2

I'm looking for best practice advice on how to IPv6 address your internal infrastructure network gear (routers, switches, etc). In my searching I've seen some people suggest using /127 like in a /30 for IPv4. I've read some suggest best practice is to just use /64 for your p2p connection due to having an abundance of IP's with v6. And most advise to using Global (public) IP's to use on your internal infrastructure gear.

I'd like to know your thoughts. Thanks!

Improve this question

1 Answer 1

Reset to default
7

I wrote a whitepaper on this many years ago, and it is still valid: https://labs.ripe.net/Members/steffann/preparing-an-ipv6-addressing-plan

To directly answer your questions: these days I usually reserve a /64 for each point to point link, but I configure it as a /127 using the xyz::a and xyz::b addresses. That makes it easier to talk about the link (a side and b side) and it allows you to change it to anything you'd like in the future if you change your mind.

Using private (a.k.a. ULA) addresses internally is often causing problems. If a router sources an ICMP error from such an address it will be filtered on the internet, and error messages that don't arrive cause black holes. Much better to use public addresses everywhere.

If you want to protect your infrastructure set aside a block from your public space for loopback, point to point and other infra, and put a simple ACL on your edge routers to drop incoming traffic to those addresses. Outbound errors will go out, but incoming traffic can't attack your infra. At least not directly, which is the same protection that using ULA would give you, but without the headaches.

Improve this answer
4
  • 1
    That is awesome! Thanks. I’ve got it saved in my iBooks to read later in full. Browsing thru it, makes sense. And I agree using private IPv6 would later cause we issues and one other person addressed that. I will def hit you up after reading your write up.
    – Engineer_fear
    Dec 30, 2017 at 17:32
  • @Engineer_fear: If you like this answer please mark it as such
    – Sander Steffann
    Jan 4, 2018 at 16:01
  • 1
    sorry it took me so long to get back to ya. The article was very informative. Def gave some perspective on how to address a company. I work in a hospital environment so we have 2 data centers, 5 major hospital locations and a bunch of remote sites. In each hospital, each IDF closet on every floor has its voice/data/wireless/vendor subnets. And there may be 2 to 10 closets per floor. It would take a little bit to plan that out. It would be a big project. But anyways. Thanks for the article and help!
    – Engineer_fear
    Jan 8, 2018 at 22:58
  • Glad I could help! Spending some time to plan is good, but do remember: most people need 2 or 3 iterations before they get the "perfect" plan, so don't spend too much time on it. Make a first plan, try it out in a lab or small part of your network, then make the second plan, and repeat :) It's almost impossible to get it right on paper the first time, so do spend time actually trying it out!
    – Sander Steffann
    Jan 9, 2018 at 9:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.