AWS claims 'monumental step forward' with optional IPv6-only networks
(2021/11/24)
- Reference: 1637777046
- News link: https://www.theregister.co.uk/2021/11/24/aws_claims_monumental_step_forward/
- Source link:
AWS customers can now create IPv6-only virtual private cloud (VPC) networks, with the company claiming it is a "monumental step forward" towards the enablement of IPv6 on its cloud.
Systems running dual network stacks (supporting both IPv4 and IPv6 addresses) are commonplace, but IPv6-only is less common. The new feature allows admins to create a IPv6-only subnet within a dual-stack VPC.
A limitation is that EC2 (Elastic Compute Cloud) instances launched into IP-v6 only subnets must be built on [1]Nitro , a custom hypervisor and network card which has both performance and security advantages.
[2]
Each subnet has a /64 CIDR (Classless Inter-Domain Routing) range, offering "approximately 10 quintillion IP addresses for applications," [3]according to AWS .
[4]
Creating an IPv6-only subnet on AWS
In a [5]separate post , solutions architect Rohit Aswani and senior product manager Aditya Santhanam said that the capability is "ideal if you have workloads, such as serverless and container applications, that consume a large number of IP addresses."
AWS has enabled its local Instance Metadata Service (IMDS), Time Sync, and VPC DNS server to be accessed with IPv6 addresses. Currently some operations can only be done with the AWS API or CLI (Command-line interface) and not from the web-based console. The IMDS gives the ability to retrieve data about or to configure the EC2 VMs, so it is a critical part of the AWS infrastructure.
[6]
[7]
Making them a little bit easier to remember, the local addresses for the instance services all have the ULA (Unique Local IPv6 Unicast Address) prefix fd00:ec2. For example, the Time Sync service is at fd00:ec2::123.
IPv6-only interfaces can be exposed to the public internet, subject to security group rules in the normal way. An issue though is what happens if clients are on IPv4-only networks.
[8]
Aswani and Santhanam explained that "if the end user is located in a corporate network that doesn’t support IPv6 address space, you need to launch a dual-stack instance in a dual-stack subnet which the user can SSH into via public IPv4 address first. Then, from that dual-stack instance, the user can SSH into the IPv6-only instance."
The same logic would apply to other applications that need to be accessible via IPv4, but to call services in an IPv6-only subnet. The general approach would be IPv6 for the core, and IPv4 for public accessibility. A full walkthrough of setting up an IPv6-only subnet in an AWS VPC is [9]here .
[10]IPv6 still 5–10 years away from mainstream use, but K8s networking and multi-cloud are now real
[11]China sets goal of running single-stack IPv6 network by 2030, orders upgrade blitz
[12]It's 2021 and a printf format string in a wireless network's name can break iPhone Wi-Fi
AWS is ahead of rivals Microsoft and Google in its IPv6-only enablement. Both Azure and GCP support dual-stack virtual networks but do not match what AWS now offers.
It may seem that an IPv6-only subnet is all pain and no gain for administrators. There are some potential benefits, though, one being a strategic one, in that it gives developers and hardware vendors an incentive to ensure applications work correctly in IPv6 and may therefore accelerate its adoption.
Another benefit is eliminating the risk of IP address conflicts, for example when a VPN connects two local networks both of which use the same local IPv4 address range. When will IPv4 become legacy and IPv6 the norm? That moment always seems to be [13]five to 10 years away .®
Get our [14]Tech Resources
[1] https://www.theregister.com/2017/11/29/aws_reveals_nitro_architecture_bare_metal_ec2_guard_duty_security_tool/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://aws.amazon.com/about-aws/whats-new/2021/11/amazon-virtual-private-cloud-ipv6-subnets-ec2-instances/
[4] https://regmedia.co.uk/2021/11/24/ipv6.png
[5] https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-ipv6-only-subnets-and-ec2-instances/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://docs.aws.amazon.com/vpc/latest/userguide/vpc-subnets-commands-example-ipv6-v2.html
[10] https://www.theregister.com/2021/07/15/ipv6_istilli_510_years_away/
[11] https://www.theregister.com/2021/07/26/china_single_stack_ipv6_notice/
[12] https://www.theregister.com/2021/06/21/wifi_ssid_flaw/
[13] https://www.theregister.com/2021/07/15/ipv6_istilli_510_years_away/
[14] https://whitepapers.theregister.com/
Systems running dual network stacks (supporting both IPv4 and IPv6 addresses) are commonplace, but IPv6-only is less common. The new feature allows admins to create a IPv6-only subnet within a dual-stack VPC.
A limitation is that EC2 (Elastic Compute Cloud) instances launched into IP-v6 only subnets must be built on [1]Nitro , a custom hypervisor and network card which has both performance and security advantages.
[2]
Each subnet has a /64 CIDR (Classless Inter-Domain Routing) range, offering "approximately 10 quintillion IP addresses for applications," [3]according to AWS .
[4]
Creating an IPv6-only subnet on AWS
In a [5]separate post , solutions architect Rohit Aswani and senior product manager Aditya Santhanam said that the capability is "ideal if you have workloads, such as serverless and container applications, that consume a large number of IP addresses."
AWS has enabled its local Instance Metadata Service (IMDS), Time Sync, and VPC DNS server to be accessed with IPv6 addresses. Currently some operations can only be done with the AWS API or CLI (Command-line interface) and not from the web-based console. The IMDS gives the ability to retrieve data about or to configure the EC2 VMs, so it is a critical part of the AWS infrastructure.
[6]
[7]
Making them a little bit easier to remember, the local addresses for the instance services all have the ULA (Unique Local IPv6 Unicast Address) prefix fd00:ec2. For example, the Time Sync service is at fd00:ec2::123.
IPv6-only interfaces can be exposed to the public internet, subject to security group rules in the normal way. An issue though is what happens if clients are on IPv4-only networks.
[8]
Aswani and Santhanam explained that "if the end user is located in a corporate network that doesn’t support IPv6 address space, you need to launch a dual-stack instance in a dual-stack subnet which the user can SSH into via public IPv4 address first. Then, from that dual-stack instance, the user can SSH into the IPv6-only instance."
The same logic would apply to other applications that need to be accessible via IPv4, but to call services in an IPv6-only subnet. The general approach would be IPv6 for the core, and IPv4 for public accessibility. A full walkthrough of setting up an IPv6-only subnet in an AWS VPC is [9]here .
[10]IPv6 still 5–10 years away from mainstream use, but K8s networking and multi-cloud are now real
[11]China sets goal of running single-stack IPv6 network by 2030, orders upgrade blitz
[12]It's 2021 and a printf format string in a wireless network's name can break iPhone Wi-Fi
AWS is ahead of rivals Microsoft and Google in its IPv6-only enablement. Both Azure and GCP support dual-stack virtual networks but do not match what AWS now offers.
It may seem that an IPv6-only subnet is all pain and no gain for administrators. There are some potential benefits, though, one being a strategic one, in that it gives developers and hardware vendors an incentive to ensure applications work correctly in IPv6 and may therefore accelerate its adoption.
Another benefit is eliminating the risk of IP address conflicts, for example when a VPN connects two local networks both of which use the same local IPv4 address range. When will IPv4 become legacy and IPv6 the norm? That moment always seems to be [13]five to 10 years away .®
Get our [14]Tech Resources
[1] https://www.theregister.com/2017/11/29/aws_reveals_nitro_architecture_bare_metal_ec2_guard_duty_security_tool/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://aws.amazon.com/about-aws/whats-new/2021/11/amazon-virtual-private-cloud-ipv6-subnets-ec2-instances/
[4] https://regmedia.co.uk/2021/11/24/ipv6.png
[5] https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-ipv6-only-subnets-and-ec2-instances/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YZ7EJHaGNgs3qXQu2gJLHgAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://docs.aws.amazon.com/vpc/latest/userguide/vpc-subnets-commands-example-ipv6-v2.html
[10] https://www.theregister.com/2021/07/15/ipv6_istilli_510_years_away/
[11] https://www.theregister.com/2021/07/26/china_single_stack_ipv6_notice/
[12] https://www.theregister.com/2021/06/21/wifi_ssid_flaw/
[13] https://www.theregister.com/2021/07/15/ipv6_istilli_510_years_away/
[14] https://whitepapers.theregister.com/
Re: Made the switch
Victor Ludorum
I haven't used them , but [1]vultr.com 's cheapest VPS product is IPv6-only, and $1 a month cheaper than the equivalent IPv4 product.
[1] https://www.vultr.com/products/cloud-compute/#pricing
Dwarf
You have to wonder with AWS's success and need to have services in each region, then how many IPv4 address blocks do they actually have ?
I'm happy to see the move here, since in many cases there is nothing stopping people moving to IPv6 other than the fear of the unknown and not doing what they did yesterday. Layer 3 changed, that's all. In many cases, client side is already enabled for IPv6 as the telco's have all enabled their customer base to use it.
Peter-Waterman1
They publish them - here https://ip-ranges.amazonaws.com/ip-ranges.json
How did they get so many? They buy them of companies who don't need them.
https://www.internetsociety.org/blog/2017/05/mit-goes-on-ipv4-selling-spree/
http://www.southgatearc.org/news/2020/october/sale-of-amateur-radio-amprnet-tcp-ip-addresses.htm#.YZ6b-9DP02g
Made the switch
My employer made the transition to IPv6 after a merger due to massive collisions in RFC 1918 address space. The only IPv4 addresses we have remaining are on the external side of our public facing load-balancers and a few firewalls we use for IPSec tunnels. All of our external DNS, mail, proxy, public VPN, and web servers are IPv6-only. We use a mix of IPv6, IPv4-to-6, and IPv6-to-4 virtual servers to make it all work. I wouldn't be surprised if we're still using address translation a decade from now, but I would be surprised if IPv4 traffic isn't the minority by then.
As for AWS now offering IPv6-only networks, I wonder if this will pave the way for them to start charging extra for public IPv4 addressing. Blocks of IPv4 addresses aren't cheap.