376 Understanding IPv6, Second Edition

For more information about configuring a computer running Windows Server 2008 or Windows Vista as an ISATAP router, see Chapter 12. For the details of deploying an ISATAP infrastructure, see the Intra-site Automatic Tunnel Addressing Protocol Deployment Guide at http://www.microsoft.com/ipv6.

Upgrade IPv4-Only Hosts to IPv6/IPv4 Hosts

Intranet hosts must be upgraded to use a dual IP layer or dual IP stack architecture and a DNS resolver that can process DNS query results containing both IPv4 and IPv6 addresses. For hosts running Windows Server 2003 or Windows XP with Service Pack 1 or later, you can do one of the following:

■Install the Microsoft TCP/IP version 6 protocol component from the Network Connections folder or from a command prompt with the netsh interface ipv6 install command.

■Upgrade computers running Windows XP with Service Pack 1 or later with Windows Vista. Upgrade computers running Windows Server 2003 with Windows Server 2008.

As described in the “Platform Support for IPv6” section earlier in this chapter, IPv6/IPv4 hosts running Windows Server 2003 or Windows XP have limited built-in network application support for IPv6.

With an ISATAP infrastructure in place, Windows-based IPv6/IPv4 hosts will determine the IPv4 address of the appropriate ISATAP router, automatically configure global or unique local ISATAP addresses based on the advertised prefixes, and register those addresses in DNS. They can then begin communicating with other ISATAP hosts.

Begin Deploying a Native IPv6 Infrastructure

Determining when to begin deploying a native IPv6 infrastructure depends on when your IT department is ready to begin handling operation and management of a dual IPv4 and IPv6 network and when you want to begin using IPv6 native traffic for your applications. You can measure where and when to deploy IPv6 capability on portions of your intranet by analyzing ISATAP-encapsulated traffic patterns and usage.

For unicast IPv6 traffic, see the documentation for your routers for information about how to do the following:

■Enable IPv6 unicast forwarding.

■Enable IPv6 unicast advertising.

■Configure route prefixes for each native IPv6 subnet.

■Enable and configure your chosen IPv6 unicast routing protocol.

To use a computer running Windows Server 2008 or Windows Vista as a static unicast IPv6 router, use commands in the netsh interface ipv6 context to enable unicast forwarding and

advertising and configure route prefixes for each native IPv6 subnet and other routes as needed to provide the appropriate IPv6 connectivity. For more information, see Chapter 10.

For multicast IPv6 traffic, see the documentation for your routers for information about how to do the following:

■Enable IPv6 multicast forwarding.

■Enable and configure your chosen IPv6 multicast routing protocol.

As IPv4-only routers are configured to also support native IPv6 traffic, there will be portions of your network that are IPv4-only and portions that are IPv6-capable. Coordinate the rollout of IPv6 capability with your ISATAP deployment so that when a portion of your network that is served by an ISATAP router is converted, the ISATAP router can be removed. For example, if there is a site of your organization that uses its own ISATAP router and the entire site is converted to be IPv6-capable, remove the A record for that ISATAP router and then remove the ISATAP router. IPv6/IPv4 hosts in the site will no longer use ISATAP and will use IPv6 native traffic exclusively.

During the rollout of IPv6 capability across your network, the following types of communications exist:

■Communication between IPv6 hosts on the IPv6-capable portion of your intranet is native IPv6 traffic that flows across IPv6-capable routers.

■Communication between ISATAP hosts on the ISATAP-deployed portions of your intranet is tunneled IPv6 traffic that either is sent directly between ISATAP hosts (when the hosts are on the same ISATAP logical subnet) or flows through one or more ISATAP routers (when the hosts are on different ISATAP logical subnets).

■Communication between IPv6 hosts on the IPv6-capable portion of your intranet and an ISATAP host is native IPv6 traffic on the IPv6-capable portion of your intranet and tunneled IPv6 traffic on the ISATAP-deployed portions of your intranet.

For infrastructure servers running Windows Server 2008, such as DNS or DHCPv6 servers, disable randomized interface identifiers (IDs) with the netsh interface ipv6 set global randomizeidentifiers=disabled command. With randomized interface IDs enabled, Windows Server 2008 generates a new randomized interface ID each time Windows Server 2008 is installed, which can create incorrect AAAA entries in DNS. With randomized interface IDs disabled, Windows Server 2008 uses Extended Unique Identifier (EUI)-64-based interface IDs, which remain the same if Windows Server 2008 is reinstalled.

Coincident with the rollout of native unicast IPv6 capability on your intranet is the optional rollout of DHCPv6. To deploy a DHCPv6 infrastructure, you must do the following:

■Set up DHCPv6 servers, and configure them with IPv6 configuration settings and, if needed, IPv6 subnet prefixes.

378Understanding IPv6, Second Edition

■Set up a DHCPv6 relay agent for each IPv6 subnet, and configure them with the IPv6 addresses of your DHCPv6 servers. For your routers, update or upgrade the routers as needed and configure the DHCPv6 relay agent. You can also use a computer running Windows Server 2008 and Routing and Remote Access as a DHCPv6 relay agent.

■Configure your IPv6 routers to advertise the M and O flags with the appropriate values, depending on whether you are using DHCPv6 stateless or stateful modes of operation.

Computers running Windows Server 2008 or Windows Vista require no additional configuration as DHCPv6 clients. They perform DHCPv6 stateless or stateful operation based on the M and O flags in received router advertisements.

Connect Portions of Your Intranet over the IPv4 Internet

To connect different portions of your intranet across the IPv4 Internet, you can configure the following:

■6to4 with IPsec protection of 6to4-tunneled traffic

■Site-to-site virtual private network (VPN) connections

6to4 with IPsec Protection of 6to4-tunneled Traffic

As described in the “Tunnel-Based IPv6 Connectivity” section earlier in this chapter, 6to4 provides automatic tunneling of IPv6 packets between 6to4 sites and the IPv6 Internet across the IPv4 Internet, but it does not provide any protection of those packets. 6to4-tunneled private traffic sent unprotected across the IPv6 Internet can be easily interpreted by malicious intermediate hosts. If you must use 6to4, protect the 6to4-tunneled traffic between organization sites with IPsec and encryption.

For 6to4 routers running Windows Server 2008 or Windows Vista, you must configure connection security rules or IPsec policies for protocol 41 traffic between the IPv4 addresses of your 6to4 routers. For 6to4 routers that are not running Windows Server 2008 or Windows Vista, see the router documentation for information about how to configure the equivalent IPsec protection.

Site-to-Site VPN Connections

The preferred method to send private intranet data across the IPv4 intranet is with a site-to- site VPN connection between site edge routers. The site-to-site VPN connection provides encapsulation and encryption for intranet packets. If your edge routers are running Windows Server 2008, you can send the following types of traffic over the site-to-site VPN connection:

■Tunneled IPv6 traffic You can send tunneled IPv6 traffic over a site-to-site VPN connection that uses the Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol with IPsec (L2TP/IPsec). You can also use edge routers running Windows Server 2003.