RFC 4554
Use of VLANs for IPv4-IPv6 Coexistence in Enterprise Networks
RFC 4554 💖 Use of VLANs for IPv4-IPv6 Coexistence in Enterprise Networks
Network Working Group 🌸 Request for Comments: 4554 🎀 Author: T. Chown, University of Southampton 🧚 Category: Informational 📚 (provides information to the Internet community, not an Internet standard) Date: June 2006 📅 Obsoletes / Updates: none listed in the title block ✨
Status of This Memo 📜
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
Copyright Notice ©️
Copyright (C) The Internet Society (2006).
Abstract 🌈
Okay bestie, so Ethernet VLANs are super common in enterprise networks for keeping traffic separated 🫶. This document explains how those same VLANs can be used to roll out IPv6 in an enterprise 🚀. It's mainly about early deployment, before switch-router gear that can handle IPv6 is actually available 💅. The idea is that IPv6 runs in parallel with the existing IPv4 🦋 and gets delivered at Layer 2 through VLAN tech. The IPv6 connection into the site might come in through the same physical link as the IPv4 traffic, or it might not 🌙.
Table of Contents 🗂️
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Enabling IPv6 per Link . . . . . . . . . . . . . . . . . . . . 3
2.1. IPv6 Routing over VLANs . . . . . . . . . . . . . . . . . 3
2.2. One VLAN per Router Interface . . . . . . . . . . . . . . 4
2.3. Collapsed VLANs on a Single Interface . . . . . . . . . . 4
2.4. Congruent IPv4 and IPv6 Subnets . . . . . . . . . . . . . 5
2.5. IPv6 Addressing . . . . . . . . . . . . . . . . . . . . . 5
2.6. Final IPv6 Deployment . . . . . . . . . . . . . . . . . . 5
3. Example VLAN Topology . . . . . . . . . . . . . . . . . . . . . 6
4. Security Considerations . . . . . . . . . . . . . . . . . . . . 7
5. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 7
6. Informative References . . . . . . . . . . . . . . . . . . . . 7
Appendix A. Configuration Example . . . . . . . . . . . . . . . . 81. Introduction 🎀
Ethernet VLANs are a big deal in enterprise networks, mostly for traffic segregation 💅. This doc is about using them to get IPv6 running in an enterprise, and that includes the early-days situation where you don't have IPv6-capable switch-router equipment yet 😭. In this setup, IPv6 gets routed alongside the IPv4 that's already there and reaches the LANs you want through VLAN tech 🧚.
Here's the long-term plan: sites moving to dual-stack will either upgrade their existing switch-router gear to do IPv6, or buy new gear that does 🔥. If a site already has production routers that support IPv6, then none of the procedures in this doc are needed 🙈. But in the meantime, early IPv6 adopters still need a way to roll IPv6 out in a structured, managed way 🌸. That's for some or all of an enterprise network that doesn't have IPv6 support in its core infrastructure yet 🫠.
So IEEE 802.1Q is the VLAN standard, and it lets separate LANs live on one bridged LAN by sticking "Virtual LAN" tagging or membership info into Ethernet frames 🏷️. Hosts and switches that understand VLANs basically let you reconfigure LANs in software, just by changing the tagging parameters ⭐. Because it's software-controlled, you can change the LAN setup without physically rewiring the links between LAN segments and Layer 3 routers 🎀.
Lots of IPv4 enterprise networks are already on VLANs 💖. So if a site doesn't have IPv6-capable Layer 2/3 switch-router gear but does support VLANs, there's a simple, effective way to bring IPv6 into some or all of the network gradually 🦋. You can do it before the core infrastructure is dual-stack 🌈.
If a site wants IPv6, it can deploy a parallel IPv6 routing setup. That's probably a different platform from the site's main infrastructure gear, specifically one that does IPv6 where the existing equipment can't ✨. Then it uses VLAN tech to "overlay" IPv6 links on top of the existing IPv4 links 🧚. The big win is that none of the IPv4 config has to change 💅. The VLANs don't need to tell IPv4 and IPv6 apart. The whole thing is just dual-stack, the same way Ethernet is without VLANs 🫶.
The IPv4 default route to the VLAN comes from one IPv4 router, and the IPv6 default route to the VLAN comes from a different IPv6 router 👑. That IPv6 router can give native IPv6 connectivity to the whole site using just a single physical interface, thanks to VLAN tagging and trunking, which we'll get into below 🍓.
The IPv6 connection into the enterprise might come in through the same physical link as the IPv4 traffic or a different one 🌙. It can also be native, or tunneled from the external provider to the IPv6 routing equipment 🎈.
This VLAN approach is already being used by a bunch of sites, including the author's own 🫶✨.
Now, a parallel setup costs extra. You need more infrastructure, and that means more money 💸. It'll often also need a separate link into the site from an IPv6 provider, and that link is quite possibly tunneled 🙈. That link needs the site's security policy applied, for example firewalling and intrusion detection 🔥. For sites that think getting onto IPv6 early really matters, that price might be one they're totally happy to pay 💅. This document, though, sticks to the technical side of using VLANs in that scenario 🎀.
2. Enabling IPv6 per Link 🌸
How IPv6 gets "injected" into an existing IPv4 network depends on the deployment 🧚. Say a site has an IPv4-only router hooked up to a VLAN-capable Ethernet switch, with a bunch of hosts on that VLAN 💖. Now imagine the site has twelve of these setups (a dozen, basically) that it wants to IPv6-enable right away 😭. One option is to upgrade all twelve routers so they support IPv6 and turn it on 🔥. But that might not be practical for a bunch of reasons 🙈.
The simplest approach is to hook one IPv6 router up to one interface on an Ethernet switch. Then you connect that switch to other switches, and use VLAN tags between the switches and the IPv6 router to "reach" every IPv4-only subnet from the IPv6 router 🦋. So the general idea is that the IPv6 router (say it's doing IPv6 Router Advertisements [1] for stateless autoconfiguration) connects to the target link through VLAN-capable Layer 2 equipment ✨.
2.1. IPv6 Routing over VLANs 🌈
Picture a common setup where you want to give connectivity to a bunch of existing IPv6 internal subnets 🫶. You could deploy one IPv6 router with an external interface and one or more internal interfaces 🎀. The external interface faces the wider IPv6 internet. It can be dual-stack if a tunnel mechanism is used for external connectivity, or IPv6-only if there's a native external connection 🌙.
The internal interface(s) can plug straight into a VLAN-capable switch 💅. From there, the router can put VLAN tags on packets it sends out, based on the target IPv6 link prefix 🧚. The VLAN-tagged traffic then gets carried across the site's VLAN-capable internal infrastructure to the target IPv6 links, which might be spread all over the site network 🗺️✨.
And if the IPv6 router can't add VLAN tags itself, you can create a protocol-based VLAN on the VLAN-capable device that's connected to the IPv6 router 🔥. Then the IPv6 traffic gets tagged and redistributed onto the (congruent) IPv4 subnet links that are in the same VLAN 💖.
2.2. One VLAN per Router Interface 🍓
There's more than one way to do the VLAN marking 🦋. Some sites might like one router interface per VLAN 💅. For example, if there are three internal IPv6 links, you could use a standard PC-based IPv6 router with four Ethernet ports: one for the external link and three for the internal links 🧚. In that case you'd need one switch port per link, to receive the connectivity from each router port 🎀.
With this setup, IPv6 routing can be cascaded through lower-tier internal IPv6-only routers 🌈. The internal-facing ports on the IPv6 edge router can feed other IPv6 routers over IPv6-only links. Those routers then inject the IPv6 connectivity into the VLANs, using the stub links with 64-bit subnet prefixes and their associated Router Advertisements ✨🫶.
2.3. Collapsed VLANs on a Single Interface 🌸
Using multiple IPv6 routers with one port per IPv6 link (that is, one per VLAN) might be unnecessary 🙈. Lots of devices now support VLAN tagging based on virtual interfaces, so multiple IPv6 VLANs can be assigned (trunked) from one physical router interface port 💖. So you can use just one router interface for "aggregated" VLAN trunking from a switch 👑. Honestly this is the much more interesting case for a site that's planning to bring IPv6 into (part of) its network 🔥.
This approach works as long as the IPv6 traffic load is light 🦋. Once the traffic grows, that single collapsed interface can be extended to use two or more physical ports, as long as the IPv6 router device has the capacity for it 🚀.
2.4. Congruent IPv4 and IPv6 Subnets 💅
This VLAN-based technique can be used to deploy IPv6-only VLANs in an enterprise network 🧚. Still, most enterprises will be more interested in dual-stack IPv4-IPv6 networking 🫶.
For a dual-stack setup, the IPv6 connectivity can get injected into the existing IPv4 VLANs. That way the IPv4 and IPv6 subnets are congruent, meaning they line up exactly when you lay one on top of the other 🎀. This can be really nice administratively. For example, every device in an IPv4 subnet also lands in the same IPv6 subnet 💖. This is the method used at the author's site ✨.
IPv6-only devices can also be added gradually to the subnet, without ever having to resize the IPv6 subnet 🌈. A /64 can effectively hold an enormous number of hosts, which is a big contrast to IPv4, where subnet sizes are often pretty limited or kept as small as possible because of address space concerns 😭. Not having to keep resizing IPv6 subnets is a real administrative perk for IPv6 🌸.
2.5. IPv6 Addressing 🦋
One site using this VLAN technique chose to number its IPv6 links in the format [Site IPv6 prefix]:[VLAN ID]::/64 🧚. The VLAN tag is 16 bits, so this works with a typical maximum 48-bit site prefix 🔢. Tying the VLAN ID into the site's addressing scheme might not fit with topology and aggregation, so it isn't necessarily a recommended addressing plan 🙈. Some sites might still want to think about using it 💅.
2.6. Final IPv6 Deployment 👑
The VLAN technique for IPv6 deployment is a more structured option than opportunistic per-host intra-site tunnelling methods, like Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) [2] 💖. It gives you a simple yet efficient way to do early IPv6 deployment in an enterprise site 🫶.
Once the site gets IPv6-capable switch-router equipment, the VLAN-based method can keep going 🌈. It can still deliver IPv6 links to physical switch interfaces, just like it's commonly used for IPv4 subnets today, except now everything runs on a common routing infrastructure ✨🎀.
3. Example VLAN Topology ✨
okay so this section is literally the vibe of "here's how you actually pull this off in a real building" 🏢🎀 the picture shows a whole VLAN setup for bringing IPv6 into an enterprise network, running a parallel IPv6 routing setup next to the existing stuff, with VLAN tagging doing the heavy lifting 💅
External IPv6 Internet
|
|
IPv6 Access Router
|
|
Switch-router with VLAN support
|
|
+--------------+----------------+
|Site enterprise infrastructure |
| with support for VLANs |
+----+--------------------+-----+
| |
| |
VLAN switch A VLAN switch B
| | |
| | |
Subnet1 Subnet2 Subnet3
Figure 1: IPv6 deployment using VLANs (physical diagram)So in this setup the IPv6 access router has one physical port facing the internal infrastructure 🦋 and in this example it only needs to be IPv6-enabled, because its whole job is handling IPv6 traffic for the enterprise. It also has a second interface facing the external side. In this example that one could be dual-stack if the external IPv6 connectivity comes through a tunnel to an IPv6 ISP 🌸
The internal-facing port handles a bunch of VLANs. Here it's IPv6 links Subnet1, Subnet2, and Subnet3 👑 Those VLANs show up as logical subinterfaces on the physical interface, and it's using the "collapsed VLAN" method we talked about earlier. Basically it tags the inbound traffic with one of three VLAN IDs depending on which IPv6 Subnet prefix the traffic is headed for. iykyk 🫶
Here's the IPv6 view of the same deployment. Every IPv6 subnet is on-link to the IPv6 access router, whether or not those subnets share the same physical links over the VLAN infrastructure ✨
External IPv6 Internet
|
|
Site IPv6 Access Router
| | |
| | |
Subnet1 Subnet2 Subnet3
Figure 2: IPv6 view of the deployment (logical view)In this example the router acts as an IPv6 first-hop access router to the physical links, and that's separate from the IPv4 first-hop router 💜 This technique lets a site easily "inject" native IPv6 into every link where VLAN-capable infrastructure exists, which means partial or full IPv6 deployment on the wire across the site 🌈
4. Security Considerations 🙈
okay this one is serious bestie, so pay attention 😭
There are no additional security considerations particular to this method of enabling IPv6 on a link. 💅
Where the IPv6 connectivity is delivered into the enterprise network by a different path from the IPv4 connectivity, care should be given that equivalent application of security policy (e.g., firewalling) is made to the IPv6 path. 🔥 Like, if your IPv6 comes in a different door than your IPv4, you have to make sure the bouncer checks both doors the same way. Non-negotiable energy 💀
5. Acknowledgements 🫶
the author gives a big shoutout to colleagues on the 6NET project, where this technique for IPv4-IPv6 coexistence is widely deployed 🌸 special thanks to Pekka Savola (CSC/FUNET), and also to Janos Mohacsi (Hungarnet), Martin Dunmore and Chris Edwards (Lancaster University), Christian Strauf (JOIN Project, University of Muenster), and Stig Venaas (UNINETT) 🧚
6. Informative References 📚
- [1] Narten, T., Nordmark, E., and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998.
- [2] Templin, F., Gleeson, T., Talwar, M., and D. Thaler, "Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)", RFC 4214, October 2005.
Appendix A. Configuration Example 🎀
this appendix is a configuration example for a computer running the FreeBSD variant of the Berkeley Software Distribution (BSD) operating system, used as a router to deploy IPv6 networking across a bunch of IPv6 links on an enterprise. in this case that's six links, for a scenario similar to the one above 🦋 the exact config can totally vary depending on the site's existing VLAN deployment. the big takeaway: the VLAN configuration has to be manually configured. the support is NOT "automatic" 😭
in this example the BSD router connects directly to a site's external IPv6 access router. it has one interface (dc0) toward the site IPv6 access router, and three interfaces (dc1, dc2, dc3) for the internal routing. the number of interfaces can vary, but three are used here to spread out the traffic load ⚖️ the IPv6 documentation prefix (2001:db8::/32) is used throughout the example 💖
--- Example IPv6 VLAN configuration, FreeBSD ---
#
# To IPv6 enable a vlan
#
# 1. Add a new vlan device to cloned_interfaces called vlanX
#
# 2. Add an ifconfig_vlanX line, the number is the vlan tag ID
#
# 3. Add vlanX to ipv6_network_interfaces
#
# 4. Add an ipv6_ifconfig_vlanX line, with a new unique prefix
#
# 5. Add vlanX to rtadvd_interface
#
# 6. Add vlanX to ipv6_router_flags
### Interfaces ###
# Bring physical interfaces up
ifconfig_dc0="up"
ifconfig_dc1="up"
ifconfig_dc2="up"
ifconfig_dc3="up"
# Create VLan interfaces
cloned_interfaces="vlan0 vlan1 vlan2 vlan3 vlan4 vlan5 vlan6"
# Upstream link to IPv6 Access Router
ifconfig_vlan0="vlan 37 vlandev dc0"
# Downstream interfaces, load balance over interfaces dc1,dc2,dc3
ifconfig_vlan1="vlan 11 vlandev dc1" # Subnet1
ifconfig_vlan2="vlan 17 vlandev dc2" # Subnet2
ifconfig_vlan3="vlan 24 vlandev dc3" # Subnet3
ifconfig_vlan4="vlan 25 vlandev dc1" # Subnet4
ifconfig_vlan5="vlan 34 vlandev dc2" # Subnet5
ifconfig_vlan6="vlan 14 vlandev dc3" # Subnet6
### IPv6 ###
# Enable ipv6
ipv6_enable="YES"
# Forwarding
ipv6_gateway_enable="YES"
# Define Interfaces
ipv6_network_interfaces="vlan0 vlan1 vlan2 vlan3 vlan4 vlan5 vlan6"
# Define addresses
ipv6_ifconfig_vlan0="2001:db8:d0:101::2 prefixlen 64" # Uplink
ipv6_ifconfig_vlan1="2001:db8:d0:111::1 prefixlen 64" # Subnet1
ipv6_ifconfig_vlan2="2001:db8:d0:112::1 prefixlen 64" # Subnet2
ipv6_ifconfig_vlan3="2001:db8:d0:121::1 prefixlen 64" # Subnet3
ipv6_ifconfig_vlan4="2001:db8:d0:113::1 prefixlen 64" # Subnet4
ipv6_ifconfig_vlan5="2001:db8:d0:114::1 prefixlen 64" # Subnet5
ipv6_ifconfig_vlan6="2001:db8:d0:115::1 prefixlen 64" # Subnet6
# Router advertisements
rtadvd_enable="YES"
rtadvd_interfaces="-s vlan0 vlan1 vlan2 vlan3 vlan4 vlan5 vlan6"
### Routing ###
# Multicast
mroute6d_enable="YES"
mroute6d_program="/sbin/pim6sd"
# RIP-ng
ipv6_router_enable="YES"
ipv6_router_flags="-N dc0,dc1,dc2,dc3, vlan1,vlan2,vlan3,
vlan4,vlan5,vlan6"
--- End of configuration ---Note that if there's only one internal-facing interface, then again, so long as the OS supports VLAN trunking, all the VLAN IDs could be associated with that interface (dc1, for example). 🍓
The VLAN IDs need to be managed by the site administrator 👑 They'd probably already be assigned for the existing IPv4 subnets, the ones IPv6 is being introduced into 💅
For a large enterprise, a combo of internal tunnels and VLAN usage could work, because the whole site doesn't have to be enabled by VLAN tagging alone. This choice is one for the site administrator to make 🧚✨
Author's Address 🦋
Tim Chown University of Southampton Southampton, Hampshire SO17 1BJ United Kingdom
EMail: tjc@ecs.soton.ac.uk
Full Copyright Statement 💜
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🌸
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 🧚
Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA). 💖
📦 where this page comes from
- ietf: rfc4554 2006-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms