0

We want to implement ipv6 on our network as we begin to offer our customers dual stack. We offer dedicated servers and we wish to give a /64 with each server.

In one vlan, we wish to have 255 x /64

Is there any other way to do it on a Juniper MX router, instead of describing each gateway (255 gateways) in the configuration?

Improve this question
10
  • I'm not sure I follow. Do you want one VLAN with a /56 network (256 /64 networks)?
    – Ron Maupin ♦
    Oct 12, 2016 at 18:17
  • @RonMaupin Yes, but split as 256x /64 (each /64 with it's own gateway)
    – VelDev
    Oct 12, 2016 at 18:20
  • Then you need that many VLANs, unless you want customers to be able to contact each other's servers at layer-2. I would think that you would want to separate the networks by layer-2, and probably firewall them from each other at layer-3.
    – Ron Maupin ♦
    Oct 12, 2016 at 18:23
  • @RonMaupin We firewall at the switch level, it's not a problem. We need to keep the single vlan method as we already use it for ipv4. The only problem we have is that adding 1000 gateways on our router doesn't seem a clean/good solution.
    – VelDev
    Oct 12, 2016 at 19:30
  • How do you do the gateways with IPv4? It really isn't different with IPv6.
    – Ron Maupin ♦
    Oct 12, 2016 at 19:31

1 Answer 1

Reset to default
1

A different setup would probably make more sense for IPv6. Putting multiple /64s on one layer-2 domain isn't very useful. Just one /64 has 2^64 addresses. You could let each server pick addresses from a subset of the /64 for example. If the /64 is for example 2001:db8:aa:bb::/64 then server 1 could use every address between 2001:db8:aa:bb:0001:0000:0000:0000/64 and 2001:db8:aa:bb:0001:ffff:ffff:ffff/64, etc. That way you could fit 65536 servers on a subnet with 16 million addresses per server.

But that's still pretty much IPv4-thinking. What would probably be much more useful to your customers is if you provide a routed subnet per server so that they can more easily run things like docker and virtual machines inside their server. I would recommend at least a /56 per server. If you combine this with the addressing suggestion above you could route the prefix to the ::1 address of each server. So for server 1 above you could for example set static route 2001:db8:ff00:0100::/56 to 2001:db8:aa:bb:1::1.

Then you are really using IPv6: provide plenty addresses on the LAN and give a block of subnets to each customer for virtualisation etc. Much cleaner and more useful to your customers than messing with multiple /64s on one LAN.

Improve this answer
6
  • Or, a modern server may just decide to pull a RFC 7217 SLAAC address, which means you pretty much have to give it its own /64, at a minimum. This is the default in current Fedora and will probably be in a future RHEL version, for instance.
    – Michael Hampton
    Oct 13, 2016 at 2:33
  • I never enable SLAAC on server networks, I prefer server configurations to be predictable.
    – Sander Steffann
    Oct 13, 2016 at 13:06
  • They're predictable now, which is part of the point of RFC 7217. Even replacing a PCIe card NIC should not change the address.
    – Michael Hampton
    Oct 13, 2016 at 15:50
  • The addresses are more stable with RFC 7217, true. What I meant is that I don't want any auto configuration on servers. I want to manually configure the addresses they use, put them properly in DNS etc. I also have seen server networks where the admin of a server didn't think about IPv6 and never configured an IPv6 firewall etc. Especially on networks where there didn't use to be IPv6 before. That's more what I meant :)
    – Sander Steffann
    Oct 13, 2016 at 20:33
  • 2
    Aha! Since I have machines that register themselves in DNS, I don't care so much about that. The addresses only need to be reasonably stable.
    – Michael Hampton
    Oct 13, 2016 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.