■Native IPv6 traffic You can send native IPv6 traffic over a site-to-site VPN connection that uses L2TP/IPsec. Edge routers running Windows Server 2003 do not support the forwarding of native IPv6 traffic over a site-to-site VPN connection.

For the details of creating a site-to-site VPN connection with PPTP or L2TP/IPsec, see Windows Server 2008 Networking and Network Access Protection (NAP) by Joseph Davies and Tony Northrup (Microsoft Press, 2008).

If your edge routers are not running Windows Server 2008 or Windows Server 2003, see the router documentation for information about how they support IPv6 tunneled or IPv6 native traffic over site-to-site VPN connections.

Connect Portions of Your Intranet over the IPv6 Internet

To connect different portions of your intranet across the IPv6 Internet, you can also use site- to-site VPN connections. If your edge routers are running Windows Server 2008, you can send native IPv6 traffic over a site-to-site VPN connection that uses L2TP/IPsec. Edge routers running Windows Server 2003 do not support the forwarding of native IPv6 traffic over

a site-to-site VPN connection.

For the details of creating a site-to-site VPN connection with L2TP/IPsec, see the Windows Server 2008 Networking and Network Access Protection (NAP) book from Microsoft Press.

If your edge routers are not running Windows Server 2008, see the router documentation for information about how they support IPv6 native traffic over site-to-site VPN connections.

Summary

It is possible to deploy IPv6 connectivity on your IPv4-only intranet today with minimal cost and investment. Before you start this process, consider the following:

■Security Ensure that your edge routers and firewalls can block IPv6 traffic for the initial deployment. Ensure that packet inspection and tunneling technologies can be enabled later on your edge routers and firewalls.

■DNS infrastructure support Ensure that your DNS servers can store AAAA records and support DNS dynamic updates for AAAA records.

for prioritized delivery of native IPv6 traffic.

380 Understanding IPv6, Second Edition

When deploying IPv6 on your IPv4-only intranet, first set up an IPv6 test network to gain hands-on experience. Then begin to inventory your applications and plan for the migration of your applications that currently use only IPv4. Configure your DNS infrastructure to support IPv6 AAAA and PTR records and dynamic updates. If you want to start with tunnel-based IPv6 connectivity, deploy an ISATAP infrastructure. Begin upgrading or configuring your IPv4-only hosts to become IPv6/IPv4 hosts. Begin deploying a native IPv6 infrastructure. Eventually, the native IPv6 infrastructure will encompass your entire intranet and you can disable ISATAP. Optionally, you can create protected connections between the sites of your organization across the IPv4 or IPv6 Internet.

References

The following references were cited in this chapter:

■RFC 4193 — “Unique Local IPv6 Unicast Addresses”

■Internet Draft — “IPv6 Unicast Address Assignment Considerations”

You can obtain this RFC and this Internet draft from the \RFCs_and_Drafts folder on the companion CD-ROM or from http://www.ietf.org/rfc.html and http://www.ietf.org/ html.charters/v6ops-charter.html.

Testing for Understanding

To test your understanding of an IPv6 deployment, answer the following questions. See Appendix D, “Testing for Understanding Answers,” to check your answers.

1.What is the value of deploying IPv6 on an intranet for which most of the hosts run Windows Server 2003 or Windows XP with Service Pack 2?

2.What types of applications must be migrated for IPv6 support and why? Do they need to be migrated before you begin deploying IPv6?

3.How do you determine the boundaries of IPv6 subnets?

4.Why is ISATAP the automatic tunneling technology supplied with Windows that is most suitable for intranet deployment?

5.A user on an ISATAP host calls her help desk because she is unable to receive a live media presentation that is being multicast over IPv6. What is the most likely problem and its solution?

6.Why is DHCPv6 an optional and technically unnecessary technology to deploy on an intranet that is using both IPv4 and IPv6?

7.Two different sites of an organization’s intranet have deployed a native IPv6 routing infrastructure serving their individual sites. How would you connect these two IPv6capable portions of the intranet together across an IPv4-only infrastructure?