HP 635n HP Jetdirect Print Servers - Practical IPv6 Deployment for Printing an - Page 28

IPv6 Discovery, Attacks, and Mitigations

Page 28 highlights

It is also important to recognize there may be key services on the network that must be dual stack (or IPv6 only) when moving a subnet over to IPv6 only. As an example, domain controllers, http proxies, recursive DNS servers, etc... all have to be accessible over IPv6. Refer to Figure 19 - IPv6 Only Subnet Figure 19 - IPv6 Only Subnet Here we have created an IPv6 only subnet. Notice that the server subnet all needs to be dual stack and be accessible over IPv6 for this process to be successful. At this point, various applications can be deployed in the IPv6 only subnet (as well as communicate with the IPv6 only subnet remotely) to see how they react. IPv6 Discovery, Attacks, and Mitigations So now we have IPv6 only subnets. What are some of the things we should worry about? Discovery: Unicast One of the ways to highlight some concerns over IPv6-only network deployments is to first talk about an IPv4 only network. Here is a scenario Web Jetadmin administrator working on an IPv4 only network: I am a Web Jetadmin administrator responsible for a network of 100 subnets. Anytime someone installs a printer or MFP on the network, I want to find this device in a reasonable amount of time and put the necessary configurations on it for our network. Every night from 10pm to 2am, except Saturday and Sunday, I configure a network discovery using IP ranges. Each range has 20 subnets and there are 250 usable IPv4 addresses per subnet (/24). I configure 5 ranges total and schedule the discovery, which iteratively goes through each usable IPv4 address with a unicast packet, waits 28

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37

28
It is also important to recognize there may be key services on the network that
must
be dual stack (or
IPv6 only) when moving a subnet over to IPv6 only. As an example, domain controllers, http proxies,
recursive DNS servers, etc… all have to be accessible over IPv6.
Refer to Figure 19 – IPv6 Only Subnet
Figure 19 - IPv6 Only Subnet
Here we have created an IPv6 only subnet.
Notice that the server subnet all needs to be dual stack
and be accessible over IPv6 for this process to be successful. At this point, various applications can
be deployed in the IPv6 only subnet (as well as communicate with the IPv6 only subnet remotely) to
see how they react.
IPv6 Discovery, Attacks, and Mitigations
So now we have IPv6 only subnets. What are some of the things we should worry about?
Discovery: Unicast
One of the ways to highlight some concerns over IPv6-only network deployments is to first talk about
an IPv4 only network.
Here is a scenario Web Jetadmin administrator working on an IPv4 only
network:
I am a Web Jetadmin administrator responsible for a network of 100 subnets.
Anytime someone
installs a printer or MFP on the network, I want to find this device in a reasonable amount of time
and put the necessary configurations on it for our network.
Every night from 10pm to 2am, except
Saturday and Sunday, I configure a network discovery using IP ranges.
Each range has 20 subnets
and there are 250 usable IPv4 addresses per subnet (/24).
I configure 5 ranges total and schedule
the discovery, which iteratively goes through each usable IPv4 address with a unicast packet, waits