4

I run a small ISP for a rural community in England. There are around 350 residential properties and 15 small businesses. Three of these businesses run systems that require two consecutive IPv4 addresses - it is some sort of EDI system for taking orders, but I don't know the details.

There is currently no IPv6 provision at all. Until very recently our upstream provider has only made IPv4 space available.

I am considering options to deploy IPv6. DS-Lite is one of the options, although I am at the research stage.

https://benunetworks.com/new-products/dual-stack-lite/ would suggest that ISPs that deploy DS-Lite will be unable to route IPv4 blocks to their clients as CGNAT is performed in the provider network.

Is this a true reflection of the technical reality? I would like to be as IPv6 native as possible - the attraction to DS-Lite - but I still need to let business customers do their own NAT for IPv4.

I am hoping someone has deployed DS-Lite and will be able to enlighten me.

  • If you're struggling with this, I know it's possible these days to run a pure IPv6 network and outsource the technology needed to provide IPv4. – Sander Steffann Apr 8 '18 at 10:15
  • 1
    DS-lite has it's place but I very much doubt it's a good fit for your network. Stick with conventional dual stack unless you have a very good reason not to. – Peter Green Apr 12 '18 at 3:21
  • @PeterGreen - Yes, I think I have reached the same conclusion. The absence of information (which ultimately landed me here) meant it took a little longer to determine this was the case. – alifen Apr 13 '18 at 10:25
3

As I explained in my comments, CGN and DS-Lite are for residential customers. You should not deploy these to your business customers. Continue to serve your business customers as you do today, but deploy CGN or DS-Lite for your residential customers.

RFC 6333, Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion explains how DS-Lite works:

This document revisits the dual-stack model and introduces the Dual- Stack Lite technology aimed at better aligning the costs and benefits of deploying IPv6 in service provider networks. Dual-Stack Lite enables a broadband service provider to share IPv4 addresses among customers by combining two well-known technologies: IP in IP (IPv4- in-IPv6) and Network Address Translation (NAT).

If your business customers need to have exclusive use of a public IPv4 address, then you cannot use CGN or DS-Lite for the business customers.

You also should have already been providing IPv6 to both your residential and business customers for several years now. You should look at RFC 6177, IPv6 Address Assignment to End Sites and the other IETF recommendations for that. Each business customer site should get no longer than a /48 IPv6 prefix, and residential customers should get something smaller than a single /64 prefix (/56 is fairly common for residential customers).

  • Thanks - looks like I have to rule out DS-Lite if I want a single solution. Without boring you with the details, our ISP is built under this government programme which restricts the choice of upstream provider. Until recently, we have only been provided IPv4 address space to distribute -- now we have v6 address space we are examining our options! – alifen Apr 7 '18 at 23:56
  • He's in the UK; unfortunately practically that whole country is several years behind on IPv6 for a variety of reasons. – Michael Hampton Apr 8 '18 at 2:28
  • Technologies like MAP are probably better suited to his needs. They provide the flexibility to assign a full IPv4 address to a customer, or a partial (port range) one. – Sander Steffann Apr 8 '18 at 10:11
2

So over the past few days I have spoken to a few different vendors and the answer is very much "it depends!"

It is possible to deploy DS-Lite and provide an IPv4 block to some customers, but some vendor implementations assume that the IPv4 packets that come out of the IPv4-in-IPv6 tunnel must go through CGN, whereas others decouple the two elements.

Implementations that decouple them allow the B4 device to put public IPv4 addresses inside the IPv6 tunnel, not NAT them, and then forward them on into the provider network just as IPv6 packets. Essentially, you retain IPv6 as the transport mechanism only.

The other question I asked of them was if it were possible to examine the IPv4 address and determine if to NAT or not. i.e. If it's RFC1918 then put it through CGN and if it isn't just pass the traffic into the provider network.

The answer to that was pretty much 'no'. On a IPv6 tunnel basis the decision has to be made as to if the v4 traffic is going through CGN or not.

All this really means is a customer that gets an IPv4 block needs to do their own NAT for IPv4 clients accessing the IPv4 Internet. They'll get a B4 device and will then need to put their own gateway between that and their clients. I think this will be fine, and possibly even preferable, for customers that need IPv4 space.

Some vendors have this functionality on their roadmap which I was shown under NDA, so I have stopped short of calling out which vendors behave in which way.

  • As you have noted, this is proprietary to some vendors. It is not actually DS-Lite, per the RFC standard. By the standard the tunnel from the B4 Element terminates on the ISP-contained AFTR Element, and on the AFTR Element, IPv4-IPv4 NAT is implemented. In any case, we cannot help with or recommend secret, proprietary technologies. – Ron Maupin Apr 12 '18 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.