To implement the “2024 Work Plan for Deepening the Large-Scale Deployment and Application of IPv6” issued by the Central Cyberspace Affairs Commission, the National Development and Reform Commission, and the Ministry of Industry and Information Technology, and to promote the early activation of IPv6 for internet access in various levels of party and government organs, public institutions, and state-owned enterprises in our city, the Chongqing Municipal Internet Information Office has organized the compilation of the “Internet Office Network IPv6 Transformation Guide (1.0)” to provide references for the IPv6 transformation of office networks in various units.
Table of Contents
Chapter 1 Overview
1.1 Policy Background
1.2 Basic Principles
Chapter 2 Basic Structure of the Internet Office Network
2.1 Basic Structure of the Internet System
2.2 Typical Networking Topology of Office Networks
Chapter 3 IPv6 Function Detection of Internet Office Networks
3.1 IPv6 Detection Process for Office Networks
3.2 Terminal Detection
3.3 Detection of Interfaces Provided by Operators
3.4 Firewall Detection
3.5 Router Detection
3.6 Switch Detection
Chapter 4 IPv6 Upgrade Plan for Office Networks
4.1 IPv6 Address Planning
4.2 VLAN Planning
4.3 Main Device Configuration Reference
4.4 Implementation Steps
4.5 Acceptance Testing
Chapter 5 Common Problems and Solutions
Thanks
Chapter 1 Overview
With the rapid development of the global internet and the continuous advancement of network technology, the sixth version of the internet protocol (IPv6) as the next-generation network protocol not only provides almost unlimited resources of IP addresses but also supports more efficient network configuration, more secure network connections, and broader heterogeneous network access. Given the exhaustion of IPv4 address resources, the deployment and application of IPv6 have become an urgent need for internet users across society, including individuals, families, units, and enterprises.
This guide targets typical office networks, providing a comprehensive framework for IPv6 transformation, helping users assess the current network status based on the existing office network architecture and mainstream terminal devices, and providing practical references during the IPv6 upgrade process to achieve a smooth transition to IPv6 with minimal impact on existing operations.
This guide focuses on common internet office network environments, providing examples based on widely used network devices and their operating interfaces to guide users in IPv6 network status assessment, configuration, and upgrade. For special network architectures or special devices, it is recommended to seek professional technical support and customized solutions.
1.1 Policy Background
The General Office of the CPC Central Committee and the General Office of the State Council issued the “Action Plan for Promoting the Large-Scale Deployment of Internet Protocol Version 6 (IPv6)” in 2017. The Central Cyberspace Affairs Commission, the National Development and Reform Commission, and the Ministry of Industry and Information Technology issued the “Notice on Accelerating the Promotion of Large-Scale Deployment and Application of Internet Protocol Version 6 (IPv6)” in 2021. All regions and departments have earnestly implemented this according to their actual situations, accelerating the promotion of internet upgrades and evolution, and achieving significant progress in IPv6 deployment and application.
The Central Cyberspace Affairs Commission, the National Development and Reform Commission, and the Ministry of Industry and Information Technology issued the “2024 Work Plan for Deepening the Large-Scale Deployment and Application of IPv6,” which clarifies the development goals for the IPv6 transformation and upgrade of internet office networks in party and government organs and requires the demonstration to lead all social enterprises and institutions to actively use IPv6.
1.2 Basic Principles
Given that the evolution of IPv6 networks is a long-term process and that IPv4 networks are still widely used, considering factors such as comprehensive business operations and transformation costs, this guide proposes the following basic principles:
(1) Dual-stack priority. The network transformation should generally adopt a dual-stack approach of IPv4/IPv6, encouraging users with conditions to adopt a single-stack approach of IPv6.
(2) Minimal changes. Network transformation should be based on existing devices and networks, making as few changes to the network architecture and minimal device replacements as possible.
(3) Safe and stable. Network transformation should be planned uniformly, adapted to local conditions, implemented in phases, and ensure safety and stability, with infrastructure as a priority, gradually transforming terminals and applications, ensuring smooth business transition.
Chapter 2 Basic Structure of the Internet Office Network
2.1 Basic Structure of the Internet System
Figure 2-1 Basic Structure of the Internet System
The internet system can be divided into three parts: the user access side, the operator network, and the internet. The user access side is divided into office networks, home networks, and wireless networks based on user scenarios. This guide focuses on the detection and transformation of IPv6 in typical office networks.
2.2 Typical Networking Topology of Office Networks
Office networks generally consist of entry and exit devices, aggregation layer devices, access layer devices, and various terminals. Network devices generally include firewalls, routers, and layer 2/3 switches, while terminals generally include office computers, mobile phones, tablets, etc. The following is a typical office network structure:
Figure 2-2 Basic Structure of the Internet System
Legend:
① Operator provided interface, generally fiber optic dedicated line.
② Entry and exit devices, generally firewalls, exit routers, layer 3 switches, etc.
③ Aggregation layer devices, generally routers, layer 3 switches, etc.
④ Access layer devices, generally layer 2 access switches, wireless APs, etc.
⑤ Various terminals, generally including office computers, mobile phones, tablets, etc.
Chapter 3 IPv6 Function Detection of Internet Office Networks
3.1 IPv6 Detection Process for Office Networks
Before upgrading and transforming the office network to IPv6, it is necessary to first detect whether the office network supports IPv6. Different levels of devices need to have corresponding IPv6 functions:
Note: Units/enterprise users should combine their office network structure and gradually detect according to the functional requirements in the above table.
Figure 3-1 Detection Process Diagram
Explanation:This detection process only verifies whether the device supports the IPv6 protocol and validates it by configuring the IPv6 address. Further detection of IPv6-related functions is required.
3.2 Terminal Detection
Connect the terminal to the office network and check whether it supports the IPv6 protocol and can access IPv6 websites.
3.2.1 Fixed Terminal Detection
(1) For computer terminals, open the network card settings and check if there is an IPv6 protocol stack – “Internet Protocol Version 6 (TCP/IP6)” (using Windows and Tongxin UOS as examples). The network card settings for Windows and Tongxin UOS are shown in the following images:
(2) By running the command ipconfig /all or the Ping command, check whether a public IPv6 address has been obtained, or access IPv6 protocol-supported websites (such as test-IPv6.com, ipw.cn) for testing.
① The detection results for support are as follows:
Running the command ipconfig /all, check if the fixed terminal has obtained a public IPv6 address, gateway, and DNS server. The running screenshot is as follows:
For websites supporting IPv6, running the Ping command can resolve the DNS domain name to an IPv6 address and can Ping successfully. The running screenshot is as follows:
Accessing test-IPv6.com, IPv6 connection tests pass; accessing ipw.cn shows IPv6 status is normal. The detection screenshots are as follows:
By opening an IPv6 website in the browser, you can check that the remote address is an IPv6 address (verification method: open the browser to visit the webpage, then press F12, and refresh the page by pressing F5, randomly locate a directory file, and check the 【network】 section in the 【header】 properties for the 【remote address】); the webpage screenshot is as follows:
② The detection results for non-support are as follows:
Running the command ipconfig /all, the fixed terminal can only obtain IPv4 addresses, gateways, and DNS servers. The running screenshot is as follows:
Accessing test-IPv6.com, the IPv6 connection test fails; accessing ipw.cn shows that it is accessed via IPv4. The detection screenshot is as follows:
3.3.2 Mobile Terminal Detection
Current smart mobile terminals generally support the IPv6 protocol by default. By turning on the wireless LAN and joining the office network, check whether an IPv6 address is obtained (using mainstream smart mobile terminal devices as examples).
Android/HarmonyOS terminals: Settings – About Phone – Status Information.
iOS terminals: Settings – Wireless LAN – Click on the “ⓘ” next to the joined office network – Scroll down to the bottom.
① The detection results for support are as follows:
Mobile terminals can normally obtain public IPv6 addresses. Screenshots for Android/HarmonyOS terminals and iOS terminals are as follows:
Accessing test-IPv6.com, IPv6 connection tests pass; accessing ipw.cn shows IPv6 status is normal. The detection screenshots are as follows:
② The detection results for non-support are as follows:
Mobile terminals can only obtain IPv4 addresses and cannot obtain public IPv6 addresses. Screenshots for Android/HarmonyOS user interface and iOS user interface are as follows:
Accessing test-IPv6.com, the IPv6 connection test fails; accessing ipw.cn shows that it is accessed via IPv4. The detection screenshot is as follows:
3.3 Detection of Interfaces Provided by Operators
At the internet office network exit, use a laptop to directly connect to the interface link provided by the operator, configure the IPv6 address assigned by the operator on the network card or obtain the IPv6 address through dial-up, then ping the IPv6 gateway address provided by the operator and access IPv6 protocol-supported websites (such as test-IPv6.com, ipw.cn). If access is successful, it indicates that the operator-provided IPv6 interface link and address resources are normal.
① The detection results for support are as follows:
After configuring the computer to the IPv6 address provided by the operator, it can successfully ping the opposite end’s IPv6 address. The running screenshot is as follows:
The computer accesses test-IPv6.com, and all IPv6 connection tests pass; accessing ipw.cn shows that IPv6 status is normal. The detection screenshots are as follows:
② The detection results for non-support are as follows:
After configuring the computer to the IPv6 address provided by the operator, it cannot successfully ping the opposite end’s IPv6 address. The running screenshot is as follows:
3.4 Firewall Detection
Log in to the firewall configuration interface, open the IPv6 protocol in the global configuration, and configure an IPv6 address on any available port. If successful, it indicates that the device supports IPv6.
Taking the Huawei USG series firewall as an example, enable the IPv6 function on any port of the firewall and configure the IPv6 address.
By checking the command, it can be seen that the firewall port has been configured with an IPv6 address, indicating that the firewall supports the IPv6 protocol.
3.5 Router Detection
Log in to the router configuration interface, open the IPv6 protocol in the global configuration, and configure an IPv6 address on any available port. If successful, it indicates that the device supports IPv6.
Taking the Huawei AR series router as an example, enable the IPv6 function on any port of the router and configure the IPv6 address.
By checking the command, it can be seen that the router port has been configured with an IPv6 address, indicating that the router supports the IPv6 protocol.
3.6 Switch Detection
Log in to the switch configuration interface, open the IPv6 protocol in the global configuration, enter the VLAN interface, and configure the IPv6 address. If successful, it indicates that the device supports IPv6.
Taking the Huawei S3700 switch as an example, enable the IPv6 function on the switch and configure the IPv6 address on the VLAN port.
By checking the command, it can be seen that the VLAN port of the switch has been configured with an IPv6 address, indicating that the switch supports the IPv6 protocol.
Chapter 4 IPv6 Upgrade Plan for Office Networks
4.1 IPv6 Address Planning
During the IPv6 network transformation process, IPv6 address planning will determine the planning for interconnection with ISPs, routing planning, AS planning, NAT planning, etc., and it will also have a decisive impact on the compatibility and scalability of the network. It is the first and most important step in the IPv6 network transformation.
4.1.1 Planning Principles
(1) The division of IPv6 addresses should have a hierarchical structure to simplify the routing table. IPv6 address allocation should try to assign contiguous IP address space to each area; similar services and functions should also be allocated contiguous IP address space, which is conducive to route aggregation and security control.
(2) The allocation of IPv6 addresses needs to have sufficient flexibility and manageability, considering the needs of existing services, new types of services, and various special services, balancing short-term needs with long-term development and network expansion, and reserving corresponding address segments. From a security perspective, it is necessary to implement records and historical audits of IPv6 address allocations.
(3) Subnet address segments should be continuous to facilitate aggregation and should try to maintain a certain correspondence with the original IPv4 addresses, reserving segments for Loopback addresses.
(4) At least one IPv6 address in each subnet is recommended to be used as the gateway address for that subnet.
(5) Configure IPv6 addresses for the out-of-band management ports of various security devices, connecting them to the management switch for out-of-band management.
4.1.2 Planning Case
Generally, the IPv6 addresses we obtain are /48 or /64, from which multiple /64 address segments can be divided for providing to user terminals and various services in the office network. Terminals can automatically obtain the corresponding IPv6 addresses through configuration; a specific /64 subnet can be further divided into multiple /127 segments for providing to device link interconnection ports. For device link interconnection addresses, upstream devices use smaller IP addresses, while downstream devices use larger IP addresses; multiple /128 segments can be divided for device loopback interfaces for network management of devices.
The IPv6 business address segment allocated by the operator to enterprises is 240E:250:2814::/48. In actual use, this entire large segment needs to be further divided into smaller address segments allocated to wired and wireless terminal users within the enterprise, as well as some other IPv6 business terminals.
Wired and wireless users’ IPv4 and IPv6 gateways are deployed on the core switch, which uniformly allocates IPv4 and IPv6 addresses; for IPv6 address allocation, IPv6 stateless automatic configuration can be configured on the switch, or DHCPv6 address allocation can be used.
(1) Mainly follow four principles: uniqueness, scalability, continuity, and practicality;
(2) Device management and interconnection addresses: use the 240E:250:2814:1::0/64 subnet;
(3) Loopback address planning, using a whole segment of contiguous IP addresses, also using the 240E:250:2814:1::0/64 subnet;
(4) The IPv6 business gateway is uniformly set to the first address of the segment, i.e., ::1;
(5) After completing the IP address planning, static IP addresses can be configured, or dynamic IP address allocation can be performed using a DHCP server, depending on actual needs.
4.2 VLAN Planning
4.2.1 Planning Principles
IPv6 networking VLANs should generally reuse the IPv4 network VLANs to build dual-stack.
4.2.2 Planning Case
The business addresses are based on VLAN information, associating VLAN information with IPv6 address prefixes to construct independent IPv6 address prefixes for each VLAN, with different subnet segments allocated for different business VLANs.
For example, in the planning of VLAN 20N, the number 20N represents “Building 2, Nth Floor,” corresponding to the prefix in the user IPv6 address:
4.3 Main Device Configuration Reference
4.3.1 Basic Functions and Configuration Commands Reference
(1) Configure the global IPv6 unicast address of the interface.
The ipv6 address command is used to manually configure the global unicast address of the interface.
(2) Configure the gateway address of the interface.
The gateway command is used to configure the gateway address of the interface.
(3) Configure DNS.
The dns server command is used to configure the domain name server.
(4) Configure static routing.
The ip route-static command is used to configure unicast static routes.
The ip route-static 0.0.0.0 0.0.0.0 command is used to configure the default route.
(5) Configure DHCP services.
The dhcpv6 prefix-pool command is used to create a DHCPv6 prefix pool and enter the prefix pool view.
The prefix command is used to configure the DHCPv6 address prefix/prefix length.
The dhcpv6 pool command is used to create a DHCPv6 address pool and enter the address pool view.
The prefix-pool command is used to bind the DHCPv6 address pool with the DHCPv6 prefix pool.
The dhcpv6 pool command is used to specify the DHCPv6 address pool used under the interface.
(6) Other functions.
Use the dhcrelay command for DHCP relay configuration. If DHCPv6 is used for stateful address distribution and management, the relay command configuration needs to be done on the switch, and the address pool needs to be configured on the server.
It is important to note that DHCPv6 relay transfers the task of issuing IPv6 addresses to the DHCPv6 Server. This networking structure moves the DHCPv6 address pool from the core switch to the server, which is usually adopted in slightly larger networks.
4.4 Implementation Steps
The upgrade transformation can be divided into three phases: preparation phase, planning phase, and implementation phase. The related work contents are as follows:
4.4.1 Preparation Phase
4.4.2 Planning Phase
4.4.3 Implementation Phase
4.5 Acceptance Testing
4.5.1 Testing IPv6 Network Interconnectivity
4.5.2 Testing Terminal IPv6 Address Acquisition
4.5.3 Testing SDN Controller IPv6 Address Display
4.5.4 Testing Portal Website Access
Chapter 5 Common Problems and Solutions
5.1 Network Device Issues
(1) Insufficient IPv6 flow table on exit devices leads to lag and packet loss. Most exit devices (such as firewalls) have different performance capacities for forwarding IP traffic between IPv4 and IPv6, and the performance optimization of conventional network devices tends to support high-concurrency IPv4 traffic, which may result in fewer entries and capacity for IPv6.
Solution: Increase the flow table capacity of the device or replace it with high-performance exit network devices.
(2) Internet exit devices using ADSL dial-up links may fail to obtain IPv6 addresses due to device incompatibility, preventing IPv6 activation.
Solution: First dial through the optical modem to obtain an IPv6 address, then dynamically allocate it to internal network devices.
(3) Terminal device software versions are outdated; for example, Android 8.0, HarmonyOS 3.0, and iOS 9 and earlier versions do not support IPv6.
Solution: Update the system to the latest version using the built-in software update feature of various terminal devices.
5.2 DNS Resolution Issues
(1) DNS servers do not respond to IPv6 AAAA resolution requests, causing terminal timeouts while waiting for AAAA responses, leading to slow access issues for dual-stack IPv4 and IPv6.
Solution: Replace with DNS servers that support AAAA request responses, such as 61.128.128.68, 114.114.114.114, etc.
(2) After configuring IPv6 dual-stack on terminals, internet traffic prioritizes IPv6, which may cause link congestion due to load balancing failure.
Solution: Use policy routing, user routing, and application routing to schedule IPv4/6 traffic to achieve load balancing.
5.3 Address Allocation Issues
(1) Some Android phones do not support DHCPv6, preventing some users from obtaining IPv6 addresses.
Solution: Enable stateless IPv6 address acquisition on the user side.
(2) IPv6 routing issues may arise if an enterprise has multiple operator exit links, leading to uneven traffic load, where most traffic flows to the exit dedicated line supporting IPv6.
Solution: Configure NAT66 or IPv6 policy routing on exit devices to achieve load balancing across multiple links.
5.4 Security Issues
(1) Both IPv4 and IPv6 share common security issues, and due to the presence of specific tags and extension headers in the IPv6 protocol header, IPv6 also has unique threats and attack methods (such as RH0 attacks, flood attacks). Therefore, it is necessary to consider IPv6 security as well.
Solution: After deploying IPv6, timely adjustments to security device protection strategies are needed to avoid security incidents.
(2) After IPv6 deployment, internal hosts are directly exposed on the internet without NAT protection, requiring attention to network security protection.
Solution: Configure NAT66 on exit devices and increase IPv6 security firewall devices and policies.
5.5 Website Access Issues
(1) The “window issue” occurs when accessing IPv6 web pages with a single-stack IPv6 connection, where external links containing content from other websites that do not support IPv6 may result in partial information not displaying.
Solution: Users should use dual-stack IPv4/6 addresses to access pages; web service providers can implement IPv6 to IPv4 functionality through DNS proxy.
(2) Terminals with IPv4/6 dual-stack enabled and IPv6 addresses configured may not access the internet due to the default support for IPv6 resolution by most IPv4 DNS servers, leading to slow webpage loading.
Solution: Check the reasons for IPv6 connectivity issues to the internet, and disable the IPv6 protocol stack on user terminals until the problem is resolved.
Thanks
During the compilation of this guide, we received strong support from the following units, for which we express our sincere thanks! (In no particular order)
China Academy of Information and Communications Technology Technology and Standards Research Institute Internet Center
China Telecom Co., Ltd. Chongqing Branch
Fujian Wanwu Yilian Network Technology Co., Ltd.
Zhengzhou Muyun Electronic Technology Co., Ltd.
Attachment: “Internet Office Network IPv6 Transformation Guide (1.0)” （👈Click to download）
Source: Internet Information Chongqing
What Everyone Is Watching2024 Chongqing Cybersecurity Awareness Week | Chengdu-Chongqing Link! This “real” attack and “practical” defense cybersecurity drill has startedBe Careful! Don’t Send This Kind of Photo CasuallyGreat Job! The “Flower Dress Girl” bravely rescued someone, and it turns out she is a beauty from Chongqing
Disclaimer: Except for original content and special instructions, the text and images of the submitted articles are sourced from the internet and major mainstream media, with copyrights belonging to the original authors. If there is any infringement of content, please contact us for removal.