process enables you to connect the IPv6 islands
without converting the entire network to IPv6. Tunneling is an
integration method where an IPv6 packet is encapsulated within
another protocol, such as IPv4. This method of encapsulation is
IPv4 protocol 41 and has the following characteristics:
- Includes a 20-byte IPv4 header with no options and an IPv6
header and payload.
- Considered dual stacking, which
enables the connection of IPv6 islands without converting an
intermediary network to IPv6.
- Tunneling presents these
issues:
- The MTU is decreased by 20 octets (if the IPv4
header does not contain any optional field).
- Difficult
to troubleshoot.
Tunneling is an
intermediate integration and transition technique that should
not be considered a final solution. Native IPv6 architecture
should be the ultimate goal.
Content 8.6 Using
IPv6 and IPv4 8.6.4 Isolated Dual-Stack
Host Encapsulation can be done by edge routers between
hosts or between a host and a router. The example in Figure
shows an isolated dual-stack host using an encapsulated tunnel
to connect to the edge router of the IPv6 network. Tunneling
does not work if an intermediary node between the two end
points of the tunnel, such as a firewall, filters out IPv4
protocol 41, which is the IPv6-over-IPv4 encapsulation.
Content 8.6 Using IPv6 and IPv4 8.6.5
Configuring Tunneling If you are manually configuring a
tunnel, you should configure both the IPv4 and IPv6 addresses
statically. You should perform this configuration on the
routers at each end of the tunnel. These end routers must be
dual stacked, and the configuration cannot change dynamically
as network and routing needs change. Routing must be set up
properly to forward a packet between the two IPv6 networks.
Tunnel endpoints can be unnumbered, but unnumbered endpoints
make troubleshooting difficult. The IPv4 practice of saving
addresses for tunnel endpoints is no longer an issue.
Content 8.6 Using IPv6 and IPv4 8.6.6
Example of a Configured Tunnel The example in Figure
shows how to configure an IPv6 overlay tunnel manually. With
manually configured IPv6 tunnels, an IPv6 address is
configured on a tunnel interface, and manually configured IPv4
addresses are assigned to the tunnel source and the tunnel
destination. The host or router at each end of a configured
tunnel must support both the IPv4 and IPv6 protocol stacks.The
command that enables the IPv6 overlay tunnel is tunnel mode
ipv6ip. Specifically, it specifies that IPv6 is the
passenger protocol and that IPv4 will be used as both the
encapsulation and transport protocol. Several other automatic
tunneling transition mechanisms exist, including these:
- 6to4: Uses the reserved prefix 2002::/16 to allow an
IPv4 Internet-connected site to create and use a /48 IPv6
prefix based on a single globally routable or reachable IPv4
address.
- Intra-Site Automatic Tunnel Addressing
Protocol (ISATAP): Allows an IPv4 private intranet (which
may or may not be using RFC 1918 addresses) to incrementally
implement IPv6 nodes without upgrading the network.
Another transition mechanism is Teredo (formerly known as
Shipworm). This mechanism tunnels IPv6 datagrams within IPv4
UDP. This method provides for private IPv4 address use and IPv4
NAT traversal. Web Links Implementing Tunneling in
IPv6
http://cisco.com/en/US/products/sw/iosswrel/
ps5187/products_configuration_guide_chapter
09186a00801d6604.html#wp1038496
Content 8.6
Using IPv6 and IPv4 8.6.7 IPv6 to IPv4
Tunneling and Addresses The 6to4 tunneling method
automatically establishes the connection of IPv6 islands
through an IPv4 network. It applies a valid IPv6 prefix to each
IPv6 island, which enables the fast deployment of IPv6 in a
corporate network, without address retrieval from the ISPs or
registries. The 6to4 tunneling method requires a special code
on the edge routers, but the IPv6 hosts and routers inside the
6to4 site do not require new features to support 6to4. Each
6to4 site receives a /48 prefix, which is the concatenation of
0x2002 and the hexadecimal IPv4 address of the edge router. In
Figure , the IPv4 address of the edge router is 192.168.99.1.
As a result, the prefix of its IPv6 network is
2002:c0a8:6301::/48 because c0a86301 is the hexadecimal
representation of 192.168.99.1. The IPv6 network can substitute
any IP address in the space after the first 16-bit section
(0x2002). When an IPv6 packet with a destination address in the
range of 2002::/16 reaches the 6to4 edge router, the 6to4 edge
router extracts the IPv4 address that is embedded in the 2002::
destination address (inserted between the third and sixth
octets, inclusive). The 6to4 router then encapsulates the IPv6
packet in an IPv4 packet with the destination IPv4 address that
was extracted from inside the IPv6 destination address. This
IPv4 address represents the address of the other 6to4 edge
router of the destination 6to4 site. The destination edge
router decapsulates the IPv6 packet in the IPv4 packet and then
forwards the native packet toward its final destination.
Note
2002::/16 is the address range specifically
assigned to 6to4.
Content 8.6 Using IPv6 and
IPv4 8.6.8 Translation of NAT-PT For legacy
equipment that will not be upgraded to IPv6 and for some
deployment scenarios, techniques that can connect IPv4-only
nodes on IPv6-only nodes are available. Translation is
basically an extension of NAT techniques. NAT-Protocol
Translation (NAT-PT) is a translation mechanism that sits
between an IPv6 network and an IPv4 network. The translator
translates IPv6 packets into IPv4 packets and vice versa.
Static NAT-PT uses static translation rules to map one IPv6
address to one IPv4 address. IPv6 network nodes communicate
with IPv4 network nodes using an IPv6 mapping of the IPv4
address configured on the NAT-PT router. Figure shows how the
IPv6-only node (Node A) can communicate with the IPv4-only node
(Node D) using NAT-PT. The NAT-PT device is configured to map
the source IPv6 address for node A of 2001:0db8:bbbb:1::1 to
the IPv4 address 192.0.2.2. NAT-PT is also configured to map
the source address of IPv4 node C, 192.0.30.1 to 2001:0db8::a.
When packets with a source IPv6 address of Node A are received
at the NAT-PT router they are translated to have a destination
address to match Node D in the IPv4-only network. NAT-PT can
also be configured to match a source IPv4 address and translate
the packet to an IPv6 destination address to allow an IPv4-only
host communicate with an IPv6-only host. From the perspective
of Node A, it is establishing a communication to another IPv6
node. And from the perspective of node D, it is establishing
IPv4 communication with its correspondent. Node D requires no
modification. If you have multiple IPv6-only or IPv4-only hosts
that need to communicate, you may need to configure many static
NAT-PT mappings. Static NAT-PT is useful when applications or
servers require access to a stable IPv4 address. Accessing an
external IPv4 DNS server is an example where static NAT PT can
be used.
NAT-PT translations may also be mapped dynamically
based on DNS queries, using a DNS application level gateway
(DNS ALG). Other possible solutions are as follows:
- ALGs: This method uses a dual-stack approach and
enables a host in an IPv6-only domain to send data to another
host in an IPv4-only domain. It requires that all application
servers on a gateway run IPv6.
- API: You can
install a specific module in a host TCP/IP stack for every host
on the network. The module intercepts IP traffic through an API
and converts it for the IPv6 counterpart.
Web Links Implementing NAT-PT for IPv6
http://cisco.com/en/US/products/sw/iosswrel/
ps5187/products_configuration_guide_chapter
09186a00801d6600.html
Content 8.7 IPv6 Lab
Exercises 8.7.1 Lab 8-1 Configuring OSPF for