Planning Guide/Roadmap Toward
IPv6 Adoption within the U.S.
Government
Strategy and Planning Committee
Federal Chief Information Officers Council

Version 2.0
May 2012

The Federal CIO Council Strategy and Planning Committee
Technology Infrastructure Subcommittee
Federal IPv6 Working GroupIn collaboration with the

The American Council for Technology/Industry Advisory Council’s
Network and Telecommunications (N&T-SIG)

Present:
Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government
May 2012

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Table of Contents
1.

Executive Summary..................................................................................................................... 1
1.1

Background ..................................................................................................................................... 1

1.2

Benefits ............................................................................................................................................ 2

1.3

Guidance ......................................................................................................................................... 2

1.4

Our Business Situation ................................................................................................................... 22.

Contributors ................................................................................................................................. 4

3.

Federal Transition Initiatives....................................................................................................... 6
3.1

OMB Guidance................................................................................................................................ 6
3.1.1 OMB September 2010 Memorandum ................................................................................ 6
3.1.2 Agency Transition Plans ...................................................................................................... 7
3.1.3 OMB Memorandum M‐05‐22 .............................................................................................. 7

3.2

IPv6 Federal Acquisition Regulations (FAR) ................................................................................ 8
3.2.1 Current Applicable FAR Previsions..................................................................................... 8
3.2.2 Acquisition Guidance............................................................................................................ 8

3.3

Federal IPv6 Task Force ..............................................................................................................11

3.4

Sample Agency Timelines ...........................................................................................................11
3.4.1 Sample Federal Agency Execution Timeline ................................................................... 11
3.4.2 Implementation Recommendations .................................................................................. 14

3.5

Agency Progress Tracking ...........................................................................................................15

3.6

Sub-Working Groups ....................................................................................................................16
3.6.1 IT Management Sub-Working Group ................................................................................ 16
3.6.2 Outreach Sub-Working Group ........................................................................................... 16
3.6.3 Technical Sub-Working Group .......................................................................................... 16

3.7

USGv6 Activities ...........................................................................................................................173.7.1 USGv6 Profile Process ...................................................................................................... 17
3.7.2 USGv6 Test Program ......................................................................................................... 17

3.8

DoD IPv6 Profile ...........................................................................................................................17

4.

The Business Rationale for IPv6............................................................................................... 18

5.

Federal IPv6 Transition: The “To Be” State ............................................................................. 20
5.1

The 2012 ―To Be‖ State ................................................................................................................20

5.2

The 2014 ―To Be‖ State ................................................................................................................21

May 2012

Page iPlanning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

5.3
6.

Beyond the 2014 State .................................................................................................................22

Leveraging Enterprise Architecture ......................................................................................... 24
6.1

Using the IT Infrastructure Segment Architecture ......................................................................25
6.1.1 Developing a Shared Approach to Infrastructure Services ............................................. 26

6.2

EA-Driven IPv6 Planning ..............................................................................................................27
6.2.1 Using the USG IPv6 Standards Profile ............................................................................. 29

7.

6.3

Developing an IPv6 Transition Strategy Plan .............................................................................30

6.4

Integration with Capital Planning .................................................................................................30

6.5

OMB IPv6 EA Assessment Criteria .............................................................................................32

Transition Milestones ................................................................................................................ 32
7.1

Accellerating IPv6 Deployment ....................................................................................................32
7.1.1 Develop an IPv6 Test Lab Capability................................................................................ 32
7.1.2 Standup Centralized Addressing Authority (CAA) ........................................................... 33
7.1.3 Address Plan Management and Policies.......................................................................... 34
7.1.4 Address Acquisition ............................................................................................................ 35
7.1.5 Establish Address Block Allocation and Management Procedures ............................... 36
7.1.6 Interfaces for DHCP, DNS, Network Management and Provisioning Systems ............ 37
7.1.7 Address Space Plan Management and Address Assignment System .......................... 38
7.1.8 Domain Name Service ....................................................................................................... 40
7.1.9 Address Assignment Methods........................................................................................... 42
7.1.10 Network Management ................................................................................................... 43

8.

IPv6 Impact on Federal Initiatives............................................................................................. 44
8.1

Trusted Internet Connection ........................................................................................................45
8.1.1 TIC Objectives .................................................................................................................... 45

9.

8.2

HSPD-12........................................................................................................................................47

8.3

IT Modernization ...........................................................................................................................47

8.4

U.S. Government Configuration Baseline...................................................................................47

8.5

Networx Migration .........................................................................................................................48

8.6

DNSSEC ........................................................................................................................................50

8.7

Cloud Computing: Cloud First Strategy ......................................................................................50

8.8

Federal Data Center Consolidation Initiative (FDCCI) ..............................................................50

8.9

Digital Government Initiative (DGI)..............................................................................................51

IPv6 in IT Governance and Procurement ................................................................................. 51

May 2012

Page ii

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

9.1

Governance ...................................................................................................................................51

9.2

Procurement ..................................................................................................................................52

10.

Acronym Dictionary................................................................................................................... 53

11.

Definitions .................................................................................................................................. 55

12.

IPv6 FAQ .................................................................................................................................... 56

13.

Resources .................................................................................................................................. 57

List of Exhibits
Figure 1. View of IPv6 Deployment Monitor ..................................................................................................... 7
Figure 2. Federal IPv6 Governance Framework ............................................................................................11
Figure 3. Timeline for 2012 Milestones ...........................................................................................................12
Figure 4. Timeline for 2014 Milestones ...........................................................................................................14
Figure 5. IPv6 vs. IPv4 Features......................................................................................................................19
Figure 6. IPv6 Capability Examples by LoB ....................................................................................................24
Figure 7. IPv6 Transition Concept of Operations ...........................................................................................25
Figure 8. Role of IT Infrastructure Optimization ..............................................................................................26
Figure 9. Sample USG IPv6 Profile Excerpt ...................................................................................................29
Figure 10. FEA Collaborative Planning Method .............................................................................................30
Figure 11. IPv6 Relation to Other Federal Initiatives .....................................................................................44
Figure 12. TIC Architecture ..............................................................................................................................46

May 2012

Page iii

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

1. Executive Summary
The purpose of this planning guide is to provide United States (U.S.) Federal Government agency
leaders with practical and actionable guidance on how to successfully integrate Internet Protocol version
6 (IPv6) throughout their enterprise. This guide has been updated from the original guide published in2009 to aid in understanding the Federal Government‘s Internet Protocol version 6 (IPv6) history, vision ,current goals, and deadlines. Based on the information found in this document, the Agency Chief
Information Officer (CIO), IPv6 Transition Managers, Chief Enterprise Architects, and Chief Acquisition
Officers (CAO) can assess their own agency‘s current IPv6 implementation progress and develop an
agency-specific plan with detailed milestones to achieve the defined IPv6 goals for FY2012 and FY2014.

1.1 BackgroundTo reduce the cost of providing services to increasing numbers of customers, and to increase the variety
of services, businesses have embraced the Internet and the social and Web services that exist on it. The
current Internet is a commercialization of a U.S.-funded DARPA project that began in 1960‘s with theaccompanying technological leadership, humanitarian, and economic benefit to the United States andthe world.
In the mid to late 1990s, after thirty years of the meteoric growth of users and applications on theInternet, a major technology refresh was being developed and deployed for the underlying
communications technology of the Internet and the World Wide Web (www). This includes high-speed
fiber optic communications links with dense wave division multiplexing (DWDM), giving a data carrying
speed of over one terabit per second (1 Tbsp.) per fiber and over 70-150 Tbsp. per fiber cable on asingle communications hop. Terabit and petabit routers and switches are being deployed to route, switch
and terminate these packets into large virtualized data centers and high speed consumer, business , andgovernment networks and exchanges. These systems are capable of handling hundreds of millions tobillions of devices and packet streams now and in the foreseeable future. Currently , the number ofwireless devices connected to these networks has exceeded 1 billion handsets .
In the same timeframe, the Internet community, in cooperation with U.S. and other governments, began
developing the required protocol components of the Next
Generation (Internet) Network (NextGen), IPv6. The high―The US leadership is exemplary inperformance infrastructure is being deployed very aggressively tothis global undertaking. This is themeet data and mobile computing requirements, while thefirst upgrade of the Internet and most
deployment of the required IPv6 protocols has not kept pace. For
probably the last one for decades tothis Next Generation ―Super‖ Internet to operate effectively andcome. So, let‘s get it right. ‖reliably, the communications systems must be deployed with the
IPv6 protocol developed for them. The current Internet has
Latif Ladidbrought tremendous humanitarian, open government andIPv6 Forum President
economic benefit, and it is in the best interests of the UnitedStates to continue this growth and to expand these systems with
their increased benefits.
The current Internet is a hybrid IPv4/IPv6 network with growing IPv6 traffic which will be interconnecting
the USG with citizens and business partners worldwide. Agencies not only need to meet the 2012 and2014 deadlines, but they need to be able to leverage IPv6 protocol capabilities and ensure compatibility
with new Internet services.

May 2012

Page 1Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

1.2 Benefits
The IPv6 protocol is the enabler of ultra-high performance networks which reduces the costs ofinterconnecting Web and information services with their customers, increasing the territory that can beserved. The benefits of IPv6 include:
Improves government operations for:– Streamlining services for more citizens and citizen groups– Improving of both the quality and delivery of Education and Healthcare in all areas of thecountry– Fostering environmental and energy monitoring and control
 Increases economic activity and increases jobs for urban and rural areas
 Supports remote and mobile offices and telework sites
 Fosters high speed equal Internet access for all
An Issue of Business Continuity
 Supports Continuity of Operations (COOP) for agencies.
"The technical stuff for IPv6 is done.
Some Federal initiatives supported include:
IPv6 is ready. This is a business ―Cloud First‖ policy for secured Cloud Computing
issue in the Internet service industry.
The ISP community round the world
 Federal Data Center Consolidation Initiativeneeds to pay attention…They are Transparent Government
persisting in the ‗nobody is asking for Digital Government Strategy
this‘ mentality. They are not valuing
business continuity as they should.
1.3 Guidance
When they finally wake up, there is
In fostering these policies and benefits, on September 28, 2010,
going to be a mad scramble for IPv6
the Office of the Federal Chief Information Officer issued aand they won't implement it―Memorandum for Chief Information Officers of Executive
properly.‖
Departments and Agencies,‖ titled ―Transition to IPv6,‖ which
Vinton Cerf, September 30, 2008
detailed the Federal Government‘s commitment to theinterview with ―The Times Online.‖
operational deployment and use of IPv6. The memo states that
OMB will work with the National Institute of Standards andVinton ―Vint‖ Cerf is an American
Technology (NIST) to continue the evolution andcomputer scientist who is the person
implementation of the USGv6 Profile and Testing Program andmost often called ―the father of theprovides guidance and deliverables agencies are required toInternet.‖ His contributions haveachieve.
been recognized repeatedly, withhonorary degrees and awards that
1.4 Our Business Situation
include the National Medal of
Action is needed by the U.S. government in order to retain ourTechnology, the Turing Award, andnation‘s technical and market leadership in the Internet sector
the Presidential Medal of Freedom.
and to expand and improve services for America‘s citizens.
There has already been significant progress by foreign
governments in attempting to reap the advantages of early IPv6
deployment, including:The European Commission– i2010 initiative, an action plan to see IPv6 widely deployed in Europe by 2010.

May 2012

Page 2

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government



















Australia– A Strategy for the Implementation of IPv6 in Australian Government Agencies - July 2009
Peoples Republic of China– Next Generation Internet project (CNGI), is a five-year plan with the objective of cornering asignificant proportion of the Internet space by implementing IPv6 early. China showcased
CNGI and its IPv6 network infrastructure at the 2008 Olympics in Beijing, using IPv6 to network
everything from security cameras and taxis, to the Olympic events‘ cameras.
Hong Kong– HK Govt implements IPv6
India
– The Government of India, Ministry of Communications and Information Technology,
Department of Telecommunication‘s IPv6 Deployment Road Map, includes policy for:
 All major service providers (having at least 10,000 Internet customers or STM-1
bandwidth) will target to handle IPv6 traffic and offer IPv6 services by December 2011.
 All central and State government ministries and departments, including its PSUs, shallstart using IPv6 services by March 2012.
Indonesia– IPv6 Development Updates in Indonesia Working on Building Awareness of IPv6 - Publishedby Indonesia IPv6 Task-ForceJapan– Overview Report: Study Group on Internet's Smooth Transition to IPv6 (Tentative Translation)- Issued by the Ministry of Internal Affairs and Communications (MIC), Japan, June 2008
– Report: Study Group on Internet's Smooth Transition to IPv6 (Tentative Translation) - Issued
by the Ministry of Internal Affairs and Communications (MIC), Japan, June 2008
Korea
– IPv6 Deployment in Korea - by Mr. Park, Syung-Kyoo, National Internet Development
Agency of Korea (NIDA), September 2008
Malaysia– Moving The Nation TowardsIPv6-Enabled by 2010: Policy and Regulatory Matters - Issued
by the Malaysian Communications and Multimedia Commission, Malaysia, November 2007
Singapore– Singapore Internet Protocol Version 6 (IPv6) Profile, 2 Jan 2012
– Information Paper: Internet Protocol version 6 Phase 2 Transition Plans for Singapore, April
2011 - Issued by the Info-Communications Development Authority (iDA), Singapore– Report for iDA, IPv6 adoption guide for Singapore, 15 March 2011 - Published by Analysis
Mason and Tech Mahindra– Information Paper: Internet Protocol version 6 Transition Plans for Singapore, June 2006 Issued by the Info-Communications Development Authority (iDA), Singapore
Taiwan– Taiwan IPv6 Deployment Current Status - by Sheng-Wei Kuo, Taiwan Network andInformation Center (TWNIC), February, 2008

May 2012

Page 3

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

IPv6 provides valuable benefits to agencies by facilitating an improvement in operational efficiencies andcitizen services. Many of these benefits will not be realized until running IPv6 natively. Examples of IPv6
benefits include:









Addressing and Routing: IPv6‘s extremely large address space enables global connectivity to
many more electronic devices—mobile phones, laptops, in-vehicle computers, televisions,cameras, building sensors, medical devices, etc.
Security: IPv6‘s security, when enabled and configured with the appropriate key infrastructure,
comes in the form of IPsec, which allows authentication, encryption, and integrity protection at the
network layer.
Address Auto-Configuration: IPv6 address auto-configuration enables simple devices to achieveout of the box plug-and-play network access that is the key to self-organizing networks.
Support for Mobile Devices: IPv6-enabled applications can benefit from seamless mobility. The
mobility comes in the form of Mobile IPv6, which allows devices to roam among different networks
without losing their network connectivity.
Peer-to-Peer (P2P) Communication Tools that Can Improve Interagency Collaboration: True
end-to-end connectivity, enabled by the IPv6 address space and elimination of private network
addresses, will allow the optimization of media-streaming applications. This will allow timely video
feeds and quality-rich information to be easily distributed to millions of locations.

IPv6 supports an integrated, well-architected platform with all the aforementioned benefits, as well as
headroom for future growth and enhancement.
However, in order to realize the benefits offered by IPv6, it is important that the Federal Government
continue the process of architecting and deploying secure IPv6-enabled network services.
The adoption of several technology solutions, Classless Inter-Domain Routing (CIDR) addressing,
Network Address Translation (NAT), and Port Address Translation (PAT), all helped extend the life-span
and availability of IPv4. While some Federal agencies may have enough IPv4 space allocated to support
their needs for the foreseeable future, the Internet Assigned Numbers Authority (IANA) address pool
was exhausted in January 2011, and several Regional Internet Registries (RIR) exhausted their
allocations in April 2011. The remaining RIR expect exhaustion within the next two years .
Demand levels for addresses continue to accelerate due to rapid population growth; mass-market
broadband deployment; the demand for globally unique addresses for applications such as Voice overIP (VoIP); the addition of network addressable devices such as mobile phones and sensors to theInternet, and continuing adoption of cloud computing. One of the main advantages of IPv6 is that it reestablishes the P2P connection that was difficult in IPv4 due to Network Address Translation (NAT).
IPv6 greatly simplifies the deployment of the next generation of the Internet services and technologies,
sometimes called the ―Internet of Things,‖ providing the ―plug and play‖ experience.
It is important to note that without a concentrated effort by Federal agencies to effectively and efficiently
deploy secure IPv6 network services, the U.S. government‘s technical advancement and ability to meetits mission needs will be critically impacted.

2. Contributors
This guide was produced by a team of dedicated individuals led by the Federal IPv6 Working Group of
the Technology Infrastructure Sub-Committee (TIS). The TIS is a formally chartered sub-organization of
the Strategy and Planning Committee (SPC) of the Federal Chief Information Officer (CIO) Council. The
May 2012

Page 4

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

E-Government Act of 2002 authorizes the Federal CIO Council. This guide was developed in conjunction
with the American Council for Technology/Industry Advisory Council.
The following SPC and TIS leadership members and OMB staff were responsible for the development of
this guide:
Name
Simon Szykman
Linda Cureton
Roberta Stempfley
Charles RominePeter Tseronis
Bobby Flaim
Carol Bales

Roles
Co-Chair , Strategy andPlanning Committee (SPC)
Co-Chair, SPC

Title
CIO

CIO
Deputy Assistant
Co-Chair, Technology
Secretary, National
Infrastructure Subcommittee
Protection & Programs(TIS)
Directorate
Co-Chair, Technology
Director ITL
Infrastructure Subcommittee(TIS)
Chair, Federal IPv6 Task
Force

Chief Technology
OfficerSupervisory Special
Co-Chair, Federal IPv6 Task
Agent
Force
Executive Sponsor

Lead Policy Analyst

Organization
Department of Commerce (DoC)
NASA
Department of Homeland Security(DHS)
Department of Commerce (DoC),
National Institute of Standards andTechnology, Information
Technology Laboratory
Department of Energy (DoE)
Department of Justice (DoJ),
Federal Bureau of Investigations(FBI)
Executive Office of the President(EoP) Office of Management andBudget

The following persons were primary contributors to developing this guide:
Name
Chris Chroniger
Jane Coffin

Roles
Title
Chair – ACT-IAC
Chief Technology Officer
IPv6 Working GroupKey Contributor
Policy Analyst

Dale Geesey
Key Contributor
John L. Lee
Key Contributor
Kenny Burroughs Key Contributor
Barry Chapman
Key Contributors
Ralph Wallace
Key Contributor
Doug Montgomery Key Contributor
StephenNightingale
Ron Broersma

Key Contributor

Tim Owen
TJ Evans
Bill Kyburz

Key Contributor
Key Contributor
Key Contributor

May 2012

Key Contributor

Organization
Acentia

Department of Commerce(DoC)
Chief Operating Officer
Auspex Technologies
Chief Technology Officer
Internet Associates LLC
Managing Director
Internet Associates LLC
Solutions Architect
Acentia
Executive Vice President of Operations White Oak Consulting
Manager, Internetworking Technologies Department of Commerce
Research Group(DoC) NIST
Senior Computer Scientist
Department of Commerce(DoC) NIST
Chief Engineer
Department of Defense (DoD)
DREN
Chief Engineer
Secure Mission Solutions
Director, Network Engineering
Nephos6
Senior Director, Business Development General Dynamics

Page 5

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

In addition, the following individuals supported the development of this document.
Name
Steven Pirzchalski
Silvia Brugge
Kafi Johnson
Frank Troy

Organization
Department of Veterans Affairs (VA)
Acentia
Acentia
Troy Networks, Inc.

3. Federal Transition Initiatives
Early initiatives led by the U.S. Department of Defense (DoD) and the Office of Management and Budget(OMB) stakeholders drove agencies to demonstrate progress in areas of standardization andtesting/certification to prepare for eventual government-wide IPv6 integration and transition.

3.1 OMB Guidance
3.1.1

OMB September 2010 Memorandum

On September 28, 2010, the Federal Chief Information Officer issued a Memorandum For Chief
Information Officers of Executive Departments and Agencies titled ―Transition to IPv6‖(http://www.cio.gov/documents/IPv6memofinal.pdf), stating that the Federal Government is committed tothe operational deployment and use of Internet Protocol version 6 (IPv6). The memo describes specificsteps for agencies to take to expedite the operational deployment and use of IPv6. It went on to explainthat the Federal Government must transition to IPv6 in order to:
Enable the successful deployment and expansion of key Federal Information Technology (IT)modernization initiatives, such as Cloud Computing, Broadband, and SmartGrid, which rely on
robust, scalable Internet networks.
 Reduce complexity and increase transparency of Internet
services by eliminating the architectural need to rely on―Transitioning to IPv6 is a critical
Network Address Translation (NAT) technologies.
journey that must begin today for the Enable ubiquitous security services for end-to-end
U.S. Government and Industry
network communications that will serve as the foundation
before the exhaustion of the current
for securing future Federal IT systems.
IPv4 address space, to assist with
 Enable the Internet to continue to operate efficiently
the restoration of the Internet End2through an integrated, well-architected networking
End model, and an important
platform and to accommodate the future expansion oftechnical optimization for Next
Internet-based services.
Generation Networks technology
In order to facilitate timely and effective IPv6 adoption, agencies
such as Voice Over IP (VOIP),
were asked to:Always Connected Seamless
Network Mobility, IPTV, and Cloud Upgrade public/external facing servers and services (e.g.
services for ubiquitous mobile
Web, email, DNS, ISP services, etc.) to operationally use
devices."
native IPv6 by the end of FY 2012.
Upgrade internal client applications that communicate withpublic Internet servers and supporting enterprise networks
to operationally use native IPv6 by the end of FY 2014.
Designate an IPv6 Transition Manager and submit his or
her name, title, and contact information to

May 2012

Jim Bound
CTO, IPv6 Forum Chair North
American IPv6 Task Force (NAv6TF)

Page 6

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentIPv6@omb.eop.gov by October 30, 2010. The IPv6 Transition Manager is to serve as the person
responsible for leading the agency‘s IPv6 transition activities and will liaison with the wider Federal
IPv6 effort as necessary.
Ensure agency procurements of networked IT comply with FAR requirements for use of the USGv6
Profile and Test Program for the completeness and quality of their IPv6 capabilities.

To facilitate the Federal Government‘s adoption of IPv6, OMB will work with the National Institute ofStandards and Technology (NIST) to continue the evolution and implementation of the USGv6 Profile
and Testing Program. This Program provides the technical basis for expressing requirements for IPv6
technologies and tests commercial products‘ supportof corresponding capabilities.
NIST has implemented a Website deployment
monitor to track the status of the 2012 Mandate
goals. This Website is available at: http://usgv6deploymon.antd.nist.gov/cgi-bin/generate-gov.
Figure 1 is a partial sample from the Website for
September 2011.
Transition Managers are advised to check the
deployment monitor to verify the accuracy of their listof Websites, domains, and mail services that are
being monitored.
3.1.2

Agency Transition Plans

All Federal Government agency leaders were asked
to complete an IPv6 Transition Plan, based on atemplate provided by OMB, by April 2011 to:


3.1.3

Figure 1. View of IPv6 Deployment Monitor

Upgrade public/external facing servers and services (e.g. Web, email, DNS, ISP services, etc.) to
operationally use native IPv6 by the end of Fiscal Year 2012.
Upgrade internal client applications that communicate with public Internet servers and supporting
enterprise networks to operationally use native IPv6 by the end of Fiscal Year 2014.
OMB Memorandum M‐05‐22

OMB Memorandum M-05-22, issued August 2, 2005, laid the groundwork for the early stages ofintegration by requiring Federal agencies, specifically agency CIOs, to confirm that agencies had
successfully demonstrated IPv6 capability over IP backbone networks and reported by June 30, 2008.
The memo, broadly circulated among government and industry, specified the critical timeline in which
IPv6 readiness had to be satisfactorily demonstrated across the Federal Government. A copy of the
OMB Memorandum M-05-22 is available online at
http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2005/m05-22.pdf.
The Memorandum also directed NIST to develop the technical infrastructure (standards and testing)necessary to support wide-scale adoption of IPv6 in the U.S. government. In response, NIST developed
a technical standards profile for USG acquisition of IPv6 hosts, routers and network protection devic es.
Use of the NIST technical standards and testing for USG Acquisition is codified in the FAR.

May 2012

Page 7

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

3.2 IPv6 Federal Acquisition Regulations (FAR)
DoD, GSA, and NASA published a proposed rule in the Federal Register at 71 FR 50011, August 24,
2006, to amend the FAR to ensure that all new IT acquisitions using Internet Protocol are IPv6
compliant. The Civilian Agency Acquisition Council and the Defense Acquisition Regulations Council(Councils) issued a final rule amending the FAR to require that IPv6-compliant products be included in
all new IT acquisitions using Internet Protocol effective December 10, 2009.
3.2.1

Current Applicable FAR Previsions

FAR 7.105(b)(4)(iii) For information technology acquisitions using Internet Protocol, discuss whether the requirements
documents include the Internet Protocol compliance requirements specified in 11.002(g) or a waiver ofthese requirements has been granted by the agency‘s Chief Information Officer.
FAR 11.002(g)(g) Unless the agency Chief Information Officer waives the requirement, when acquiring information
technology using Internet Protocol, the requirements documents must include reference to theappropriate technical capabilities defined in the USGv6 Profile (NIST Special Publication 500-267) andthe corresponding declarations of conformance defined in the USGv6 Test Program. The applicability of
IPv6 to agency networks, infrastructure, and applications specific to individual acquisitions will be inaccordance with standards identified in the agency‘s Enterprise Architecture (see OMB Memorandum M05-22 dated August 2, 2005).
FAR 12.202(e)(e) When acquiring information technology using Internet Protocol, agencies must include theappropriate Internet Protocol compliance requirements in accordance with 11.002(g).
FAR 39.101(e)(e) When acquiring information technology using Internet Protocol, agencies must include theappropriate Internet Protocol compliance requirements in accordance with 11.002(g).
3.2.2

Acquisition Guidance

It is detailed in the FAR that agency acquisition processes will be modified to include detailing of
required IPv6 capabilities as defined by USGv6 Profile (NIST Special Publication 500-267) and thecorresponding declarations of conformance defined in the USGv6 Test Program. These processes andprocedures also need to address procurement of services as well as products.
The acquisition of IPv4/IPv6-based network infrastructure is a collaborative effort between technical andacquisition resources, and between financial and mission management. It is recommended that crossfunctional teams be empaneled to develop agency-specific processes and procedures addressing theirrequirements that can be updated over time, as appropriate. These services specifications are notlimited to ISP services. They may also include access methods for provision of application services,
including cloud provision.
3.2.2.1

Background

During the late 1980s, the Public Switched Telephone Network migrated from analog to digitaltechnology utilizing a series of technical specifications and protocols labeled Integrated Services Digital
Network (ISDN). This process included a large number of protocols and configuration options that were
May 2012

Page 8Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

not standardized until mid-way through the deployment, which hampered service and productdevelopment, acceptance, and use for years. During the initial analysis of the Next Generation Network
Protocol, it was determined that IPv6 would not be backwards compatible with IPv4. This action
spawned a collection of IPv6 protocols that would replace their existing IPv4 counterparts. This meantthat extensive testing would need to be done in all areas of the network, including standard network andend user devices features and functions and how they interoperate.
Government and industry experts developed various IPv6 test and interoperability networks, protocol
test and certification methods, as well as a minimum set of standard IPv6 protocols and well known
options that support IPv6 network operations. The Defense Research and Engineering Network (DREN)
was tasked with being the initial USG IPv6 test and evaluation network prior to wider adoption by otherparts of the government. Networking experts at NIST had been following IPv6 protocol developments.
As part of the initial OMB mandate, they developed both standard product profiles and test andcertification processes for USG deployment to avoid the past ISDN deployment issues.
3.2.2.2

Equipment Profiles

Three types of network attached devices (sets of functions or capabilities) were defined routers, end
user, and network protection devices. If the device routes packets (whether it is a router or a server withmultiple interfaces that is running a routing application), then it is a router. If the device is not a router but
is used to protect the network, servers, or other devices, then it is a network protection device.
Everything else is an end user device.
3.2.2.3

Example Case

Organizations with large networks usually develop a standard set of router and switch configurations t odeploy across their networks in order to improve service and reduce maintenance costs. As an example,
suppose an organization has two sizes of field offices, a regional office, data centers, and headquarters.
The smaller field offices have 16/24 port routers with T1 interfaces, while the larger field offices have thesame 16/24/32 port routers with fractional T3 (Frac T3) circuits that terminate at the closest regional
office. Regional offices connect to at least two of the data centers with OC-3c connections, andheadquarters also connects to at least two data centers with multiple OC-3c connections. The data
centers are the gateways to the Internet and other networks are interconnected to each other by
fractional OC-48(c) connections. If the offices are connected to a service provider network, then theorganization‘s routers and switches would be connected by GigE to the service provider‘s routers thatwould terminate these circuits.
This sample organization is looking to replace T1 and Frac T3 point-to-point circuits with service provider
based MPLS/VPN ―cloud‖ connections. During the last two tech refresh cycles, all router control andswitching hardware was upgraded to the latest firmware supporting version 2.0 of production IPv6 code,
memory upgrades were made to higher capacity chips, and all router and switch OS‘s were brought up
to latest tested, secured production release. This network has a two router vendor policy with mixed
devices in the field and one of each at the data centers and headquarters.
As this organization goes out to add new field offices and to enhance backbone interconnectivity, thesepurchases will fall under the new FAR regulations on IPv6 compliance and support. They build a project
team consisting of Network Engineering and Operations, Server support, IT, and procurement. They
contact their two well-known router vendors and request any Supplier's Declaration of Conformity(SDOC)s on any existing or new equipment. Network Engineering and Operations personnel dump
router configurations, firewall logs and protocol dumps of major links identifying all protocols on the
May 2012

Page 9Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

network. Server support identifies all higher layer application protocols. Network Engineering confirms
that: (1) their Interior Gateway Router Protocol, the router to router protocol used within the Agencies
network, is IS-IS; and (2) the Exterior Gateway Router Protocol, the router to router protocol that is used
to advertise the Agencies prefixes to the rest of the Internet, is BGP4.
The network engineering and server support groups have some unresolved questions on IPv6 link layer
protocols and their potential interaction with IPv4 in a dual-stacked environment. This is a small agency
without the need of a full-time test lab, so through an earlier formal agreement with a sister agency, they
run a shared network test lab as they also have some common router configurations. Both service
providers who are vying for the MPLS service contract have IPv6 test and integration labs that for asmall fee can also be used for IPv6 testing.
The two agencies‘ procurement groups communicate on issues of common interest. It was discoveredthat the sister agency has already filled out the IPv6 profile, which was added to the existing standard
IPv4 router requirements profile they had been using to purchase for several years.
A wider discussion of the relative responsibilities of procurement departments and Offices of the CIO isgiven in the USGv6 Buyers Guide at http://www.antd.nist.gov/usgv6/BuyersGuide.html. For a summaryof the relevant amendments, refer to http://edocket.access.gpo.gov/2009/pdf/E9-28931.pdf. To review
these amendments in their full context, refer to https://www.acquisition.gov/far/index.html.

May 2012

Page 10

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

3.3 Federal IPv6 Task Force

Figure 2. Federal IPv6 Governance Framework

In order to provide better guidance and coordination, the Federal IPv6 Task Force was established tohelp guide agencies through the IPv6 transition process. Figure 2 depicts the Federal IPv6 Governance
Framework.

3.4 Sample Agency Timelines
3.4.1

Sample Federal Agency Execution Timeline

The IPv6 Outreach Sub-Working Group, described in section 3.6.2, prepared a sample execution
timeline for agencies in meeting the OMB-directed IPv6 transition milestones. The first timeline, shown in
Figure 3 describes the 2012 milestones.

May 2012

Page 11

Milestone
4 5 6

7

8

06/12

12/12

06/14

12/14

Legend:In Progress:

12/13

3

06/13

2
12/11

Sample Agency IPv6 Execution Timeline Key Stakeholders
2012 Public Facing Execution(External)
Network Connectivity
Internet Gateway 1 IPv6 EnabledInternet Gateway 2 IPv6 Enabled
Networx or Other Carriers(ISP)Internet Gateway 3 IPv6 EnabledInternet Gateway 4 IPv6 Enabled
Addressing
ISP Provided IPv6 Addresses
Networx or Other Carriers(ISP) ARIN
Announce Agency
Routing
Basic IPv6 Routing
IPv6 BGP Routing Gateway 1
IPv6 BGP Routing Gateway 2
Networx or Other Carriers(ISP) Routing Vendors
IPv6 BGP Routing Gateway 3
IPv6 BGP Routing Gateway 4
IPv6 Multi-home Routing
Domain Name Services (DNS)
ns1 IPv6 Enabled
ns2 IPv6 Enabled
GSA (.gov) DNS Providers
Ns3 IPv6 Enabled
ns4 IPv6 Enabled
Primary Agency Domain (www.agency.com)
Phase 1Cloud/Hosting Providers
Web Vendors
Phase 2
Mail
Inbound SMTP IPv6 Enabled
Cloud Hosting Providers
SMTP/Mail Security
Outbound SMTP IPv6 Enabled
Vendors
Security
DMZ Basic IPv6 Security
MTIPS/TICAP Providers
DMZ Comparable IPv6 Security
SMTP/Mail Security
Vendors
Full IPv6 Security
Network Management
Basic IPv6 Network Management
Network Management
Comparable IPv6 Network Management
Vendors
Full IPv6 Network Management
Public Facing Domains
1 Public Facing Domain IPv6 Enabled
Cloud/Hosting Providers
35% Public Facing Domains IPv6 Enabled
Web Vendors
100% Public Facing Domains IPv6 Enabled
PilotsMission Pilots
Impacted
Vendors/Providers

1
06/11

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Completed:

Figure 3. Timeline for 2012 Milestones

May 2012

Page 12Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

May 2012

5

6

7

8

12/12

06/13

12/13

06/14

12/14

06/12

4

12/11

Sample Agency IPv6 Execution Timeline Key Stakeholders
2014 Enterprise Network Execution(External)
Network Connectivity
Core/Backbone Network
Infrastructure Routers 25%
Networx or Other Carriers
Routers Vendors
Infrastructure Routers 50%
Infrastructure Routers 100%
Addressing
Internal IPv6 Addresses Allocated
DHCPv6 Enabled 25%
ARIN
DCHPv6 Vendors
DHCPv6 Enabled 50%
DHCPv6 Enabled 100%
Routing
Core/Backbone Network Routing
Infrastructure Routing 25%
Networx or Other Carriers
Router Vendors
Infrastructure Routing 50%
Infrastructure Routing 100%
Domain Name Services (DNS)
DNS Vendors
Internal DNS IPv6 Enables
Data Centers
Data Center 1 IPv6 Enabled
Networx or Other Carriers
Data Center 2 IPv6 Enabled
Router Vendors
IT Vendors
Data Center 3 IPv6 EnabledService Providers
Data Center 4 IPv6 Enabled
Mail
Mail Vendors
Exchange IPv6 EnabledInternal Applications and Services
IPv6 Enabled Apps and Services 25%
Application Vendors
IPv6 Enabled Apps and Services 50%
Service Providers
IPv6 Enabled Apps and Services 75%
IT Vendors
IPv6 Enabled Apps and Services 100%
End Device Transition
Internal Servers IPv6 Enabled 25%
Server and OS Vendors
Internal Servers IPv6 Enabled 50%
Virtualization Vendors
Internal Servers IPv6 Enabled 75%
IT Vendors
Internal Servers IPv6 Enabled 100%
User Computers IPv6 Enabled 25%
User Computers IPv6 Enabled 50%
Laptop/Desktop and OS
Vendors
User Computers IPv6 Enabled 75%
User Computers IPv6 Enabled 100%
PDA/Mobile Devices IPv6 Enabled 25%
PDA/Mobile Devices IPv6 Enabled 50%
PDA Vendors
PDA/Mobile Devices IPv6 Enabled 75%
PDA/Mobile Devices IPv6 Enabled 100%

Milestone
1 2 3
06/11

The second timeline, shown in Figure 4 describes the 2014 milestones. Note that the 2014 timelinebuilds upon the 2012 milestones.

Page 13

8
12/14

06/13

In Progress:

7
06/14

12/12

Legend:

6
12/13

5

06/12

4

12/11

Sample Agency IPv6 Execution Timeline Key Stakeholders
2014 Enterprise Network Execution(External)
Mission Devices IPv6 Enabled 25%
Mission Devices IPv6 Enabled 50%
IT Vendors
Device Vendors
Mission Devices IPv6 Enabled 75%
Mission Devices IPv6 Enabled 100%
PilotsEnclave Pilot Phase 1
Enclave Pilot Phase 2
IT Vendors
Enclave Pilot Phase 3

Milestone
1 2 3
06/11

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Completed:

Figure 4. Timeline for 2014 Milestones

3.4.2

Implementation Recommendations

The Federal IPv6 Taskforce has provided the following guidance to assist agencies with their respective
IPv6 planning and implementation:
September 2011








Aggressively resolved any problems identified
Integrated Lessons Learned into Transition Plan
Finalized plan for DNS, review IPsec signing to include AAAA records
Identified additional public services, including sub agencies
Planned for mail exchange upgrades
Publicized successes and build a culture of IPv6
Acquisition (Agency procurement processes should have IPv6 requirements fully integrated into
the acquisition lifecycle and processes.)

December 2011






Authoritative DNS servers should provide transport over IPv6
Infrastructure components (e.g., ISP, Load balancers, etc.) should support IPv6
Additional sites and services should be IPv6-enabledComplete Support Staff, Operations and Security Staff training and experimentation
Meet with vendors to ensure critical capabilities will be covered

March 2012

Agencies should have a complete understanding of their vendor‘s‘ readiness and support of IPv6and have a plan to upgrade/implement/replace components (Network, Systems, Software, etc.) as
appropriate and necessary to assure that industry partners are fully capable, complaint and readyto provide implementation of IPv6 configuration within their networks and infrastructure.
Continue progress on enabling public facing services– Estimated 10% complete
Upgrade Operations and Management tools to be IPv6-aware

May 2012

Page 14

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government








Conduct awareness and training for Project Managers, Systems Engineers, Security Engineers,and Change Managers as soon as possible
Integrate IPv6 requirements into acquisition and COTS upgrade plans. COTS product upgrades
should be made to IPv6-capable products only
Include IPv6 requirements in proposals for all new projects
Track the IPv6 status of all their COTS and GOTS products—Agencies should begin their platform
assessment at this time and should incorporate the results into a spreadsheet or database where
all the results are visible in one place. This should be a living document/record which reflects all
upgrades and changes to products so the sites can track their IPv6 readiness at any point in time.
It is important to emphasize that assessments and COTS/GOTS transition plans can (and should)
begin at this time and do not necessarily have to wait until the backbone is dual-stack.
Review Agencies transition plan—A forward-looking schedule should be created that will bringsites to the IPv6 capability by the target date. This may include proactively upgrading products to
IPv6 capability even if there is no tech refresh cycle or engineering change driving the upgrade.

June 2012Continue to work with vendor to identify and eliminate IPv6 bugs and workarounds
Develop a testing and integration process for key fixes
Continue progress on enabling public facing services (Web, DNS, MX)– Estimated 50% complete

September 2012
OMB instructions to the Enterprise Architecture (EA), Capital Planning and Investment Control (CPIC),
acquisition and security community should include the following guidance:

Public services should be 100% IPv6-enabled
Start integrating milestones to successfully meet 2014 milestones
Ongoing monitoring will ensure focus is on operational status
Agencies should have fully integrated IPv6 activities, goals and milestones into the overall
governance and management processes to include:– Enterprise Architecture: IPv6 should be fully integrated into the agencies‘ EnterpriseArchitecture including the core design artifacts (e.g., network diagrams and security
documentation), as well as the Infrastructure Reference Model and Security Reference Model.
– Capital Planning: Agency capital planning processes should include IPv6 in all reviews toensure that budgets and project plans include the appropriate IPv6 activities.
– Security: All agency security processes and reviews should include IPv6.

3.5 Agency Progress Tracking
NIST has established a Website to track the progress of agencies in meeting the 2012 OMB milestone
for public facing services. The NIST Deployment Monitor can be found at http://usgv6deploymon.antd.nist.gov/cgi-bin/generate-gov. The Deployment test suite can be found at the USGv6
testing Website via http://www.antd.nist.gov/usgv6/.

May 2012

Page 15

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

3.6 Sub-Working Groups
In transitioning to IPv6 there are a number of common issues that need to be addressed by all agencies
with networking best practices. In addition, the IPv6 Task Force believes that despite the complexity andanomalies associated with each agency networks and infrastructure there is some value add in sharing
best business practices among Federal agencies. To reduce time and effort in resolving these problems
and to improve cross agency information exchange, volunteer Sub-Working Groups were set up in three
general areas: IT Management, Outreach, and Technical.
The Leads and members of the Working and Sub-groups are interested in learning more about youragency‘s issues and progress and are willing and ready to assist you in learning more about issues andconcerns you might have relative to IPv6 Transition and in helping you better plan and transition to meet
OMB directives for FY 2012 and 2014.
3.6.1

IT Management Sub-Working GroupThe IT Management Sub-Working Group, subordinated to the IPv6 Federal Task Force, is committed toproviding support, advocacy and leadership to government agencies and their IPv6 Transition Managers
during the transition and implementation of IPv6. The Team is co-led by Mr. Donald Beaver (GSA) and
Mr. Luis F. Gonzalez (DHS).
The main goal of the IT Management Sub-Working Group is to assist Transition Managers insuccessfully assuring the implementation of IPv6 compliance in networks and agency infrastructure per
the OMB Federal Mandate. The Sub-Working group will be primarily a conduit of IPv6 information,intervention and support to Agencies, providing or facilitating assistance in IPv6 Project Planning, IPv6
Procurement and Acquisition, and IPv6 Vendor Integration.
To this end the IT Management Sub-Working Group will identify best practices and will share lessons
learned from agency experiences and the private sector with IPv6 implementation. We further envision
our strategic role to also collaborate with other Sub-Working groups, as appropriate and necessary, toadvocate the profound benefits of IPv6 adoption. The sub-working group of the Task Force will be
convening bi-monthly meeting with agency transition managers to better facilitate and accomplish thevision and mission set forth by OMB.
3.6.2

Outreach Sub-Working GroupThe Federal IPv6 Task Force identified Outreach across government agencies and with industry as a
critical aspect of the Federal IPv6 transition. Mr. Steven Pirzchalski (VA) has been designated as theFederal IPv6 Outreach Chair. The goals for the outreach program include facilitating collaboration andcommunication between agencies and within industry, sharing information and results and identificationof training and other resources to assist in the transition process.
Some of the Federal outreach activities will include:




3.6.3

Semi-annual Federal IPv6 conferences
Direct agency interaction and discussion
Resource and support identification
General inter-agency IPv6 training
Technical Sub-Working Group

Another critical aspect of the transition effort is the discussion of technical issues common to the
Agencies. A Technical Sub-Group co-led by Mr. Stewart Mitchell (DoL) and Ms. Sharon Lattanze
May 2012

Page 16

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government(USPS), was organized and has a series of monthly roundtable discussions on technical topics ofinterest to the Agencies in cooperation with the ACT-IAC IPv6 Address Planning Sub-group co-lead by
Mr. John L. Lee and Mr. Kenny D. Burroughs.

3.7 USGv6 Activities
3.7.1

USGv6 Profile Process

OMB Memorandum M-05-22 also directed the NIST to develop the technical infrastructure (standards
and testing) necessary to support wide-scale adoption of IPv6 in the U.S. government. In response,
NIST developed a technical standards profile for USG acquisition of IPv6 hosts and routers, as well as a
specification for network protection devices. The Host and Router Profile includes a forward-looking set
of Requests for Comments (RFCs), published by the Internet Engineering Task Force (IETF), thatencompasses basic IPv6 functionality, and sets specific requirements and key optional capabilities forrouting, security, multicasting, mobility, network management, and quality of service.
The Protection Device Profile contains a NIST-established set of capability requirements for IPv6 aware
firewalls and intrusion detection systems. This Profile, which can be found at
http://www.antd.nist.gov/usgv6/profile.html, underwent extensive vetting by both industry and theFederal IT community. It lists the Federal technical requirements for secure and inter-operable network
products into the global IPv6 marketplace.
3.7.2

USGv6 Test Program

Following publication of the USG IPv6 Standards Profile, an infrastructure to demonstrate IPv6 productcompliance was established. NIST established a testing program based on ISO 17025-accredited test
laboratories and standard reference tests to assure compliance of Hosts, Routers, and Network
Protection Devices.
NIST developed Special Publication (SP) 500-273, USGv6 Test Methods: General Description andValidation, which, taken together with the abstract test specifications published at the USGv6 testing
Website, provides the essential material for accreditors to establish testing programs. This is prerequisite to open public review of the test specifications, and Accreditation Bodies' establishingassessment programs, leading to the creation of Test Laboratories that adhere to the ISO 17025"General Requirements for the Competence of Testing and Calibration Laboratories.‖
Compliance is signaled by device vendors issuing a "Suppliers Declaration of Conformance,‖ based on
ISO 17050. Specific provisions of this SDOC require that host and router products be tested forconformance and interoperability, and network protection products undergo functional testing inaccredited laboratories.
The test program is in operation; moreover, accredited laboratories are now in operation and have been
testing products with USGv6 capabilities for conformance and interoperability. The latest information canbe found via http://www.antd.nist.gov/usgv6/.

3.8 DoD IPv6 Profile
A June 2008 Memorandum issued by the DoD Assistant Secretary of Defense – for Networks andInformation Integration/DoD Chief Information Officer (ASD NII/DoD CIO) entitled ―DoD Internet Protocol
Version 6 (IPv6) Definitions,‖ updated the definition of ―IPv6 Capable Products‖ and ―IPv6 Capable
Networks‖ in the context of products intended for use in DoD networks. ―IPv6-Capable Products shall beable to interoperate with other IPv6 Capable Products on networks supporting only IPv4, only IPv6, or

May 2012

Page 17

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

both IPv4 and IPv6.‖ In addition, these products are to comply with the IPv6 standards contained in the
DoD Information Technology (IT) Standards Registry (DISR) as elaborated in ―The DoD IPv6 Standards
Profiles for IPv6 Capable Products.‖ The first version of the DoD IPv6 Profile was published in July 2006,
and it has been updated annually. The current officially promulgated version is Version 6.0, dated July
2011, and is available on the DISRonline at: https://disronline.csd.disa.mil.
The DoD IPv6 Profile provides guidance on applying DoD policy, DISR requirements, and IETF
requirements to clearly define the requirements for IPv6 Capable networking equipment for acquisitions.
The DoD IPv6 Profile defines specific tailored standards profiles for six product classes(Host/Workstation, Router, Layer 3 Switch, Network Appliance/Simple Server, Security Device, andAdvanced Server) by identifying the standards (RFCs) that apply to products of that class. The DoD IPv6
Profile lists each standard according to its level of requirement, as indicated below:MUST: The standard is required to be implemented in the product now; it is essential to IPv6
capability and interoperability.
SHOULD: The standard is strongly recommended and should be followed in implementation,
unless there are particular circumstances justifying its omission.
SHOULD+: Similar to SHOULD; however the standard will likely advance to MUST in
the next version of the DoD IPv6 Profile or on a specific timeline identified in the text.
Conditional Requirement: A requirement at one of the above levels is only called for in particularapplication or deployment.

DoD no longer supports standalone IPv6 product certification testing. For products identified in the DoD
Unified Capabilities Requirements (UCR) document, IPv6 requirements will be validated in conjunction
with the larger Interoperability Certification and Information Assurance testing that is conducted on the
product for listing on the UC Approved Products List (APL). The detailed IPv6 requirements for UC
products and/or functions are provided in section 5.3.5 of the UCR 2008, Change 3 document, and arederived from the DoD IPv6 Profile. The UCR document and the UC APL are available on the following
link: http://www.disa.mil/ucco/.
While the USG IPv6 Profile (developed by NIST) and the DoD IPv6 Profile started as independent
efforts, the current published versions reflect collaboration between the editorial teams to harmonize thetwo documents. Most of the differences between the earlier versions have been harmonized, and theresidual differences reflect specific mission requirements particular to target users of each document.
For example, the DoD Profile mandates the use of the Suite-B encryption algorithms [RFC 4869] basedon DoD policy; however, these algorithms are considered beyond current civilian requirements.
The editors of the two profiles agree that the documents need not be identical; however, they must becompatible. Therefore, commercial products certified to meet either are unlikely to have interoperability
issues with products certified to meet the other. The two editorial teams will continue to dialog and cross review to maintain compatibility throughout future updates.

4. The Business Rationale for IPv6
Over the past several years, the robustness, scalability, and limited feature set of IPv4 has been tested
by a consistently expanding need for new IP addresses. The surge of new devices and Internet
connectivity has continued to accelerate; therefore, the Internet Assigned Numbers Authority (IANA)
IPv4 address space is now exhausted.

May 2012

Page 18

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

One of the drivers for establishing the 2012 milestone was the pending exhaustion of IPv4 address
space and the realty that soon there would be IPv6-only users on the Internet. This is considered acontinuity of operations issue for agencies that provide citizen services or work with external business
partners.
With IPv4 address space exhausted, IPv6 is now inevitable as we continue to move toward aubiquitously connected society. Without the full deployment and support of IPv6, it is just a matter of time
before networks become isolated and unable to communicate. The ability to integrate computers witheveryday devices, such as mobile phones, handheld devices, tablets, and home entertainment, is nolonger a want − it is a need. Without this capability, we will severely limit the move toward a connectedsociety, hindering business efficiency. Federal Government personnel and information workers need
integrated, secure functionality that helps them manage their professional lives through the use of email, instant messaging (IM), contact management, shared calendars, and relationship management.
Figure 5 provides a high level business-focused summary of the advantages IPv6 has over IPv4 interms of features:
FeatureIPv6
Easier Management IPv6 networks provide auto-configurationof Networks
capabilities. They are simpler, flatter and moremanageable, especially for large installations.

IPv4
Networks must be configured manually orwith Dynamic Host Configuration Protocol(DHCP). IPv4 has had many overlays tohandle Internet growth, demanding
increased maintenance efforts.
End-to-end
Direct addressing is possible due to vast address Widespread use of Network Address
Connective Integrity space; the need for network address translation Translation (NAT) devices means that adevices is effectively eliminated. This allows
single NAT address can mask thousands
network resources to have their own unique real of non-routable addresses, making endIP addresses, paving the way for secure end-to- to-end integrity unachievable.
end, peer-to-peer networks. This will enablepeople to access information and shareresources without going through a complex mazeof middle boxes that require IT management.
Unconstrained
3.4 x 1038 = 340 trillion trillion trillion
4.29 x 109 = 4.2 billion addresses—far
Address Abundance addresses—about 670 quadrillion addresses per less than even a single IP address per
square millimeter of the Earth's surface.
person on the planet.
Platform for
Given the numbers of addresses, scalability, and IPv4 was designed as a transport andInnovation,
flexibility of IPv6, its potential for triggeringcommunications medium; thus, any work
Collaboration, and innovation and assisting collaboration is
on IPv4 has had to find ways around
Transparency
unbounded.
increasing constraints.
Integrated
IPv6 provides interoperability and mobility
Relatively constrained network topologies
Interoperability and capabilities that are already widely embedded in restrict mobility and interoperability
Mobility
network devices.
capabilities in the IPv4 Internet.
Improved Security
Security is dependent on applications;
IPsec is built into the IPv6 protocol and is usable
Features
IPv4 was not designed with security inwith a suitable key infrastructure.
Capabilities
mind.
Figure 5. IPv6 vs. IPv4 Features

The transition to date has been gradual but the steep curve is starting and it is critical to be prepared. It
is also important to note, however, that the transition to IPv6 is more complex than previous advances
we have made regarding Internet technology (e.g., from dial-up modems to always-on DSL or from hostMay 2012

Page 19

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

files to the domain name system). This is all the more reason why the critical step toward the ―Next
Generation Internet‖ requires immediate attention and detailed planning to ensure success.

5. Federal IPv6 Transition: The “To Be” StateIn 2005, OMB formally initiated the Federal process of transitioning to IPv6 with the release ofMemorandum 05-22 which culminated in a successful set of Federal-wide IPv6 tests. In September
2010, the Federal CIO released a new IPv6 directive that established a step-wise approach for agencies
transitioning to IPv6. This approach focused Federal agencies on meeting a short-term goal of making
their external and public-facing services IPv6 operational by the end of FY2012. A mid-term goal wasestablished to make agency internal services IPv6 operational by the end of FY2014. These goals would
provide agencies with the operational infrastructure to build truly robust IPv6-enabled end-to-end
services in the future that would take advantage of advanced IPv6 capabilities and features.
One of the drivers for establishing the 2012 milestone was the pending exhaustion of IPv4 address
space and the realty that soon there would be IPv6-only users on the Internet. This was considered acontinuity of operations issue for agencies that provided citizen services or worked with externalbusiness partners. The expected depletion of IPv4 addresses finally occurred in February of 2011 whenthe Internet Corporation for Assigned Names and Numbers (ICANN) made the last assignments of IPv4
addresses to the Regional Internet Registries (RIR).
As agencies move forward with their IPv6 transition planning and implementation, the initial strategy
should be to focus on making IPv6 operational to meet specific OMB targets or milestones and ensure
short/mid-term IPv6 operational ability. Agencies should initially focus on rolling out IPv6 operational
capabilities that are overlaid on the existing IPv4 infrastructure and provide comparable features andfunctionality. This is the most expedient approach and will be the easiest for agencies to adopt to create
an operational IPv6 capability in order to successfully reach the 2012 milestone and 2014 milestonetargets. However, this approach alone will not provide agencies with the robust IPv6 deployments thatwill allow them to take advantage of many of the new features and functionality of IPv6.
Agencies also need to develop a deployment approach focused on leveraging the full capabilities andfeatures of IPv6. This could require significant changes in the underlying physical infrastructure, as well
as a potentially significant redesign of the enterprise network and of many of the policies and standard
operating procedures. Agencies should incorporate IPv6 as part of their technology refresh and make itpart of their longer term IT strategy.
From a longer-term perspective, agency‘s should evaluate how IPv6 can be rolled into mid- and longterm modernization activities and strategies, ensuring requirements are being included in existing
acquisition and development efforts, particularly for those efforts that will be in operation for extended
periods of time.

5.1 The 2012 “To Be” StateThe 2012 ―To Be‖ state is focused on ensuring agencies can continue communicating with outside
entities utilizing IPv6. With the exhaustion of IPv4 addresses that has occurred and the continuing rapid
deployment of broadband services, including those being spurred by the national broadband initiative
and the accelerated deployment of mobile 4G and Wi-fi services, it is clear that IPv6 only users will soon
be a reality within the U.S. Federal agencies will need to ensure their ability to continually communicate
with these users to maintain proper continuity of services and their overall mission. Essentially, all IPbased communications that occur with entities outside of the agency‘s enterprise network should beavailable operationally over IPv6.
May 2012

Page 20

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

The following excerpts from the ―Federal Government Adoption of Internet Protocol Version 6 (IPv6)
Frequently Asked Questions‖ Updated: November 4, 2011 provider better clarification of the services
included for the 2012 milestone.
How do you define what is a USG provided “public/externally facing server or service”?
The intent of the FY 2012 requirement is to ensure that any and all networked services that agencies
provide to the general public over the Internet are seamlessly accessible via both IPv6 and IPv4.
That is, a service that is both accessible external to the agency (i.e., over the Internet) andaccessible to general public users.
Internal services (i.e., accessible only within an agency enterprise or intra-net) and external services
that are only accessible to sites/users employing virtual private network (VPN) technologies, or toclosed user groups (e.g., requiring an out-of-band establishment of a login account) are not in scopeof the FY 2012 requirement.
In summary, if there is a USG provided network service that is currently available to all users of the
public Internet, that service must be available to a user who only has IPv6 capabilities.
What sites, domains and services are in scope?
Typical examples of public external facing services that are within the scope of the memorandum
include external web (HTTP), email (STMP) and domain name system (DNS) services; but thescope extends to any and all such public services provided or contracted by an USG agency. This
includes USG network services both named under the .gov top level domain (TLD), and in other
TLDs, and includes services that are entirely outsourced to commercial providers .
Agencies will need to take an inventory of the services they use to communicate with outside entities.
They should utilize multiple methods in ascertaining these services such as active router and switch
configuration audits and Quality Assurance tools. It is also recommended that agencies utilize packet
capture, protocol analysis and network analyzers tools directly attached to ingress and egress circuits, toensure they have fully accounted for all services leaving or entering their enterprise. By the end of
FY2012, agencies will need to provide IPv6 operational capabilities for services such as: E-mail (SMTP)
 FTP
 Web (Including SSL services) Other DNS
In addition to services entering or leaving the agency‘s enterprise, outsourced services that interact
outside the agency should be included in the overall 2012 planning and architecture, such as: Cloud Services
 DNS
 Web
 E-mail (may include more than SMTP)
In order for the services to be operational over IPv6, agencies will need to ensure the supporting
infrastructure operations are in place and fully functional in IPv4 are also available and functional forIPv6. Examples of these infrastructure services include:

ISP services
Addressing and routing

May 2012

Page 21

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentSecurity services
Network management services

The nominal 2012 ―To Be‖ architecture will be focused on deploying IPv6 in dual stack configuration overthe existing IPv4 infrastructure. While there may be some difference, the majority of the capabilities,
policies, and standard operational procedures will be very similar.

5.2 The 2014 “To Be” StateThe 2014 ―To Be‖ state is focused on ensuring the internal segment of the agency‘s enterprise is IPv6
operational and able to IPv6 traffic from public/external locations. As agencies move toward the 2014
―To Be‖ state, their plans should focus on ensuring all internal devices, networks, services, andapplications that are required for the use of public/external IP-based communications are IPv6
operational. This will impact a significant number of devices, applications and infrastructure on eachagency‘s enterprise network.
How do you define what USG applications “communicate with public Internet servers”?
The intent of the 2014 requirement is to ensure that public IPv6-enabled network services that areprovided external to an agency, are accessible to USG users residing in their agency enterprisenetworks. The definitions of what is meant by “public” are the same. That is, in this case, the same
service that an USG client/application is trying to access, is available to everyone on the Internet.
The agency clients applications, host operating systems, and supporting networking infrastructure
should be IPv6-enabled such that it is possible to establish native IPv6 end-to-end communication
between client application and the external IPv6-enabled public server/service.
Typical examples of client applications that access public Internet servers/services include external
web (browsers), email (mail user agents), DNS (resolvers), and their host operating systems.
Messaging and social media applications that access publicly available network servers are also
within scope.
In summary, if there is an IPv6-enabled external network service that is currently available to allusers of the public Internet, that service must be available to an Agency network user who only has
IPv6 capabilities. Of course, this requirement does not override agency policies that might restrict
employee access to such services. But if such a service is permissible to access using IPv4, it must
be possible to access the same service using IPv6.
The following excerpts from the ―Federal Government Adoption of Internet Protocol Version 6 (IPv6)
Frequently Asked Questions‖ Updated: November 4, 2011 provider better clarification of the services
included for the 2014 milestone.
As with the 2012 ―To Be‖ state, the nominal approach will be to deploy IPv6 over the existing IP
infrastructure. This will limit the near-term deployment value of IPv6, but will allow agencies to achieve
an aggressive 2014 deployment date and make IPv6 operational across the enterprise.
In developing the approach to the 2014 ―To Be‖ state, agencies should prioritize their IPv6 deployments
across the enterprise to turn up IPv6 in manageable waves as opposed to attempting an all-at-oncecutover. Agencies with larger enterprise deployments will find that focusing from a ―core out‖
methodology provides a logical process for transitioning the enterprise that starts with the core

May 2012

Page 22

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

WAN/Backbone infrastructure (that should already have been enabled and tested) and then works tosites and finally to LAN segments.

5.3 Beyond the 2014 State
Although the latest memorandum from OMB did not go beyond publicly available services, it is clear thatagencies need to consider at the very least mission critical external services that could be impacted as
IPv6-only users appear on the Internet. Examples of these could include telework, citizen services that
require login-in or other external business partners that utilize secure communications with agencies. In
the next 18 – 24 months as IPv6-only users appear agencies may lose the ability for telework, orInternet-based healthcare services or a variety of other Internet-based services necessary to meet its
agency‘s core mission, reduce cost, deploy cloud services or improve customer service.
In addition, other next steps in the Federal IPv6 transition beyond the 2014 ―To-Be‖ states is the
deployment of secure, end-to-end, IPv6-enabled network services which support Federal Agency Core
Missions and applications from the core to the server center and to desktop and mobile platforms. This
will be accomplished by upgrading, piloting and launching entire production subnets with IPv6
applications and desktop/mobile services. The Internet Protocol upgrade is a core technology that must
be addressed in programs of record when purchasing solutions such as unified communications,workgroup collaboration tools, Web-applications and other end-user applications.
Figure 6 provides high-level examples of IPv6 features and capability enhancements that could be
deployed, by Line of Business (LoB), throughout the Federal community:Line of Business

Objectives/Requirements

IPv6 Feature and Capability Enhancements

Land Use, Mapping,and Agriculture Resource tracking and allocation via
sensor networks
 Land boundary and border marking via
tags with IP addresses

Science, Green
Science, and Weather

 Improved utilization of existing
infrastructure Sensor networking

Commerce, Banking,and Finance End-to-end network security
authentication and encryption

Information Scienceand IT Optimization

 Streamlined data flows and reduced
networking complexity
 Improved end-to-end multimedia andconverged
 communications
 Virtual services and tele-presence
























May 2012

Ad-hoc routing via neighbor discovery
Address tagging with low-order 64-bit identifiers
Extension headers (location-based services)
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce
Sensor Networks
Satellite communications
Ad-hoc routing via neighbor discovery
Extension headers (location-based services)
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce
Sensor Networks
IPsec authentication and encryption
Extension headers (financial attributes)
Unified Communications
Flow labels for priority data flows
Optimized hierarchical addressing and routing
Extension headers (variable)
Unified Communications
Teleworking/Distributed Workforce

Page 23

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Line of Business

Objectives/Requirements

Justice and Law
Enforcement

 Asset deployment identification andtracking
 Real-time, ad-hoc, interoperable
communications

Privacy, Protection,and SecurityIPv6 Feature and Capability Enhancements

Defense, Intelligence,  Secure, mobile communications
and Military Operations  Mobile, ad-hoc communications for













 Transport and container tracking via
Transportation
sensor networks
Optimization, Shipping, Live traffic reporting andand Tracking










Address tagging with low-order 64-bit identifiers
Mobile, ad-hoc routing via neighbor discovery
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce
Asset Tracking/ITV
IPsec authentication and encryption
Extensive address pool
Unified Communications
IPsec authentication and encryption
Mobile, ad-hoc routing via neighbor discovery
Address tagging with low-order 64-bit identifiers
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce
Sensor Networks
Transportation Automation (Wireless Access in
Vehicle Environments)
IPsec authentication and encryption
Mobile, ad-hoc routing via neighbor discovery
Address tagging with low-order 64-bit identifiers
Extension headers (specialize, private use)
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce
Asset Tracking/ITV
RFID
Sensor Networks
Transportation Automation (Wireless Access in
Vehicle Environments)
Ad-hoc routing via neighbor discovery
Address tagging with low-order 64-bit identifiers
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce
Asset Tracking/ITV
RFID
Sensor Networks

Education, Learning,
Knowledge
Management, andLibrary Science Improved end-to-end multimedia andconverged communications
 Virtual services and tele-presence

Health and Biomedical
Science Tele-presence Tele-science (real-time) Records management and security













Flow labels for priority data flows
Source routing for more efficient transport
Unified Communications
Teleworking/Distributed Workforce
Mobile Applications Access
Flow labels for priority data flows
Extension headers (attribution characteristics)
IPsec authentication and encryption
Unified Communications
Mobile Applications Access
Teleworking/Distributed Workforce

Homeland Protection
and First Response












Mandatory, end-to-end authentication and encryption
Non-attributable addressesSecure communications

Mobile, ad-hoc communications for first 
respondersTotal force and asset integration






warfighters Asset integration and insightful
logistics
 Military training/Mission rehearsal

communications

May 2012

Page 24

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Line of Business

Objectives/Requirements

 Tracking via sensor networks
Constituent Services(Delivery and Tracking)  Package locations services

IPv6 Feature and Capability Enhancements






Ad-hoc routing via neighbor discovery
Address tagging with low-order 64-bit identifiers
Extension headers (Location-based services)
Sensor Networks
Asset Tracking/ITV

Figure 6. IPv6 Capability Examples by LoB

6. Leveraging Enterprise Architecture
The purpose of this section is to describe how to use the agency‘s Enterprise Architecture (EA) and the
IT Infrastructure Segment Architecture as strategic planning and execution tools to enable effective IPv6
deployment. The agency‘s EA should be used to:






Assess the ―As-Is‖ IPv4 and IPv6 environments
Envision your agency‘s ―To-Be‖ IPv6 state, defining network services to be IPv6-enabled based
upon the agency‘s business needs
Develop an IPv6 Transition Strategy to address the gaps between the ―As-Is‖ and ―To-Be‖ IPv6
environments
Identify where to invest in IPv6-enabled network services (as defined in your Target EA) through theCPIC process
Monitor IPv6 deployment progress according to the milestones defined in your agency‘s Transition
Strategy Plan.

This concept of operations and the relationship between EA and CPIC is illustrated in Figure 7:

Figure 7. IPv6 Transition Concept of Operations

May 2012

Page 25

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

EA Governance and Management: Governance is the mechanism by which EA planning decisions are
realized and enforced within each agency. Agencies should be prepared to provide OMB withgovernance charters, agendas, and other documentation to demonstrate that:

The agency body responsible for EA governance is aware of the requirement for IPv6 transition
and the specific role IPv6 plays within the agency‘s target architecture.
The agency body charged with implementing IPv6 is coordinating its activities with the EA
governing body, and changes to either EA or IPv6 implementation policies are effectively
communicated to each group.

The EA provides agency managers with the ability to observe the current state of the IPv6 transition
within the agency and its impact on other strategic agency initiatives.

6.1 Using the IT Infrastructure Segment Architecture
OMB requires agencies to incorporate IPv6 modernization activities into their overall EA as well as the
specific IT Infrastructure Segment Architecture for IPv6.
The target architecture should reflect not only the impact on agency networking components, but also
the impact of IPv6 on other architectural views such as Business, Strategy and Performance; Data,
Service Component; Technology; and Security and Privacy. Agencies should integrate their IPv6 target
visions into the following layers of their IT environment, as appropriate:








Business Architecture: Refers to capabilities or tasks that enable the achievement of agency mission
objectives. Core business functions will be supported or enhanced by IPv6-enabled services. As areference point, consider earlier the introduction of telephones and the Internet as examples ofinfrastructure-enabled business function transformations.
Application Architecture: Refers to components/applications that enable the business needs andservices defined in the Business Architecture.
– Application development and certification processes must ensure that IPv6 is supported.
– Development environments, service-oriented architecture (SOA), and Web services, should be
updated to include IPv6.
Technology Architecture: Refers to assets that support IT services and communications. IPv6
migration goes beyond network backbone upgrades to:– Basic naming services, such as DNS and DHCP
– Common shared infrastructure services, such as file, print, database, and Web services– Individual computing units.
Security and Privacy: May be represented as a cross-cutting concern rather than a separate
view of the target architecture. IPv6 deployment within the network backbone may have asubstantial impact on the target security architecture, including:– Changes to network security standards and configuration as a result of the IPv6 end-to-end
security model– Changes to IT security policy– Privacy considerations.

May 2012

Page 26

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Figure 8. Role of IT Infrastructure Optimization

Figure 8 depicts the critical underlying role that IT Infrastructure optimization and related initiatives playin improving agency and program performance to provide better services to end customers, as well as
the impact that IPv6 has in realizing these benefits.
6.1.1

Developing a Shared Approach to Infrastructure
Services

At DOT, IPv6 can provide the
OMB Memorandum 11-29 as issued August 8, 2011 andinfrastructure for services developed
directed agencies to take a shared service approach towith the Intelligent Transportationdelivering commodity IT, including core infrastructure functions.
Systems (ITS), the Vehicle
This approach emphasizes delivering infrastructure capabilities
Infrastructure Integration Project,
as a ―service‖ to the entire agency rather than as individual
and the Next Generation Air
components. One can think of this as a collection of functioning
Transportation Systemcapabilities, including technology, standards, and collaborative(Next Gen).
processes, that enable safe and efficient collaboration throughthe development and deployment of shared operational IT
services. A key aspect of this approach is providing IT
Infrastructure services via a pool of resources (Web servers, application servers, database servers,
servers, storage instances) instead of through discrete instances. The concept also has a broader usagethat includes all configurable infrastructure resources such as computer, storage, and networking
hardware and software to support the running of applications.
IPv6 provides significant advantages in the deployment of shared IT infrastructure services, including

Massive scaling potential

May 2012

Page 27

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government







End-to-end addressing
Improved network level security
Auto-configuration
Mobility
Modular design with clean extensibility

6.2 EA-Driven IPv6 PlanningThis section contains additional details describing how agencies can use EA to effectively plan for
deploying IPv6-enabled network services.
1. Define Business Needs and Objectives.
The integration or implementation of any new information technology must support an agency‘s core
mission areas, business needs, and strategic objectives.
IPv6-deployment can be:Strategy-driven: Improving IT Infrastructure quality through security, reliability, agility
Core mission-driven
Operationally driven: Involving a technology refresh or meeting OMB requirements.

2. Define the Applications Supporting Each Business Function and the Services Provided by
Each Application (Enabling Each Business Function). Identify Potential IPv6- EnabledServices.
Once a strategic perspective for IPv6 integration is defined at the business level, the n ext step is toperform a dependency analysis and develop an understanding of the underlying IT services supporting
the business strategy. For this effort, it is important to review the application, system, or segment
architecture that relates to each IT investment that will be affected by a change in network protocols.
This step goes beyond developing or updating an inventory of network devices to evaluate theirreadiness to support IPv6 features. It is important to note that IPv6 is an update of existing T CP/IP
technologies; therefore any device, service, or application that currently uses TCP/IP is in the scope of
this assessment.
Listed below are examples of network services/IPv6 capabilities that may be used to support your core
mission applications. Please note that this is not an exhaustive list but should be used for guidance.
Each of the network services/IPv6 capabilities listed below is mapped to a Functional Category specified
in NIST Special Publication 500-267, ―A Profile for IPv6 in the U.S. Government – Version 1.0‖
(http://www.antd.nist.gov/usgv6/usgv6-v1.pdf).
Functional Category
IPv6 Basic Capabilities
Routing Protocols
Quality of Service
Transition Mechanisms
Link Specific
Addressing
IP Security
May 2012

Notes – Examples
IPv6, ND, SLAAC, DHCP, FTP, DNS, E-mail, Printing, Network file system, Web
Access (HTTP/HTTPS), Internet Information Services, Directory services
OSPF, BGP
DiffServ
Dual Stack, Tunneling, 6PE
IP over X, ROHC
IPv6 global, ULA, CGA
IPsec, IKE, ESP, Cryptographic Algorithms
Page 28

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Functional Category
Network Management
Multicast
Mobility

Notes – Examples
SNMP, MIBs
MLDv2, PIM-SM
MIP, Nemo, Voice over Internet Protocol (VoIP) Transport Services, Internet
Protocol Telephony (IPT) Services, Internet Protocol Facsimile (IP Fax) Services,
Internet Protocol Video Transport, Wireless Personal Area Network (WPAN),
Wireless Local Area Network (WLAN), Wireless Metro Area Network (WMAN), andWireless Wide Area Network (WWAN) technologies, Instant Messaging Services,
Unified Messaging Services, Radio over IP, Video Conferencing, TeleWork:








Application Requirements
Network Protection Device
Requirements
Miscellaneous

Premise-based Virtual Private Network (VPN) services
Network-based VPN Services
Audio, video and data communications
Managed notebook/desktop support services
Security services
Application support through the Systems/Data Center services
Customer support services through the Helpdesk and Desktop services

Sockets, DNS, URIs, Guidance.
Firewalls, intrusion detection systems, IPS
E-Learning, Video Surveillance, Video On-Demand, Asset Tracking

3. Identify Each Application’s Technology Components, Assessing Changes Required Support
IPv6 Transition.
The technology architecture view should be updated to reflect the technology assets that:

Support the potential IPv6-enabled network services
Provide or require IP services and identify whether those assets, such as routers and servers, arecapable of being upgraded to support IPv6.

This step also requires that the agency technology architecture be updated to address changes to:



6.2.1

Additional technology infrastructure and standards necessitated by the need for IPv4/IPv6
interoperability and dual-stack configurations
Technology hardware and software products
The agency networking topology, if the agency technology architecture extends to this level ofdetail.
Using the USG IPv6 Standards Profile

The U.S. Government IPv6 Standards Profile was developed and released by the NIST to foster explicit
IPv6 harmonization across industry/user groups. This IPv6 Profile is a strategic planning document toguide the acquisition of IPv6 technologies for operational Federal IT systems.
The profile is intended to define a minimal set of IPv6 recommendations to:Deliver expected functionality
Insure interoperability
Enable secure operation
Protect early investments.

The profile is also intended to define a compliance framework to:

May 2012

Page 29

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentEnable products to be tested against requirement sets
Document the results of such tests.

Agency standards profiles must align to the standards set forth by the USG IPv6 Standards Profile asshown in Figure 9.
The Profile contains a detailed specification of IPv6 recommendations, allowing agencies to choose
among the configuration options.
The recommendations are organized in threeways:
1. Into subsets by ―device‖ type (Host, Router,
Network Protection Device)
2. By functionality (Base, Mobility, Routing,
QoS, Transition, Link, Security, Multicast,
Application, NPDs)
3. By requirement (Unconditional MUSTs,
Conditional MUSTs, Optional Capabilities).
The USGv6 Profile is meant to provide a vehicle
Figure 9. Sample USG IPv6 Profile Excerpt
to communicate requirements and capabilities
between USG design, specification andacquisition communities, and networking vendors and system integrators. The USGv6 Test Program will
provide an open, traceable means of verifying the correctness and interoperability of IPv6 capabilities
claimed by individual products.
The USGv6-V1 Capability Check List in Annex-A of the USGv6 Profile, provides a quick tabular meansof conveying functional requirements and declarations of capabilities between the USG and its suppliers.
The USGv6 Node Requirements table further expands each of the configuration options above into a
detailed list of IETF standards and additional requirements necessary to conform to the USG user
requirements expressed through the checklist.

6.3 Developing an IPv6 Transition Strategy Plan
Following release of the September 2010 OMB memorandum, agencies were required to c omplete IPv6
Transition Plans by April 2011. The IPv6 Transition Plan should be folded into the agency‘s Enterprise
Roadmap. It should link to core mission segments, as appropriate, and it should define a specifictimeline and set of milestones to deploy secure IPv6-enabled network services defined in the EA and/or
IT Infrastructure Segment Architecture.
As with any other technology integration effort, the planning effort should consider multiple timelines,
including:







Budget cycles
Technology refresh cycles
IT Infrastructure quality improvements
Equipment and software certification cycles
IT project dependencies
Technology standards development and adoption

May 2012

Page 30

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentSoftware development life cycle

When developing the transition strategy, be sure to focus on ensuring that network, computing,application, and service components are enabled in a sequence that will generate maximum benefit tothe business mission through meaningful end-to-end IPv6 activity. At times, an immediate incremental
change has advantages over waiting for all IPv6 features to be available in the next version of a product.
Elements that an IPv6 Transition Strategy must include are:









Identification of transition priorities
Identification of transition activities
Transition milestones
Transition criteria for legacy, upgraded,
and new capabilities
Dependencies
Risks and mitigation strategies
Maintenance of interoperability andsecurity during transition
Use of the USGv6 Profile to express
IPv6 capability requirements for specificproductsTransition governance:– Policy– Roles and Responsibilities– Management Structure– Management Controls– Performance Measurement– Reporting– Management Actions
Training
Testing

Please refer to RFC 5211, ―An Internet Transition Plan,‖ for additional guidance.

6.4 Integration with Capital Planning
Results-oriented architecture is developed within thecontext of the Collaborative Planning Method(CPM) which is comprised of five phases. ―. Eachlifecycle phase is comprised of tightly integrated
Figure 10. FEA Collaborative Planning Method
processes that combine to transform the agency‘s
top-down strategic goals and bottom-up systemneeds into a logical series of work products designed to help the agency achieve strategic results. Throughpractice area integration, the Performance Improvement Lifecycle provides the foundation for soundinformation and IT management practices, end-to-end governance of IT investments, and alignment of IT
investments with an agency‘s strategic goals.
Figure 10 illustrates the logical integration and sequencing of key architecture, investment andimplementation activities in the CPM, as well as feedback from program assessment and performancemeasurement.
The initial IPv6 Roadmap published in 2009 recommended that agencies develop and submit Exhibit
300 business cases to invest in the IPv6 vision defined by their IT Infrastructure Segment Architectureand Enterprise Roadmap. Moving forward, IPv6 should be a component of all agency business casesthat leverage IT capability and services, but not a standalone business case.

May 2012

Page 31

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

6.5 OMB IPv6 EA Assessment Criteria
OMB requires that ―the agency‘s EA (including the Enterprise Roadmap and IT Network Segment
Architecture) must incorporate Internet protocol version 6 (IPv6) into the agency‘s IT Infrastructure
segment architecture and IT investment portfolio. The agency must have concrete plans to deploy IPv6 enabled mission services and applications in its environment.

7. Transition Milestones
7.1 Accellerating IPv6 Deployment
In concert with developing initial IPv6 modernization plans through the IT Infrastructure Segment
Architecture and IPv6 Transition Strategy Plan, it is recommended that agencies undertake the following
activities to accelerate their preparation for IPv6-enabled network service deployment.
7.1.1

Develop an IPv6 Test Lab Capability

The total testing strategy discussed in this document includes general purpose IPv6 device testing that is
appropriate for all agencies, covered in Section 1.7.2 ―USGv6 Test Program.‖ This section provides
agency-specific deployment and acceptance testing guidance.
Setting up a testing capability is important for the safe, controlled introduction of new features,
technology, and versions of control software into your network and prototyping with an emphasis on
validation of targeted behavior and performance outcomes(e.g., experimenting with secure IPv6-enabled teleworking).
Testing in a controlled environment enables the agency IT―A change in thinking is required togroup to perform tests that could potentially be disruptive or
survive and thrive. Yesterday's
introduce a security risk if deployed on the production network.
thinking won't solve today's
The test environment should be set up as close as possible toproblems. Any organization that
resemble the production environments, including required
relies on the Internet to any extent
network services such as DNS and DHCP.
must be prepared to support IPv6.
Postponing the inevitable is not wise
At first, the test sites should not be connected to the production
and will put organization at a
network but be limited to a controlled environment until
competitive disadvantage. When,
preliminary testing is complete. During the testing phase, the IT
how and what you do must be
team will gain valuable experience with integrating IPv6,
aligned with your business goals andallowing them to determine whether the technology plan oroverall IT plan. The US Government
schedule needs to be modified. Once preliminary limited
is showing leadership by embracing,testing is complete, the test environment can be interconnected
planning and enabling IPv6.
to other Government IPv6 test networks such as Commerce or
Recognizing that pervasive IPv6
DREN.
based connectivity will enable the
It is important to determine what the long-term vision for the
next innovative killer app for the 21stdual-stack IPv4 and IPv6 network includes, i.e., the transition
century always on communication
approach that will be followed and the tools that will beera."required manage the process and the production environment.
Yanick Pouffary,
All technologies, to the extent possible, should be tested in the
IPv6 Forum Fellow,
lab. Ideally, the final test lab configuration will match theNorth American IPv6 Task Forceproduction environment as close as possible and may continue
Technology Director
to function as an integration lab for future technology refresh
requirements.
May 2012

Page 31

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

During IPv6 testing, document successful configurations as well as all interoperability and/or bugs found.
The test plan should include IPv4-IPv6 dual-stack capabilities and all network and application services.
Induce failure conditions, such as router unavailability, DNS server misconfigurations, link outage, etc.,
to identify and document observed behavior of networking and application elements. Explore alternative
workarounds to each simulated outage and observe suitability of resolution. This information will be
helpful after rolling into production to aid in troubleshooting and to expand the experience and comfort
level of IT staff members. Once standard test scenarios have been completed, develop training material
and labs and cycle groups of IT staff through to provide hands-on IPv6 training.
After IT staff members have developed solid competence with IPv6, begin production deployment in a
few well-defined and controlled locations. During this phase, the pilot site infrastructure should be―IPv6enabled.‖ At this point, the following steps should occur:





7.1.2

Set up routers and switches to process IPv6 traffic and configure the LAN to transport the agency‘s
IPv6 prefixes to production host computers, printers, and other devices.
Ensure that the security architecture is integrated with the overall agency EA and is configured tohandle both IPv4 and IPv6 and set up the DNS and DHCP servers to handle IPv6 queries.
Configure the associated Network Management Systems (NMSs) to monitor the IPv6 network andinfrastructure; as part of the pilot, set up one or more applications that can run over IPv6 so that theagency personnel can expand and build on their existing experience of IPv6 within theirenvironment.
Continue to test agency specific applications and services, as appropriate, to achieve the 2012 andthen 2014 mandates.
Standup Centralized Addressing Authority (CAA)

Due to a lack of routable IPv4 address space, current deployment practices utilize a few globallyroutable IPv4 addresses that are deployed to front end pockets of RFC1918 or private IPv4 local space.
Since the scope of the private address space is very limited, only local control was required. Currently,
there are large numbers of overlapping and duplicate RFC1918 space in IPv4 networks that interferewith appropriate network operations, management and cyber security best practices.
Commercial and Government Service providers including
Defense Information Systems Agency (DISA) and the Defense
Research Engineering Network (DREN) employ a centralized
address authority (CAA) as a necessary adjunct to their Network
Operations and Security Centers (NOSC) to control and manage
their address space. CAA systems can manage existing IPv4
space including overlapping RFC1918 blocks, current or new
IPv6 allocations as well as interface to router, switch, firewall,
IDS/IPS configuration and management systems.
Current policies also require each agency to request IPv6 space
directly from the cognizant IANA addressing authority, a
Regional Internet Registry. In North America, this registry is theAmerican Registry of Internet Numbers (ARIN). ARIN policies
require:

Tip: Many unexpected results during
IPv6 testing are due to the misconfiguration of LAN and VLAN
segments of services required tosupport IPv6, such as DNS. This
underscores the importance of
training and hands-on experience
before IPv6 is deployed in an
operational environment.

Management and control of all blocks and sub-blocks allocated to the organization for periodic
review by ARIN or other RIR, especially if additional space is required.

May 2012

Page 32

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentA single Point of Contact (PoC) per organization requesting and receiving space.

Therefore, it is Highly Recommended that an Agency-wide addressing authority (CAA) be established to:









Coordinate with the CIO policies, procedures, and requirements for IP based networks.
Formulate requirements for management of and implementation of addressing plans that
accommodate network direction for a two to five-year period.
Develop and maintain an Agency Addressing Plan encompassing both new IPv6, as well as
existing IPv4 plans.
Coordinate address space with ARIN or appropriate RIR, including sub allocation policies within
the government agency or organization. (NOTE: Spoofing of an organization to an RIR has
occurred; unfortunately, this can compromise the entire address space and network for thatorganization.)
Promulgate allocation policies and procedures and control sub-block allocations to agencies andcomponents within the Department.
Coordinate allocations with Service Providers and communities of interest.
Stand up an IP address design and engineering tool or capability to help:– Maintain an accurate, current address plans, IP address space plan and operational posture.
– Coordinate allocation and delegation of address blocks to: Agencies and components
 Service providers and communities of interest
 Operating and support systems (e.g., Provisioning and Configuration), Network management and network services (e.g., DHCPv6, DNS and ENUM)
 Cyber and Network security applications (e.g., Firewalls, IPS/IDS, Deep Packet Inspection)– Meet RIR reporting requirements.

It is also recommended for major agencies or components of a Department to have an addressing
authority supporting these subordinate elements. With automated tool support, it is not envisioned thatthese requirements will not add additional resources within the Agency. A traditional location for thisauthority would be in the IT organization with management responsibility reporting to the CIO‘s office.
7.1.3

Address Plan Management and Policies

While address space plans are a major work product of the CAA and some examples of those arelocated in the Address Plan appendix, the process and procedures framework around them as well as
the suite of tools and applications managing and implementing them are a critical foundation for the
successful transition and sustainment of next generation Agency networks. The specific organizationand framework for the CAA, as well as the different policies will be agency specific.
Address Space plans should:Concentrate on hierarchical routing information by distributing address blocks for major enterprisenetwork locations before breaking network blocks into separate subnets for varying security and
QOS support levels. The addressing structure initially should initially follow the existing network
topology (i.e., routers and switches and how they are interconnected by communication circuits).
As more experience is gained with new IPv6 protocol capabilities. the network topology can be
optimized leveraging these new capabilities.

May 2012

Page 33

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentAccount for evolving government requirements, such as Trusted Internet Connection (TIC),
Networx, security, Continuity of Operations (COOP), and geographical diversity.
Be maintained in an Agency/Enterprise wide secured database for IPv4 and IPv6 address blocks,
subnets and network structures. This current dynamic database serves as the basis for address
block and interface status and moves, adds, and changes. Interactive simultaneous access to thedata, real time reports and audit information are required for management, security andmaintenance activities.

2012 – 2014 Tips: You cannot perform a partial plan for part of the network as it is an integrated whole.
Make sure to plan for your network horizon with detailed design and implementation for the 2012
requirements. Routers, switches and other customer facing infrastructure, servers and network services
are required to meet the 2012 requirements. If IPv6 services are not available agency-wide, you should
acquire circuits from IPv6 peering points to concentrations of Web servers or services either logically,physically, or virtually to move the servers to the v6 circuits. This infrastructure needs to be secured andmanaged deployment through operational turn up.
Another strategy to meet the 2012 requirements is to use external IPv6 enabled content delivery networks(CDN) for citizen and customer facing service delivery. While the source and validity of this informationneeds to be maintained, it is for public dissemination and use. If this portal is used for procurement or othersensitive information delivery to the agencies, then additional steps may be required to secure it toappropriate standards.
For example Akamai‘s1 CDN / Cloud Services support DNS resolution of AAAA records with both IPv4 andIPv6 transport and dual stacked Web server front ends interconnected to backend Agency IPv4 only
content and Web servers. This support is for both http and https traffic. A CDN strategy may not currently
support the 2014 objectives of enabling internal agency infrastructure for IPv6 support but supports 2012
requirements for DNS and Web services.
7.1.4

Address Acquisition

Acquiring IPv6 address space is a key step in the transition to IPv6. As previously mentioned, IPv6
space can be obtained from the ARIN for North American-based networks. Other Internet Registries
exist for address assignment in other parts of the world: RIPE for Europe; APNIC for Asia/Pacific;
LACNIC for Latin America/Caribbean; and AfriNIC for Africa. Agencies can receive space directly fromthe RIRs and this is Provider-Independent space (PI). For international locations and locations where therouting of PI space is not appropriate Provider Assigned (PA) space can be obtained from an ISP or
Service Provider. When obtaining PA space special attention should be paid to peering, routing andtransit policies as well as who the peers for the peering arrangements are to support required
interconnectivity.
The ARIN Website, https://www.arin.net/, contains application templates and fee schedules for IPv4 andIPv6 allocations. The current process for obtaining IPv6 address space entails completing an IPv6
network request template, which requires information about points of contact, IPv6 allocation plans, andDNS reverse mapping name server hostnames, among other items. Once the template is submitted to
ARIN, the template is reviewed. ARIN will respond within three business days requesting further
information or providing approval. Once approved, payment of the annual fee is required, along with

1 Use of a vendor or product name does not constitute endorsement by the USG and is used for illustrative purposes only.

May 2012

Page 34

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

execution of a Registration Services Agreement. Once these tasks are completed, the address space
will be allocated.
The amount, or size of space allocated, depends on the address space requirements and the applying
entity‘s role in requesting the allocation. The primary factor, in the RIR request, is how much Global
Unique Unicast Address Space is required by the Agency for the deployment horizon . The two current
default sizes are a /48 for an Enterprise or equivalent, and a /32 for an ISP or larger Enterprise from asingle RIR. If your Agency has international sites than an allocation from ARIN for the North American
sites and smaller allocations from Regional ISPs may be preferred, as there may or may not be sufficientrequirements for the minimum /48 from other registries. A /32 will be allocated to an ISP, a larger
Enterprise or equivalent or an entity acting as a Local Internet Registry (LIR). Setting up a CAA for larger
distributed Agencies allows the CAA to act as an LIR for the Agency and help qualify for the /32 andsupport RIR reporting requirements.
Current delegation recommendations from a /32 are to assign a /48 to each site. A /48 will give the site
65,535 sub-networks or VLANs which should be sufficient for most locations. If there are mega locations
such as large data centers or campuses that would exceed 16 bits of sub-networks than a larger nonstandard block should be allocated to that location. If the 65,535 /48s is not sufficient for the organization
than larger blocks can be requested from the RIR following more detailed justification process. If there
are a large number of very small sites than a /32 can be requested but smaller than /48s can beallocated. Allocating /56s to sites would give 256 /64s per site for small sites.
A table top exercise for an order of magnitude validation could be run on various scenarios with thenumber and type of locations and different aggregation schemes to validate the size of block being
requested. Non-allocated spare blocks should also be part of the calculations as a liberal amount ofexpansion space should be maintained at all levels of the design. More detail on addressing issues areavailable in the Addressing Appendix of this document.
The IPv6 addressing architecture also defines unique local address (ULA) space as address space that
may be used internally and is not routable on the public Internet. This address space is analogous to the
RFC 1918 private address space in IPv4. While not Internet-routable, ULA network uniqueness is
nonetheless desired to minimize the probability of overlapping ULA space among private interorganizational interconnections. To increase the probability of uniqueness of this local address space,
the global ID portion of the address prefix must be pseudo-randomly generated as recommended by
RFC 4193. The end result is an entirely locally administered /48 prefix for use within the organization,
while also enabling global IPv6 Internet reachability without requiring NATs.
Agencies should develop policies and criteria to define which agencies or organizations may obtain
address space from other organizations or directly from ARIN or ISPs. Policies regarding the use of ULA
space should also be developed. These policies should be reflected in addressing management
approaches, and they should be incorporated in addressing plans.
7.1.5

Establish Address Block Allocation and Management Procedures

Agency wide address management is crucial to assuring unique, consistent and coordinated IPv6
subnet and address assignments across a distributed organization, not to mention accurate provisioning
and configuration of associated DNS and DHCP services, equipment network monitoring andmanagement as well as cyber and network security.
To meet network control, management, security and certification requirements an Enterprise Address
Management System/Framework (EAMS) is required. An EAMS is a collection of applications/devices

May 2012

Page 35

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Governmentthat manage IP address and associated information and are integrated together preferably with industry
standard open interfaces such as XML. These applications include but are not limited to:








IP Address Space Plan Management
IP address block and interface management
IP address blocks for different routing domains and from different ASNs
Host DNS resource records (RR), zone identification and DNSSEC control information
DHCP, DHCPv6 both stateful and stateless, Prefix delegation and other interface address
assignment methods
IP addresses associated with Routers, Switches and other network and end devices
configurations
IP addresses associated with Network and Cyber security devices such as Routers, Switches,
Network Access Controllers (NAC), Firewalls, IDS/IPS such as access control list (ACLs),
Firewall rules and IDS/IPS signatures.

The IP address management component of the system should support IPv4, IPv6 block management aswell as ASN management if required. All major transition mechanisms used by Agencies should be
supported, e.g., interface dual stacking, tunnels, by the address management component.
To support dual stacking it is required that the IP address management components support both IPv4
and IPv6 blocks and interface addresses in a single system. It is suggested that existing IPv4 address
block and interface assignment data be maintained in the same system as will be allocating andassigning IPv6 blocks and interfaces for consistency and coordination. (note: same system is notindicating whether the application / database is on the same hardware, virtual machine, method ormechanism.)
Agencies have different vendor‘s components which need to be controlled/configured from the EAMS or
are a part of the EAMS. Optimally there is multi-vendor compatibility between components in the system
for reliability and security.
7.1.6

Interfaces for DHCP, DNS, Network Management and Provisioning Systems

IP address blocks allocated from the IP address management component can be delegated as scopes
to different DHCPv4 and DHCPv6 functions across the network. DHCP server functions are
implemented in appliances, routers, servers and other devices as well as managed services which forthis discussion will not be distinguished but will all be referred to as DHCP servers. It is also assumed forthe foreseeable future that DHCP servers will have different instances for IPv4 and IPv6 address
assignment and distribution. DHCP servers can also be used to configure other end device parameters if
this is permitted by security policy.
The role of DNS has been expanding as Web interfaces are more complex with richer media content
and increasing requirements from current laptop, desktop and mobile device operating systems. The
number of Resource Records (RRs) in DNS zone files has been increasing to support these newfeatures and functions. The fully qualified domain names (FQDN) for those RRs are getting longer andmore complex and the ip6.arpa records for IPv6 are very error prone if done manually. It is
recommended to the maximum extent possible, that DNS RRs be generated automatically from theapplication doing either the interface assignment or service provisioning. The same system should also
generate the ipv6.arpa (reverse mapping of addresses to URI/L) records automatically. The security andauthenticity of these RRs should be maintained during generation and transmission to the DNS servers
which will then continue the chain of trust with DNSSEC.

May 2012

Page 36

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Network Management systems require address information from both the Address block and interface
assignment and Provisioning function. Network Management Systems maintain the status of all devices
attached to the network as well as some device subsystems. NAC functions in switches and discreet
systems are employed to exclude rogue non-certified systems from joining the network. Additional
exclusion methods include IEEE 802.1x and Link Layer Discovery Protocol (LLDP). Most Agency
security policies require network, computing and serving devices to be certified to run on Government
production networks as well as routing, switching and other network and security services.
Network provisioning systems are utilized to manage and control router, switch, NAC , Firewall and otherdevice configurations necessary for the efficient and secure operation of the network. Routerconfigurations contain Access Control Lists (ACLs) which are used to filter and protect systems fromdifferent types of network and server malware and are used in combination with firewalls, IDS and IPS
systems. Best practices require these configurations to be validated in the test network before theconfigurations are loaded onto Government production networks. If the network has different levels of
security or sensitive information different Network Management and Provisioning systems may be
employed controlling different domains. Some Internet facing servers and system may need isolated
Network Management and Provisioning to maintain security domains.
Other end user configuration and provisioning systems are used to maintain standard United States
Government Configuration Baseline (USGCB) configurations for end user devices attached to the
network. http://usgcb.nist.gov/.
7.1.7

Address Space Plan Management and Address Assignment System

Addressing applications run on a variety of hardware platforms and database systems which include:






Industry standard appliances, individual and clustered servers
Virtual Machines either on bare metal or on a host operating system
Vendor controlled appliances
Industry standard databases
Vendor controlled databases

Each Agencies network has different requirements and selection criteria for different network services
and the platforms they run on. Agencies are cautioned that unless the networks are small and wellcontained putting processor and disk intensive network services on VMs is not recommended.
These address management systems concentrate very sensitive network architecture, configuration andopenings for malware attacks. These systems should be shielded and firewalled from other systems withsecured communications on preferable Government secured industry standard systems. By having acentralized master database that can drive DNS, DHCP, IPAM, NAC, Firewalls and other systems thatare potential targets of network hackers, the consolidated information is not exposed .
Applications are available to design and manage IPv4 and IPv6 blocks to provide a high level to very
specific address space plan. Some features listed which may not be in all systems include:Support for any size IPv4 and IPv6 blocks.
Validate blocks on entry into the system from any source and maintain the accuracy and integrity of
the addresses in the system.
Feature parity between IPv4 and IPv6 methods.

May 2012

Page 37

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government













Uniquely manage multiple overlapping address space supporting multiple routing domains (Theprimary example is multiple overlapping RFC1918 space in IPv4 and overlapping IPv6 space
between test and production networks and networks in isolated enclaves.
Generalized tree structure or other mechanism that supports:– Delineation of address blocks by network, organization, geographic location, function, etc.
– Articulate and define address space authority boundaries– Visibility and organization of blocks at all levels of the tree
Commands to manipulate the tree structure including move, add, delete and clone supporting
different ―what if‖ design scenarios.
Multiple manual and automated address block allocation, manipulation and reclamation methods
maintaining all blocks under management:– Manual move and allocate blocks– Allocate contiguous blocks or skip blocks to support future needs while maintaining
aggregation and CIDR boundaries– Allocation of blocks starting at either the high or low block in the range– Support pseudo random distribution of a block size across a larger block– Automatically breakup larger blocks to fit current allocation size requirements– Reclaim a range of blocks and coalesce to the largest available CIDR block
Generate a DHCPv4 and DHCPv6 scope for DHCP configurations.
Control of blocks by an IP address lifecycle process.
Generalized reporting and interfaces to standard query and report writers.
External interfaces to save and load either partial or complete designs in industry standard formats
such as XLS or XML.

Address Assignment Features include:












Support for any size IPv4 or IPv6 subnet either point to point, LAN or VLAN.
Named sub-network blocks for greater accuracy on assigning specific interfaces in large network.
IPv6 specific address types assignments such as /64 EUI-64, /64 Random, and other size IPv6
blocks, as required.
Multiple interface assignment methods such as starting at either the low or high end of a range.
Audit logs of IP address and user activities.
Equipment which organizes physical and logical interfaces supporting dual stack capability
including multiple addresses per physical port.
RIR interfaces to automatically update WHOIS and other records, if allowed.
Manage static and restricted addresses in DHCP configurations.
Generate a DNS RR and .ip6.arpa from an address assignment.
Control of interface assignments by an IP address lifecycle process.
General query and reporting capability– Individual addresses, address ranges, equipment and interface connections, amount utilized,
which network owns the addresses– Which networks the address are associated with

May 2012

Page 38

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. GovernmentExternal interfaces to save and load parts of the network with network structure, address blocks
and equipment configuration.

Some additional potential system capabilities include:









7.1.8

Active Directory integration for Personal Identity Verification (PIV) / Common Access Card (CAC)and single user sign on.
User accounts with granular access and control for networks, features and functions including sizeof blocks.
Multiple simultaneous access with granular record locking in the database.
Policy control across the application.
Scheduled and asynchronous events and alerts.
Authorized user access: includes:– Standard Agency approved Web browser– Java client that have to be loaded onto the system and FDCC accredited
Applications run on industry standard appliances and servers with Web services that allow better
performance with much larger number of simultaneous users on clustered servers.
Geographically dispersed high availability servers with Transaction based primary / mirrored
database system.
Domain Name Service

DNS systems are an ever increasing component of content rich Web sites, modern browsers and Web
applications and are one of the network services required to be IPv6 capable to meet both the 2012 and2014 mandates. For most Government Agencies there are two sets of DNS infrastructure whether
physical or logical, one for internal services and users and one for external users accessing externallyfacing servers and services. DNS systems are sets of DNS servers that start with root or ―top leveldomain‖ servers such as ―.GOV‖ and eventually resolve to the particular server or service at the Agency
they are trying to communicate with.
To meet the 2012 mandate customer facing servers, services and infrastructure are being enabled topass IPv6 traffic accessing these services. In the case of Web servers once the servers and theinterconnecting routing, switching and transport service support v6 services the server IPv6 addresses
will need to be populated in customer facing DNS servers. These addresses go into the address field o f
a AAAA ―quad A‖ record to allow the server to resolve the address to terminate the customer traffic.
There are several different technologies to support DNS services for the 2012 mandate and they
include:1. Open sourced, for example BIND, on a Government furnished server or appliance
2. Another vendors DNS server software on either an industry standard server or a vendor
controlled server
3. DNS services provided by your ISP, Service Provider, carrier or content distribution network
provider4. DNS service provided by a DNS services provider or Content Delivery Network.
Methods one and two are used for internal DNS services to maintain the more sensitive internal network
addresses and topology. Methods three and four are used for external and customer facing services
since those are well known publically available addresses anyway. The security issues are prefix
hijacking and stealth redirection of customer traffic to bogus sites that are setup for data and keystroke
May 2012

Page 39

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

mining of personal information being entered into the ―Government systems‖. Reputations metrics forsites and URLs are becoming are the next valued added services for external DNS services andsystems to reduce bogus sites. Existing IPv4 based DNS servers are not touched as a new server orservice is brought on line to handle the initial IPv6 traffic. And at a planned point in the future dual
stacked DNS servers are brought on-line with mixed IPv4 and IPv6 zones.
Specific transition actions include:










Requirements: Develop DNS transition requirements for the organizations infrastructure based on
the address and routing plan and organizational domains, locations, functions, etc. Determine thespan of DNS domains. Note that DNS address spaces are independent of address spaces/network
topology. RFC 4472 (http://www.ietf.org/rfc/rfc4472.txt) discusses name space fragments, as well
as operational considerations and issues associated with IPv6 DNS.
Inventory: Conduct an inventory of existing DNS infrastructure and servers, including the current
versions of DNS software.
Upgrades Guidance: Develop comprehensive guidance for the upgrade of DNS servers andsoftware. This guidance should include procedures and best practices.
Separation: The initial transition to IPv6 capability for DNS should incorporate a philosophy ofseparation rather than integrated dual-stack functionality. In other words, leave the existing IPv4only DNS servers alone and functioning normally; implement new dual-stack DNS servers, inrequired pairs, separated by security procedures. Once the IPv6 capable DNS is active and theorganization has confidence in the new system, then the servers can be integrated. The physicaland/or logical separation of IPv4 and IPv6 capabilities and services will provide additional security
in all facets of the network and application environment.
DNS Demonstration: DNS should be demonstrated in a laboratory setting first, then as acompanion service to IPv4-only DNS; subsequently, it should be demonstrated as a separate
production service.
Future Upgrades: Plan for future upgrades to the IPv6-capable DNS and continue to plan for andincorporate system upgrades.
– Implementation of unicast vs. anycast addressing for DNS: Unicast DNS is the current
mode of operation for the IPv6 DNS infrastructure. IPv6 will permit the use of anycast
addressing, providing potential increases in reliability and flexibility of DNS.
– DNSSEC: Investigate and implement DNSSEC security features in operational IPv6 DNS
servers. DNS security extensions, DNSSEC, defined in RFCs 4033- 4035, provide a means toauthenticate the origin of resolution data within DNS and to verify the integrity of that data.
Thus, DNSSEC provides a means to detect packet interception, ID guessing, and cachepoisoning attacks. In fact, DNSSEC was acknowledged as the only comprehensive solution to
the well-known cache poisoning bug. The operation of DNSSEC relies on digital signatures toenable data origin authentication and end-to-end data integrity verification. Open sourced
software such as BIND‘s DNS server implementation supports DNSSEC and provides two coreutilities required to generate private/public key pairs and to sign zones using these keys.
Signing zones deployed on DNS servers enable resolvers and servers obtaining authoritative
information from such DNS servers to authenticate the origin or resolution data and to verify
the integrity of that data. In summary, DNSSEC administration requires processes andprocedures for key generation, zone signing, key distribution, and key rollovers. IT staff must
be well versed in DNSSEC technology to monitor and troubleshoot secure resolution issues.

May 2012

Page 40

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

7.1.9

Address Assignment Methods

DHCPv6 performs a variety of functions. It can be used to assign IPv6 addresses and option parameters
as does DHCP for IPv4, or it can be used simply to supply IP parameter options to clients that haveauto-configured addresses. The assessment required entails consideration of the trade-offs ofimplementing DHCPv6 vs. use of stateless address auto-configuration (SLAAC).
In a stateful address assignment model, the DHCPv6 server provides the IPv6 address and associateddevice IP parameters (e.g., address of a recursive DNS server). This mimics the DHCP for IPv4
approach and gives the network administrator the most control by defining who can get an address (e.g.,using MAC address filtering to identify acceptable clients), which address is assigned, and which
additional parameter values are assigned. While providing the most control, it does require proper
configuration and administration; however, an IP address management system can help ease thisburden by associating address pools in the address plan with configuring corresponding DHCPv6 server
address pools.
Stateless address auto-configuration (SLAAC) entails a client identifying the IPv6 sub-network prefix
through router advertisements, calculating of its own interface identifier, and concatenating these fields
to derive a global IPv6 address. After verifying uniqueness through the duplicate address detection
process, the derived IPv6 address may be used. However, this stateless auto-configuration may not
sufficiently configure the device to communicate on the IPv6 network. For example, which DNS servers
are available on or near this subnet to resolve hostnames to IPv6 addresses? This and other information
may be obtained via DHCPv6. Use of SLAAC for address assignment and DHCPv6 for parameter
assignment is sometimes referred to as stateful/stateless hybrid approach.
Prefix delegation entails the assignment of an entire prefix or subnet address. This function is useful inenvironments where devices downstream in the routing topology request a prefix for use , automating
subnet assignment and encouraging IPv6 addressing hierarchy. While the DHCPv6 protocol is used forthis function, the actual disseminator of subnets may be a router. A policy should be defined regarding
prefix delegation. The fundamental question becomes, ―Should devices be enabled to request subnets,
or should this function reside under the control of the IP address planning team?‖
Use of dynamic DNS is optional but very useful in automatically updating DNS with hostname and IP
address information, particularly for DHCP clients. The DHCP server can be configured to update DNS
based on leases dispensed to clients. The server can also allow the client to perform the update itself,
though this is typically frowned upon in enterprise environments due to security concerns. However, if
SLAAC is used, and auto-configured hostnames and IP address assignments appear in DNS, theneither the client must be permitted to update DNS using DDNS, or the centralized IP inventory
administrator must perform such an update manually.
If the DHCP server updates DNS, the ISC DHCP server can be configured to sign the update usingtransaction signatures (TSIG). The DNS server receiving the update can likewise be configured toauthenticate the TSIG and also to constrain what source IP addresses or subnets from which DDNS
updates may be accepted. For non-dynamic clients, e.g., servers and routers, addresses are enteredmanually and should be tracked using a centralized IP database. Such updates may also trigger DDNS
updates from the IP database to the corresponding master DNS server.
As discussed above, IP parameters (other than IPv6 addresses) can also be assigned by DHCPv6
servers. These parameters, in the form of DHCP options, can be configured with values for assignment
to clients. Different client devices may require different or unique parameter values, e.g., VoIP devices
vs. plain old data devices. The DHCPv6 server can be configured to recognize these different device
May 2012

Page 41

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

types by analyzing the vendor class identifier, user class identifier, MAC address, or other parameterwithin the DHCPv6 packet. Once matched on a value, the DHCPv6 server may then assign thecorresponding options. For example, a VoIP phone may supply a value of ―VOIP‖ within its vendor class
identifier option and if the DHCPv6 server is configured to recognize clients providing this value in thevendor class identifier field, it can provide the corresponding VOIP options.
7.1.10 Network Management
IPv4-based network management systems (NMS) and fault tracing tools must undergo significant
change to properly manage IPv6 networks. These would include both equipment and component
managers as well as managers of managers (MoM) systems. Service order and network provisioning
systems (NPS) are used in the configuration (provisioning), rollout and turn-up of equipment andservices in the network. Network management systems, which are integrated with NPSs, then manage
the operation and reconfiguration of the systems in the production environment.
These systems can include but are not limited to routers, switches, servers, network services (DNS,
DHCPv4/6, IPAM, AAA, and Identity) and various firewalls, IPS/IDS and other cyber security systems.
End user devices can also be managed from separate systems which can include validation of end user
security software and NAC control. Various quality assurance devices, protocol monitors and other test
and evaluation systems are interfaced into the NMS for troubleshoot roles. NMS can also maintain thestatus and configuration of devices, their IP addresses and other pertinent data and information. Systemand event correlation as well as x-flow (ifx, J, Net and S) monitors can also be part of the active NMS.
NMS can be interconnected to the centralized address repository for initial IP address block andinterface assignments as well as system and IP address audits. Utilizing out of band (OOB) encrypted
control networks reduces the potential for device control interface compromise and separates lesssecure data movement circuits from control circuits. For a more complete cyber security posture, the
NMS should be interfaced with central address management, network and server security devices.
System and device event monitoring and correlation should occur in real time for event detection.
Network Management considerations include:






No dependencies on IPv4 transport or services but can utilize either transport protocol
Ability to utilize IPv6 neighbor discovery, ND cache or SNMP MIBs or other methods to perform
network mapping if allowed within security policies
Upgraded for the latest IPv6 and dual-stacked Management Information Bases (MIBs)
Database and/or storage structures upgraded for IPv6 and dual stack mode
GUI and documentation upgraded for IPv6 and dual stack.

Some resulting capabilities are but not limited to:







Full GUI interface for IPv6 features
Ability to discover and manage IPv6 only and hybrid IPv4/IPv6 devices both network and end node
Ability to map IPv6 devices and their network structures
Ability to detect status of IPv6 services such as DHCPv6, IPv6 Routers and switches, IPv6-capable
DNS, AAA and other services
Ability to alert cyber security systems about IPv6 and hybrid devices
Ability to receive and generate system and device events over IPv6 or dual stacked systems.

May 2012

Page 42Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Because of the complexity of the protocol stacks on NMS interfaces to equipment under management,
initially, while they are managing IPv6 only (data ports) or dual stacked devices, but only over an IPv4transport. Replacing a non-conforming NMS is much more difficult than replacing other hardware orsoftware as it tightly integrates with device software and hardware ports. It is recommended that NMS be
upgraded or replaced with IPv6 capable systems prior to the 2014 deadline. Testing of all types andconfiguration of devices should be completed prior to system cutover and turn-up.

8. IPv6 Impact on Federal Initiatives
The USG has numerous Federal-wide initiatives underway to improve the overall security and operabilityof the Federal-wide Enterprise Architecture while limiting or reducing cost. Figure 11 depicts a numberof initiatives that may appear to be separate but are intricately linked. Many agencies are tackling these
initiatives in a silo fashion and do not fully understand how each is related and will ultimately impact new―to be‖ architectures being developed.

Figure 11. IPv6 Relation to Other Federal Initiatives

This section examines the potential IPv6-related impacts that agencies should consider whendeveloping their solution sets for each of these initiatives. In reality, agencies need to look at theinitiatives in a coordinated fashion and understand the cross-requirement impacts that will occur asindividual solution sets are developed.
The development of solution sets and ―to be‖ architectures for each of these efforts in a silo methodology
will lead agencies to develop solutions sets that may potentially be conflicting or counterproductive.

May 2012

Page 43

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

In order to utilize their resources most efficiently, agencies need to consider working these efforts inunison. This will ensure that requirements that impact more than one initiative are taken into accountacross the board and that complimentary solutions are developed.

8.1 Trusted Internet Connection
The overall purpose of the Trusted Internet Connections (TIC) Initiative, as outlined in OMBMemorandum M-08-05, is to optimize and standardize the security of individual external network
connections, to include connections to the Internet, currently in use by the Federal Government.
Ultimately, the initiative will improve the Federal Government's security posture and incident response
capability through the reduction and consolidation of external connections, and it will provide enhanced
monitoring and situational awareness of external network connections by TIC Access Providers (TICAP).
A TICAP is the entity responsible for managing a TIC, which is the physical location an agency, utilizes
to meet the objective of the TIC Initiative.
8.1.1





TIC Objectives
Reduce and consolidate external connections through TIC Access Providers (TICAPS)
Develop and maintain baseline technical requirements for TICAP Network and Security Operation
Centers (NOC/SOC)
Oversee Federal agency transition to approved TICAPs
Maintain relationships with agencies and stay informed with their concerns, including TIC
Compliance Validations (TCVs)

Federal agencies also have an option of leveraging an outsourced Managed Trusted Internet Protocol
Service (MTIPS) that can be acquired via the GSA Networx contract. GSA has authorized the following
vendors to provide the MTIPS service:





AT&T
CenturyLink (Qwest)
SprintVerizon

MTIPS provides security for agencies‘ online traffic and delivers many other cyber security solutions.
GSA and DHS jointly developed the requirements for this Networx TICAP service. (Note: GSA Office of
Network Services is currently planning for an MPTIPS 2.0 Acquisition in the summer of 2012.) The highlevel functional components include:






Internet access
Hosted EINSTEIN enclave (a computer network intrusion detection system)
Security Operations Center (SOC)
DCID 6/9-compliant Sensitive Compartmented Information Facility (SCIF)MTIPS transport

All information exchanged with the external networks is monitored by the MTIPS Security Operations
Center to protect agency traffic, as depicted in Figure 12. The MTIPS transport serves as a collection
network for the TIC portal, insulating an agency‘s internal network from the Internet and other external
networks.

May 2012

Page 44Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

As of this writing, agencies should have determined their path forward selecting one of the following
options:

Becoming a TICAP provider
Acquiring TIC services from another TICAP provider (another Federal agency)
Acquiring TIC services from a MTIPS provider (AT&T, Qwest, Sprint, Verizon).

Figure 12. TIC Architecture

Regardless of the option selected, agencies should integrate the IPv6 project with the implementation ofTIC, ensuring that the integrated design provides the services and capabilities required to achieve boththe TIC and IPv6 goals and objectives. IPv6 considerations include:











IPv6 policy
IPv6 routing/traffic
IPv6 DNS
IPv6 firewall functionality
IPv6 IDS capability
Support for IPv6 based IPsec
IPv6 tunneling
IPv6/IPv4 translation
IPv6 privacy/address hiding
IPv6 address and network management

May 2012

Page 45

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Throughout this Planning Guide/Roadmap to IPv6 adoption, specific design and implementation
recommendations have been made that should be integrated into the design and implementation of the
TIC program. Agencies should conduct IPv6 readiness reviews of their TICs by obtaining SDOCs,
conducting a gap analysis, and implementing upgrade plans.

8.2 HSPD-12
Homeland Security Presidential Directive 12 (HSPD-12) was issued in August 2004 to improve thesecurity of Federal facilities and information systems by implementing common processes for identity
proofing and ensuring interoperability through use of standardized credentials for physical and logicalaccess.
While tying identification of users to electronic assets can be implemented independently of the TCP/IP
layer, agencies should also consider how IPv6 could support greater usability and capabilities of their
HSPD-12 implementations to support IPsec authentication and encryption services. All Federal
employees and contractors are required to have HSPD-12 Personal Identity Verification (PIV)
credentials; agencies can use these credentials as the encryption key.
Some agencies have started exploring the use of IPv6 addresses coupled with their HSPD-12
implementation and cloud computing to develop a more robust and scalable security architecture thatcan provide a service-oriented architecture (SOA) approach to lower the cost of future security
requirements reducing extensive capital infrastructure investments.
As agencies prepare their implementation plans, they should take into account areas that may impact orprovide future benefits, including:The use of multiple IPv6 addresses to support compartmentalization
The use of common digital certificates/PKI system to support HSPD-12 functionality and IPsec
Geospatial functionality using IPv6 for location-based services
Common security identification and authentication from an IP layer.

8.3 IT Modernization
OMB Memorandum 11-29 (August 2011) directs agency CIOs to consolidate duplicative IT infrastructure
networks and services. As agency IT modernization efforts move forward, IPv6 will have a major impact
on many infrastructure-related initiatives. Agencies should coordinate and include their IPv6 transition
activities within the scope of IT modernization. In particular, agencies should identify:






Common IPv6 solutions that may be applied cross-agency
Ability to develop and implement common IPv6-based services that may support multi-agency
implementations
Lessons learned and best practices
Cross-agency common purchasing agreements based on the NIST USGv6 profile
Common solution sets for security and IPsec functionality to support cross-agency security
functionality.

8.4 U.S. Government Configuration Baseline
Commercial deployment of IPv6 on standard operating systems (OS) has progressed rapidly. Almost
every current major commercial OS has IPv6 embedded within it. In some cases, IPv6 is active by
default and may be required to support certain applications.
May 2012

Page 46

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

As agencies develop their desktop requirements to meet the United States Government Configuration
Baseline (USGCB), they must understand the IPv6 requirements that should be taken into account. Thisshould include policy, default configurations and settings, and IPv6 security capabilities, as well as otherpotential requirements regarding IPv6.
Agencies should consider the following potential IPv6 impacts when developing their USGCB solutions:Remote access requirements
Virus and firewall scanning capabilities
Support for centralized management
Default configuration settings

8.5 Networx Migration
As of February 2012, GSA reports that over 97% of FTS-2001 telecommunications services havetransitioned to the Networx set of contract vehicles. The target for final completion is December 2012.
For the agencies that have completed the Networx transition, or ones currently in process or being
planned, the transition to Networx will be one of the greatest opportunities for agencies to implement
IPv6 across their entire enterprise in a cost-effective manner. In June 2008, agencies were required toenable agency infrastructures (network backbones) to use IPv6. The experience acquired through these
activities, along with the other associated activities, detailed throughout this document, can provide theagencies with the understanding and background required to successfully implement IPv6.
As agencies develop and refine their Networx requirements, they should do so in conjunction with theirshort- and long-term IPv6 plans to ensure that their Networx vendor can adequately support theirrequirements. This should include every aspect of the enterprise that is being impacted during the
Networx transition, including the Trusted Internet Connection (TIC) Internet consolidation program, theUnited States Government Configuration Baseline (USGCB), the Cloud-First Policy and the Digital
Strategy. IPv6 design should account for each of these initiatives and can build in the flexibility to adapt
to additional requirements. By following network addressing best practices and specific IPv6 lessons
learned, agencies can successfully implement and support the current initiatives while ensuring a solid
foundation for future evolution and innovation.
During their Networx transition planning efforts, agencies should consider the following potential IPv6
impacts:










IPv6 routing
IPv6 addressing
IPv6 multi-homing/business continuity
IPv6 security (firewall/IDS)
Telework/remote access
IPv6 device management
IPv6 address and network management
IPv6 SLAs
DNS support

OMB and GSA continue to hold on-going discussions with Networx and MTIPS providers to confirm theavailability and readiness of IPv6 services. Agency transition managers are encouraged to participate in
the discussions and to provide agency experiences with the acquisition and implementation of IPv6
May 2012

Page 47

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

services via the Networx contract. Transition Managers should also work with their appropriate Networx
Designated Agency Representatives (DAR) and their Network Operations group to pr oactively update
their existing circuit inventory and to confirm the ability of all circuits to support IPv6.
Connections II offers IPv6-compliant equipment, applications, transition support, and integrated solutions
to help you with your IPv6 conversion planning, including:






Upgrade public/external facing servers and services (e.g. Web, email, DNS, ISP services, etc.) to
operationally use native IPv6;
Upgrade internal client applications that communicate with public Internet servers and supporting
enterprise networks to operationally use native IPv6;
Support your IPv6 Transition Manager in leading the agency's IPv6 transition activities, and liaison
with the wider Federal IPv6 effort as necessary;
Support agency procurements of networked IT comply with FAR requirements for use of the
USGv6 Profile and Test Program for the completeness and quality of their IPv6 capabilities;
Connections II meets Federal agencies' equipment, labor, building, and campus infrastructure
solution needs, including: Infrastructure design, installation, and implementation, Professional
services to support existing networks, Transition planning and integration services, Customized
client-specific systems.

Connections II offers access to 21 pre-competed industry partners:





















A&T Systems, Inc.
American Systems Corporation
Apptis, Inc.
AT&T Technical Services Company, Inc.
Avaya Government, Solutions, Inc.
BAE Systems Information Solutions, Inc.
CIBER, Inc.
Concert Technologies, Inc.
EPS Corporation
Futron, Inc.
General Dynamics Information Technology, Inc.
Government Telecommunications, Inc.
Harris IT Services Corporation
HP Enterprise Services, LLC
Netcom Technologies, Inc.
Nextira One Federal LLC d/b/a Black Box Network, Services
Qwest Government Services, Inc. d/b/a Century Link QGS
Science Applications International Corporation (SAIC)The Centech Group, Inc
Vector Resources, Inc.
Verizon Federal, Inc.

May 2012

Page 48

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Further information for Ordering and Fair Opportunity is available:
http://www.gsa.gov/portal/content/113287. Also, GSA Connection II staff can also help with Statement ofWork (SOW) information and requests.

8.6 DNSSEC
Deployment of DNSSEC is continuing at a rapid pace as a number of the second level .gov domains havealready been signed. Status of domains can be viewed at: http://www.dnsops.gov/USAdotGOV-status.html.
As the number of DNS query‘s increase for more complex Web sites and additional services security andperformance of DNSSEC securing the DNS resolving infrastructure is critical. A part of the transition to IPv6
initially is to add an IPv6 only overlay DNS servers along with existing IPv4 DNS servers. This will increase
the load on the number of zones that need to get signed and potentially the PKI infrastructure to sign them.
Customer facing DNS servers will not be authenticating customer queries but will be authenticated by the
DNS infrastructure supporting those customer facing DNS servers. It is highly recommended that address
management systems be used to automatically generate forward and reverse RRs for DNS servers.
DNSSEC authenticates Primary DNS server traffic out to end users and devices requesting URL resolution
but not the systems generating the DNS RRs. Agencies should verify the security of the generation andtransportation of DNS RRs to their primary DNS servers, meets their security requirements.
The processor intensive cryptographic requirements of DNSSEC will place additional load on the hardware
and processors of the host servers or appliances. These systems should be sized correctly to handle peakand sustained loads under periods of network stress. DNS servers with DNSSEC and other processor
intensive network services are not good candidates for virtualization or multi-role appliances.

8.7 Cloud Computing: Cloud First Strategy
Due to the potential cost savings and overall improved performance capabilities, OMB has initiated a
Cloud-First Strategy for agency applications and services that can migrate to a Cloud-based infrastructure.
This can apply to public, private, or hybrid public-private clouds.
It is critical that agencies identify and incorporate IPv6 requirements at the beginning of the Cloud
Computing efforts. IPv6 will play a pivotal role in the future and overall value of Cloud Computing solutions.
At a minimum, agencies should ensure that their internal or external cloud service provider can provide theIPv6 capabilities necessary to meet their requirements for the 2012 and 2014 milestones and future IPv6
mission requirements.

8.8 Federal Data Center Consolidation Initiative (FDCCI)FDCCI is a major initiative to reduce the number of data centers across the Federal Government. The
expected result will be a decrease in overall cost, resources, space, and power consumption. This not only
furthers the goal of a more efficient government, but a greener government as well.
IPv6 will play a critical role in developing the service-oriented infrastructure necessary to provide the fully
virtualized computing and network environments for agencies to create next generation data centers thatprovide the flexibility and agility necessary to maximize their value in the FDCCI initiative.
Agencies should plan to accommodate IPv6 within the consolidated data center, paying special attention tosecurity architecture and network management. IPv6 paths might provide inadvertent back doors or
increase the likelihood of using an IPv6 network to exploit vulnerability on the IPv4 network.

May 2012

Page 49

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

8.9 Digital Government Initiative (DGI)
Today‘s amazing mix of high performance servers, cloud computing, ever-smarter mobile devices,collaboration and sharing tools has the potential to change Governance and its service delivery model inthe most fundamental way since the Chinese invented paper to manage it. With ever expanding mission
requirements and smaller budgets it is incumbent on agencies to review their service delivery methods andinternal processes to better leverage the digital revolution which was the genesis for development of theDigital Government Strategy (DGS).
The DGS sets out to do two things:
Enable citizens and an increasingly mobile workforce to access high-quality digital government
information and services anywhere, anytime, on any device.
Operationalizing a data-centric model, we can architect our systems for interoperability andopenness, modernize our content publication model, and deliver better digital services, at a lower
cost, and in a platform and device agnostic way.
Ensure that as the government adjusts to this new digital world, we seize the opportunity to procure
and manage devices, applications, and data in smart, secure and affordable ways. Learning fromthe previous transition of moving information and services online, we now have an opportunity to
break free from the inefficient, costly, and fragmented practices of the past, build a soundgovernance structure for digital services, and do mobile ―right‖ from the beginning.

Additional information on the strategy will be available when the ―Government as a Platform: Building a
Future-Ready Digital Government‖ is published.

9. IPv6 in IT Governance and Procurement
One of the most difficult aspects of any technology transition is the policy and procurement phase.
Agencies understand their overall top-down approach to transitioning to IPv6 and ensure that it is correctly
supported in their policies as well as in their government and procurement programs.

9.1 GovernanceAgencies will need to update their Transition Strategy Plans to reflect the next steps in their IPv6 transition.
This must be done in lock-step with the release of new agency policy and procedures that will continue tosupport the orderly transition to IPv6. In addition, agencies should review their IPv6 transition teams toensure that as their goals evolve over time, their roles and success metrics change to match the new goals.
In addition, senior-level support is needed in the on-going transition to ensure agency-wide participation.
Agencies should:

Develop updated policies to support the on-going IPv6 transition activities, including:– Stated organizations‘ objectives– Capabilities based on stated milestones– Required advanced IPv6 features– IPv6 functional hurdles– Definition of IPv6-capable– Program preparation and planning requirements– Locations for deployment– Levels of security

May 2012

Page 50

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government







– Utilization of IPv6
– Functional profiles– Prohibitions of use
Develop milestones that are believable and achievable
Publish guidelines for minimum functional capabilities by specific milestones
Point to a technical architecture
Establish an agency plan and schedule
Inject IPv6 into current programs and projects.

9.2 Procurement
One of the primary tenets associated with the Federal IPv6 transition philosophy has been the use oftechnology refreshment cycles to enable IPv6 across the Federal-wide Enterprise Architecture. This
concept supports an extended transition timeframe during which agencies can incorporate IPv6 into theirnormal acquisition cycles over time, thus alleviating large capital deployments to support the transition.
With the new targets established by OMB for 2012 and 2014, some agencies may find that waiting fortechnology refresh will not be a compatible approach to meeting these dates. In these instances, agencies
will need to direct short-term funds to ensure the necessary IPv6 functionality.
In accordance with Federal Acquisition Regulation (FAR) 11.002(g), agencies need to include theappropriate standards for IPv6 in all IT-related acquisitions that have any relation to the network. In
addition, agencies must review the NIST USGv6 Profile and Testing plans to determine how to specify
future IPv6 product acquisitions.
Thus, agencies will have to work with their acquisition groups to augment their existing acquisition process
in order to ensure that IPv6 is embed to the fullest extent possible throughout the IT Supply Chain of the
USG. . While the USGv6 Profile and test process developed by NIST provides part of the acquisition
solution, it is limited to identifying conformance and interoperability requirements for host, routers, andnetwork protection devices. Agencies may have additional requirements for performance or functionality or
have IPv6 requirements for other acquisition needs, such as applications or ISP services. In these cases,
agencies will have to develop additional language for their acquisition packages.
Agencies should consider:






FAR-compliant acquisition and procurement language for all IT-related products and services
Development of standard contractual language
Investigation of the modification of past contractual language
Investigation of an IPv6 contractual vehicle that permits all agency entities to contract for IPv6
supportDevelopment of product profiles based on the NIST USGv6 Profile.

May 2012

Page 51

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

10.

Acronym Dictionary

Acronym
AAAA
ACL
ARIN
ARP
BGP
CCTV
CDN
COI
CONUS
COOP
CPIC
DHCPv6DISRDMZDNSDNSSEC
DoD
DOL
DOT
EA
EAAF
E-Authentication
ED
E-Maile-Gov
FDCC
FEA PMOFTPGRE
GUI
HSPD-12IAIDSIKE
IP Fax
IPAM
IPS
IPsec
IPT
IPv4
IPv6
ISATAPIS-IS
ISP
IT
ITI LoB

May 2012

Description
Authentication, authorization, accounting and auditing
Access control list
American Registry for Internet Numbers
Address Resolution Protocol
Boundary Gateway Protocol
Closed Circuit Television
Content Delivery Network
Communities of Interest
Continental United States
Continuity of Operations Plan
Capital Planning and Investment Control
Dynamic Host Configuration Protocol for IPv6
DoD Information Standards Registry
Demilitarized Zone
Domain Name System
Domain Name System (DNS) Security Extensions
Department of Defense
Department of Labor
Department of Transportation
Enterprise ArchitectureEnterprise Architecture Assessment Framework
Electronic Authentication
Education
Electronic Mail
Electronic Government
Federal Desktop Core Configuration
Federal Enterprise Architecture Program Management OfficeFile Transfer Protocol
Generic Routing Encapsulation
Graphical User Interface
Homeland Security Presidential Directive-12
Information Assurance
Intrusion Detection System
Internet Key ExchangeInternet Protocol Facsimile
Internet Protocol Address Management
Intrusion Prevention System
Internet Protocol Security
Internet Protocol TelephonyInternet Protocol Version 4Internet Protocol Version 6
Intra-Site Automatic Tunnel Addressing Protocol
Intermediate System to Intermediate System
Internet Service Provider
Information Technology
Information Technology (IT) Infrastructure Line of Business

Page 52

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

Acronym
ITI PPMO
ITS
ITV
LAN
LLDP
LoB
MAC ID
MIPv6
MPLS
NAC
NAT
NEMO
NIST
NMS
NOAA
NWS
OMB
OS
OSPF
PCs
PDA
PKI
QoS
RFC
RFP
RIR
RR
SLAAC
SNMP
SOA
SSL
TCP/IP
TIC
TRM
UC
USGCB
USG IPv6 FAQs
USPS
VLAN
VoIP
VPN
WAAS
WAN
WOA

May 2012

Description
IT Infrastructure Program Performance Measurement OfficeIntelligent Transportation Systems
In-Transit Visibility
Local Area Network
Link Layer Discovery Protocol
Line of BusinessMedia Access Control Identification. (MAC is also known as Medium AccessControl.)
Mobile IP version 6
Multi-Protocol Label Switching
Network Access Control
Network Address Translation
Network Mobility
National Institute for Standards and Technology
Network Management System
National Oceanic and Atmospheric Administration
National Weather Service
Office of Management and Budget
Operating System
Open Shortest Path First
Personal Computers
Personal Digital AssistantPublic Key Infrastructure
Quality of Service
Request for Comments
Request for Proposal
Regional Internet Registry
DNS Resource Record
Stateless Address Auto Configuration
Simple Network Management Protocol
Service-Oriented Architecture
Secure Sockets Layer
Transmission Control Protocol/Internet Protocol
Trusted Internet Connection
Time Reversal Mirror
Unified Communications
United States Government Configuration Baseline
United States Government IPv6 Frequently Asked Questions
U.S. Postal Service
Virtual LAN
Voice over Internet Protocol (IP)
Virtual Private Network
Wide Area Application Services
Wide Area Network
Web Platform Oriented Architecture

Page 53

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

11.





Definitions
Firewall: A firewall is a dedicated appliance, or software running on another computer, whichinspects network traffic passing through it, and denies or permits passage based on a set of rules.
HSPD-12: Homeland Security Presidential Directive (HSPD) 12 is ―Policy for a Common
Identification Standard for Federal Employees and Contractors‖
NETWORX: Federal Government contract vehicle for telecommunications and related services.
Wi-Fi: A trade name for the popular wireless technology used in home networks, mobile phones,
video games and other electronic devices that require some form of wireless networking capability.
Wi-Fi technologies are supported by nearly every modern personal computer operating system,
most advanced game consoles and laptops, and many printers and other peripherals.

May 2012

Page 54

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

12.

IPv6 FAQ

The Federal IPv6 task force has created and maintains a set of Frequently Asked Questions that are
published on the CIO.GOV Website at the URL below:
http://www.cio.gov/Documents/IPv6-FAQ%2011-4-2011.pdf

May 2012

Page 55

Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government

13.

Resources

APNIC 24 Plenary Session: "The Future of IPv4," September 2007.
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_10-3/103_addr-dep.html
Improving Agency Performance Using Information and Information Technology, Enterprise Architecture
Assessment Framework (EAAF) version 3.0. December 2008.
http://www.whitehouse.gov/omb/e-gov/fea
IPv6 FAR Amendment
http://www.gpo.gov/fdsys/pkg/FR-2009-12-10/pdf/E9-28931.pdf"IPv6 Standards Profile Released," September 19, 2008.
http://gcn.com/articles/2008/09/19/ipv6-standards-profile-released.aspx
IPv6 Wiki For Transition Managers
https://max.omb.gov/community/x/EhPVINIST IPv6 Deployment Monitor
http://fedv6-deployment.antd.nist.gov/―NIST Special Publication 500-267: A Profile for IPv6 in the U.S. Government – Version 1.0‖, July 2008.
http://www.antd.nist.gov/usgv6/usgv6-v1.pdf
NIST USGv6 Deployment Test Suite
http://www.antd.nist.gov/usgv6/
NTIA IPv6 Web-page and Resources
http://www.ntia.doc.gov/category/ipv6"OMB: Agencies met IPv6 deadline," July 1, 2008.
http://fcw.com/Articles/2008/07/01/OMB-Agencies-met-IPv6-deadline.aspx
Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government
http://www.cio.gov
Practical Guide on Federal Service Oriented Architecture, June 2008.
http://www.whitehouse.gov/omb/E-Gov/pgfsoa
September 28, 2010 OMB Memorandum
http://www.cio.gov/documents/IPv6MemoFINAL.pdf―Service-Oriented Infrastructure Project Description,‖ July 31, 2007.
http://www.docstoc.com/docs/75121434/Service-Oriented-Infrastructure-Project-Description%E2%80%9CFromThe Council of the European Union, ―Council Conclusions on Future Networks and the Internet,‖
December 1, 2008.
http://ec.europa.eu/information_society/eeurope/i2010/key_documents/index_en.htm#i2010_High_Level_Grou
p_discussion_papers
For a summary of the relevant amendments, refer tohttp://edocket.access.gpo.gov/2009/pdf/E9-28931.pdf

May 2012

Page 56