8

As an LIR, you are getting a /29 to /32 network allocation by the RIPE, but I am a bit overwhelmed by the size of this subnet, and don't find a starting point to split this into common sizes.

What we need to address with this subnet:

office workstations We currently have two offices in (yet) one country.

office IoT stuff cameras, phones, tv's, other stuff

local office servers Just a bunch of VM hosts and routes/switches

data centers Currently we have servers in one datacenter. There we are hosting several different services:

  • shared SaaS applications
  • dedicated servers for individual customers
  • shared web hosting
  • internal service
  • a bunch of routes

My problem is that I don't have a idea how big subnets I should assign to:

  • individual host
  • service group (like, workstations, or all hosts of specific product)
  • location
  • county
  • There's not enough information here. How many users? Do you segment them by function/location/etc? Same for servers? How many? Do you segment applications like finance from others? – Ron Trunk Jan 18 '17 at 20:06
  • We would like to segment applications (like you said financing or even hosted exchange and sharepoint related stuff). In general we also would like to do segmentation by locations (data center and offices). There are not many users and server yet in each location (< 100) – Maximilian Ruta Jan 18 '17 at 20:10
  • ipv6forum.com/dl/presentations/IPv6-addressing-plan-howto.pdf is a nice read, it has a lot of pointers on how to create an IPv6 addressing plan. – Teun Vink Jan 18 '17 at 21:53
  • IPv6 Subnetting - Overview and Case Study ~100,000 Views on Cisco.com. Consider spelling out your acronyms (LIR, RIPE). – Ron Royston Jan 19 '17 at 3:33
18

Some simple guidelines that work most of the time:

Dividing your /29

  • The standard size of your allocation from RIPE NCC is a /32
  • A /32 is a well-accepted prefix size in the global routing table
  • You can get a /29 just by asking for it
  • Conclusion: Get a /29 and start using the a /32, save the other /32s for when you deploy to other countries, continents etc.

Determining per-site prefix size

  • RIPE allows you to assign up to a /48 per site without having to explain anything. When you assign a shorter prefix (/47, /46 etc) you'll have to explain why you need more than a /48.
  • A /32 contains 65,536 /48s.
  • So no need to give a site anything smaller than a /48 (/49, /50 etc) either.
  • Conclusion: /48 per site

Determining LAN prefix size

  • The standards say to use a /64.
  • So in your addressing plan always align on /64s
  • Configuring a /127 on point-to-point links is common and can protect you against cache overflows, use x:y:z::a on one end and x:y:z::b on the other end for readability.
  • Reserve a /64 for router loopback addresses, anycasted services etc. I usually choose the first /64 from the /48 for this so the addresses are nice and short to write with :: notation. Configure /128 addresses from this /64 on loopback interfaces etc.
  • Don't even think about not using a /64 on a LAN or VLAN, things will break. If not today then very probably in the future.
  • Don't change your LAN/VLAN architecture yet, just assign /64s to each existing LAN/VLAN.

The remaining bits

  • There are still choices to be made:
    • How to use the bits on country-level between a /32 and a /48?
    • How to use the bits in a site between a /48 and a /64?
  • In both places you could just use random numbers between 0000 and ffff, but that would create a mess that is hard to understand and remember, so do something useful with those bits!
    • Always split at multiples of 4 bits (nibbles) so your addressing plan structure matches the hexadecimal notation of IPv6 addresses (each character in an IPv6 address represents 4 bits)
    • What to use those bits for depends on your organisation. You might divide the country-level /32 into /36 blocks and use a /36 per province. Or you use a /40 for some structure that is important to your organisational or infrastructure architecture. Or both.
    • The same for the /48:
      • Maybe you want to give a /52 to each building on the site and give a /56 to each floor in each building. That works well with prefix aggregation in your routing protocols.
      • Or maybe you want to assign a /52 or /56 to each security zone in your security architecture. That makes maintaining firewall policies and rules a lot easier!
    • Whatever you choose to do: keep a balance. Don't just start assigning from 0 up to ffff sequentially without giving any thought to how to organise those numbers, but also don't over-engineer it. If you want to put too much information in the prefixes (building + floor + security zone + function of the server + what brand of server it is + etc etc) then your addressing plan becomes impossible to work with.
  • Plug: I wrote a paper on this for SURFnet a couple of years ago. RIPE NCC has translated it to English: https://www.ripe.net/support/training/material/IPv6-for-LIRs-Training-Course/Preparing-an-IPv6-Addressing-Plan.pdf
4

The good news is that there is a standard IPv6 network size: /64. You could use other sizes, but there are some features of IPv6 that can break if you use network sizes other than /64.

The recommendation is to assign a /48, or shorter, network to a site, and subnet that into /64 networks for each network, even if you have very few devices on a network. Each /48 network can have 65,536 /64 networks. Also, ISPs will not advertise any prefixes longer than /48.

You should use /128 networks for things like loopback addresses, and /127 networks for point-to-point links. A best practice is to not use any other part of the /64 network from which you use a /127 or /128 network. There are plenty of addresses, so get out of the IPv4 "I must conserve addresses" mindset.

At any given site, you can use IPv6 prefix delegation to assign networks to interfaces.

There are actually RFCs about things like this. For example, RFC 6177, IPv6 Address Assignment to End Sites and RFC 7421, Analysis of the 64-bit Boundary in IPv6 Addressing.

  • So you mean we should assign /48 to a office for instance and individual /64 networks for phones, workstations etc. But what for instance is with the data center? Having one /48 here for the data center and then /64 for service groups like webservers, database servers etc.? – Maximilian Ruta Jan 18 '17 at 21:57
  • You should use a /48 network for each site, and each VLAN (network) at a site should use a /64 network. This should work with everything, and you will not need to work around or make concessions for IPv6 features that break when not using /64 for a network. You may only use a few /64 networks out of the possible 65,536 /64 networks at a site, just as you will only use a relatively few IP addresses of the possible 18,446,744,073,709,551,616 addresses on a /64 network. – Ron Maupin Jan 18 '17 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.