Home / Blogs

IPv6: Don't Forget About Your Switches!

When preparing a network for IPv6, I often hear network administrators say that their switches are agnostic and that there is no need to worry about them. Not so fast.

Yes, LAN switches function mainly at layer 2 by forwarding Ethernet frames regardless of whether the packet inside is IPv4 or IPv6 (or even something else!) However, there are some functions on a switch that operate at layer 3 or higher. They include:

• Dynamic ARP Inspection (DAI)

• DHCP Snooping

• Multicast Listener Discovery (MLD) Snooping (the IPv6 equivalent of IGMP Snooping)

• Quality of Service (QoS) marking for upstream Differentiated Services treatment

• Access Lists (e.g., VLAN or regular ACLs).

These features were developed to push certain functions to the access layer where a network is often the most vulnerable or where it provides the closest point to the end user and thus the best place to apply certain logic and policies to application traffic. To function properly, they require layer 3 or upper layer information. They inspect the packet header or payload inside the Ethernet frame. These features may be necessary to translate your IPv4 network functionality to IPv6. While these features do not necessarily qualify the device as a layer 3 "switch" or an IPv6 router per se, they do act on more than just the Ethernet frame.

There is also the IP management interface on the switch, although I expect most networks will be dual stacked for the foreseeable future and will not abandon their IPv4 management interfaces, at least not until they can get their management systems to catch up.

The aforementioned features may not be things you are doing now, but you never know when you will. Security requirements and hardening guidelines are recommending things like DAI, DHCP Snooping and ACLs at the access layer. The more streaming video gets moved to IP networks, the more the need for multicast, and MLD Snooping is necessary to improve performance. Finally, the continued convergence of voice, video and other rich media and interactive applications to IP networks is furthering the need for QoS, and it is always best to mark traffic as close to the edge as possible.

So don't forget about your switches. A thorough IPv6 readiness assessment must consider the entire network, end to end, and everything in between.

Note: The previous list was off the top of my head and by no means all inclusive. I would welcome any comments that would help to compile a complete list.

By Dan Campbell, President, Millennia Systems, Inc.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Comments

I've personally had issues with switches behaving By Chip Marshall  –  Jul 25, 2012 8:45 am PDT

I've personally had issues with switches behaving badly with IPv6. Strange issues where the switch wouldn't pass any IPv6 traffic until it had a v6 management interface, or was blocking all IPv6 multicast traffic until IPv4 IGMP snooping was disabled.

Definitely should be lab tested before deployment!

Add Your Comments

 To post your comments, please login or create an account.

Related

Topics

Cybersecurity

Sponsored byVerisign

Brand Protection

Sponsored byAppdetex

Cybercrime

Sponsored byThreat Intelligence Platform

DNS Security

Sponsored byAfilias

Whois

Sponsored byWhoisXML API

New TLDs

Sponsored byAfilias

Domain Names

Sponsored byVerisign