IPv6 deployment at NITK Surathkal:Infrastructure and Application Migration
Centre for Open-source Software and Hardware (COSH)
National Institute of Technology Karnataka, Surathkal, India
1

Outline of the presentation
1. Project overview○ Team○ Plan of action○ Current network

2. Project status○ Advertisement of IPv6 address block○ Testbed setup at NITK
○ IPv6 deployment workshop at NITK
○ Migration of applications and infrastructure at NITK to IPv6

3. Next steps○ Performance evaluation of migrated applications○ Statistics analysis and investigating observations○ Migrate internal network services and devices to IPv62

Project Overview: Team
1. Faculty members from NITK Surathkal○ Mohit P. Tahiliani and Saumya Hegde

2. Members from India Internet Engineering Society (IIESoc)○ Dhruv Dhody

3. Network Engineers from NITK Surathkal○ Deepa Kumari

4. Students from NITK Surathkal○ Kavya Bhat, Vanessa Fernandes, Amogh Umesh, Vinayak Vatsalya, M. R. Rishi, Chinmaya Sharma

5. Advisory Team
○ Nalini Elkins○ Michael Ackermann○ Akshay Revankar and Sushanth S. Rao (alumni of NITK Surathkal)

3

Project Overview: Plan of action
1. Setup a testbed at NITK and test the basic functionality of IPv6
○ Gain insights into the working of DHCPv6, DNS and IPAM solutions

2. Migrate network services at NITK to IPv6
○ DHCPv6, DNS and IPAM

3. Dual-stack deployment at NITK
○ Enable dual-stack functionality in routers, ﬁrewalls, L3 switches and terminals

4. Update the web services and applications at NITK to support IPv6
○ Custom applications developed at NITK (for example, IRIS)○ Enable VPNs to work with IPv6

5. Detailed documentation of migrating NITK campus to IPv6
○ Capture the process of migrating NITK to IPv64

Project Overview: Current Network
1. Current Status:○ 45,000+ terminals connected to the Internet○ Upcoming campus expansion within 40 km

2. Infrastructure Overview:○ 350+ switches○ 1,200+ indoor/outdoor WiFi access points○ Dedicated data center hosting:■ Firewalls■ Core switches■ Web and application servers■ Servers for DHCPv6, DNS, IPAM and NAT■ Network management and monitoring5

Project Overview: Dual-Stack Deployment
1. Implement IPv6 on the external-facing Internet presence○ Websites, mail servers, etc.

2. Migrate the core backbone and WAN to dual-stack○ Deploy IPv6 internally on switches and routers

3. Migrate the Intranet to IPv6
○ Enable local IPv6 intranet access, with routing and switch architecture in place

4. Enable native IPv6 access to the end client

6

Project Status: Tasks completed
1. Enabled IPv6 connectivity with ISP for NITK campus.
○ NITK Surathkal has its own IPv6 address block leased from IRINN.
○ BSNL now advertises our IPv6 block.

2. Established IPv6 testbed before deployment.
○ Tested and validated the working of DHCPv6, DNS, and IPAM (DDI) solutions.

3. Compiled inventory of NITK web services and applications.
○ Evaluated the potential challenges before upgrading these services to support IPv6.

4. Migrated IRIS, a key NITK application, to IPv6.
○Most heavily used application at NITK is now dual-stack!

5. Conﬁgured NITK VPN (OpenVPN and Wireguard) for IPv6 support.
○ Ongoing performance evaluation and testing with both L3 VPNs

6. Migrated NITK Data Center VLAN to IPv6.

7

Project Status: IPv6 deployment workshop at NITK
70 participants attended the workshop from March 9-13, 2024
○ Participants belonged to industries, Government organizations, students and faculty members

8Project Status: Migration of Data Center VLAN
1. NITK Surathkal’s Data Center contains critical infrastructure:○ Routers and switches○ Firewalls○ Servers and storage systems

2. Status on migrating DC VLAN to IPv6: Completed!
3. IPv6 routing enabled for:○ Central Computing Center (CCC) Staff VLAN
○ Central Computing Center (CCC) Lab VLAN

4. DHCPv6 server: set up on a container in DC VLAN
○ Currently allocates IPv6 addresses to machines in CCC Staff VLAN and CCC Lab VLAN!

9

Project Status: Infrastructure Migration
1. All switches and access points in the NITK campus are being tagged to support
dynamic VLANs.
2. Once complete, next steps would be to:○ Conﬁgure IPv6 routing on a particular VLAN.
○ Add trusted users (deployment team - students and faculty) to this VLAN and start testing IPv6functionality.
○ Report issues noticed.
○ Debug and ﬁx these issues, document them for future use.
○ Start enabling IPv6 on a few VLANs■ academic buildings■ hostel buildings, etc.
10

Project Status: Migration of Data Center VLAN

11

Project Status: Testbed Setup at NITK

12

Project Status: Testbed Experiments (Observations)
1. DHCPv6 Filtering on intermediate switch○ Speciﬁes trusted and untrusted ports to ensure clients receive IPv6 addresses solely from authorized
DHCPv6 servers.
○ DHCPv6 ﬁlter drops server messages even when server IP was conﬁgured to be valid.
○ Analysis: TP-Link Switch does not seem to support DHCPv6 ﬁltering when a relay is involved.

2. Neighbor Discovery (ND) Snooping on intermediate switch○ Used to protect against ND attacks by constructing a table of trusted IPv6-MAC bindings.
○ Bindings and subsequent table entries are generated when the system ﬁrst joins the network andadvertises its IP address.

3. DNS Scopes○ Issue: End-client does not receive information about the DNS server.
■ Is it able to set DNS scope from RAs? Sometimes, but not always.
○ Debugging: Explicitly conﬁgure DNS scope by using resolvectl.

13

DHCPv6 Filtering (Observations)○ On DHCPv6 Server, we can see Relay-forward received and Relay-reply sent for Renew XID 0x689f26○ However, the Relay does not receive the Relay-reply14

Project Status: Testbed Experiments (Observations)
4. Router Advertisement Conﬁgurations○ On Linux systems, the net.ipv6.conf.accept_ra variable is set to 0 (disabled) by default. This would
mean the end client does not accept any gateway information from the RA conﬁgurations.
○ Suppose net.ipv6.conf.accept_ra remains set to 0:■ Default gateway information is not populated on the end client until net.ipv6.conf.accept_ra = 1.
Would this be a deployment issue if each end client has to be reconﬁgured on a network?
■ Using DHCPv6 sets the default gateway to a Global Unicast Address. Is this correct, or should thegateway always be a link-local address?
○ Set net.ipv6.conf.accept_ra to 1 after adding a default gateway manually. This results in two default
gateways. Does this result in one route being used a fallback in case the other fails or becomes stale?
○ If route information is deleted, the route table is repopulated after a few minutes.
■ Debugging: ongoing, but we suspect systemd-networkd to be a user-space tool that stores andreloads router information periodically.
15

Screenshots● Multiple default routes● Default gateway being a GUA (no timeout speciﬁed)

16

Project Status: Testbed Experiments (Observations)
5. OPNsense Services○ Issue: Sometimes, changes to the RA and DHCPv6 Relay services were not reﬂected on using the‘restart service’ option. Moreover, services would sometimes stop after any changes were made.
○ Debugging: After each conﬁguration change, check the services being used on OPNsense (in this case,RA and DHCPv6 relay). Reload the service and ensure that all required services are running.

6. Static IP address assignment○ Issue: IPv6 address assigned to OPNsense router interface was getting removed from the interface
after 15 minutes. Error message: IP was already assigned to another interface. These problems wereobserved on a (seemingly) random basis.
○ Debugging: identiﬁed the root cause and assigned IPv6 addresses correctly.

7. Pinging an external IPv6 address○ Issue: Pinging an external IPv6 address from OPNsense testbed router failed○ Debugging: There was no route that allowed trafﬁc to go through the WAN gateway. Adding a route in
System -> Routes -> Conﬁguration resolved this issue.

17Project Status: Migration of applications to IPv6
1. Integrated Resource and Information Sharing (IRIS): most widely used at NITK
○ It is a MIS + ERP of NITK that has automated 40+ processes at NITK Surathkal○ Most widely used web and mobile application at NITK: 7000+ students and 600+ staff use it everyday!
■ API based integrations with Moodle, BigBlueButton, Jitsi Video Conferencing and others○ Link: https://iris.nitk.ac.in/

2. What has been achieved so far?
○ Support for IPv6 has been enabled for IRIS!
○ IPv6 support for integrated applications, such as Moodle, BigBlueButton and others is pending○ Total hits from IPv6 on IRIS: 12,705,022○ Total hits from IPv6 after adding AAAA record for https://iris.nitk.ac.in/: 12,584,565○ Majority of IPv6 requests are from mobile devices, with the maximum coming from IRIS app: 2,472,763○ Total number of unique IPv6 addresses accessed (after addition of AAAA record): 894,516○ Ongoing work: performance evaluation and testing in terms of latency and resiliency (IPv4 vs IPv6)

18

Project Status: IPv6 Statistics from IRIS (6 months)

19

Project Status: IPv6 Statistics from IRIS (6 months)

20

Project Status: Migration of applications to IPv6
1. IRIS NGINX Reverse Proxy/Load Balancer IPv6 Migration○ Conﬁgured IPv6 on NGINX reverse proxies.
○ Added AAAA records for iris.nitk.ac.in for IPv6 load balancing via DNS.
○ Setup reverse DNS for LBs and serving HTTP(S) trafﬁc on IPv6.

2. IRIS Rails App Migration○ Conﬁgured IPv6 on hosts, NFS server, and database.
○ Updated main reverse proxies to proxy to Rails app over IPv6.
○ All services, including NGINX, MariaDB, and NFS, are IPv6 capable.

3. IRIS VPN Migration○ Enabled IPv6 on OpenVPN servers and Pritunl.
○ Created routed subnet for VPN on IPv6.
○ Implemented ip6tables forwarding and Proxy NDP for IPv6 support.

21

Project Status: Migration of applications to IPv6
4. Docker Network:○ Issue Faced:■ Containerised services inaccessible via IPv6
due to NAT setup.
■ Preference for server accessibility throughreverse proxies.

Before Migration○ Resolution:■ Conﬁgured Docker to use local IPv6addresses.
■ Established external connectivity via NAT.
■ Forwarded speciﬁc ports to reverse proxiesfor service access.
After Migration

22

Project Status: Migration of applications to IPv6
5. IRIS GitLab Migration○ Enabled IPv6 on GitLab host and conﬁgured GitLab to listen over IPv6.
○ Set up ip6tables forwarding and NGINX proxy for GitLab connections on IPv6.
Note:● Ongoing migration includes:○ Moodle Kubernetes Deployment■ Observation: we are currently using an older version of Kubernetes. Need to upgrade to a newerversion to enable IPv6 support○ IRIS Staging Server containerization and migration● Applications that haven’t been studied for IPv6 migration yet:○ Migration of Big Blue Button (BBB) video conferencing application: used for sharing recorded lectures○ NITK Mailer: conﬁrmed that it does not support IPv6 presently. Unused application at NITK, so might
discontinue using it in future.

23

Funded by:Thank you!
24