IPv6 in the Enterprise Using EX Series Switches

White Paper

IPv6 in the Enterprise
Using EX Series Switches
EX Series Ethernet Switches Enable Simultaneous
IPv4 and IPv6 Network Deployments, Easing the
Transition to IPv6

Copyright © 2012, Juniper Networks, Inc. 1

White Paper - IPv6 in the Enterprise Using EX Series Switches

Table of Contents
Executive Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
IPv6 in the Enterprise . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Deploying IPv6 Using EX Series Switches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
IPv6 Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
IPv6 Unicast Routing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
IPv6 Multicast Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
IPv6 Firewall Filters and Filter-Based Forwarding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
VRRP for IPv6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Virtual Chassis Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
High Availability. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
DHCPv6 Server/Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Port Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
6PE and 6VPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Management and OAM. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Appendix A: Supported RFCs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
About Juniper Networks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 Copyright © 2012, Juniper Networks, Inc.


Executive Summary
Today, the pool of available IPv4 addresses is close to being exhausted. As a result, enterprises need to move to
an IPv6 infrastructure in order to maintain and scale their operations. The increased deployment of IPv6-based
applications and services such as Windows Server is helping speed up this adoption. While it is imperative for
enterprises to migrate to an IPv6 network infrastructure, it is important that the network also simultaneously support
IPv4 to ensure a smooth transition and minimize capital expenditures and business disruption. In addition, the services
available in an IPv6 network should be equivalent to or better than those available in an IPv4 network.
Juniper Networks® EX Series Ethernet Switches enable enterprises to build their next-generation IPv6 networks in a
cost-effective manner, while ensuring minimal impact to their ongoing business operations. The IPv6 infrastructure
available on the EX Series switches is derived from the same carrier-class Juniper Networks Junos® operating system
that runs on other Juniper routing, switching, and security platforms.

Introduction
IPv4 was designed to provide 232 (~4.3B) addresses. This addressing structure makes it difficult to distinctly identify
every Internet device or service. Classless Interdomain Routing (CIDR) and Network Address Translation (NAT) were
developed to delay the exhaustion of IPv4 addresses. But several factors have driven up the demand for addresses,
exacerbating the problem and accelerating the move to IPv6. These include:
• An exponential increase in the number of mobile phones, personal digital assistants (PDAs), and other wireless devices
that require a unique IP address
• A rapid increase in the number of people with persistent Internet access in emerging markets such as Brazil, Russia, India,
and China
• The emergence of applications such as virtualization that allow the instantiation of multiple operating systems on a
single device, with each virtual system requiring its own IP address
In February 2011, the Internet Assigned Numbers Authority (IANA) assigned the last five class A IPv4 address blocks to
the Regional Internet Registries (RIRs), officially depleting the global pool of fresh blocks of addresses. In April 2011,
the Asia Pacific Network Information Center (APNIC) was the first RIR to completely run out of IPv4 addresses.
IPv6 is the next version of IP, developed by the Internet Engineering Task Force (IETF) to deal with the problem posed
by the exhaustion of IPv4 addresses. Its benefits include:
• A large address space—2128 vs. 232 addresses for IPv4
• A stateless address auto configuration that simplifies deployment, maintenance, and operations, leading to significant
cost savings
• Optimized bandwidth usage with efficient multicasting capabilities
• Improved support for mobility and quality of service
• Mandatory, built-in security

IPv6 in the Enterprise
Enterprises are migrating to IPv6 not just to deal with the IPv4 address exhaustion problem, but also to deploy IPv6-
based applications and services. In order to migrate to IPv6, enterprise customers must provide the following:
• An IPv6 network infrastructure that is equivalent to or better than the IPv4 network infrastructure
• Simultaneous support for IPv4 and IPv6 deployments in the network
• A highly available IPv6 network infrastructure
• Management of network devices over IPv6
• IPv6 port security to prevent loss of information and productivity
• Scale and performance to support next-generation IPv6 networks



Deploying IPv6 Using EX Series Switches
The EX Series Ethernet switch product family supports a dual-stack implementation that allows for the concurrent
deployment of IPv4 and IPv6 networks. EX Series switches provide wire-speed IPv6 forwarding performance using their
ASIC-based Packet Forwarding Engines (PFEs).

IPv6 Infrastructure
IPv6 Neighbor Discovery is a protocol that replaces and enhances the Address Resolution Protocol (ARP) function in
IPv4. It is responsible for determining the link-layer addresses of other nodes, address prefix discovery, and discovery of
other nodes on the link.
IPv6 stateless address auto configuration allows a node to automatically configure its addresses based on router
advertisements. When first connected to a network, a host sends a router solicitation request for its configuration
parameters. Routers respond to such requests with a router advertisement message that contains the network
parameters. Replacing manual configuration with auto configuration not only makes the network easier to manage, but
also significantly reduces operating expenses.
Path maximum transmission unit (MTU) discovery allows a node to discover and take advantage of paths with an MTU
greater than the IPv6 minimum link MTU. When transmitting data, it is preferable to send the largest packets that can
successfully traverse the entire path from source to destination. Sending packets smaller than the path MTU wastes
network resources and provides suboptimal throughput for the enterprise network.
EX Series switches support Neighbor Discovery Protocol (NDP), path MTU discovery, and stateless address auto
configuration (SLAAC).

IPv6 Unicast Routing
The EX Series switches support IPv6 unicast routing in both global and virtual router environments. Interior gateway
protocol (IGP) for IPv6, including RIPng, OSPFv3, IS-IS, and multiprotocol Border Gateway Protocol (MBGP) for IPv6,
are also supported.

IPv6 Multicast Routing
Multicast is used in the enterprise to support applications such as audio/video streaming, desktop conferencing, and
collaborative communication. Multicast Listener Discovery (MLD), a component of the IPv6 protocol suite that is
included as part of Internet Control Message Protocol (ICMPv6), is used by IPv6 nodes to discover multicast hosts
connected to it. It is equivalent to Internet Group Management Protocol (IGMP) in IPv4. MLDv1 is similar to IGMPv2, and
MLDv2 is similar to IGMPv3.
MLD snooping is a subset of the MLD protocol that helps conserve network bandwidth by reducing the flooding of multicast
IPv6 packets. When a node receives a packet with a multicast destination address, it floods the packet to all ports in the
same VLAN. With MLD snooping, the packet will only be sent to ports that have listeners/hosts for that address.
Protocol Independent Multicast (PIM) for IPv6 is a multicast routing protocol that allows IPv6 nodes to discover other
nodes that can receive multicast packets.
The EX Series switches support MLDv1/2 and PIM for IPv6, along with IPv6 multicast routing in both global and virtual
router environments. MLDv1/2 snooping is also supported.

IPv6 Firewall Filters and Filter-Based Forwarding
EX Series switches support both behavior aggregate (BA) and multifield classifiers. The BA classifier maps the DiffServ
code point (DSCP) bits to a forwarding class and loss priority. While the forwarding class determines the output queue,
the loss priority is used by a scheduler to control packet discards during periods of congestion. Multifield classifiers
examine multiple fields in a packet such as source and destination IPv6 address. The forwarding class and loss priority
of a packet are determined through firewall filter rules.



Rewrite rules map the forwarding class and loss priority to the DSCP bits in the IPv6 packet before sending the packet
to the next hop. Firewall filters subject packets to filtering, classification, and traffic policing. The EX Series switches
support filters for IPv6 traffic that can match on several fields including IPv6 source, destination address, prefix list,
IPv6 version, and so on.
The EX Series switches also support filter-based forwarding (FBF), which uses firewall filters to forward packets to
virtual routing instances. This allows for packets to follow different paths in the network.

VRRP for IPv6
Virtual Router Redundancy Protocol (VRRP) increases the availability of the default gateway servicing hosts on the
same subnet. A logical device consisting of a master and backup is advertised as the default gateway instead of
one physical node. VRRPv3 introduces support for IPv6 in addition to IPv4. Even though IPv6 includes robust router
discovery as part of its Neighbor Discovery Protocol, VRRP is able to failover much more quickly with its sub-second
timers.
EX Series switches support VRRPv3, increasing the availability of IPv6 networks.

Virtual Chassis Technology
Juniper Networks EX4200, EX4500, and EX8200 lines of Ethernet switches support Virtual Chassis technology, which
allows two or more interconnected devices to operate as a single logical device with a single management plane,
configuration file, and operating system. The IPv6 functionality that can be deployed on a standalone switch can also
be deployed in a Virtual Chassis configuration. Virtual Chassis technology also eliminates the need for protocols such
as VRRP, since the logical device is managed through a single IPv6 address.
EX4200, EX4500, and EX8200 switches support IPv6 within a Virtual Chassis configuration.

High Availability
Nonstop active routing (NSR) enhances the resiliency characteristics of network protocols by preventing service
interruptions during the brief period when a backup Routing Engine (RE) takes over for a failed primary RE. Without
NSR, routing protocols would begin the process of reconverging network paths. NSR prevents such a reconvergence
from occurring, thus maintaining service continuity and minimizing business disruption for the enterprise.
EX Series switches support NSR for IPv6 routing protocols that include RIPng, OSPFv3, IS-IS, and IPv6 PIM.

DHCPv6 Server/Relay
Dynamic Host Configuration Protocol (DHCPv6) can automatically provide a host (DHCP client) with IPv6 addresses
assigned by a DHCPv6 server without the need for manual intervention. Although the stateless address auto
configuration protocol removes the need for DHCP in IPv6, DHCPv6 can still be used to assign addresses if the network
administrator desires more control over addressing. DHCPv6 is the “stateful” address auto configuration protocol. The
DHCPv6 server manages a pool of IPv6 addresses and information about client configuration parameters such as
default gateway, domain name server, and others.
In small networks where only one subnet is being managed, DHCPv6 clients communicate directly with DHCPv6
servers. However, if the DHCPv6 client and server are not on the same subnet, relay agents are required. A DHCPv6
relay agent exchanges unicast messages with the DHCPv6 server to relay messages between clients and servers. The
relay agent stores its own address in the messages sent to the server. The server uses the address to determine the
subnet on which the relay agent received the broadcast from the host (client) and allocates an IPv6 address on that
subnet.
EX Series switches will be able to be configured to act as both a DHCPv6 server and relay agent in future releases.



Port Security
Port security features protect the network against malicious attacks, minimizing loss of information and productivity
for the enterprise. These include features like Router Advertisement (RA) guard, DHCPv6 snooping, and IPv6 source
guard. The EX Series switches will support port security features in future releases.
• RA guard: IPv6 RAs are used to determine node configuration information during address auto configuration, whether it
is through “stateless” or “stateful” (via DHCPv6) means. If rogue RAs appear on the network, they can cause partial or
complete failure of IPv6 hosts. For example, rogue RAs can cause hosts to assume wrong prefixes during stateless auto
configuration. Rogue RAs can appear on the network either because of administrator, user, or malicious misconfiguration.
RA guard provides a solution to the rogue RA problem.
Stateless RA guard examines incoming RAs and decides whether to forward or block them based on the configuration
in the network device. Once the RA frame is validated; it is either forwarded to the destination or it is dropped. Stateful
RA guard, on the other hand, learns dynamically about legitimate RA senders and stores this information for allowing
subsequent RAs.
• DHCPv6 snooping: DHCPv6 snooping monitors and blocks DHCPv6 server messages received from untrusted devices
connected to the switch. It is analogous to DHCP snooping for IPv4; it builds and maintains an IPv6 media access control
(MAC) address binding database called the DHCPv6 snooping database.
• IPv6 source guard: IPv6 source guard mitigates the effects of spoofed source IPv6 or MAC addresses in a switched
environment. It is analogous to IP source guard for IPv4; it uses the DHCPv6 snooping database to determine if the
packet received from a host has a valid IPv6 and MAC source address.

6PE and 6VPE
IPv6 provider edge (6PE) is useful for tunneling IPv6 packets over an MPLS cloud to a remote location in the enterprise.
Note that the MPLS backbone itself can be built on IPv4. This allows for a smooth transition for enterprises that have
an existing IPv4-based MPLS backbone. The MPLS backbone is totally unaware of the packets it is transporting;
therefore, it can be shared for tunneling both IPv4 and IPv6 packets. 6VPE provides the same functionality in a
virtualized environment.
The EX8200 line of Ethernet switches supports both 6PE and 6VPE configurations.

Management and OAM
The EX Series switches can be managed using IPv6 addressing. Syslog, Telnet, SSH, Juniper Networks Junos Web, and
Simple Network Management Protocol (SNMP) services are supported over IPv6. In addition, services such as Network
Time Protocol (NTP) and Domain Name System (DNS) are also supported over IPv6. The EX Series switches also
support essential IPv6 Operation, Administration, and Maintenance (OAM) tools such as ping and traceroute.

Licensing
An advanced feature license (AFL) is required to deploy IPv6 routing protocols such as RIPng, OSPFv3, IS-IS, MBGP,
PIM, and MLDv1/2 on EX Series switches. An AFL is also required for deploying 6PE and 6VPE functionality on the
EX8200 line. All other functionality, including IPv6 infrastructure (SLAAC, NDP, and path MTU discovery), IPv6 quality
of service (QoS), firewall filters, FBF, VRRP for IPv6, DHCPv6 server/relay, port security, management and OAM, is
available in the base image.

Certification
Juniper is committed to providing its customers—including government agencies across the globe—with certified
products that are standards compliant. Certifications that demonstrate IPv6 capability and conformance include:
1. The Installation Information Infrastructure Modernization Program (I3MP), a collection of efforts (voice/data/cable/
long-haul gateway/enterprise management) that modernizes the core enterprise information infrastructure at
Army installations (CONUS/Pacific/Europe/SWA) worldwide. I3MP certification testing is performed by the Army
Technology Integration Center (TIC), and IPv6 is an integral part of this testing.
2. Joint Interoperability Test Command (JITC), which tests and certifies IT products for IPv6 compatibility according to
the RFCs outlined in the Department of Defense IPv6 Standards profiles for IPv6-capable products. Once products
are certified for special interoperability, they are added to the DoD’s Unified Capabilities Approved Products List (UC
APL) for IPv6. This list is used by procurement offices in the DoD and by U.S. Federal agencies for ongoing purchases
and acquisitions of IT equipment.



3. The IPv6 Forum “IPv6 Ready” logo program is a conformance and interoperability testing program intended to
increase user confidence by demonstrating that IPv6 is ready and available now. The Phase 1 logo focuses on core
IPv6 protocols.
4. USGv6 is a test program designated by National Institute of Standards and Technology (NIST) that provides a
proof of compliance to IPv6 specifications outlined in current industry standards for common network products.
It is meant as a strategic planning guide for USG (United States Government) IT acquisitions to help ensure the
completeness, correctness, interoperability, and security of early IPv6 product offerings so as to protect early USG
investments in the technology.
EX Series switches have achieved I3MP (TIC) and UC APL (JITC) certifications, and are currently in the process of
achieving IPv6 Ready Logo (Phase 1) and USGv6 certifications.

Conclusion
Juniper Networks EX Series Ethernet Switches provide a highly available IPv6 network infrastructure together with the
features required to build the next-generation IPv6 networks. With features like IPv6 unicast and multicast routing,
QoS, IPv6 over Virtual Chassis configurations, port security, 6PE, 6VPE, and management, the EX Series switches can
provide the enterprise with a complete IPv6 solution. The EX Series switches also enable simultaneous IPv4 and IPv6
network deployments to ease the transition to IPv6. In addition, the certification programs underway for the EX Series
platforms demonstrate commitment, completeness, and compliance.
Please contact your sales representative for current and future support of IPv6 features on all EX Series platforms.



Appendix A: Supported RFCs
The table below summarizes the list of RFCs supported on the EX Series switches.

RFC# Synopsis
RFC1157 SNMP
RFC1213 MIB for network management
RFC1215 A convention for defining traps for use with SNMP
RFC1771 Border Gateway Protocol 4 (BGP-4)
RFC1772 Application of BGP on the Internet
RFC1901 Introduction to community-based SNMPv2
RFC1902 Structure of management information for SNMPv2
RFC1905 Protocol operations for SNMPv2
RFC1981 Path MTU discovery for IPv6 (EX 8200, EX4200, and EX3200)
RFC2080 RIPng for IPv6
RFC2081 RIPng protocol applicability statement
RFC2283 Multiprotocol extensions for BGP-4
RFC2373 IPv6 addressing architecture
RFC2375 Multicast address assignments
RFC2460 IP
RFC2461 Neighbor Discovery for IPv6
RFC2462 IPv6 stateless address auto configuration
RFC2463 ICMPv6 for the IPv6 specification
RFC2464 Transmission of IPv6 packets over Ethernet networks
RFC2465 MIB for IPv6
RFC2474 Definition of the differentiated services field (DS field) in the IPv4 and IPv6 headers
RFC2545 Use of BGP-4 multiprotocol extensions for IPv6 interdomain routing
RFC2578 Structure of management information version 2 (SMIv2)
RFC2711 IPv6 router alert option
RFC2740 OSPF for IPv6
RFC3306 Unicast prefix-based IPv6 multicast addresses
RFC3484 Default address selection for IPv6
RFC3513 IPv6 addressing architecture
RFC3587 Global unicast address format
RFC3587 IPv6 global unicast address format
RFC3768 VRRP
RFC3810 MLDv2 for IP
RFC4291 Addressing architecture
RFC4552 Authentication/confidentiality for OSPFv3
RFC4604 Using IGMPv3
RFC4659 BGP-MPLS IP Virtual Private Network (VPN) Extension (partial support on EX8200)
RFC4798 Connecting IPv6 islands over IPv4 MPLS using IPv6 Provider Edge routers (6PE—available
only on EX8200)
RFC4890 Recommendations for filtering ICMPv6 messages in firewalls (except EX8200)
RFC5095 Deprecation of Type 0 routing headers in IPv6
RFC5308 Routing IPv6 with IS-IS
RFC5340 OSPF for IPv6
draft-ietf-isis-ipv6-06.txt Routing IPv6 with IS-IS
draft-kato-bgp-ipv6-link-local-00. BGP4+ peering using IPv6 link-local address
txt

Note: For more information on IPv6, please visit www.juniper.net/ipv6.



About Juniper Networks
Juniper Networks is in the business of network innovation. From devices to data centers, from consumers to cloud
providers, Juniper Networks delivers the software, silicon and systems that transform the experience and economics
of networking. The company serves customers and partners worldwide. Additional information can be found at
www.juniper.net.

Corporate and Sales Headquarters APAC Headquarters EMEA Headquarters To purchase Juniper Networks solutions,
Juniper Networks, Inc. Juniper Networks (Hong Kong) Juniper Networks Ireland please contact your Juniper Networks
1194 North Mathilda Avenue 26/F, Cityplaza One Airside Business Park representative at 1-866-298-6428 or
Sunnyvale, CA 94089 USA 1111 King’s Road Swords, County Dublin, Ireland authorized reseller.
Phone: 888.JUNIPER (888.586.4737) Taikoo Shing, Hong Kong Phone: 35.31.8903.600
or 408.745.2000 Phone: 852.2332.3636 EMEA Sales: 00800.4586.4737
Fax: 408.745.2100 Fax: 852.2574.7803 Fax: 35.31.8903.601
www.juniper.net

Copyright 2012 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos,
NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other
countries. All other trademarks, service marks, registered marks, or registered service marks are the property of
their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper
Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice.

2000418-002-EN Mar 2012 Printed on recycled paper


IPv6 in the Enterprise Using EX Series Switches

Recomendados

Recomendados

Mais conteúdo relacionado

Mais de Juniper Networks

Mais de Juniper Networks (20)

Último

Último (20)

IPv6 in the Enterprise Using EX Series Switches