2005 VersionIPv6 Deployment Guideline
A Case Study for a Large Enterprise toIntroduction IP Telephony in Their NetworkMarch 2005
IPv6 Promotion Council of Japan
DP-WG Large Enterprise, Local Government and SOHO SWG

1Case Envisaged
Taken up here is the case of a certain large enterprise, who has introduced the IPtelephony subject to IPv6.
Company B has an entrepreneurial size enough to have 10,000 employees all over thenation plus a group workforce totaled at 7,000 employees, with another 5,000 people
working at their subsidiaries overseas.

As far as the wide area network (WAN) services

are concerned, Company B is an IP-VPN user both in Japan and overseas.

Their network(VPN) is configured in a tree formation, with the head office centered in the system.

Toavoid a possible address collision, Company B has had the NAT equipment installedinterdepartmentally.

And major bases overseas are connected with the head office, too.

And bases overseas are interconnected in the tree formation, with major bases centered.
As far as an Internet connection is concerned, their bases inside Japan are linked via thehead office.

As far as their bases overseas are concerned, Company B permits them toconnect with the Internet by way of some major bases overseas rather than the head officein Japan.

A large enterprise is envisaged to have a network as
follows:
 Parent company has domestic total workforce of10,000 employees.
 Group member companies in Japan have a total
workforce of 7,000 employees.
 Subsidisaries overseas have a total workforce of5,000 employees.
 For WAN services, the enterprise have applied IPVPN both in Japan and overseas.
 The enterprise has the network configured in a tree
formation, with the head office centered.
 The enterprise has NAT equipment installed in eachdepartment to avoid a possible collision of addresses.
 The enterprise has major bases overseas connectedto the head office.
The network configuration overseas is formed in a tree,with major bases centered.

 Internet Connections
Each base in Japan is connected via the head office.
Bases overseas are connected via major ones overseas.

2Workforce
per baseNo. ofBases

Total

Head Office

15000

5000

Major Base

57003500

Minor Base

15100

1500

Subotal10000

Group Membersin Japan

10700

7000

Major BasesOverseas

5700

3500

Minor Bases
Overseas151001500

Subtotal

12000

Total

22000

Network Concept
NAT

NAT

Departmental
LANDepartmental
LAN

Head Office

Departmental
LANDepartmental
LAN

Ｍajor Ｂase

NAT

Departmental
LAN

NAT
DepartmentalLANthetheInternet
Internet

IP-VPN
IP-VPN

Departmental
LAN

Minor Base
NAT

Departmental
LAN

Departmental
LAN

Departmental
LANGroup Companies
NAT

Major Base Overseas
Departmental
LAN

Departmental
LAN

NAT

Minor Base Overseas

NAT
Departmental
LAN

NAT

Departmental
LAN

Motivations and Problems in Company B’s Network
For the backgrounds where Company B had introduced VoIP subject to IPv6, their
network prior to the introduction had its situations as discussed here.
It was necessary for Company B to make their network cope with a consolidation orde-consolidation of their in-house departments, and with an expansion of their business sizedue to an M&A project. To proceed with such action, the following problems might well betaken up:・

Private addresses set up under IPv4 may collide with those which have arisen from anentrepreneurial consolidation.

・

Wireless LAN telephony is likely to be introduced increasingly in addition to a growthof the in-house PC population, leading to an increase in number of terminals.

(= Asubnetwork will have its design complicated more than ever.)・A larger number of equipment units will be introduced, leading to an increase innetwork management cost.

It is necessary for the Company to study any possible solutions to the above-mentioned
problems while taking into account the trends of technologies and services in the future as3

well as the effectiveness of investment. To do so, the address-related problems should beresolved, first of all, because a lot of problematical items involve an address.
Either IPv4 or IPv6 provides you with solutions to a collision of private addresses and to
an increase in number of terminals. It is necessary, however, to take into consideration
their respective advantages and disadvantages. An increase in operational cost may be
coped with by simplifying the network.

A real question, however, lies in how to materialize

the network simplification. To cope with an application in the future, moreover, we should
focus on how the network could simplify itself.

Solution Policy
Addresses collideWith IPv4, apply private addresses.
With IPv6, apply global addresses.

Terminals increase

Operational cost
increases

New Application

An increase in operational cost is
essential to a change in network.
Cost, however, tries to be loweredby reducing equipment to beoperated or otherwise.

Cope with an application to be
introduced in the future (except
for a restriction for the sake ofsecurity).

Problem is soluble with
IPv4 and IPv6, respectively.
What advantages anddisadvantages will arise
therefrom?

Operational cost is reducedby simplifyng the network.
Then, how to reduce thecost?
It is indispensably necessary
to set up the network capableof coping with any application
introduced.
Then, what network isrequired?

As far as it is thought out under IPv4, there are high possibilities that the network may be
set up on a patch-work basis, that working applications may be limited and that the cost may
increase due to an increment of the objects to be managed by the network.
Now, let’s think about the address collision and terminals’ increase issues, first of all.
The IPv4 network provides us with the following four options as a specific solution to theproblems:
・Continue using NAT.

・Re-allocate addresses every time so as to avoid a possible collision of private address
ranges on an inter-base basis.

4

・Change the net mask rather than changing the address range.

・Use a secondary address.

A table given below summarizes the advantages and disadvantages of theabove-mentioned four options under IPv4 and of using IPv6.

Any of the IPv4-applied

methods may work as a temporary solution but will invite a complication of the network.
With the future taken into consideration, therefore, IPv4 has a fear of restricting theextensibility of the network in the future.

IPv6, on the other hand, allows for a simple

network setup and it might well be considered showing a high potential for growth in thefuture.

A Comparison of IPv4 with IPv6
Advantages and Disadvantages of IPv4- and IPv6-applied Networks
METHODADVANTAGEDISADVATAGE

NAT

Easy and inexpensive to introduced
by installing NAT equipment or byletting a router perform the NAT
functions.

Too difficult to grasp a network statusahead NAT, resulting in failure to manage
the network in a centralized manner.
Some applications may be unserviceable.
Objects to be operated will increase.

Reconfiguring the network willpermit a more readily manageable
network to be set up.

It will necessary to review the network,
being followed by re-setting anddeployment operations. Cost involved
will incur.
There are possibilities that the network
may be required to be reviewed all overagain, though dependent upon an
application to be introduced in the future.

IPv4
Renumber

IPv6

Net mask change

A phenomenon would take place as if renumbering were done.

Secondary address

A phenomenon will take place as if NAT were implemented.

Addressacquisition

Addresses may have their possible
runout coped with while making thenetwork scalable. A simple
network may be set up.

It is necessary to set up a IPv6-applicable
network.
At present, some unserviceable
applications are existing.

IPv4 may be used to set up the network as a stopgap. It would never fail to get bogged
down. Besides, there is a fear that the setup cost may continue to incur.
Making the network applicable to IPv6, however, permits us to assume that a futurebog-down will take place less frequently than that with IPv4.

5

What need be taken in consideration for security in IPv6
To set up a company network with IPv6, however, it is necessary to take security into fullprior consideration.

It involves some aspects that may require principles different fromthose under IPv4 and new measures. The IPv6 network should take security measures, withthe following points taken into account:
Firewall （enterprise boundary firewall）
The firewall located on the boundary between Internet and an in-house network should be,in principle, operated in accordance with the following policy:
・IPv6 routing is allowed between DMZ and Internet.

・IPv6 routing is allowed between DMZ and an in-house network.

・IPv6 routing is not allowed between an in-house network and Internet.

Stepping-stone protection （Intra-DMZ server）
The server inside DMZ should have proxy prohibited so that it may be protected against
becoming a stepping-stone for invasion of security.
Virus protection for servers in DMZ and in house
These servers are to have virus-scanning data established in the interior.
Illegal access protection in routers for in-house server segment
For IPv4, NAT（Static NAT for DNS） is to be established.

As far as filtering is concerned,

IPv6 SIP only is permitted in this segment.
Illegal access protection in departmental routers
Limiting IPv6 to a certain bandwidth is to be also taken into consideration.
Departmental firewall
The departmental level firewall is to be established for IPv4 as usual. For IPv6, on theother hand, the network is to select whether all communications or SIP/designated port
number only be permitted.

6General PC
For general in-house PC terminals, a personal firewall is to be introduced so that thepermit of an SIP phone-related application will be selected.

A virus is also to be scanned.

To identify a terminal, an anonym is to be inhibited from being used as far as the IPv6
address management is concerned.

An EUI-64-based address is to be used.

Coping with an Increase in Operational Cost and with a New
Application
Out of the three major issues, the first one, or address collision/increase in number ofterminals, has been already discussed.

Now, how about the rest two issues, i.e. anincrease in operational cost and a new application?
For operational cost, an expansion of the network would undeniably tend to complicate
the network configuration.

Trying to reduce the equipment to be managed, however, could

suppress that trend to complicate.

A reduction of NAT, in particular, will bring about apossibility of alleviating the management load.
For another issue or how to cope with an application, it may be safely pointed out thatusing global addresses while avoiding the use of private addresses as far as practicablewould be advantageous to set up the network infrastructure capable of coping with a wider
range of applications likely to be used in house from now on.

Miscellaneous Considerations
An increase in operational costis essential to a change innetwork. The cost reduction isattempted by reducing theequipment to be operated.

Operational cost is reduced bysimplifying the network.
Now, how to reduce?

 Simplification requires a decrease in equipment to bemanaged. Extra equipment is not used.
 Equipment to be managed may be reduced by removing
the NAT that has been used to set up a network on a patchwork basis.
Cope with an application to beintroduced in the future(except for restrictions for thesake of security)

Indispensably necessary to set up thenetwork capable of coping with anyapplication that may be implemented.
Now, what network is required?

 Network should be set up preferably with global
addresses rather than private ones to cope with any
application that may be introduced.
77

Comparing Cost to Set up VoIP between IPv4 and IPv6
As gathered from what has been referred to hereinabove, you will feel it better to set up
VoIP with IPv6.

Could an IPv6 setup, however, really reduce the cost?

Now, let’s compare the cost between IPv4 and IPv6 on the assumption that Company B
newly introduces VoIP.
Company B has already set up the IPv4 network equipped with about 125 units ofcore-system routers/switches and about 4,300 units of other routers/switches.

To makeuse of IPv6, the equipment required to be made applicable to IPv6 includes approximately
125 units of core system routers and switches.

The IPv4 network has been already set up

but requires the setup cost for delivery of VoIP addresses. For SIP terminals, moreover,soft phones and hard phones should be distributed at a ratio of 1:1. To set up the VoIP withIPv4, it is necessary to provide the equipment capable of holding an SIP session (SIP-NAT)
since the network is partially composed of NAT.
What is required for the initial cost to set up the network with VoIP mainly includes an SIP
server, SIP-NAT with the IPv4 network set up, and SIP terminals (soft and hard phones).
As far as various setup expenses are concerned, the IPv4 network would require the costto set up the VoIP network, SIP and SIP-NAT.

A setup of the IPv6 network, on the other

hand, would require the cost for a changeover of the network to IPv6 in addition to theexpenses incurred on the IPv4 network.
For running cost, the equipment requires the cost for maintenance and operation
monitoring on a component by component basis.
An actual estimate of the elements referred to above would result in a graph as given
below.
As far as the initial cost is concerned, the IPv6 network shows a significant increase inacquisition expenses as compared with the IPv4 because the former requires the cost for achangeover of the network to IPv6 while a limited number of hard phone models only areapplicable to the IPv6. On the other hand, the IPv6 network would save the cost forpurchasing the SIP-NAT.
As a conclusion, the IPv6 network requires a higher initial cost than the IPv4 but with little
difference in cost. As far as the running cost is concerned, the IPv6 network is less costly
because the SIP-NAT operation/maintenance cost is saved. Consequently, the estimate
reported herein has led to the conclusion that the IPv6 network will achieve a lower total costthan that for the IPv4 within one year following the introduction.

8Cost Comparison
Initial Cost
IPv4 is likely to require lower initial cost than that for IPv6. So large adifference, however, could not been seen .
VoIP setup cost (*)
Hard phone
Soft phone
SIP-NATSIP server
Cost for network changeover to IPv6
VoIP network setup costIPv4IPv6(*) Cost to set up SIP server / IP-NAT

Running Cost
A difference between IPv4 and IPv6 would turn out to apply as cost for
maintenance of SIP-NAT.
The case study reported herein would permit the cost to be recovered within oneyear.

Conclusion
Discussed in the case study reported hereinabove are those problems which a large
enterprise with an existing network may encounter when introducing the application
requiring to hold a session, such as VoIP, in their timing to update the network for various
reasons.
Proceeding with the introduction of such application premised on the existing network
would invite a variety of problems.

An address duplication issue and an address

assignment policy deadlock due to an increase in number of terminals may be taken up for
exemplar problems.
In addition, an estimated cost comparison has been made between VoIPs set up withIPv4 and with IPv6.

Both, however, has been found not to differ significantly on a costbasis.
Since undeniably the cost that the network operator could not see may incur, such cost

9aspect might well be considered to vary with the company trying to introduce. Though thiscost portion is most important, it has been excluded from the cost comparison reported
herein because it would vary remarkably from case to case.
From the cost comparison referred to hereinabove, however, it may be safely gatheredthat there is no significant difference in cost between IPv4 and IPv6.

Consequently, thedeployment from an existing network to the IPv6 seems to raise no cost problem.
With the future networking trends taken into consideration, the deployment to IPv6 is likely
to make unavoidable progress.

It is considered necessary, therefore, to go on

accumulating various verifications and setup estimations about a possible changeover tothe IPv6 network even if an envisaged network should be small-sized.

10

Members in Large Enterprise/Local Government
Segment, DP-WG（titles omitted）

SWG Chair
Tsukioka (Hitachi)
Sakauchi(NEC)Members
Arano (Intec NetCore Inc.)
Ito (Canon)
Inomata (Fujitsu)
Oikawa (Microsoft)
Ota (NTT East)
Ohira (Ricoh)
Kato (NTT)
Kanayama (Intec W&G)
Kokubu (RINT)
Suzuki (Hitachi)
Tachibana (aniani.com)
Tatsuki (NEC)Tokushige (NTT Communications)Nakai (NTT Communications)Nakahara (NEC)Nishida (Ricoh)
Shirota (Hitachi)
Hashimoto (MRI)
Hiroumi (Intec NetCore Inc.)
Yamazaki (NTT Communications)
Yamamoto (NTT East)
Yoshioka (Toyota IT Development Center)11

Members in SOHO Segment, DP-WG(titles omitted)

SWG Chair
Inomata (Fujitsu)
Sakauchi(NEC)Tsukioka (Hitachi)

Members
Arano (Intec NetCore Inc.)
Nakai (NTT Communications)Nakahara (NEC)Kanaumi (NEC)Ohira (Ricoh)
Ito (Canon)
Yamamoto (Shimizu Construction)
Yoshioka (Toyota)
Ozaki (Fujitsu)

Inquiries
For information relating to these Guidelines, please inquire by emailing to:
wg-dp-comment@v6pc.jp
IPv6 Promotion Council of Japan, DP-WG

12