Routing and Remote Access Blog : IPv6

Quick snap-shot of IPv6 scenarios and features supported in RRAS

rrasblog — Wed, 09 May 2007 08:40:00 GMT

Hi All,

In Longhorn, Routing and remote access server role supports IPv6 (in addition to IPv4). In this blog, I will give a quick summary on what are the scenarios that are supported and what changes are required to enable the same. This will also help you to decide a roll-out plan to enable you to migrate to IPv6.

Let us first look at what are the main scenarios for which customers deploy RRAS:

1) Enable remote access to their users - using dialup or VPN (i.e. over Internet) as the link-layer.

2) Enable site-to-site connectivity between their offices - using dialup or VPN (i.e. over Internet) as the link layer

Now let us look at what it means by IPv6 support in context with the above scenarios:

1) First look at your connectivity between end user PC to RRAS (i.e. remote access scenario ) or RRAS-RRAS (i.e. site-to-site connectivity):

a. If your connectivity is dial-up, then move to step 2).

b. If your connectivity is VPN i.e. a virtual tunnel over Internet, now look at whether you have IPv4 based ISP connectivity (which is most common today) or IPv6 based connectivity (which is gaining momentum and will become common soon).

i. If it is IPv4 connectivity, then you can use any form of VPN tunnel (PPTP, L2TP or SSTP) – just configure the hostname/IPv4 address of destination server inside your VPN client/originating router.

ii. If it is IPv6 connectivity, you can use L2TP/IPSec or SSTP based VPN tunnel to establish a tunnel between two ends and configure hostname/IPv6 address instead. Also ensure RRAS server public interface has the same IPv6 address which client connects to and the firewalls in-front of RRAS server are enabled to allow L2TP/SSTP packets destined to RRAS server IPv6 address.

2) Now let us look at your connectivity behind your RRAS server or networking connectivity within your Intranet

a. I am sure you will be having IPv4 connectivity there today. No changes required here (i.e. you can continue to support IPv4 as well as IPv6 in parallel).

b. Now if you are planning to migrate to IPv6 (i.e. your LAN machines will be having IPv6 address too), then you need to make the following changes.

i. Remote Access: Enable RRAS server as “IPv6 remote access server” and manually configure a /64 bit IPv6 prefix in it. This one prefix will be shared by all remote access clients. In addition, install and configure DHCPv6 Relay Agent present inside RRAS server. This will enable forwarding of DHCPv6 Inform packets coming from remote access clients onto DHCPv6 server running on Intranet side. This extra step is required to hand-out extra addressing parameters like DNS server IPv6 address, DNS suffix etc to the remote access clients.

ii. Site-to-site connectivity: Enable RRAS as “IPv6 Router” and then add a “demand-dial interface”. As a site-to-site server also acts as remote access server (to accept connections), follow the steps given above (except DHCPv6 relay agent).

The above steps will enable RRAS server to send IPv6 prefix to other end as well as forward IPv6 packets received on its dialup/VPN interface onto Intranet side and vice versa. The other end can be a remote access user or a site.

iii. Rest of your configuration – like authentication/authorization remain same as IPv4.

iv. Rest of your IPv6 deployment can continue to happen as planned. For example – if you want some servers (like your Radius server or Domain controller to be using IPv6), you can continue to enable them towards IPv6 at same or different times.

This really means RRAS server can be used to bridge IPv6 islands separated by IPv4.

References: Look at following blogs:

1) RAS IPv6 FAQ

2) How PPPv6 works

3) Cable guy article

Note: We will be soon adding link to step-by-step guide for IPv6 connectivity – stay tuned.

Feel free to share your comments

Cheers,

Samir Jain

Lead Program Manager (Windows Enterprise Networking)

[This posting is provided "AS IS" with no warranties, and confers no rights.]

Broadband connections and DHCPv6 Prefix Delegation in Windows Vista

rrasblog — Tue, 23 Jan 2007 11:13:00 GMT

Some Microsoft customers and partners have enquired about the support for Requesting-Router behaviour of DHCPv6 Prefix Delegation in Windows Vista. I have also seen attempts by some vendors to use prefix delegation to assign IPv6 addresses to Broadband/PPPoE interfaces. In this post, I’ll clarify our view of prefix delegation and outline the support available for it in Windows Vista.

RFC 3633 defines options for delegating IPv6 prefixes through DHCPv6. As the aptly termed phrase “requesting router” suggests, the prefix delegation mechanism is suitable for assigning a prefix to clients which will act as routers between networks.

The appropriate mechanism for assignment of addresses to PPPoE interfaces is through the use of IPv6CP to negotiate an interface-identifier and then using the prefix in a RA from the server to generate an IPv6 address. In the case of a broadband router which dials a PPPoE connection, we recommend that the router first obtain an IPv6 address for its PPPoE interface through this mechanism. It should then follow this with a DHCPv6 prefix delegation request on the PPPoE interface to obtain an IPv6 prefix from the service provider’s router. This prefix should then be used for Router Advertisements on its LAN interface.

In most cases, Windows Vista clients dialling a Broadband connection will use this connection for their own Internet connectivity. This is the reason that the Vista PPPoE client does not by default trigger DHCPv6 prefix delegation. Only when Internet Connection Sharing is enabled on Windows Vista, where the host needs to act as a router for other clients on a home network does Windows Vista trigger the requesting router behaviour of prefix delegation. In this scenario, the Windows Vista host will obtain the IPv6 prefix from the server and advertise it to other clients on the home network.

Santosh Chandwani

Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]

Vista: How PPPv6 support works?

rrasblog — Fri, 15 Dec 2006 20:28:00 GMT

I have seen lots of email coming around on how IPv6 supports works on WAN links in Vista. Or in other words how PPPv6 works

Lets start by some fundamentals first:

PPP is the protocol which is normally used to connect to your ISP over dial-up links (i.e. PPP over dialup) OR broadband networks (i.e. PPP over Ethernet) OR to your corporate network (i.e. PPP over PPTP/L2TP based VPN tunnel). PPP provides capability to authenticate the user (using protocols like MSCHAPv2, EAP-TLS, PEAP etc) and get the IP address information from the server (using IPv4CP OR IPv6CP). And then depending upon IPv4CP or IPv6CP success, IPv4 OR IPv6 stack is plumbed on top of PPP.

The fundamental difference in the way IPv4 is configured on top of PPP vs IPv6 is:

IPv4CP phase of PPP provides a way to transfer IP address + DNS server address from server to the client.

Whereas, IPv6CP provides way to transfer only lower-half (or 64 bit interface-identifier) of IPv6 address from server to the client. This means upper half (or 64 bit IPv6 prefix) needs to be sent to client through some other ways. Vista PPP client + Longhorn server based PPP (or RRAS server) supports sending IPv6 prefix through IPv6 router advertisement (or RA) mechanism. This means once the PPP is up, IPv6 RA is sent from the server to the client to hand-out the IPv6 prefix to the client. And then DHCPv6 Inform is sent from client to server to get the DNS related information from the server.

So the flow on the client side will look like

1) Establish link (i.e. dialup or VPN etc) connectivity between PPP client and server

2) PPP goes through LCP, Authentication, IPv4CP and/or IPv6 CP phase.

3) If both IPv4 and IPv6CP fails, the PPP connection is disconnected.

If IPv4CP comes up, PPP is attached as IPv4 interface.

If IPv6CP comes up, then it is attached as IPv6 interface.

4) Client IPv6 stack begins the IPV6 address autoconfigration process and sends IPv6 router solicitation packet to the PPP server.

5) Upstream router (i.e. PPP server) if configured properly sends IPv6 router advertisment packet (containing IPv6 prefix, route information) to the client.

6) Client then sends DHCPv6 Inform (or DHCPv6 stateless client) to the server to get the rest of the information (like DNS server address, DNS suffix etc).

7) Client is ready to use IPv6 interface for sending/receiving IPv6 packets.

Note: Last 4 steps remain same for LAN interface too. Think PPP IPv6CP as a way to provde interface-id to the IPv6 stack - which in LAN interface may be derived from MAC address.

Now comes to some aspects where some implementation differ:

Some PPPv6 server vendors expect client to send DHCPv6 prefix requesting client packet to the server - to obtain the prefix to be assigned to PPP or WAN link. Vista client does not send this because:

1) DHCPv6 prefix delegation mechanism is for a router "A" to request its upstream router "B" to get (or delegate) a prefix, which router "A" can send to its LAN clients on the downstream direction.

2) DHCPv6 prefix delegation mechanism is not the right mechanism to obtain prefix for the interface on which the router is requesting to upstream router. Also this is not the mechnism to be used by IPv6 host (and note in PPPv6 client scenario I mentioned above, client is really behave as host and not a router).

Vista does supports sending DHCPv6 prefix requesting packet only in scenario where internet connection sharing (or ICS) is enabled. i.e. Vista box is running as a ICS "router". In this scenario, once the public IPv6 interface comes up (say PPPv6 over Ethernet is enabled as public interface on ICS), Vista will send DHCPv6 PD to get a prefix which ICS assigns to the LAN (or private interface). And the LAN machines behind Vista ICS box can then get this prefix via IPV6 router advertisement packets sent on LAN interface.

Please send me email at rrasblog@microsoft.com in case you have further queries

Till then - have fun and welcome to IPv6 world

Samir Jain
Lead Program Manager
RRAS, Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]

Vista/WS08: Frequently asked questions on IPv6 support for remote access scenarios (RAS)

rrasblog — Wed, 01 Nov 2006 18:55:00 GMT

Hi,

In this blog, I am giving quick FAQ on RAS IPv6 support in Vista and Longhorn Server

IPv6

How do we support IPv4 and IPv6?

First a little background: After you establish a VPN connectivity, you have two interfaces on your client machine – one is your Internet interface (i.e. like Ethernet, PPPoE, PPP over dialup) and other is your corporate or VPN interface (i.e. PPTP or L2TP or SSTP VPN tunnel). Which really means you have two set of IP addresses – can be IPv4 and/or IPv6.

In Vista, we support L2TP or SSTP VPN tunnel over IPv6 (i.e. when your ISP connectivity is IPv6) and continue to support both L2TP/SSTP/PPTP VPN tunnel over IPv4. In all scenarios IPv4 and/or IPv6 packets can be sent on top of VPN tunnel (i.e. packets going to/from corporate network can be IPv4/IPv6).

If you are confused between over/on top, my rule of thumb:

è Look at the connectivity between VPN client and VPN server i.e. your ISP connectivity. That determines how the tunnel packets flow “over” Internet.

è Look at the connectivity between VPN server and corporate network i.e. your corporate connectivity. That determines what flows “on top” of the tunnel.

How do I identify this while configuring?

Open a VPN connection properties in “Network and sharing Center”->”Manage Network Connections”. Right click on Properties.

1) Go under “General” tab, Hostname or IP address that you enter here is the IP address (v4 or v6) or hostname of the VPN server. i.e. the IP address you are going to connect to VPN server or the IP address over which VPN tunnel will be established. Or in other words determine your ISP connectivity.

If you enter IPv6 address, then L2TP or SSTP tunnel is supported. If you enter IPv4 address, then PPTP , SSTP or L2TP tunnel is supported.

But if you enter a hostname, then the type of tunnel selection is deferred till you do “connect” and a name lookup is done. Now DNS server can return you both IPv4 as well as IPv6 addresses. In that scenario, it is tried in order in which the addresses are returned by DNS server inside DNS response.

2) Now go under “Networking” tab, and see “This connection uses the following items”. The protocol listed there includes both IPv4 and IPv6. This protocol will be the protocol that gets negotiated on top of the VPN tunnel. Or in other words this determines your corporate connectivity – whether you will be sending IPv4 and/or IPv6 packets to the corporate network on top of the tunnel.

You can get both IPv4 as well as IPv6 address from your corporate VPN server. And then depending upon the name lookups, appropriate address will be taken.

How does it work when I select “automatic” as Type of VPN?

Automatic VPN tunnel logic is very simple. First try PPTP, if that fails try L2TP, then SSTP.

1) Now say you have configured IPv4 address as the destination VPN server. Then the logic remains same.

2) Lets say you have configured IPv6 address as the destination VPN server. Then L2TP is tried and if that fails PPTP is tried.

3) Lets say you have configured hostname as the destination VPN server. Now your DNS server returns only IPv4 address (i.e. A record), goto logic 1). If your DNS server returns only IPv6 address (i.e. AAAA record), goto logic 2). If your DNS server returns both IPv4 and IPv6 address, then logic will be to go through each IP address and then go to either 1) or 2) depending upon the IP address.

What will happen if I connect Vista client to a VPN server not supporting IPv6 (say 2k server)?

This means you cannot use IPv6 to connect to VPN server (i.e. IPv4 connectivity to ISP), which means your tunnel can be both L2TP or PPTP.

Secondly Vista client will try to get IPv4 as well as IPv6 address from the VPN server, but it will only get IPv4 address and the connection will still go through.

Note: The connection only fails if you are not able to get both IPv4 as well as IPv6 address on top of the VPN tunnel.

Will Vista support IPv6 for connection to my ISP?

Absolutely - Vista supports PPPv6 over Ethernet (very commonly used in broadband deployments like cable/DSL modem) as well as PPPv6 over Dialup. This way depending upon your ISP connectivity (broadband or dialup), you can get native IPv6 connectivity to Internet.

Please feel free to send your comments

Samir Jain
Lead Program Manager
RRAS, Windows Enterprise Networking

[This posting is provided "AS IS" with no warranties, and confers no rights.]