企业园区网络中的IPv6部署指南 - CSDN文库

需积分: 10 197 浏览量更新于2024-07-29 收藏 1.8MB PDF 举报

"Deploying IPv6 in Campus Networks - Shannon McFarland, Cisco Validated Design" 在当前网络环境中，IPv4地址资源的枯竭已经成为一个不容忽视的问题，这使得IPv6的部署变得至关重要。《Deploying IPv6 in Campus Networks》这份文档专为那些计划或正在实施校园网络中IPv6部署的客户提供指导。它不涉及基本的校园网络设计原则、最佳实践，也不包含IPv6的基础知识、过渡机制或IPv4与IPv6功能的对比，而是专注于实际部署过程中的策略和实施步骤。作者Shannon McFarland是Cisco Systems的首席咨询工程师，他在企业IPv6部署、虚拟桌面基础设施（VDI）和数据中心技术方面有深入研究。作为Cisco公司首席技术官办公室的一员，他已经有9年的时间专注于企业IPv6的设计和部署工作，并撰写了多篇技术论文和Cisco Validated Design指南，同时参与了Cisco Press书籍的编写，经常在Cisco Live和其他行业会议上发表演讲。他的专业背景确保了这份文档的专业性和实用性。 Cisco Validated Design (CVD)程序是一个由Cisco推出的系统和解决方案设计、测试和文档化项目，旨在加速和简化客户的网络部署过程，提供经过验证的、可信赖的设计方案。通过CVD，客户可以利用经过严格测试的配置和流程，确保新部署的IPv6校园网络不仅能满足业务需求，还能保证性能、稳定性和安全性。文档可能涵盖了以下关键知识点： 1. **IPv6的优势**：IPv6提供了几乎无限的地址空间，解决了IPv4地址耗尽的问题，同时也引入了流标签、更大的报头选项等特性，增强了网络的效率和可管理性。 2. **过渡机制**：尽管文档不详细介绍过渡机制，但实际部署中可能涉及双栈、隧道技术（如6to4、ISATAP）、转换技术（如NAT64）等，帮助平滑地从IPv4过渡到IPv6。 3. **网络规划**：在校园网络中部署IPv6，需要考虑地址规划、路由策略、DHCPv6配置、网络安全以及服务的IPv6兼容性。 4. **设备升级与兼容性**：检查并更新网络设备的固件和软件，确保它们支持IPv6，以及与IPv6相关的协议和服务。 5. **性能和稳定性**：测试和优化IPv6网络的性能，确保其与IPv4网络相媲美，同时关注网络的稳定性和可靠性。 6. **故障排查和维护**：建立有效的故障排查流程，以便在部署后及时解决可能出现的问题，维持网络的正常运行。 7. **培训与支持**：提供必要的员工培训，确保网络管理员和用户了解如何在IPv6环境下工作。 8. **业务连续性**：确保在IPv6部署过程中，现有业务不受影响，实现平稳过渡。 9. **策略与策略控制**：制定合适的IPv6策略，例如访问控制、流量管理，以满足校园网络的安全和管理需求。 10. **未来扩展性**：设计应考虑未来可能的网络扩展，包括新的设备接入、服务添加以及对物联网(IoT)的支持。《Deploying IPv6 in Campus Networks》提供了在校园网络环境中实施IPv6部署的实用指南，旨在帮助企业解决IPv4地址短缺问题，利用IPv6的优势构建更加高效和可持续的网络基础设施。

10

Deploying IPv6 in Campus Networks

OL-11818-01

Deployment Models Overview

Figure 3 illustrates the process of matching users in a specific VLAN and IPv4 subnet with a specific

ISATAP tunnel.

Figure 3 Hybrid Model—ISATAP Tunnel Mapping

1. The core layer switch is configured with a loopback interface with the address of 10.122.10.2, which

is used as the tunnel source for ISATAP, and is used only by users located on the 10.120.2.0/24

subnet.

2. The host in the access layer is connected to a port that is associated with a specific VLAN. In this

example, the VLAN is “VLAN-2”. The host in VLAN-2 is associated with an IPv4 subnet range

(10.120.2.0/24) in the DHCP server configuration.

The host is also configured for ISATAP and has been statically assigned the ISATAP router value of

10.122.10.2. This static assignment can be implemented in several ways. An ISATAP router setting can

be defined via a command on the host (netsh interface ipv6 isatap set router 10.122.10.2—details

provided later in the document), which can be manually entered or scripted via a Microsoft PowerShell,

Microsoft Group Policy, or a number of other scripting methods. The script can determine to which value

to set the ISATAP router by examining the existing IPv4 address of the host. For instance, the script can

analyze the host IPv4 address and determine that the value “2” in the 10.120.2.x/24 address signifies the

subnet value. The script can then apply the command using the ISATAP router address of 10.122.10.2,

where the “2” signifies subnet or VLAN 2. The 10.122.10.2 address is actually a loopback address on

the core layer switch and is used as the tunnel endpoint for ISATAP.

A customer might want to do this for the following reasons:

• Control and separation—If a security policy is in place that disallows certain IPv4 subnets from

accessing a specific resource, and ACLs are used to enforce the policy. What happens if HM is

implemented without consideration for this policy? If the restricted resources are also IPv6

accessible, those users who were previously disallowed access via IPv4 can now access the protected

resource via IPv6. If hundreds or thousands of users are configured for ISATAP and a single ISATAP

tunnel interface is used on the core layer device, controlling the source addresses via ACLs would

be very difficult to scale and manage. If the users are logically separated into ISATAP tunnels in the

same way they are separated by VLANs and IPv4 subnets, ACLs can be easily deployed to permit

or deny access based on the IPv6 source, source/destination, and even Layer 4 information.

• Scale—For years, it has been a common best practice to control the number of devices within each

single VLAN of the campus networks. This practice has traditionally been enforced for broadcast

domain control. Although IPv6 and ISATAP tunnels do not use broadcast, there are still scalability

220103

Access

Block

Host in VLAN-2

IPv4 Subnet-

10.120.2.0/24

Core

Layer

Distribution

Layer

Access

Layer

2

1

ISATAP tunnel is pseudo-associated with a specific IPv6 prefix

Mapping: IPv4 subnet 10.120.2.0 <-> 2001:db8:cafe:2::/64

IPv4 subnet 10.120.3.0 <-> 2001:db8:cafe:3::/64

......

11

Deploying IPv6 in Campus Networks

OL-11818-01

Deployment Models Overview

considerations to think about. It is important to remember that a single tunnel interface will have

many tunnels established by ISATAP users and, based on Cisco testing, it is easy to scale the number

of ISATAP connections into the thousands.

Solution Requirements

The following are the main solution requirements for HM strategies:

• IPv6 and ISATAP support on the operating system of the host machines

• IPv6/IPv4 dual-stack and ISATAP feature support on the core layer switches

As mentioned previously, numerous combinations of transition mechanisms can be used to provide IPv6

connectivity within the enterprise campus environment, such as the following two alternatives to the

requirements listed above:

• Using 6to4 tunneling instead of ISATAP.

• Terminating tunnels at a network layer different than the core layer, such as the data center

aggregation layer.

Note The 6to4 and non-core layer alternatives are not discussed in this document and are listed only as

secondary options to the deployment recommendations for the HM.

Benefits and Drawbacks of This Solution

The primary benefit of HM is that the existing network equipment can be leveraged without the need for

upgrades, especially the distribution layer switches. If the distribution layer switches currently provide

acceptable IPv4 service and performance and are still within the depreciation window, HM may be a

suitable choice.

It is important to understand the drawbacks of the hybrid model, specifically with HM:

• The HM can be and most often is an operational nightmare to manage.

• IPv6 multicast is not supported within ISATAP tunnels.

• Terminating ISATAP tunnels in the core layer makes the core layer appear as an access layer to the

IPv6 traffic. Network administrators and network architects design the core layer to be highly

optimized for the role it plays in the network, which is very often to be stable, simple, and fast.

Adding a new level of intelligence to the core layer may not be acceptable.

As with any design that uses tunneling, considerations that must be accounted for include performance,

management, security, scalability, and availability. The use of tunnels is always a secondary

recommendation to the DSM design.

Conclusion, page 57 summarizes the benefits and challenges of the various campus design models in a

tabular format.

Solution Topology

Figure 4 shows a high-level view of the campus HM. This example is the basis for the detailed

configurations that follow later in this document.

剩余58页未读，继续阅读

liline680

粉丝: 0
资源: 3

最新资源