ISATAP Overview

276 Understanding IPv6, Second Edition

There is a common misconception that before you can begin experimenting with IPv6 connectivity and application migration, you must deploy native IPv6 addressing and routing, which requires a detailed analysis of IPv6 addressing schemes, router updates and configuration, and a rollout schedule. Although this should eventually be done for intranets, ISATAP allows you to turn the IPv4-only portion of your intranet into a logical IPv6 subnet. Once this subnet is defined and assigned a global or unique local prefix, IPv6/IPv4 hosts that support ISATAP can use ISATAP-based addresses for IPv6 connectivity. ISATAP allows you to make your IPv4-only intranet IPv6-capable, without requiring modifications to your existing router infrastructure to support native IPv6 addressing and routing. With ISATAP, you can immediately begin experimenting with IPv6 connectivity and application migration.

ISATAP allows you to phase in the native IPv6 addressing and routing capability on your intranet in the following way:

■Phase 1: IPv4-only intranet In this phase, your entire intranet can be a single, logical ISATAP subnet.

■ Phase 2: IPv4-only and IPv6-capable portions of your intranet In this phase,

your intranet has an IPv4-only portion (the logical ISATAP subnet) and an IPv6-capable portion. The IPv6-capable portion of your intranet has been updated to support native IPv6 addressing and routing.

■Phase 3: IPv6-capable intranet In this phase, your entire intranet supports both IPv4 and native IPv6 addressing and routing and ISATAP is no longer needed.

With ISATAP, you can have IPv6 connectivity between hosts and applications during the first two phases of the transition from an IPv4-only to an IPv6-capable intranet.

ISATAP Tunneling

ISATAP-based IPv6 traffic is tunneled or encapsulated with an IPv4 header, also known as IPv6-over-IPv4 traffic. For the details of IPv6-over-IPv4 traffic, see Chapter 11, “IPv6 Transition Technologies.” This tunneling is automatically done by an ISATAP tunneling interface on the sending host or forwarding router. The ISATAP tunneling interface treats the entire IPv4-only portion of the intranet as a single link layer, in much the same way as Ethernet. In the case of ISATAP, the link-layer encapsulation is IPv4.

The IPv6 protocol for Windows Server 2008 and Windows Vista creates a separate ISATAP tunneling interface for each LAN interface that is installed in the computer that has a different DNS suffix. For example, if a computer running Windows Vista has two LAN interfaces and they are both attached to the same intranet and are assigned the same DNS suffix, there is only one ISATAP tunneling interface. If these two LAN interfaces are attached to two different networks with different DNS suffixes, there are two ISATAP tunneling interfaces. For

computers running Windows Server 2008 or Windows Vista with Service Pack 1, the ISATAP tunnel interfaces are placed in a media disconnected state unless the name “ISATAP” can be resolved.

By default, the IPv6 protocol for Windows Vista with no service packs installed automatically configures link-local ISATAP addresses (FE80::5EFE:w.x.y.z or FE80::200:5EFE:w.x.y.z) on the ISATAP tunnel interfaces for the IPv4 addresses that are assigned to the corresponding LAN interface. The IPv6 protocol for Windows Server 2008 and Windows Vista with Service Pack 1 configures link-local ISATAP addresses (FE80::5EFE:w.x.y.z or FE80::200:5EFE:w.x.y.z) on ISATAP tunnel interfaces only if the name “ISATAP” can be resolved.

These link-local ISATAP addresses allow two hosts to communicate over an IPv4-only network without requiring additional global or unique local ISATAP addresses. You can determine the names and interface indexes of the ISATAP tunneling interfaces from the display of the ipconfig /all command.

All tunneling interfaces by default have an asterisk (“*”) in their name, such as “Local Area Connection* 6”. ISATAP tunneling interfaces have an asterisk in their name, “ISATAP” in their description, and are assigned a link-local ISATAP address. You can obtain the interface index for an ISATAP tunneling interface from the number after the percent sign (“%”) in the link-local addresses assigned to the interface. For example, the interface index of the ISATAP tunneling interface with the address FE80::200:5EFE:131.107.9.221%10 is 10.

You can disable ISATAP by setting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpip6\Parameters\DisabledComponents registry value to 0x4 (DWORD).

Note IPv6 for Windows Server 2003 and Windows XP created only a single ISATAP tunneling interface that was named “Automatic Tunneling Pseudo-Interface,” with an interface index that was typically set to 2.

ISATAP Tunneling Example

Host A has a single LAN interface and is configured with the IPv4 address of 10.40.1.29. Host B has a single LAN interface and is configured with the IPv4 address of 192.168.41.30. IPv6 on Host A has the ISATAP address of FE80::5EFE:10.40.1.29 assigned to its ISATAP tunneling interface (named “Local Area Connection* 6” with the interface index 10) and Host B has the ISATAP address of FE80::5EFE:192.168.41.30 assigned to its ISATAP tunneling interface (named “Local Area Connection* 5” with the interface index 11). Figure 12-1 shows this example configuration.

278 Understanding IPv6, Second Edition

Host A

FE80::5EFE:10.40.1.29

IPv4-Only

Infrastructure

Host A

FE80::5EFE:192.168.41.30

Figure 12-1 An example ISATAP configuration

When Host A sends IPv6 traffic to Host B destined for Host B’s link-local ISATAP address, the source and destination addresses for the IPv6 and IPv4 headers are as listed in Table 12-1.

Table 12-1 Example Link-Local ISATAP Addresses

To test connectivity between ISATAP hosts, you can use the Ping tool (subject to Windows Firewall exceptions for Internet Control Message Protocol for IPv6 [ICMPv6] traffic). For example, to ping Host B at its link-local ISATAP address from Host A, you would use the following command:

ping fe80::5efe:192.168.41.30%10

Because the destination of the ping command is a link-local address, you must use the %ZoneID as part of the destination address to specify the interface index of the interface from which traffic must be sent. In this case, “%10” specifies interface index 10, which is the interface index assigned to the ISATAP tunneling interface on Host A. The ISATAP tunneling interface uses its own link-local ISATAP address as a source IPv6 address. The ISATAP tunneling interface determines the destination IPv4 address of the encapsulating IPv4 header from the last 32 bits in the destination IPv6 address, which correspond to the embedded IPv4 address