Preparing Servers for IPv6 Support

Because servers are considered IPv6 hosts, by default their IPv6 addresses are automatically configured by the Neighbor Discovery protocol. However, many servers have multiple network interface cards (NICs) that you might want to swap out for maintenance or replacement. When you replace one NIC, Neighbor Discovery automatically generates a new interface ID for that NIC. This behavior might not be acceptable for a particular server.

Therefore, consider manually configuring the interface ID portion of the IPv6 addresses for each interface of the server. For instructions, refer to How to Configure a User-Specified IPv6 Token. Later, when you need to replace an existing NIC, the already configured IPv6 address is applied to the replacement NIC.

How to Prepare Network Services for IPv6 Support

1. Update the following network services to support IPv6:

   • Mail servers

   • NIS servers

   • NFS

     ---

     Note - LDAP supports IPv6 without requiring IPv6-specific configuration tasks.

     ---

2. Verify that your firewall hardware is IPv6 ready.

   Refer to the appropriate firewall-related documentation for instructions.

3. Verify that other services on your network have been ported to IPv6.

   For more information, refer to marketing collateral and associated documentation for the software.

4. If your site deploys the following services, make sure that you have taken the appropriate measures for these services:

   • Firewalls

     Consider strengthening the policies that are in place for IPv4 to support IPv6. For more security considerations, see Security Considerations for the IPv6 Implementation.

   • Mail

     In the MX records for DNS, consider adding the IPv6 address of your mail server.

   • DNS

     For DNS-specific considerations, see How to Prepare DNS for IPv6 Support.

   • IPQoS

     Use the same Diffserv policies on a host that were used for IPv4. For more information, see Classifier Module.

5. Audit any network services that are offered by a node prior to converting that node to IPv6.

How to Prepare DNS for IPv6 Support

The current Solaris release supports DNS resolution on both the client side and the server side. Do the following to prepare DNS services for IPv6.

For more information that is related to DNS support for IPv6, refer to System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP).

1. Ensure that the DNS server that performs recursive name resolution is dual-stacked (IPv4 and IPv6) or for IPv4 only.

2. On the DNS server, populate the DNS database with relevant IPv6 database AAAA records in the forward zone.

   ---

   Note - Servers that run multiple critical services require special attention. Ensure that the network is working properly. Also ensure that all critical services are ported to IPv6. Then, add the server's IPv6 address to the DNS database.

   ---

3. Add the associated PTR records for the AAAA records into the reverse zone.

4. Add either IPv4 only data, or both IPv6 and IPv4 data into the NS record that describes zones.

Planning for Tunnels in the Network Topology

The IPv6 implementation supports a number of tunnel configurations to serve as transition mechanisms as your network migrates to a mix of IPv4 and IPv6. Tunnels enable isolated IPv6 networks to communicate. Because most of the Internet runs IPv4, IPv6 packets from your site need to travel across the Internet through tunnels to destination IPv6 networks.

Here are some major scenarios for using tunnels in the IPv6 network topology:

• The ISP from which you purchase IPv6 service allows you to create a tunnel from your site's boundary router to the ISP network. Figure 4-1 shows such a tunnel. In such a case, you would run a manual, IPv6 over IPv4 tunnel.

• You manage a large, distributed network with IPv4 connectivity. To connect the distributed sites that use IPv6, you can run an automatic 6to4 tunnel from the edge router of each subnet.

• Sometimes, a router in your infrastructure cannot be upgraded to IPv6. In this case, you can create a manual tunnel over the IPv4 router, with two IPv6 routers as endpoints.

For procedures for configuring tunnels, refer to Tasks for Configuring Tunnels for IPv6 Support (Task Map). For conceptual information regarding tunnels, refer to IPv6 Tunnels.

Security Considerations for the IPv6 Implementation

When you introduce IPv6 into an existing network, you must take care not to compromise the security of the site. Be aware of the following security issues as you phase in your IPv6 implementation:

• The same amount of filtering is required for both IPv6 packets and IPv4 packets.

• IPv6 packets are often tunneled through a firewall. Therefore, you should implement either of the following scenarios:

  • Have the firewall do content inspection inside the tunnel.

  • Put an IPv6 firewall with similar rules at the opposite tunnel endpoint.

• Some transition mechanisms exist that use IPv6 over UDP over IPv4 tunnels. These mechanisms might prove dangerous by short-circuiting the firewall.

• IPv6 nodes are globally reachable from outside the enterprise network. If your security policy prohibits public access, you must establish stricter rules for the firewall. For example, consider configuring a stateful firewall.

This book includes security features that can be used within an IPv6 implementation.

• The IP security architecture (IPsec) feature enables you to provide cryptographic protection for IPv6 packets. For more information, refer to Chapter 19, IP Security Architecture (Overview).

• The Internet Key Exchange (IKE) feature enables you to use public key authentication for IPv6 packets. For more information, refer to Chapter 22, Internet Key Exchange (Overview).