438Understanding IPv6, Second Edition

6.A Teredo client has the address 2001::62C3:1B8D:346B:EBC9:7C94:EA26. Is this client behind a cone NAT or a restricted NAT? What is the public IPv4 address of its Teredo server? What is the external IPv4 address and UDP port number for this Teredo client’s Teredo traffic?

This client is behind a restricted NAT. (The Cone flag is set to 0 in fifth block.)

The public IPv4 address of the Teredo server is 98.195.27.141 (decimal representation of 62C3:1B8D).

The external IPv4 address for this Teredo client’s Teredo traffic is 131.107.21.217 (dotted decimal representation of 7C94:EA26 XOR FFFF:FFFF).

The external UDP port for this Teredo client’s Teredo traffic is 5174 (decimal representation of EBC9 XOR FFFF).

7.How does a Teredo client determine the external IPv4 address and UDP port number for its traffic during the Teredo address configuration process?

The incoming Router Advertisement message to the Teredo client from the Teredo server includes the Origin indicator, which contains the external IPv4 address and UDP port number of the Router Solicitation message that the Teredo server received from the Teredo client.

8.Initial communication between two Teredo clients in different sites when both Teredo clients are behind restricted NATs requires four more packets than when both Teredo clients are behind cone NATs. What is the purpose of these four additional packets?

The four additional packets create the source-specific NAT mappings that are needed by the restricted NATs to forward incoming traffic to the Teredo clients.

9.How does a Teredo client determine the public IPv4 address of the Teredo relay when initiating communication to a host on the IPv6 Internet?

From the Echo Reply message forwarded to the Teredo client by the Teredo relay.

Chapter 15: IPv6 Security Considerations

1.Without support for SEcure Neighbor Discovery (SEND) or DHCP message authentication, what can you do to help prevent unauthorized intranet hosts from obtaining an IPv6 address and configuration?

Use IEEE 802.1X authentication for all computers that are connecting to your network with wired or wireless connections.

2.Why are IPv6 addresses with EUI-64–based interface IDs more vulnerable to address scans than addresses with randomly derived interface IDs?

Because with EUI-64–based interface IDs, the first 24 bits are the well-known manufacturer IDs of network adapter vendors and the next 16 bits are set to FF-FE. Therefore,

40 bits of an interface ID can be determined and address scans must scan up to 224 combinations for each manufacturer ID. With randomly derived interface IDs, none of the bits of an interface ID can be determined and address scans must scan up to

264 combinations.

3.Will a port scan be able to detect a server service on a host even when a host-based stateful firewall is running?

Yes. To allow unsolicited incoming traffic, a server service on the host must instruct the host-based firewall to open the port.

4.What is the recommended configuration for exchanging IPv6 traffic between an intranet and the IPv6 Internet?

Upgrade your edge firewall between your intranet and the IPv6 Internet to support stateful IPv6 firewalling.

Chapter 16: Deploying IPv6

1.What is the value of deploying IPv6 on an intranet for which most of the hosts run Windows Server 2003 or Windows XP with Service Pack 2?

Even though many of the built-in applications and services in Windows Server 2003 and Windows XP with Service Pack 2 do not operate over IPv6, you can gain valuable experience in deploying IPv6 connectivity and name resolution and can begin migrating and testing your custom applications to support IPv6.

2.What types of applications must be migrated for IPv6 support and why? Do they need to be migrated before you begin deploying IPv6?

The types of applications that must be migrated are those that use IPv4-specific application programming interfaces (APIs) and have IPv4-specific code for IPv4 addresses and subnet masks.

No. You can begin migrating them to operate over either IPv4 or IPv6 before you deploy IPv6.

3.How do you determine the boundaries of IPv6 subnets?

You can define your subnet boundaries to be the same as your IPv4 subnet boundaries. Alternately, you can use your switching and router infrastructure to define larger subnets for IPv6 traffic.

4.Why is ISATAP the automatic tunneling technology supplied with Windows that is most suitable for intranet deployment?

ISATAP was specifically designed as a host-to-host and host-to-router tunneling technology for connectivity across an IPv4-only intranet, rather than across the IPv4 Internet.

440Understanding IPv6, Second Edition

5.A user on an ISATAP host calls her help desk because she is unable to receive a live media presentation that is being multicast over IPv6. What is the most likely problem and its solution?

ISATAP does not support IPv6 multicast. To solve this problem, send the live media presentation over IPv4.

6.Why is DHCPv6 an optional and technically unnecessary technology to deploy on an intranet that is using both IPv4 and IPv6?

IPv6/IPv4 nodes can continue to use DHCP to obtain additional configuration settings, such as the addresses of DNS servers and DNS domain names. IPv6 hosts can be configured with address prefixes and default gateways with stateless address autoconfiguration.

7.Two different sites of an organization’s intranet have deployed a native IPv6 routing infrastructure serving their individual sites. How would you connect these two IPv6capable portions of the intranet together across an IPv4-only infrastructure?

You can use a manually configured tunnel between two IPv6 routers in the two sites.