IPv6 deployment "howto"
Hi, I'm looking for some assistance on deploying IPv6. I'm currently using FreeRADIUS Version 1.1.6. I have for testing a Cisco 3640 running C3640-IK9S-M. The cisco has properly routable IPv6 addresses on its Ethernet and Loopback. I currently allow clients to dial to this device using the E1 (ISDN-PRI) and with 30 mica modems. Currently - I issue IPv4 addresses to clients and all is working well. I run MySQL as the admin backend to FreeRadius - ie thats where my clients info is stored. Usually - a client will be given a dynamic IPv4 address from a local pool of addresses configured on the Cisco... some (very few - but importaint) clients have static addresses (ie - for pre-defined holes in their company firewalls - etc). I'd like to also be able to provide dialup clients with IPv6 addresses - in addition to any IPv4 address. I think that I'd like to have a pool of IPv6 addresses on the cisco and to be able to provide clients with a /64 block (might look at a /60 or /56 one day). To do this in IPv4 - I send 255.255.255.254 to the NAS/Cisco. So whats the IPv6 equivalent? I expect to stay with FreeRADIUS Version 1.1.6 for now and understand that packets between the NAS and Radius will be via IPv4. Thats fine - though one day I think I expect to see FreeRadius listening on both IPv4 and IPv6 at the same time. The WIKI has little to say on IPv6 - except that IPv6 support is better on FreeRadius2.0 - but IPv6 attributes can be supplied from pre-2.0 versions of freeRadius. So - can anyone help me please? What magic lines would I need to add to my Cisco and what magic to add to FreeRadius? Anyone have Dialup clients being issued IPv6 addresses yet? 1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static IPv6 address or to signify the NAS to use a Dynamic address) 2 - I expect the "authorize_check_query" and other SQL queries to change a bit... ie return IPv6 data - without breaking IPv4 only NAS's 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco. just need a little help...? Someone must have done this already! -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje@posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496
Mark J Elkins wrote:
I'm looking for some assistance on deploying IPv6. I'm currently using FreeRADIUS Version 1.1.6. I have for testing a Cisco 3640 running C3640-IK9S-M. The cisco has properly routable IPv6 addresses on its Ethernet and Loopback.
Version 1.1.6 doesn't support IPv6.
I think that I'd like to have a pool of IPv6 addresses on the cisco and to be able to provide clients with a /64 block (might look at a /60 or /56 one day). To do this in IPv4 - I send 255.255.255.254 to the NAS/Cisco. So whats the IPv6 equivalent?
I don't think there is one. See the Cisco documentation for more. Address allocation in IPv6 is very different from IPv4.
I expect to stay with FreeRADIUS Version 1.1.6 for now and understand that packets between the NAS and Radius will be via IPv4. Thats fine - though one day I think I expect to see FreeRadius listening on both IPv4 and IPv6 at the same time.
Version 2.0 will support IPv6.
What magic lines would I need to add to my Cisco and what magic to add to FreeRadius? Anyone have Dialup clients being issued IPv6 addresses yet?
1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static IPv6 address or to signify the NAS to use a Dynamic address) 2 - I expect the "authorize_check_query" and other SQL queries to change a bit... ie return IPv6 data - without breaking IPv4 only NAS's 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco.
There's Framed-IPv6-prefix, where you can assign Ip's to a client. Alan DeKok.
What magic lines would I need to add to my Cisco and what magic to add to FreeRadius? Anyone have Dialup clients being issued IPv6 addresses yet?
1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static IPv6 address or to signify the NAS to use a Dynamic address) 2 - I expect the "authorize_check_query" and other SQL queries to change a bit... ie return IPv6 data - without breaking IPv4 only NAS's 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco.
There's Framed-IPv6-prefix, where you can assign Ip's to a client.
I do it with: cisco-avpair = "ipv6:route#1=2001:dead:beef::/64" I do not use dynamic allocation. Cheers Matthias -- Matthias Cramer / mc322-ripe System & Network Manager Interway Communication GmbH Phone +41 43 500 1111 Josefstrasse 225 Fax +41 44 271 3535 CH-8005 Zürich http://www.interway.ch/ GnuPG 1024D/2D208250 = DBC6 65B6 7083 1029 781E 3959 B62F DF1C 2D20 8250
Alan DeKok wrote:
Mark J Elkins wrote:
I'm looking for some assistance on deploying IPv6. I'm currently using FreeRADIUS Version 1.1.6. I have for testing a Cisco 3640 running C3640-IK9S-M. The cisco has properly routable IPv6 addresses on its Ethernet and Loopback.
Version 1.1.6 doesn't support IPv6.
From the Wiki... http://wiki.freeradius.org/index.php/FAQ#Does_FreeRADIUS_Support_IPv6.3F
"FreeRADIUS 1.1.x does not particularly care if the host it runs on is dual-stack. It will work just fine, but only use the IPv4 stack of the machine. It will also transport IPv6 RADIUS attributes just fine but will NOT send packets over IPv6." My reading of this is that I can use FreeRADIUS 1.1.6 to store and transport IPv6 Radius attributes.... so I can use 1.1.6 ???
I think that I'd like to have a pool of IPv6 addresses on the cisco and to be able to provide clients with a /64 block (might look at a /60 or /56 one day). To do this in IPv4 - I send 255.255.255.254 to the NAS/Cisco. So whats the IPv6 equivalent?
I don't think there is one. See the Cisco documentation for more.
I guess you have no pointers as to exactly where..? I've already been reading Cisco stuff for hours...
Address allocation in IPv6 is very different from IPv4.
I expect to stay with FreeRADIUS Version 1.1.6 for now and understand that packets between the NAS and Radius will be via IPv4. Thats fine - though one day I think I expect to see FreeRadius listening on both IPv4 and IPv6 at the same time.
Version 2.0 will support IPv6.
What magic lines would I need to add to my Cisco and what magic to add to FreeRadius? Anyone have Dialup clients being issued IPv6 addresses yet?
1 - I expect to add some sort of IPv6 field to MySQL (ie - for a static IPv6 address or to signify the NAS to use a Dynamic address) 2 - I expect the "authorize_check_query" and other SQL queries to change a bit... ie return IPv6 data - without breaking IPv4 only NAS's 3 - I expect to add an IPv6 pool and other lines of magic to my Cisco.
There's Framed-IPv6-prefix, where you can assign Ip's to a client.
I think this is for static allocations only.
From my limited experience, rfc3162 seems to suggest using "Login-IPv6-Host" as a trigger? Login-IPv6-Host=0 - use an address from the local pool, Login-IPv6-Host="all 'F'" - use the address that the user wants Anything else - the address to assign.
No idea if this is implemented though...
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje@posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496
Mark J Elkins wrote:
My reading of this is that I can use FreeRADIUS 1.1.6 to store and transport IPv6 Radius attributes.... so I can use 1.1.6 ???
Yes.
There's Framed-IPv6-prefix, where you can assign Ip's to a client.
I think this is for static allocations only.
I don't know what you mean by that. The Access-Accept can contain an IPv6 prefix. The prefix is valid only for as long as the session is active. It is NOT a permanently allocated static IP.
From my limited experience, rfc3162 seems to suggest using "Login-IPv6-Host" as a trigger?
No. This is for connecting the user to a machine. It is not for assigning an IP address to a machine. See Login-Service, and Login-TCP-Port. The Login-* attributes are about connecting a dial-in user directly to an <ip/port> pair. Alan DeKok.
participants (3)
-
Alan DeKok -
Mark J Elkins -
Matthias Cramer