So we are looking into implementing IP mobility in our network.
The use case would be for a laptop to be able to roam between wired and wireless mode of operation while retaining all TCP/UDP based connections (ongoing browser downloads, conferencing sessions, SIP/RTM softphone connections, RDP connections)
Current state
Due to a generous /16 IPv4 network assignment from the olden days, we were hardly pressed to implement IPv6. So we didn't. The basic outline of the environment:
- Windows servers in public IPv4 address space, with a permanently assigned IPv4 address
- Cisco UCM - based phone network
- Windows clients in public IPv4 address space, with a permanently assigned IPv4 address
- countless wireless clients are getting a dynamically assigned address from a private IPv4 address space
- the private address space router is NATting outbound connections to a pool of public IPv4 addresses
- Clients and servers are mainly Windows, basically everything that is still covered under Microsoft's extended support policy (Server 2008-2016, Windows 7 - Windows 10 1607)
- all hosts are members of an AD domain.
- Cisco gear on the network side
- MAC-/VMPS-based VLAN assignment on the wired network
- no 802.1x auth for wired hosts
- Radius-backed 802.1x (EAP-TTLS-PAP) for wireless connections
- Communications between clients and servers are restricted by the Cisco routers' ACLs as well as by server-side Windows Firewall rules
The ancillary conditions fro the use case are that
- users should not be required to start/connect a separate VPN client
- we likely do not have the resources to implement Proxy Mobile IPv6 as we would need IPv6 routing and address management working first, which we do not have and are not going to get in the short term
Options considered
We have a Cisco ASA - based VPN in place, so remote and wireless users are capable of connecting into our network. But since we restrict access to our systems on a per-address basis, using this to create an overlay network for all of our users has severe management implications:
- we would permanently need to assign an additional IPv4 address from the public VPN address pool to each employee, which is going to deplete our address pools
- the router ACLs and host firewall rules are often configured with exemptions for ranges and subnets in the wired network which reflect our organization's structure (departments having own subnets). If we simply assign addresses to employees from a contiguous, non-structured pool, this method of access control will be rendered unusable.
- currently, a VPN-connected client is routing all traffic through the ASA gateways. This is not going to scale all that well if we let all users connect to the gateways at all times to support the seamless roaming scenario. Even if only connections to our internal servers would be routed through the tunnel, we are looking into more bandwidth on the tunneling endpoints, than we can possibly handle.
Windows obviously comes with things like Teredo and 6to4 tunneling along with opportunistic encryption for connections over IPSEC, which we might consider using in lieu of the current network-address based access control. But as far as I can see, no current Windows stack is implementing Mobile IPv6 and I am having a hard time finding working implementations altogether.
I have been made aware of LISP but even after reading the overview publications on this topic I am having difficulties embracing the extent of infrastructure changes needed for it to work for us. Also, as most publications are mentioning "datacenter mobility", I cannot yet see if it would fit our use case of roaming clients as well.
So what options would remain?