Home / Blogs

IPv6: Don't Forget About Your Switches!

Dan Campbell

When preparing a network for IPv6, I often hear network administrators say that their switches are agnostic and that there is no need to worry about them. Not so fast.

Yes, LAN switches function mainly at layer 2 by forwarding Ethernet frames regardless of whether the packet inside is IPv4 or IPv6 (or even something else!) However, there are some functions on a switch that operate at layer 3 or higher. They include:

• Dynamic ARP Inspection (DAI)

• DHCP Snooping

• Multicast Listener Discovery (MLD) Snooping (the IPv6 equivalent of IGMP Snooping)

• Quality of Service (QoS) marking for upstream Differentiated Services treatment

• Access Lists (e.g., VLAN or regular ACLs).

These features were developed to push certain functions to the access layer where a network is often the most vulnerable or where it provides the closest point to the end user and thus the best place to apply certain logic and policies to application traffic. To function properly, they require layer 3 or upper layer information. They inspect the packet header or payload inside the Ethernet frame. These features may be necessary to translate your IPv4 network functionality to IPv6. While these features do not necessarily qualify the device as a layer 3 "switch" or an IPv6 router per se, they do act on more than just the Ethernet frame.

There is also the IP management interface on the switch, although I expect most networks will be dual stacked for the foreseeable future and will not abandon their IPv4 management interfaces, at least not until they can get their management systems to catch up.

The aforementioned features may not be things you are doing now, but you never know when you will. Security requirements and hardening guidelines are recommending things like DAI, DHCP Snooping and ACLs at the access layer. The more streaming video gets moved to IP networks, the more the need for multicast, and MLD Snooping is necessary to improve performance. Finally, the continued convergence of voice, video and other rich media and interactive applications to IP networks is furthering the need for QoS, and it is always best to mark traffic as close to the edge as possible.

So don't forget about your switches. A thorough IPv6 readiness assessment must consider the entire network, end to end, and everything in between.

Note: The previous list was off the top of my head and by no means all inclusive. I would welcome any comments that would help to compile a complete list.

By Dan Campbell, President, Millennia Systems, Inc.

Related topics: IPv6

WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

I've personally had issues with switches behaving Chip Marshall  –  Jul 25, 2012 7:45 AM PST

I've personally had issues with switches behaving badly with IPv6. Strange issues where the switch wouldn't pass any IPv6 traffic until it had a v6 management interface, or was blocking all IPv6 multicast traffic until IPv4 IGMP snooping was disabled.

Definitely should be lab tested before deployment!

To post comments, please login or create an account.

Related Blogs

Related News

Topics

Industry Updates – Sponsored Posts

Afilias Partners With Internet Society to Sponsor Deploy360 ION Conference Series Through 2016

Dyn Adds Chris Griffiths As New VP of Labs

New Nixu Solution Slashes Cloud Application Delivery Times from Weeks to Milliseconds

Domain Name Registrations Pass 233 Million in the First Quarter Of 2012

Nominum selected as 2012 AlwaysOn Global 250 Top Private Company

Nominum Releases New Version of Carrier-Grade DHCP Software for Telecom Providers

Nominum Survey of World's Leading ISPs Shows Nearly 60% of ISPs Plan to Roll-Out IPv6 by End of 2012

Nominum Sets New Record for Network Speed and Efficiency

Implementing a Cyber-Security Code of Conduct: Real-Life Lessons From Australia (Webinar)

Nominum and Nixu Software to Deliver Centralized DNS and DHCP Management Solution

Nixu NameSurfer 7.2 Strikes Rich at Dojo

DotConnectAfrica Participates at ICANN 43 In Costa Rica, the "Rich Coast"

Nominum Launches World's First Purpose-Built Suite of DNSā€Based Solutions for Mobile Operators

Is IPv6 the New Y2K? (Primer)

Nixu NEE Powers Location-Aware IPAM

Nixu DDI Awarded Gold Medal for Its IPv6 Support

UK Cabinet Office Looks to BlueCat Networks' Expertise and Best Practices for Securing PSN

BlueCat Networks Helps Organizations Transition to IPv6 with HP

BlueCat Networks to Host Webinar on DNS, DHCP and IPAM Featuring Independent Research Firm

IPAM and DHCPv6 Shake Hand in Nixu NameSurfer 7.1 Series

Sponsored Topics

Verisign

Security

Sponsored by
Verisign
Minds + Machines

Top-Level Domains

Sponsored by
Minds + Machines
dotMobi

Mobile

Sponsored by
dotMobi
Afilias

DNS Security

Sponsored by
Afilias