On June 8th, 2011, a little known even, that was likely to change the course of Internet usage for years to come, happened. Top websites and Internet service providers like Facebook, Google, Yahoo, Akamai and Limelight Networks, along with over 1000 more participating websites, united on World IPv6 Day by holding a global-scale trial of the new Internet Protocol, IPv6. The globally-coordinated 24-hour test flight event helped to demonstrate that major websites around the world are ready for the move to global IPv6-enabled Internet, with nearly 400 participating organisations enabling the protocol on their main services for 24 hours.
In a press release by the Internet Society (ISOC) which organised the event, a key goal of World IPv6 Day was to expose potential issues with real-world IPv6 use under controlled conditions. It reports, “The vast majority of users were able to access services as usual, but in rare cases, users experienced impaired access to participating websites during the trial.”
The shortage of IPv4 addresses and the need to migrate to the128-bit addresses support offered by IPv6, drew the most response from the security industry although Internet Web portal cum digital marketing experts like Yahoo also put their best food forward trying to educate the masses about what was happening. In their press release, they described, “We are running out of distinct numerical IP addresses to give to users and services… We are moving from 32-bit addresses to 128-bit addresses. With the telephone analogy, this would be like moving from a 10-digit phone number to a 38-digit phone number.”
What exactly is happening?
Internet Protocol version 4 was first deployed in 1983 for use in “interconnected systems of packet-switched computer communication networks”. It became apparent that the number of IPv4 addresses could not sustain the huge demand for network-enabled devices, stopgap measures were introduced to maximise the lifespan of IPv4 32-bit addressing and work began on a replacement protocol, IPv6. Internet Protocol version 6 was first deployed in 1999 and contains a number of improvements over the legacy IPv4. The most notable improvement in IPv6 was the huge increase in possible address space.
| Protocol Version | Address Size | Example Address | Address Range |
| Version 4 | 32 bits. | 127.0.0.1 | 4,294,967,296 |
| Version 6 | 128 bits. | 0:0:0:0:0:0:0:1 | 340,282,366,920,938,463,463,374,607,431,768,211,456 |
IPv4 and IPv6 – together in harmony
IPv4 isn’t going away. Websites and ISPs are still slow to upgrade to the latest protocol and because some consumers might find no value in upgrading their home equipment, ISPs will be forced to continue to delivering IPv4 service despite running out of unique IPv4 addresses.
One way around this is doing something similar to a telephone party line, where several houses share a single phone line and number. Translated, several houses will share a single public address using Network Address Translation or NAT and still have basic browsing and applications work. But peer-to-peer applications like voice and video chat, online video.
Needless to say, address sharing is a vulnerable to security risk as well.
The upcoming months
Many ISPs are working behind the scenes to get ready for IPv6. Some have already started commercial deployments and companies like Yahoo anticipate several IPv6-related services being made available in the next three to twelve months, from a broad spectrum of service providers.
Companies are encouraged to do early testing of their products and one of the ways to do this is via setting up IP tunnels. These are convenient ways to get early access to the replacement protocol.
“The explosion of Internet connected devices is driving up the need for more and more IP addresses,” says Zeus Kerravala, senior vice president, global enterprise and consumer research, Yankee Group. “Because of this, the migration to IPv6 is more a matter of when rather than if. However, most organisations often overlook the added benefits of IPv6 that revolve around better security and manageability
To see a full list of participating companies and the status of their support for IPv6, please visit http://isoc.org/wp/worldipv6day/participant-websites/.
The cybersecurity solutions provider announced that they have completed testing with ICSA Labs, a third-party security testing and certification body, which means that federal government customers can leverage Sourcefire’s intrusion detection and prevention solution on IPv6 networks. The Sourcefire Defense Centre successfully satisfied U.S. federal government IPv6 test requirements (USGv6) and the company’s Intrusion Prevention System (IPS) sensors are currently being tested. The Sourcefire IPS (3D System) is one of the first IT security solutions verified by ICSA Labs to meet the government’s requirements for hosts on an IPv6 network.
Country Manager of Sourcefire Malaysia, Ivan Wen says, “This independent confirmation of our IPv6 support is especially important now that the pool of available IPv4 addresses is fully allocated and nearly depleted. It is increasingly important that organisations ensure that their network IT security solutions are IPv6 compliant, such as Sourcefire’s IPS.”
Akamai Technologies announced plans to provide a real-time data visualisation of IPv6 Web traffic served from its global platform during June 8th. Available at www.akamai.com/ipv6, the visualisation was designed to show pattern of traffic served during the 24-hour period.
Akamai’s participation included IPv6-enabling www.akamai.com as well as supporting over 30 customers from around the globe who have opted in to Akamai’s IPv6 technology platform.
“Akamai’s role in the deployment of IPv6 is critical to its customers,” says Mark Townsley, Cisco Distinguished Engineer and former Internet Area Director for the IETF. “Online for over 25 years, www.cisco.com is one of the more sophisticated websites Akamai serves today. Cisco and Akamai worked closely to tailor a solution that met our needs for World IPv6 Day, and we are confident that the largest global test-drive of IPv6 ever performed will be an important milestone towards the adoption of IPv6 worldwide.”
“Akamai is committed to helping our customers and network partners with a smooth transition to IPv6,” says Andy Champagne, vice president of Engineering at Akamai. “IPv6 adoption is still in its beginning stages, but we believe that early planning and testing are critical for all Internet businesses. Our data visualisation tool is designed to serve as a representative view into the early adoption of this protocol.”
Akamai will be opening up its IPv6 offerings to all interested customers over the course of the coming year. .
Fortinet, a network security and unified threat management (UTM) provider announced their comprehensive strategy for participation of the World IPv6 Day. Says founder, CTO and VP of engineering for Fortinet, Michael Xie, “While most IT decision makers know that the transition to IPv6 is inevitable, it’s surprising how many haven’t yet developed a comprehensive migration strategy. By participating in World IPv6 Day, we highlight our products are currently IPv6 ready and USGv6 compliant. We want to help drive global awareness around the security issues surrounding the migration from IPv4 to IPv6, educate IT on best practices and allow them to see a demo of our FortiGate platform inspecting native IPv6 traffic traffic and enforcing policies.
To help build awareness around potential security holes that can be created when migrating from IPv4 to IPv6, Fortinet developed a solutions guide that explains the major challenges and security risks organisations face when planning an IPv6 rollout entitled, “Network Security in the Next Generation of IP Communication.” Another educational paper titled, “A Practical Guide for Beginning the Migration to IPv6” is a technical whitepaper that explains the three steps organisations need to take to prepare for a secure migration. More info at www.fortinet.com/solutions/ipv6.html
In addition to these are several other live demos for example to give FortiGate appliances access to security updates over a IPv6 network or enable IT professionals to see a FortiGate platform deliver complete protection of IPv6 traffic.
Fortinet began supporting IPv6 on the FortiGate consolidated security solutions in 2007 and have appliances and solutions which are IPv6 certified by the U.S Department of Defense, the IPv6 Forum as well as USGv6 certification.
For Symantec, from a security standpoint, IPv6 raises some new and potentially interesting problems for malware authors, antivirus companies and system/network administrators. All non-network centric aspects of malicious code will be unaffected by the eventual migration to IPv6, but Symantec believes the impact will be notable on malicious code that propagate around networks and attempt to disrupt network services and profile network-enabled attack vectors.
According to the security solutions provider, IPv6 has caused a massive amount of possible addresses in a default subnet and additional software tweaks has created challenges for malware authors. IPv6 mitigates a number of existing IPv4 attacks by design, and even attempts to control data interception (or sniffing) by introducing a security protocol, IPsec, to authenticate and encrypt data transmitted across an IP-enabled network.
But it’s not all a bed of roses in the IPv6 camp – adoption may cause unforeseen difficulties like IPv6 traffic which isn’t accurately detected and inspected; firewall software and hardware can now be bypassed because security companies are facing a new learning curve where new threats which are not yet fully apparent, will emerge.
Blue Coat Systems, provider of Web security and WAN optimisation unveiled that they are using their IPv5 Secure Web Gateway solution to enable secure and seamless migration of applications, services and content between IPv4 and IPv6 environments. The solution has been deployed by global companies including NTT.
“To successfully transition to IPv6, organisations must consider a number of issues that are often taken for granted in IPv4 environments, including creating secure user policies and accelerating or optimising IPv6-enabled Web content. Traditional technologies that address these challenges in IPv4 environments don’t work in IPv6 environments,” says Qing Li, chief scientist at Blue Coat Systems. “The Blue Coat ProxySG appliance is the only solution in the industry that can both rate new and unknown IPv6 Web content in real-time and optimise that content over the WAN, making the transition between IPv4 and IPv6 environments seamless for users.”
Since 2006, Blue Coat has invested in research to understand application and service security in IPv6 environments, developed IPv6 content acceleration and examined new IPv6-oriented services.
As a secure IPv6 application migration platform, the Blue Coat ProxySG appliance acts as an intelligent intermediary between requests and content, making the retrieval of applications, services and data in either an IPv4 or IPv6 environment transparent to users. To minimise network disruption and simplify migration, Blue Coat ProxySG appliances consistently enforce corporate IT policies across IPv4 and IPv6 applications and content spaces.
Brocade was another organisation which spent the 8th of June, observing World IPv6 Day. Having spent the last decade deriving and sharing best practices by rolling out IPv6-ready cloud-optimised networking solutions, their pragmatic migration path is now adopted mymany customers like Hurricane Electric and the Amsterdam Internet Exchange (AMS-IX)
Brocade has also engineered its own website, Brocade.com, to be fully IPv6-enabled, making it one of the first networking vendors to achieve IPv6 Web presence with its own proven suite of IPv6 networking solutions.
This is a significant milestone and serves as a best practice that is shared with customers. With more than a decade of research and development in IPv6 networking solutions, Brocade has shown proven history in delivering non-disruptive solutions through its comprehensive set of Ethernet switches, routers and application delivery controllers (ADC) to completely transition or simultaneously support both IPv4 and IPv6 protocols.
“For more than a decade Brocade has been advancing its switching and routing platforms to help lead the charge in IPv6 preparedness,” says Dave Stevens, chief technology officer and vice president, corporate development for Brocade. “Brocade has a full suite of products and technologies shipping today that are fully IPv6 capable and our customers are using them to seamlessly migrate their production networks to IPv6. As a leading example, the Brocade.com website has been IPv6 enabled for more than a year – making us one of the first networking vendors to field a native IPv6-compliant Internet presence.”
