IPv6 migration plan security problems still exist

There is no news of explosion on the World IPv6 Day. On June 8th, content providers and network operators tested the next-generation 128-bit hexadecimal Internet address protocol. They all reflected that this event was nothing new - customers get servers and servers provide content. However, this does not mean that the WAN manager's IPv6 migration plan will succeed.

According to Matt Levine, director of mapping engineering, network engineers at content delivery network (CDN) supplier Akamai Technologies have learned that not all IPv6 transition technologies can be created in the same way.

Levine said: "The unmanaged 6to4 channel is specifically designed to transport IPv6 packets over IPv4 networks. It is an "odd" and "problem-rich" technology that is already well known among network operators. It's up."

He said: "The network engineer may say 'This unmanaged 6to4 channel is a good technology to get IPv6 data', and the traditional view is: Do not use this method. Do not try this unmanaged technology to use at will IPv6--this will cause problems."

"Channel technology requires adding an extra header to the packet. This will generally result in an IPv6 packet that is too large to pass through the IPv4 tunnel, causing IP packet fragmentation. Levine said: "A lot of firewalls tend to compress data The control mechanism of the packet size to solve the problem is filtered out as irrelevant data (refer to Internet Control Message Protocol Version 6 (ICMPv6)). ”

"The dual stack network is already supporting IPv4 and IPv6, and although it takes more time and manpower to deploy, it is much more reliable," Levine said.

"Once a connection is established, the application cannot be significantly affected by the migration of IPv6," Levine said. "The WAN administrator must only focus on applications that are related to IP addresses, such as applications that try to enforce access control rules."

"No matter where you perform these operations, you must reconsider and ensure that users of v6 can access," Levine said.

IPv6 Migration: Security Issues Still Exist But WAN professionals need to deal with more than just handling the underlying transport issues in an IPv6 migration plan. According to Lawrence Orans, research director at Gartner Inc., questions about IPv6 security still exist in large numbers, most of them because of the slowdown of IPv6 investment and support by network security vendors.

Orans said: "In addition to their government and military customers, network security vendors see little demand for IPv6 support. In fact, the World IPv6 Day did not point out any major security issues, and therefore there is no follow-up dynamics for suppliers. Give a hint."

"WAN administrators can make their IPv6 migration more secure without the help of network security vendors. After ensuring that the network configuration and policies support the next generation of protocols, they can begin operations," said Levine of Akamai. .

"It's easy: 'Assuming I've established a rule: Allow HTTP traffic on port 80', but don't consider rules specific to IPv4," Levine said. "You may have just established an IPv6 file server, and this is not You meant it."

"However, IPv6 migration also involves other security issues. They can only be fully understood if the protocol is widely deployed," he said.

"The bad guys may skip some addresses at certain moments, so now you can only expect them not to be too easy to succeed," Levine said. "Of course, the current operating system that supports IPv4 is already very secure. In this regard, IPv6 code may be Not new, but it is not yet widely used, so strange problems we may not have encountered may arise.