To prevent a host from using DNS dynamic update to create an A record with the name ISATAP, manually create ISATAP A records in your DNS domains with an unreachable IPv4 address. ISATAP hosts running Windows Server 2003 or Windows XP with Service Pack 1 or later will use the ISATAP A record to attempt to contact the ISATAP router. However, because no reply will be received, these ISATAP hosts will not have a global or unique local IPv6 address for ISATAP connectivity.

For computers running Windows Server 2008 or Windows Vista, you can also prevent ISATAP, 6to4, and Teredo traffic by configuring inbound and outbound rules in the Windows Firewall with Advanced Security snap-in. For example, you can enable the default outbound rule named Core Networking – Teredo (UDP-Out) and the default inbound rule named Core Networking – Teredo (UDP-In).

Native IPv6 Connectivity

Native IPv6 connectivity consists of the following capabilities:

■Unicast routing (required)

■Multicast routing (optional)

Unicast Routing

Native unicast IPv6 connectivity depends on the capability of your current routers. Many modern routers already support unicast IPv6 routing and just need to be configured to perform IPv6 forwarding and the advertising of subnet prefixes. For medium to large intranets, IPv6-capable routers also need to be configured with an IPv6 routing protocol to provide dynamic routing updates for the IPv6 subnets and address prefixes of the intranet. See Chapter 10, “IPv6 Routing,” for a discussion of IPv6 routing protocols. Older routers that are not IPv6-capable need to be upgraded or replaced.

A small intranet can use static IPv6 routing, but extra configuration is required to ensure that all locations on the intranet are reachable by all of the IPv6 routers. A computer running Windows Server 2008 or Windows Vista can act as a static IPv6 router.

Multicast Routing

Multicast support is required in IPv6 for neighboring node interactions on a subnet, such as address resolution and router discovery. However, forwarding of non-link-local multicast IPv6 traffic between IPv6 subnets is optional. Enabling multicast forwarding and routing on your intranet can depend on whether you are already using multicast traffic over IPv4 and eventually want to use multicast traffic over IPv6.

Native multicast IPv6 support also depends on the capability of your current set of routers. Many modern routers already support IPv4 multicast routing. However, you need to verify

370 Understanding IPv6, Second Edition

that your routers also support IPv6 multicast forwarding and a multicast routing protocol. Older routers that are not IPv6 multicast-capable need to be upgraded or replaced.

Name Resolution with DNS

For your internal DNS to provide the same level of service for IPv6-related information as it does for IPv4-related information, you need to ensure that your DNS infrastructure supports the following:

■AAAA records for IPv6 addresses

■DNS dynamic updates so that IPv6 hosts can automatically register AAAA records

Optionally, you can investigate whether your applications require PTR records. If so, ensure that your DNS infrastructure supports the following:

■PTR records in the IP6.ARPA reverse domain

■DNS dynamic updates so that IPv6 hosts can automatically register PTR records

Additionally, because Windows hosts can send their IPv6 traffic over IPv4 or IPv6, you can investigate whether you want to configure your DNS servers and Windows hosts for DNS operation over IPv6.

DHCPv6

Because the IPv6/IPv4 hosts on your intranet, whether they are located on the IPv4-only or IPv6-capable portion, will continue to use IPv4 and Dynamic Host Configuration Protocol (DHCP) to obtain configuration settings such as the IPv4 addresses of your DNS servers or the DNS name suffix for your organization, the use of DHCP for IPv6 (DHCPv6) is optional. For example, you might want to use DHCPv6 so that your hosts use stateful IPv6 addresses that can be monitored and managed or because you want to configure your IPv6 hosts on the IPv6-capable portion of your intranet so that they perform their DNS operations over IPv6.

If you use DHCPv6, consider the following:

■You can use DHCPv6 on IPv6-capable subnets only when the routing path between the DHCPv6 relay agent on the subnet and the DHCPv6 server supports the forwarding of IPv6 traffic.

■You must determine whether the IPv6 hosts on the IPv6-capable portion of your intranet will use a combination of stateless and stateful addresses, or just stateful addresses.

■You must be able to configure your IPv6 routers to advertise the Managed Address Configuration (M) and Other Stateful Configuration (O) flags with the appropriate values.

■You must configure a DHCPv6 relay agent for each IPv6 subnet and configure the relay agent with the IPv6 addresses of your DHCPv6 servers. Ensure that your routers support a DHCPv6 relay agent. The Routing and Remote Access service in Windows Server 2008 includes a DHCPv6 relay agent.

■You must determine the location and configuration of your DHCPv6 servers. You might be able to use the same server computers that are being used for DHCP. For example, the DHCP Server service in Windows Server 2008 can be configured for both DHCP operation and for DHCPv6 stateless or stateful operation.

Host-Based Security and IPv6 Traffic

As described in Chapter 15, “IPv6 Security Considerations,” providing security for IPv6 traffic for IPv6 hosts running Windows Server 2008 or Windows Vista consists of the following:

■Protection of IPv6 packets

■Host protection from scanning and attacks

■Control of what traffic is exchanged with the Internet

For cryptographic protection of IPv6 traffic, use IPsec. In Windows Server 2008 and Windows Vista, you can use the Windows Firewall with Advanced Security snap-in to configure connection security rules to specify IPsec protection for all types or specific types of native IPv6 traffic. You can also use connection security rules to protect IPv4-tunneled IPv6 traffic.

To control what types of IPv6 traffic, either tunneled or native, are allowed to travel within your intranet, you can use the following:

■Router-based firewalls Verify that your routers can perform IPv4 packet filtering (for tunneled IPv6 traffic) based on the IPv4 Protocol field and IPv6 packet filtering (for native IPv6 traffic).

■Host-based firewalls Use the built-in Windows Firewall for Windows Server 2008 and Windows Vista or an alternative that can be configured for inbound and outbound IPv4 packet filtering (for tunneled IPv6 traffic) and IPv6 packet filtering (for native IPv6 traffic).

To control what types of IPv6 traffic, either tunneled or native, are allowed to travel between your intranet and the IPv4 or IPv6 Internet, consider the following:

■Edge routers connected to the IPv4 Internet must support the filtering of IPv4 protocol 41 and UDP port 3544 traffic.

■Edge routers connected to the IPv6 Internet must support filtering of IPv6 traffic.

Additionally, investigate whether your intrusion detection systems (IDSs) include support for analyzing both native IPv6 and tunneled IPv6 traffic.

Prioritized Delivery for IPv6 Traffic

IPv6 supports prioritized delivery of IPv6 traffic through the Traffic Class and Flow Label fields. The Traffic Class field, also known as the Differentiated Services (DS) field, contains the Differentiated Services Code Point (DSCP) field, which can instruct routers to handle packets with different levels of priority. This is also referred to as Quality of Service (QoS).