Tag Archives: ISP

DHCPv6 Prefix Delegation

DHCP/DHCPv6, IPv6, , , , , , ,

What is DHCPv6 Prefix Delegation? Coming from IPv4, you’re already familiar with DHCP (for IPv4) which hands out IPv4 addresses to clients. The same applies to (stateful) DHCPv6: it hands out IPv6 addresses to clients.

However, with IPv6 we’re heavily dealing with subnets rather than just single addresses. Again, you’re familiar with IPv4: For an IPv4-based ISP connection, you’re getting either a single public IPv4 address or a small subnet such as a /29, /28, or the like for your WAN interface. For an IPv6-based ISP connection, you’re getting a subnet which includes multiple unique subnets to be used for other layer 3 segments rather than a single address (with NAT on the CPE). This is where DHCPv6 prefix delegation (commonly abbreviated as DHCPv6-PD) kicks in: It hands out IPv6 subnets to routers.

Let’s have a closer look:

Continue reading DHCPv6 Prefix Delegation →

#heiseshow: IPv6 setzt sich langsam durch – die wichtigsten Fragen

Conference Talks, Internet Access, IPv6, , , , , ,

Ich durfte zu Gast bei der #heiseshow zum Thema IPv6 sein. In Anlehnung an die Artikelserie über IPv6 in der c’t 7/2022, in der auch mein Artikel über die Vorteile von IPv6-Adressen erschienen ist, ging es bei diesem Video-Podcast um gängige Fragen zu IPv6 sowohl im Heimanwender- als auch im Enterprise-Segment. Ne knappe Stunde lief die Schose und ich empfand es als ziemlich kurzweilig. ;)

Continue reading #heiseshow: IPv6 setzt sich langsam durch – die wichtigsten Fragen →

NTP Filtering (Delay & Blockage) in the Internet

NTP, , , , , , , ,

NTP (Network Time Protocol) messages are sometimes rate-limited or blocked entirely by Internet operators. This little-known “NTP filtering” was put into place several years ago in response to DDoS (Distributed Denial of Service) attacks. NTP filtering may drop NTP messages based on rate or message size. Let’s dig into it: Continue reading NTP Filtering (Delay & Blockage) in the Internet →

RTTs with different ISPs

Bandwidth/Delay, Internet Access, , , , , ,

Just a short post this time, but an interesting fact concerning different Internet Service Providers (ISPs) and their routing to/from other countries. I have a customer in Germany that has a remote office in France, connected via a site-to-site VPN. Around April last year the french office decided to change the ISP to a cheaper competitor that offers the same speed/bandwidth and therefore has no disadvantages… Well, I disagree.

Continue reading RTTs with different ISPs →

Juniper ScreenOS: DHCPv6 Prefix Delegation

DHCP/DHCPv6, IPv6, Juniper Networks, Routing, Tutorial/Howto, , , , , , , ,

The Juniper ScreenOS firewall is one of the seldom firewalls that implements DHCPv6 Prefix Delegation (DHCPv6-PD). It therefore fits for testing my dual stack ISP connection from Deutsche Telekom, Germany. (Refer to this post for details about this dual stack procedure.)

It was *really* hard to get the correct configuration in place. I was not able to do this by myself at all. Also Google did not help that much. Finally, I opened a case by Juniper to help me finding the configuration error. After four weeks of the opened case, I was told which command was wrong. Now it’s working. ;) Here we go.

Continue reading Juniper ScreenOS: DHCPv6 Prefix Delegation →

Policy Based Routing on a Cisco ASA

Cisco ASA, Routing, , , , , ,

Cisco ASA 9.4 (and later) is now supporting Policy Based Routing. Yeah. Great news, since many customers are requesting something like “HTTP traffic to the left – VoIP traffic to the right”. Coming with a new Cisco ASA 5506-X I was happy to try the policy based routing feature.

The configuration steps through the ASDM GUI are not easy and full of errors so I am trying to give some hints within this blog post.

Continue reading Policy Based Routing on a Cisco ASA →

Policy Based Forwarding on a Palo Alto with different Virtual Routers

Palo Alto Networks, Routing, Tutorial/Howto, , , , ,

This guide is a little bit different to my other Policy Based Forwarding blog post because it uses different virtual routers for both ISP connections. This is quite common to have a distinct default route for both providers. So, in order to route certain traffic, e.g., http/https, to another ISP connection, policy based forwarding is used.

Continue reading Policy Based Forwarding on a Palo Alto with different Virtual Routers →

Policy-Based Routing on ScreenOS with different Virtual Routers

Juniper Networks, Routing, Tutorial/Howto, , , , , ,

I already puslished a blog post concerning policy-based routing on a Juniper firewall within the same virtual router (VR). For some reasons, I was not able to configure PBR correctly when using multiple VRs. Now it works. ;) So, here are the required steps:

Continue reading Policy-Based Routing on ScreenOS with different Virtual Routers →

Policy Routing on a FortiGate Firewall

Fortinet, Routing, Tutorial/Howto, , , , , , ,

This is a small example on how to configure policy routes (also known as policy-based forwarding or policy-based routing) on a Fortinet firewall, which is really simple at all. Only one single configuration page and you’re done. ;)

Continue reading Policy Routing on a FortiGate Firewall →

Basic IPv6 Messages: Wireshark Capture

IPv6, Linux, Memorandum, , , , , , , , , ,

When explaining IPv6 I am always showing a few Wireshark screenshots to give a feeling on how IPv6 looks like. Basically, the stateless autoconfiguration feature (SLAAC), DHCPv6, Neighbor Discovery, and a simple ping should be seen/understood by any network administrator before using the new protocol.

Therefore I captured the basic IPv6 autoconfiguration with a Knoppix Linux behind a Telekom Speedport router (German ISP, dual-stack) and publish this capture file here. I am using this capture to explain the basic IPv6 features.

Continue reading Basic IPv6 Messages: Wireshark Capture →

Idea: IPv6 Dynamic Prefix

DNS/DNSSEC, Future Work, Internet Access, IPv6, , , , ,

For dynamic IPv4 addresses, dynamic DNS services such as Dyn or No-IP are well-known. If an ISP issues a single dynamic IPv4 address every 24 hours (or the like), the router or any other device registers the IPv4 address for a DNS record. With port-forwardings on the router, several services on different clients can be accessed.

Since there are some ISPs that offer dynamic IPv6 prefixes as well, I have a suggestion on how to optimize the “dynamic DNS” service for several IPv6 addresses and names. The main idea is to update only the IPv6 prefix, while the host IDs are statically configured on the DNS server. This limits the DNS updates and expands the usage of DNS names even for devices that have no “DynDNS update client” built-in.

Continue reading Idea: IPv6 Dynamic Prefix →

Basic ISP Load Balancing with a Cisco Router

Cisco Systems, Internet Access, Routing, Tutorial/Howto, ,

“We have two independent DSL connections to the Internet and want to share the bandwidth for our users.” This was the basic requirement for a load balancing solution at the customer’s site. After searching a while for dedicated load balancers and thinking about a Do-It-Yourself Linux router solution, I used an old Cisco router (type 2621, about 40,- € on eBay at the time of writing) with two default routes, each pointing to one of the ISP routers. That fits. ;)

Continue reading Basic ISP Load Balancing with a Cisco Router →

Schnellere DSL Synchronisierung mit neuerer FRITZ!Box

FRITZ!Box, Internet Access, ,

Vor einiger Zeit habe ich bei einem Bekannten eine AVM FRITZ!Box ausgetauscht: Die etwas betagte 7050 musste einer 7170 weichen. Wie immer wurde per Screenshots alles dokumentiert. Erfreulicherweise war die DSL Synchronisierung am exakt gleichen Anschluss danach um einiges höher. Anstatt 7 MBit/s im Download bekam man jetzt 11 MBit/s!

Continue reading Schnellere DSL Synchronisierung mit neuerer FRITZ!Box →

Policy-Based Routing (PBR) on a Juniper ScreenOS Firewall

Juniper Networks, Routing, Tutorial/Howto, , , , , ,

Here comes an example on how to configure policy-based routing (PBR) on a Juniper ScreenOS firewall. The requirement at the customers site was to forward all http and https connections through a cheap but fast DSL Internet connection while the business relevant applications (mail, VoIP, ftp, …) should rely on the reliable ISP connection with static IPv4 addresses. I am showing the five relevant menus to configure PBR on the ScreenOS GUI.

[UPDATE] I later on wrote an article with policy-based routing with two different virtual routers. See it here.[/UPDATE]

Continue reading Policy-Based Routing (PBR) on a Juniper ScreenOS Firewall →

Policy Based Forwarding (PBF) on a Palo Alto Firewall

Palo Alto Networks, Routing, Tutorial/Howto, , , , , ,

This is a small example of how to configure policy based forwarding (PBF) on a Palo Alto Networks firewall. The use case was to route all user generated http and https traffic through a cheap ADSL connection while all other business traffic is routed as normal through the better SDSL connection. Since I ran into two problems with this simple scenario, I am showing the solutions here.

[UPDATE] I also wrote an article about policy based forwarding with two different virtual routers on the Palo Alto firewall. See it here.[/UPDATE]

Continue reading Policy Based Forwarding (PBF) on a Palo Alto Firewall →