IPv6: Don’t Forget About Your Switches!

When preparing a network for IPv6, I often hear network administrators say that their switches are agnostic and that there is no need to worry about them.  Not so fast.

Yes, LAN switches function mainly at layer 2 by forwarding Ethernet frames regardless of whether the packet inside is IPv4 or IPv6 (or even something else!)  However, there are some functions on a switch that operate at layer 3 or higher.  They include:

• Dynamic ARP Inspection (DAI)
• DHCP Snooping
• Multicast Listener Discovery (MLD) Snooping (equivalent of IGMP Snooping)
• Quality of Service (QoS) marking for Differentiated Services treatment
• Access Lists (e.g., VLAN or regular ACLs).

These features were developed to push certain functions to the access layer where a network is often the most vulnerable or where it provides the closest point to the end user and thus the best place to apply certain logic and policies to application traffic.  To function properly, they require layer 3 or upper layer information.  They inspect the packet header or payload inside the Ethernet frame.  These features may be necessary to translate your IPv4 network functionality to IPv6.  While these features do not necessarily qualify the device as a layer 3 “switch” or an IPv6 router per se, they do act on more than just the Ethernet frame.

There is also the IP management interface on the switch, although I expect most networks will be dual stacked for the foreseeable future and will not abandon their IPv4 management interfaces, at least not until they can get their management systems to catch up.

The aforementioned features may not be things you are doing now, but you never know when you will.  Security requirements and hardening guidelines are recommending things like DAI, DHCP Snooping and ACLs at the access layer.  The more streaming video gets moved to IP networks, the more the need for multicast, and MLD Snooping is necessary to improve performance.  Finally, the continued convergence of voice, video and other rich media and interactive applications to IP networks is furthering the need for QoS, and it is always best to mark traffic as close to the edge as possible.

So don’t forget about your switches.  A thorough IPv6 readiness assessment must consider the entire network, end to end, and everything in between.

Note: The previous list was off the top of my head and by no means all inclusive.  I would welcome any comments that would help to compile a complete list.

Addressing IPv6 Serial Links – /64 or /126?

What is the proper subnet to assign to an IPv6 serial links?

The standards say that every single network segment should get a full /64 regardless of how small or large the segment is in terms of the number of hosts requiring addresses.  This makes good sense, particularly because the /64 boundary was designed according to the specifications for Stateless Address Auto-Configuration (SLAAC).