by port-scanning an IP range -- there are just too many IPs. But those improvements aren't particularly dramatic, and certainly not worth the switching cost.

But note that it's not an either/or decision, you can run both in parallel, and if you develop software, you probably should, as many people have mentioned, for testing purposes. There's no reliable way to make a program IPv6-compatible without having an internal IPv6 infrastructure to test on. Most modern OSes will set up an internal IPv6 network automatically between them -- it's just a matter of using it.

10 years ago I built a bit of software for an employer customers use to fetch program updates. When building the network component, I had to decide between building in IPv6 compatibility, or just assuming all IP addresses will be 4 bytes. I decided to take the simple route, saving myself about 4 hours of work, and made the application IPv4-only. I figured it would be replaced in a few years anyway. They're still using it today, and are therefore locked out of some smaller markets.

share|improve this answer

Running out of internal (rfc1918) ipv4 addresses can also be a very valid reason to go ipv6.

Comcast explained at Nanog37 why they were going ipv6 for their management addresses.

20 Million video customer
x 2.5 STB/customer
x 2 ip addresses/STB
--------------------  
= 100 Millions IP addresses

And this is only for video, not data/modems.

They exhausted the RFC1918 pools in 2005. Then they used public addresses pools (as nat isn't an option for management), and went ipv6 to solve their needs.

share|improve this answer
2  
What about the non-mega corporations? –  Cypher May 26 '11 at 20:55
    
well, there is still all other answers ;) –  petrus May 26 '11 at 23:17
    
I don't think that any corporation is going use more than 16,777,216 INTERNALLY...Sure, externally for their customers. Nobody disputes that we need more public IP addresses. –  KCotreau May 26 '11 at 23:18
1  
I wasn't talking about the public/wan ip address of a router, but the management ip addresses on a cable modem or set-top box. So yes, Comcast and all large cable providers do need more than 2^24 ip @. –  petrus May 26 '11 at 23:27

My old job, at a large University, would use an IPv6 allocation internally. They were assigned an IPv4 /16 back in the day and even today is passing out IPv4 addresses to nearly every internal client. The RFC1918 networks were restricted to the telecom-only network and certain specialized usages (the PCI standards required RFC1918 usage until October 2010).

Because of this, they were actively planning to use IPv6 internally as well. There were some hardware issues still to work out, the edge switches weren't supporting v6 well enough, but the core was ready. The idea was that getting v6 support at the publicly visible end (okay, the publicly responsive end) of the network would involve 70% of the work to deploy it to everyone, may as well do the extra 30% and go end-to-end with it.

Having lived with a public IP allocation for so long, our people were very aware of the adage: "just because it is public, does not mean it is reachable." As Chris S said, routeable does not imply reachable.

That is why at least one class of organization would deploy IPv6 internally: because they're already using non-RFC1918 IPv4 internally.

share|improve this answer

I can think of two reasons to use IPv6 for an internal host.

  1. You may find in the future that this host now needs to be externally available at least on certain ports.

  2. You may find that this host needs to connect to another host who has also chosen the same internal address. For example you need to connect to 10.0.0.5 at Acme corporation and your own address at Emca corporation is also 10.0.0.5. I remember this happening at a previous job, we had both used the same internal addresses.

I would say that in the modern world most computers are not 100% internal. Most desktops can make some limited connections to the outside world or vice versa.

share|improve this answer

Aside from lager address space, absence of broadcast, IPSec and simpler auto-configuration there are some "not so known" advantages of IPv6:

  1. Bigger address space means that address has more bits that can be used as data storage. For example hop-count between two nodes then can be a function of their IPv6 addresses e.g.:
    IPv6 address can be in format PREFIX:Country&Region:DC&Line:Rack&Unit:VM&ID so closer nodes will have more Most-Significant-Bits same. This is just an example, of course "closeness" metrics could be stored in some kind of external database like DNS TXT|SRV records.

  2. There are some techniques of using address space of IPv6 for cryptographic purposes such as Cryptographically Generated Addresses (CGA) and SEND (SEcure Neighbor Discovery)

  3. When IPv6 is enabled all nodes in network have link-local IPv6 address(if not configured otherwise). So there is a chance that you can access even mis-configured node.

  4. You can get nodes' MAC addresses directly from link-local IPv6 address (if IPv6 privacy extensions are not configured)

  5. There is no way you can possibly use IPv4 in subnets with thousands of nodes - your network will be overloaded with broadcast traffic (e.g. ARP).

  6. You can query node for additional information using node information, e.g. in BSD you can query host for ICMPv6 Node Information Node Addresses:

$ ping6 -a Aacgsl ::1

PING6(72=40+8+24 bytes) ::1 --> ::1
136 bytes from ::1: 
  fe80::beae:c5ff:fe43:44a(TTL=infty)
  fe80::beae:c5ff:fe43:212(TTL=infty)
  ::1(TTL=infty)
  fe80::1(TTL=infty)
  2a02::9222(TTL=infty)
share|improve this answer

Working for a small company I can only think of reasons NOT to use IPv6.

  • We don't even have an IPv6 public address, so why on Earth would we run it internally?
  • We would have to replace our firewall, which I love dearly, as it doesn't (yet) support IPv6
  • We don't have a way to assign, let alone control, IPv6 addresses
  • Only half of our PCs supports IPv6
  • None of our manufacturing plant supports IPv6
  • Our switches don't support IPv6
  • I've never even seen a printer that supports IPv6
  • IPv6 is much harder to use from the command line - pretty important point for me
  • I would need to get fully up to speed on IPv6 - hard to do when I'm uninterested
  • ... and a whole lot of other reasons I can't think of just now

It just doesn't make sense for a company like ours to make the change, as it would take considerable expense and effort with absolutely nothing to gain from it.

Quite frankly, I like NAT and the benefits we get from dealing with local addresses. If it ever becomes necessary (as opposed to being a geek want-to-do) for us to interact with IPv6 on the Internet we'll do so at the gateway.

I'm not expecting this current IPv6 fad to become a necessity for the very vast majority of the world, internally at least, for a decade or more. As I expect to be retired by then there's not a whole lot of incentive for me personally to waste time and effort on it.

Edit:

I'm getting downvotes but not a single logical and sensible opposing view. Makes me think it's just a bunch of bandwagon jumping geeks who want to follow the trend without thinking about it. There has to be a REASON to make such a drastic change to a network and I don't have one. Further, I strongly suspect only a very few SF users do have one.

share|improve this answer
2  
1. ask your ISP for an allocation.. Unlike IPv4, you can't just request a block. you have to have the ability to use up X amount of them within 6 months. –  Brian Jun 15 '11 at 5:31
2  
3. you assign by setting up your router with a IPv6 address, and let the machines autoconfigure themselves. (or setup Dhcp6) –  Brian Jun 15 '11 at 5:31
4  
4. Windows XP SP2 supports IPv6. 6. Switches don't talk IP. They talk layer 2. they work fine with Ipv6 I have run Ipv6 over some 2001 3com switches. You might need to support ipv4 still to get to the management of some of them.. Any HP printer with a jetdirect card sold in the last 5 years (or is it more) support IPv6 –  Brian Jun 15 '11 at 5:34
    
@Brian, no point having IPv6 coming in of our firewall can't talk it. As for the other points, there's nothing there that gives me any reason to implement IPv6, which is really the whole point - I have no reason to run IPv6 but plenty of reasons not to. If most people were honest with themselves they would have to admit the same. –  John Gardeniers Jun 15 '11 at 7:54
    
Many small businesses that have deployed Server 2008 R2 like Direct Access, which lets you connect to all your 'internal' resources securely, without a VPN, but requires IPv6 setup internally. (but not externally) technet.microsoft.com/en-us/library/dd758757(WS.10).aspx –  Brian Jun 15 '11 at 16:30

We are talking two things here - running internal network on pure IPv6 or running IPv4/IPv6 dual-stack. I think it is premature to talk about running pure IPv6 - on many operating systems it is even impossible using IPv6 without IPv4. However, you may consider running dual-stack for the following reasons (a) if you develop software (b) in order to prepare your network for inevitable migration to IPv6. If you situation is A then you should act now, if it is B then by my estimate you have about 1-2 years to think about it (but the sooner you start the more prepared you will be).

My situation is A and we are running dual-stack for 6 month now. During this time we identified and solved some issues with our public/private DNS, address allocation, DHCP, routing, firewalling and we could not even anticipate many of these issues without trying. Now, we are fully IPv6 ready and we even have IPv6 public access via tunneling. From my experience I can say with confidence that IPv6 is much simpler and more elegant solution in comparison to ageing IPv4, so I'll be very happy when time comes to switch to IPv6, but before this time comes - dual-stack is the way to go.

share|improve this answer

The accepted answer is misleading

Chris S concepts on NAT are way wrong; one of the best features of NAT besides the artificial expansion of IPv4 schema is SECURITY. NAT is the layer that hides the real IP of a host that if directly connected to Internet can be the target of all the imaginable attacks. Happily talking about getting rid of NAT without encouraging extra security measures is just plain ignorance on the topic.

share|improve this answer
3  
How exactly is NAT a security layer? –  MDMarra Mar 30 '13 at 9:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.