Slashdot Log In
How Feds are Dropping the Ball on IPv6
Posted by
CmdrTaco
on Monday December 17, @11:20AM
from the go-long-go-long dept.
from the go-long-go-long dept.
BobB-NW writes "U.S. federal agencies have six months to meet a deadline to support IPv6, an upgrade to the Internet's main communications protocol known as IPv4. But most agencies are not grabbing hold of the new technology and running with it, industry observers say. Instead, most federal CIOs are doing the bare minimum required by law to meet the IPv6 mandate, and they aren't planning to use the new network protocol for the foreseeable future."
Related Stories
Firehose:How feds are dropping the ball on IPv6 by Anonymous Coward
How Feds are Dropping the Ball on IPv6
|
Log In/Create an Account
| Top
| 299 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
As things go ... (Score:5, Interesting)
So there is plenty time for someone to wake up, wanting it yesterday.
CC.
Re:As things go ... (Score:4, Interesting)
When I said ALL big blocks being reclaimed into the available pool, that included all the remaining
The block allocated for Amateur radio operations was reclaimed a couple years ago, as well as the ones for Interop and other early networking groups. Those allocations are either already gone or back in the free pool.
HP has already announced plans to rent their addresses to customers who buy their big servers with a maintenance/service plan, and put the servers in partner data centres. So, in a few years, all those companies who want to get on the internet and can't wait a year or more for their allocation request to be fulfilled, they can throw a lot of money at HP and be up and running much faster. At least, that's what HP is counting on. If you think HP is going to willingly return any of their allocations when they can make US$10/month per IP address, you must be smoking some strong belly lint.
the AC
Re:As things go ... (Score:5, Funny)
End of the internet... (Score:4, Funny)
I don't blame anyone for avoiding IPv6, (Score:5, Insightful)
I don't blame anyone, even government in this case, for avoiding the hassle of getting everything converted to IPv6. Maybe eventually we all will have to be there, but there always seems to be workarounds that work for everyone, minimal hassle, minimal pain.
If you wanted a Starbucks coffee, and it was one street down, and someone told you you had to go through the in-between building, climb up and down its twenty flights of stairs just to get to the next street for you coffee, and you knew you could just walk around the building on the sidewalk, what would you do? Now, if the building were only two stories high, and the block to walk around were 600 ft each side, it might be a different choice.
An interesting aside, meeting the mandate only requires they are IPv6 capable, not running it. This is the same height bar the government set for Microsoft in the early nineties when Microsoft delivered the DOA POSIX-compliant (never to be really used) NT. NT, with its barely implemented POSIX subsystem (only implemented the library portion, btw, not the user interface) got to put a check in the POSIX checkbox for government contracts.
Lesson to be learned? If you want to make an effective mandate, make it a mandate for implementation, not capability.
The government:
What is IPv6 compliance? (Score:5, Interesting)
- Upgrading routers, firewalls et al to support IPv6.
- Some application software still not being fully IPv6 ready.
- A large number of sites still don't have IPv6 DNS addresses
I think the problem, like many government proposals is not the recommendation, but the lack of research guidelines or instructions on how to make the infrastructure IPv6 compliant or what it means to be IPv6 compliant. For example is simply having a 6to4 gateway considered IPv6 compliance.
All this said and done, has anyone here on
Routers can be a big issue (Score:5, Informative)
What happens on a large, high speed, network is that your routers rely on hardware acceleration to be able to pass traffic as quickly as you want, while still implementing all the rules you want. What that means is there are ASICs of various kinds that can handle various kinds of traffic. On older hardware (and some newer too), these are for IPv4. So anything else has to be handled by the router's CPU, which really isn't very powerful.
So, what that means is that you can technically support IPv6 by just turning it on, but only if you are willing to do it poorly. If we enabled it on all the routers, we would effectively support IPv6 internally. Great, and initially everything would work fine. However if any significant number of people actually decided to use it, network performance issues would come up in a hurry.
To really support it we have to buy new routers that support IPv6 in hardware. This could be done, but it would be expensive. Last time it was looked at the price tag was over $5 million. As you can probably guess, the university wasn't that interested in spending money like that for what was perceived to be no gain at all.
So while in a smaller network, where there's only an edge router and it isn't very high speed, yes IPv6 can be as simple as some software updates and turning it on for all devices. However when you have a larger, higher performance, network, you often need new hardware. That's a lot of money, and it is hard to justify that being spent for no real gain.
Re:What is IPv6 compliance? (Score:5, Interesting)
Yes it is.
Desktops are only the start.
Your servers need it (no ipv6 AD support).
No ipv6 network printer support.
No ipv6 VOIP support.
Poor to nonexistant ipv6 router support, and of those that do most of them don't support firewalling it.
Poor to nonexistant connectivity. Try asking the average ISP for an ipv6 address and they'll just look at you funny. It's not just consumer ISPs either - this business park I'm in at the moment has *no idea* what ipv6 is and has no timescale to look at it either.
Then there's the bits and pieces.. Dies Blackberry support ipv6? I know iphone doesn't, and Symbian's implementation is broken (relies on a dhcpv6 server and even then seems to need some kind of proprietary extension to that).
Re:What is IPv6 compliance? (Score:5, Insightful)
That's the biggest problem. Until I can reach every server with IPv6, I'll still need IPv4. Since I need IPv4, why should I bother with IPv6?
Re:What is IPv6 compliance? (Score:5, Informative)
I've done it. And now that I have a couple of posts in this thread banging the drum FOR IPv6 and correcting serious misconceptions, I'll use this thread to trash IPv6
On most networking equipment, turning on IPv6 is no more complex than a global "ipv6 routing" and setting the address on interfaces just like you do for IPv4. I'll use a pseudo-cisco example
interface Gig0/0
ip address 223.123.40.1 255.255.224.0
ipv6 address 2001:1a1:98b5:1::1/64
After that, most modern OSes on that segment will recognize the router announcements, autoconfigure, and start using IPv6. That's the easy part.
All routers and switches introduced to the market in the last two or so years seem to support v6 traffic, in VLSI hardware for the higher end kit. In fact, I haven't seen one new product announcement in at least two years that didn't have wire speed IPv6, no more passing unknown packets to CPU. But new kit is only put in slowly, and old kit has a useful lifespan of around a decade. Try passing IPv6 traffic on an older layer2 switch over a dedicated vlan, and many older switches can't deal with production traffic levels.
Once you start climbing the protocol stack you run into more problems.
With the sole exception of OpenBSDs pf firewall, there isn't a firewall out there that does IPv6 fully. Many firewall manufacturers will announce IPv6 support, but all that means is they have a rule for detecting IPv6 packets and either dropping them or passing them. They can't filter on address ranges or higher level protocols. One big manufacturer of firewalls now claims they support IPv6 because although their equipment doesn't yet support it, their tech support will take feature requests. Network security software (types like nmap) have little to no support, mostly because the authors have no real world examples to code around.
Services vary in their v6 support. Bind is fantastic. Apache kind of supports it, but many modules in Apache2 choke when it's turned on. The web programming languages are all a mess in their support; perl, PHP, java, python and the rest are a complete gamble, and even when support is mostly there, bugs crop up all over the place. The databases used behind many websites, such as MySQL and Postgres have spotty support, and if you don't go back and clean up your database code, they'll return all kinds of shit if the webserver starts passing in IPv6 addresses where someone hardcoded 4 bytes. Some of the freeware/GPLed/opensource projects like ircd and jabberd seem to have full support, and there are very few service daemons that don't at least acknowledge IPv6 existence.
Up at the application level, all modern browsers will use IPv6 correctly. Many apps written for Apple OSX make use of IPv6 if it's present, the only exception I know of is skype. All my networks, and most of my client's networks are dual stacked, so I never even notice that all my SSH sessions are over IPv6, as are all my web connections to nagios or cacti machines, our instant messenger traffic and most everything else. At least at the user application level, there has been years of preparation and it shows. On Vista, what little playing around I've done shows almost no application level support except IE7 which works as well as IE7 possibly can.
Small networking appliance support is almost non-existant. Except for Apple's wireless networking box, there isn't a DSL or cable modem on sale in the west that has support. In China, Korea, Japan and a few other south-east asian countries, most CPE boxes have IPv6 support, because most ISPs are forced to use it as they can't get enough IPv4 addresses for their end users. Much of the IPv6 web traffic I see outside my own little European island is to sites in the far east, where support is widespread.
Mandatory IPSec security is a joke, many v6 n
No real drive (Score:5, Interesting)
Bussiness dont want ipv6 (Score:2)
A rough guide as to why... (Score:4, Interesting)
Re:A rough guide as to why... (Score:5, Interesting)
This presumes that IPV6 is a good idea (Score:2, Insightful)
Those that do only the minimum to achieve IPV6 addressing are in my personal and technical opinion, doing nothing incorrectly beyond violating the spirit of mind-numbing nonsensical regulation. Even if IPV6 addressing were rational, then managing that space still needs work-- even after more than a decade of implementation.
Re:This presumes that IPV6 is a good idea (Score:5, Informative)
I tried to look up the result on Google [google.com] multiple [google.com] times [google.com] and wikipedia [wikipedia.org], finding nothing. Interestingly enough, your post is the first quote in the first google search.
If you're going to ask us to research something ourselves, please have the courtesy to provide enough information for the search.
That's a lot of trolls for one article! (Score:5, Interesting)
There isn't a lot of hoarded Class B space out there - if anything, most of the hoarding is at the
IPv6 had a lot of optimistic goals, some of which (like security and autoconfiguration) have been achieved in other ways (like IPSEC and DHCP), and others (like hierarchical simplification of routing structures) don't look like they'll really happen. But the IPv4 space is going to run out, and we're not going to be able to squeeze much past 2012 - especially if a billion people want data on their cellphones, or if the Chinese economy adds a couple hundred million broadband users, which won't take long, or a couple million businesses, which won't take long either.
The IPv6 address space is very rationally designed, and yes, managing it does take work - but it's big enough that there's room to experiment, unlike IPv4 which ran out of slack well over a decade ago.
Where is the carrot? (Score:4, Insightful)
Obviously not, because if the benefits outweighed the costs, no mandate would be necessary. Agencies would have long ago switched on their own.
And since costs outweigh the benefits, who can blame agencies for doing the bare minimum to achieve compliance? The writeup makes it sound like agency obstinance, but I view it is good budget stewardship. Agencies don't seem to want to flush good budget down the IPv6 toilet.
Expect propaganda about the Cisco Kid any day now. (Score:1, Funny)
Banner to read TRANSMISSION ACCOMPLISHED
I got the karma go ahead and troll me.
Dropping the ball? (Score:1)
Perhaps they are rightly spending time on critical issues such as people running live wires into passenger jet fuel tanks, which -- on the face of it -- seems like a really bad idea.
By the way (Score:1)
Anyway, get prepared for more and more IPv6 traffic, at least from france
Trying to push IPv6 (Score:1)
Why bother? (Score:2, Insightful)
Besides, how long did it take government computer networks to switch from proprietary systems like IBM's SNA, Microsoft's NetBIOS, Banyan's VINES, Digital's DECNET, Apple's Appletalk, and others to IPv4? IPv4 came out in the early '80s. I'd venture to say more than one government office was still using a completely-non-IPv4 network well into the '90s.
No, unless there is a big benefit that justifies the cost, most System Administrators are going to do as little as they can get away with, both in the government and in Corporate America.
Now, if you are in a shop where it's cost-effective to be on IPv6 then by all means why aren't you there already?
Re:Why bother? (Score:4, Insightful)
Switching to IPv6 often involves hardware switchovers and the elimination of old services that simply cannot interoperate with it because they weren't designed to, and should have been discarded years ago but haven't been, and the original author has very much moved on.
why not an IPv4.1 (Score:2)
Re:why not an IPv4.1 (Score:5, Informative)
IPv6 Changes (Score:1)
Doesn't matter... (Score:1, Insightful)
We should have enough to get us there...
Academic Attitude (Score:5, Insightful)
What doesn't support IPv6 these days? (Score:3, Informative)
Every major networking equipment supplier has IPv6 support on their product lines, although some still charge for turning it on. All the high-end Cisco routers and switches support it natively, but charge extra for the IOS image that can use it. Foundry's current product line supports it everywhere. Juniper has pretty much always had IPv6. Working down the list of less popular suppliers shows most of them have some level of IPv6 support. Sure, most of the older networking equipment can't deal with v6 traffic, and the useful life for old kit is long enough that it's still probably 70% of the installed base.
Most internet enabled mobile phones have IPv6 built in, but it tends to be invisible to the user because the phone companies are only using it for local communications, if at all. All the Nokias support IPv6 in their network stack, but I haven't seen one system that takes advantage, yet. iPhones and iPod Touches have v6 enabled by default, and if they connect to a WiFi system that has v6 router announcements, they'll autoconfigure and Safari will use it transparently.
Where IPv6 support falls down is in super-cheap consumer networking products. All those little $40 DSL modem+firewall+4 port switch boxes just don't support v6 at all. The only good news is from when I was in discussions with the Chinese company behind many of these boxes. The versions released in China are all IPv6, it's only the versions sold outside China where they just don't include it because there is no market demand.
The only real problem right now is with ISPs. Until the engineering staff inside ISPs and hosting companies take the responsibility to start turning it on, sales and marketing will remain blissfully unaware that it can be sold.
One of the largest IPSs in Europe turned on IPv6 to all 8 million users this week. They've done the right thing and made it opt-in for now, their customers have to go to their control panel web page and turn it on, but almost 50,000 people did in the first 24 hours. They turned it on, and their Macs and Win machines started using IPv6 with no need to do anything other than tell Firefox and Tbird to start using IPv6 for DNS lookups. Because this one major ISP did this, their main competitor has been forced to make plans to enable IPv6 in January. After that, any ISP that doesn't have IPv6 turned on will be branded as "obsolete" or "incompetent".
the AC
IPv6 still does nothing (Score:3, Insightful)
Until that happens, NOBODY can adopt IPv6. That's the law, and no legislation can change that.
who cares? (Score:1)
Why not reclaim all the wasted, unused existing space? Adding IPv6 seems akin to raising taxes instead of controlling spending. It's going to cost a shitload of money and Regular Joe won't see any benefit.
Miredo (Score:2)
Obligatory (Score:1)
Yeah, but they're the ones who set the deadline... (Score:1)
Dropping the Ball? (Score:2, Interesting)
And if you want another "great" idea, try this: I was just tasked to explain what we are doing to impliment PKI on our aircraft (again, very little). Some things just don't make sense now, and having PKI to logon or use a tactical aircraft doesn't make sense. I can see it now, "Sorry, I can't do the mission today. The hardware reader for the PKI isn't working or I forgot/misentered my password." Someday the hardware/software will be reliable enough for tactical systems but it ain't there yet. And lets not go down the biometrics path either.
Writing as AC since its been so long since I actually submitted anything that I have forgotten all account info.
Can they support IPv6? (Score:2)
The Real Problem (Score:1)
What we need from industry are advanced capabilities in IPv6 products - products that utilize IPv6 mobility and auto-configuration, and of course security, in ways that IPv4 cannot. When applications exist that can do things in IPv6 that they cannot do in IPv4, then the incentive to migrate will finally be positive. Right now, we can't even get basic security capabilities for our IPv6 networks. Network management over IPv6 is all but non-existent and advanced IPv4 features, like multicast and prioritization, are supported in only a few IPv6 products. Security, though, is the biggest hold-up, and it isn't because OMB did not mandate implementation of IPv6 security. It is because the commercial products don't exist. Federal agencies are not going to implement IPv6 with gaping security holes.
The DoD and OMB mandates provided a target on the wall, a target that we are obviously not going to hit, but one that we continue to at least aim at. Hopefully the target will continue to provide incentive to industry to provide the IPv6 products needed, not only by the first responders (DoD, Emergency workers), but by all of the federal government.
"Most" Federal Agencies (Score:1)
What Went Wrong (Score:2)
First, we only needed 48 to 64 bit addresses. 128 bits are actually unmanageable. I'm not going to argue it out, as it's an old and painful discussion. Suffice it to say, the real world has shown that raw IP's are used a lot more than people thought.
Second, autoconfiguration has been a nightmare. Addressing depended on DNS, and then DNS was bolted on, poorly. *sighs*
Third, it really should have been partially backwards compatible with IPv4. I know they wanted to build new toys and all that, but the correct approach would have been a standard V4 header, with a V6 extension that added between 16 and 32 bits of endpoints. Core IPv4 routers would have been limited to routing based on only the first four bytes of the IP at best, but that's better than the present 0.
There's more, of course. Too many spherical holy cows involved, and we've suffered for it.
No Need To (Score:1)
So the answer to NOT running out of IPv4 space is to UN-grandfather all of the current assignments, and make all those Class A and Class B hogs justify their usage/ownership.
Eminent domain should be applicable.
Having a bunch of corp's re-ip their network is work, but certainly it's WAY less expensive then redesigning the internet (and the associated new hardware costs said redesign would incur).
Songs our kids will be singing: (Score:1)
switching to v6 and TCP Vegas at the same time? (Score:2)
TCP Vegas over IPv6 is no different from TCP Vegas over IPv4. It still doesn't take its fair share of bandwidth vs. TCP Reno (v4 or v6). Can anyone think of a way to link these switch-overs? I don't think many people would want to bias routers against dropping v6 TCP packets on the assumption they were TCP Vegas.
But v6 and Vegas seem like two big switchovers that would both be useful. There's got to be a way to get people to make both switches, if they're going to use IPv6.
IPv4 advanced far more than IPv6 (Score:2)
The fundamental problem as to why there is so little drive to make a big switch to IPv6 is because what IPv6 offers ... and this is important ... over IPv4 is relatively small compared to what IPv4 offered over its predecessor, which was essentially going from no internet at all to having what we have today. There needs to be some kind of real motivating force to make it happen. IPv4 happened because having an internet was a motivating force. What does IPv6 offer? Very little as long as we still get IPv4 addresses. Other kinds of motivations are also possible. Take a look at how much the over-the-air TV broadcasters dragged their feet in deploying digital transmission at full capacity. Now we have a pretty solid analog shutoff date, so they better get those digital transmitters going (most have, to at least some degree, now). The biggest encouragement to getting IPv6 rolling is to schedule a definite, but very doable, IPv4 cutoff date for at least some critical piece of the net most people want. But we have to choose what that is. Access to the government? Access to routers going across national borders? Access to porn?
Re:I wish I were dead. (Score:1)
Pinging anonymouscoward.slashdot.org [66.35.250.151] with 32 bytes of data:
No reply. I guess you got your wish.