IPv6 support on Virgin media

Morgaine

The thing is ISP's can't abandon IPv4 completely until the rest of the internet has caught up.

Note that there's also signs that at least one country has regressed in terms of IPv6 adoption, possibly precisely because they initially chose a bad transition method.

Take a look at this.

https://www.akamai.com/uk/en/about/our-thinking/state-of-the-internet-report/state-of-the-internet-ipv6-adoption-visualization.jsp

The UK appears to be further along with IPv6 deployment than Ireland - Yet if we look at the graphs we see something profoundly disturbing.

Lets look at the UK

While there have been slight declines in IPv6 adoption at times, we have on the whole a steady increase to where we are today.

But the graph showing Irelands IPv6 adoption is really mindboggling.

We have a rise to a high of 60.7% followed by a couple of slight declines and then a crash to 1.6% adoption.

On the plus side, following that we see a steady increase back to the 15.9% adoption we have today, but to me the crash is significant, now I may be reading this wrong altogether, but to me this suggests that someone decided that the state of play with IPv6 adoption was so broken that they decided to pull the plug and start again.  Although without further data on the individual companies over time it's hard to pull anything definite from the graph.

One of the major factors in IPv6 adoption is always going to be how it affects the end user.  A good transition is one where the end user sees little or no negative affect on their internet experience, a bad transition is one that affects their experience negatively.

So what can go wrong with DS-lite.

Streaming - on the whole if we're streaming FROM an IPv4 or IPv6 enabled site, we're not going to see much difference.  Netflix, Youtube, and others already support native IPv6 (although Netflix have declared war on he.net IPv6 tunnels :()  Given the state of IPv4 adoption around the world they're still going to have to cater for IPv4 for some time yet.

However people running solutions where they stream from a home connection MAY be impacted depending on the server software used.

Plex - for example while providing limited connectivity over IPv6 (If you connect directly using a web browser), still does not support native IPv6 for their apps, and the plex.tv website itself is, at time of writing IPv4 only.  While I don't have a full handle on how it works, the server needs a public IPv4 address otherwise it reports it's not reachable from the internet.

Plex themselves have developed a workaround that caters for situations such as DS-Lite, where the server is reachable indirectly via servers at the parent company, however this is a kludge fix, that does limit the streaming bandwidth, a better solution would have been to fully embrace IPv6 in both server and client.

Social Media - Again many of the social media giants already support IPv6, and while I note people like facebook have professed a desire to move to IPv6 only, given the state of IPv6 adoption, it's likely they'll have to keep IPv4 access for a while yet, however it should still be possible to have IPv4 on the edge transtition to a totally internal IPv6 network.

Gaming - by far one of the biggest impacts is going to be for gaming software.  Again the state of play is depressing, if you look at the network settings in many games, you'll see that IPv6 provision is low, even the XBox one - which professes to work best in an IPv6 environment actually moans under native IPv6 if it can't get a Teredo address.  The Playstation 4 fares worse in that Sony have only recently added IPv6 support to the operating system this year.

Even if the gaming platform supports IPv6 - UNLESS THE GAMES DO, then we are no further along, and here is where people will really struggle under DS-Lite with users getting Strict NAT all the time and asking to go back to IPv4 as their gaming experience now sucks.

Home Security Solutions - Now here's another area that's going to be affected by the capabilities of the hardware that's installed.  If your solution dials out to a remote server, then in reality you shouldn't be affected, but many home solutions don't do this, they act as servers themselves, if the solution supports IPv6 then all is well and good (provided you are able to secure it), however if the hardware only supports IPv4 - then under DS-Lite it will become unreachable again with users wanting to go back to IPv4.

In short your transition method must cater for these issues, otherwise it's doomed to fail.

Tim

@ravenstar68:

I think you may have misread what someone said. As far as I know, *NOBODY* has ever suggested switching off all IPv4 access, and I certainly didn't. It would be suicidal (currently), at least in our western part of the Internet, since around 75% of it still runs exclusively over IPv4.

Speaking for myself, I was reporting only on the well-publicized fact that major Internet companies like Facebook, LinkedIn and Microsoft are heading as fast as they possibly can towards IPv6-only infrastructure internally, and I've always qualified it with that word, INTERNALLY. Needless to say, they retain as much IPv4 connectivity under these internal migration plans as they need, but the only IPv4 infrastructure that they retain resides at the edges of their AS.

Under the understanding that nobody at all is talking about abandoning IPv4 connectivity (yet), all four of your categories need to be revisited, since they all address the disaster that would occur if IPv4 connectivity were simply cut off. (You seem to be implying that IPv4 through DS-Lite doesn't work at all in all those common cases.)  Well that total loss of IPv4 just isn't happening, under anyone's plans. :-)

And it's certainly not happening under VM's known or assumed plans. Quite the opposite --- from the little we know, they seem to be retaining native IPv4 provisioning as an option, which surprises me because it negates the only good reason for choosing DS-Lite, namely getting them close to IPv6-only internally.

I'm no fan of DS-Lite, and I've described several times how I would have phased this IPv6 rollout differently, starting with Dual Stack for minimum disruption and easiest evolution.  But I do recognize that DS-Lite has a role later in allowing ISPs to turn off their legacy IPv4 equipment and to grow beyond the limits of IPv4, which Dual Stack cannot do.

Morgaine.

A short postscript to the above ...

It needs to be recognized that a few things are NEVER going to work except through natively provisioned IPv4. Those few things have a short shelf life and a grim future, because ISPs aren't going to keep spending money on dual stack hardware and on the manpower to maintain it, nor to endure more than twice the security headache for very long, just to satisfy a few edge cases.

If you have one of those legacy applications, in due course your choices will be either to replace it with another solution that isn't quite so restrictive, or to employ a service that gives you native IPv4 access by some other means.  A few may decide that they prefer to look back rather than to look forward and so will move to another ISP that matches their requirement better, and that's perfectly fine.  But it would be odd to expect Virgin to fill that role.

Short version:  A few legacy applications that neither work with IPv6 nor with tunneled IPv4 are best replaced by more modern ones. To keep them working in a world that is moving to IPv6 will cost you extra money, some effort, and probably considerable aggravation.

Just because some people are still using a product does not mean that it will still be supported.  At various times when upgrading my PC I have had to replace other pieces of kit as well because the appropriate driver software was no longer available, such as printers and digital cameras.

So I cannot see ISPs continuing to spend money on supporting legacy IPv4 once the vast majority of their customers are happily using the new standard.  Customers will either have to ditch their outdated kit switch to alternative ISPs.

VM definitely need to keep assigning unique IPV4 addresses to their customers hubs, even with IPV6 enabled. Shared IPV4 is a nightmare for many reasons. You can't host, can't game properly when games need port forwarding. And if someone else behind the shared IP does dodgy things they would end up getting everyone behind that IP banned along with them, GG.

VM have no problems with IPV4, all they need to do is toggle on IPV6 along side without doing any IPV4 adjustments.

Morgaine

I wasn't talking about switching IPv4 off completely.

However I can say that DS-Lite will cause users problems, you see users will no longer have a unique public IPv4 address, instead the B4 element on the users router will have a private WAN v4 address.  From the B4 element the connection is then tunneled over IPv6 to the AFTR element where it is passed to the local gateway and then gets a public IPv6 address that is shared with multiple users. i.e. CGNAT

So now we have double NAT - once on the router to translate from the LAN to the WAN IPv4 and once at the gateway to translate from private to public CGNAT address.

So what'll happen?

No port forwarding, either manual or automatic (via UPnP)
Strict NAT for all gaming consoles which means no one can host games - bye bye multiplayer in many cases.  Games hosted on external public servers run by the major companies should be unaffected (so you should still be able to play WoW and Diablo as well as the Call of Duty games and Elder Scrolls online)
No Teredo for XBox one.
You want to access a home security solution over IPv4 from outside your network - forget it.
You want to work from home over IPv4 - it may be possible, but if your employer won't be able to guarantee that only you can connect if he filters by IPv4 address.

People who are merely consumers of IPv4 services i.e. who only surf and stream from the internet will be unaffected as double NAT won't affect these services.

If Virgin Media does roll out DS-Lite these boards are going to be fun.

Tim

ravenstar68 if they did do a public rollout like that I'd be posting ASAP to be reverted back to IPV4 only.

I could are less about IPV6, the whole attitude of "ooh, IPV6, SHINY, roll it out." Is like the people who demanded 4K content from VM two years when 4K is only a temp stop before 8K tvs and no provider had any 4K content either. Aka the 'early adopters' only thinking of their base line, not the bigger picture.

What matters to me is ease of accessibility plus ease of hosting your own things. Right now that is best done over IPV4 with your own unique IPV4 assigned and that's not going to change for a very long time (talking 6+ years easily here.)

See I do think we need IPv6 rolled out.  At the moment we're in a chicken and the egg situation.  ISP's don't want to roll it out as there's no incentive and many game and hardware manufacturers haven't included it because ISP's don't provide it.

I will repeat what I've said previously, IPv6 rollout should have been done LONG BEFORE we neared the point of IPv4 exhaustion.  At that time the two protocols could have theoretically been run side by side with an aim to phasing out IPv4 much sooner,  While I can understand the logistics of ISP's running pure dual stack would be a nightmare, a better solution would be to have a transition mechanism that puts a public IPv4 address on the B4 element.

The overall connection could still be tunnelled over IPv6 to the AFTR  element but there would be no double NAT involved.

Tim

Gamers on VM are going to be screwed.

It seems this is a price they are prepared to pay. Perhaps some sort of opt-in roll out as described previously may mitigate the problem.

I doubt it will encourage the major platforms to get themselves together and incorporate better IPv6 support. Surprised they haven't taken an Apple like approach. Why have a walled garden if you don't use it to do some gardening?

I don't think the Xbox Teredo should be a issue.

Once a Xbox has a working IPv6 connection then that becomes a non-issue (Hosting IPv4 games will still be broken tho).  CGNAT without IPv6 would kill the Teredo, and more to the point you were making, it would stop all non-requested UDP inbound streams.  So a large chunk of things will either not work, or work highly sporadically.  TCP tunnels should work fine as long as they were started from the Customer side.

I think PLEX is in the same chicken and egg situation.  PLEX works great with a lot of devices, a lot of devices that have no intention of adding IPv6 support!  So they are probably of the view, why bother.

What I dislike is how we view IPv4 over IPv6 as a "Transition" mechanism.  I also dislike how we have to lump CGNAT in at the same time.

The reality is that there's two issues at play here, CGNAT(DS-Lite), and IPV6 Deployment.  IPv6 deployment should have started years ago, when the IPv4 pool became an issue THEN DS-Lite should have been something they looked to move to. 

The other thing that I don't like with CGNAT is that we are moving back to PHORM again... Yes I am barking up a old tree here, but If they are sharing data for a single IP then that means they will be doing some form of network accounting.  That's the same type of MITM customer data snooping they wanted to monitize previously!  The thing is that now there will be a legal requirement for them to record data, and once it's there then they might as well make money off of it.  It have no doubt in my mind that it has been seen and considered by someone internally.

You make a very good point. From a deployment perspective converting the network to be IPv6 managed dual-stack then cherry picking users to use DS-Lite afterwards makes a lot more sense to me( as a not-ISP network engineer). Surely this would give lots of options to, for example, force new users to be DS-Lite or start charging for IPv4 for those that feel they really need it.

DS-Lite has been deployed elsewhere so presumably these CGNAT boxes have somewhat known scaling. Cherry picking would at least allow the scalability to be assessed in a more controlled way while giving the most benefits. Sky ran into a surprising issue with their DNS resolver capacity. A DNS resolver is a heck of a sight simpler than a DS-Lite AFTR.

Daft question but does anyone know how DS-Lite was rolled out to the German Liberty Global networks that have been mentioned?

---

thelem wrote:
Shelke wrote:
Shared IPV4 is a nightmare for many reasons. You can't host, can't game properly when games need port forwarding. And if someone else behind the shared IP does dodgy things they would end up getting everyone behind that IP banned along with them, GG.

Those are all problems caused by the game / website not supporting IPv6, they need to be fixed by the game / website makers.

---

I'm not interested in IPV6, what I am interested in this outlook of stick lots of customers behind a single IP address and thinking that it will work. Say you have 29,000 customers natted behind the IP 1.2.3.4. All it takes is one person to say get their self banned on Sony's PSN and that will ban all the other customers who will be stuck with the natted IP for 4+ years because VM IP leases are very sticky. And couple that with how big companies are linking together on abuse issues, one IP ban on Sony PSN under a natted IP could lead to other companies like netflix, googles' youtube etc banning that IP too.

And  I do want to be able to host over IPV4 when I need it.

Literally moving back towards natting IPs is like saying let's all go back to living like it's the 80s. Regressive move. The adding of IPV6 shouldn't interfere with how IPV4 is allocated to hubs now. They should be isolated systems.

It's fun how everybody likes to argue "most people are fine with NATed v4, so we don't need v6", but the moment you extend that to "most people are fine with CGNATed v4, so we don't need public v4 addresses" they get super uppity about it.

We're out of v4, folks. CGNAT is gonna happen whether you like it or not, because there's simply no other way to continue to provide v4 service to people. That's what being "out" means. You might blame VM for doing it earlier than needed, but somebody has to go first. (In the UK that would be Hyperoptic, or any number of community and small scale ISPs -- VM aren't even close to being the first UK ISP to do CGNAT, although they'd be the biggest.)

If anything, we should be glad that VM are giving us v6 at all, so we can continue to host stuff. There are a lot of ISPs out there that do CGNATed v4 and no v6 whatsoever, which means you straight up can't host anything on them.

It's bad that VM are tying v6 deployment and CGNAT together unnecessarily, but unfortunately they've left v6 deployment so late that it starts to make sense to do that and just get all the network changes over and done with in a single project, rather than trying to get management approval for two separate network engineering projects.

Do we know how many customers are sharing an IP on the Liberty networks that already have CG-NAT? 29,000 seems an awful lot of people to share an IP. You only need to allocate the same IP to ten people to reduce your usage of IP addresses by nearly 90%.

CG-NAT is coming whether we like it or not. Individuals may be able to put it off by switching ISP, but that can't work for everyone (there aren't enough IPs).

As CG-NAT becomes more widespread the sites will have to respond to the problems you mention by stopping the practise of blocking by IP address.

I've never been 100% happy with NAT.  I've always been acutely aware of it's shortcomings, and it's clear from reading the RFC that it was only intended to be a stop gap measure until the next IP standard came along.

In some ways NAT was too good at it's job, and we also had the magazines proclaiming how with NAT routers we no longer needed separate firewalls as the router did it all for us.  So small wonder that people who don't understand networking are happy to stay behind NAT.

Make no bones about it - we do need IPv6, and it's not about it being shiny and new, it's the fact that without it, the internet as a whole will become increasingly fractured.  The main concern for me is that the transition for end users be as smooth as possible.  For the most part they should not notice the transition period at all.

I can see I'm going to have to do some digging to see if anyone has a clue exactly what went wrong with IPv6 deployment in Ireland.  to see a drop from 60% back to 1% usage is alarming to say the least,  One wonders whether any lessons could be learned from it.

Tim

The Akamai IPv6 stats looks pretty suspect back in 2015. The APNIC graphs show the LG IPv6 roll out starting at the same point as the Akamai graph but it continues in a steady up and to the right manner:

https://stats.labs.apnic.net/ipv6/AS6830?c=IE&p=1&v=1&w=30&x=1

Google's stats showed no substantial bump in 2015 either; they spent the second half of 2015 growing gradually from 2.5% to 3.5%. I think that bump in Akamai's stats is a measurement artefact. I've seen similar things happen when v4 fails but v6 continues to work, meaning that v6 is a larger percentage of the remaining traffic, although not normally for 6 whole months.

but sticking to IPv4 won't cause the big players any actual issues

You're not paying enough attention to the big players (which is understandable, since they tend to be pretty private about most of their operations); they've been hitting issues due to v4 exhaustion for years and years now. So far they've been able to manage by throwing time and money at the problem, and/or by degrading the service they offer to users, but who ultimately pays for that?

As far as I remember mobile network providers are using GC-NAT (at the APN) to serve all of their customers so I imagine scaling has been long solved in one way or another.

However, I'm also guessing that some of the issues that have been mentioned also perhaps aren't so prevalent as I doubt there are a significant number of people that would choose to regularly game or provide hosting, etc. over a mobile network connection in preference to a fixed line broadband connection.

IPv6 solves the problem for mobile provider (or users) as they could then, in theory, provide a unique v6 address per connected device, compared to NAT'd v4.

Lol

 Fixed broadband providers like VM have an two orders of magnitude more data flowing through their networks. VM have almost 1Tbps of interconnect bandwidth through LINX for example.

Scaling is really non trivial at this scale.

---

Dagger2 wrote:

It's fun how everybody likes to argue "most people are fine with NATed v4, so we don't need v6", but the moment you extend that to "most people are fine with CGNATed v4, so we don't need public v4 addresses" they get super uppity about it.

We're out of v4, folks. CGNAT is gonna happen whether you like it or not, because there's simply no other way to continue to provide v4 service to people. That's what being "out" means. 

 

---

has anyone on this thread indicated that we don't need v6? I think the entire point of the thread was the very opposite :)

and Virgin have been telling us for the entire 7 years that I've been on this thread that they have more than enough ipv4 addresses for their customers. that was one of their justifications for not bothering with ipv6 up until recently. So to then decide to remove those addresses would rankle somewhat.

The DS-Lite with public IPv4 address is an interesting one - it actually makes the problem a lot simpler.  Instead of needing a stateful CGNAT (that remembers the port and maps it to a client IP), the edge router just needs to (de)encapsulate the v4 packet in its v6 wrapper and send it on its way.  That's stateless, so can be done much more efficiently - could be done at line rate with suitable hardware. At this point the ISP network is v6 only, but customers have full v4 routing so it shouldn't break any apps.  Unlike DNS64 and friends it's completely transparent to the end user.

It doesn't solve the v4 exhaustion problem, but that could be done opportunistically (eg new customers don't get a public v4, or put lower tier customers on private v4, or some other criteria).

@Shelke writes:

I'm not interested in IPV6.

Shelke, I have news for you.  You need IPv6, and badly, despite having convinced yourself of the opposite.  All of your problems are being caused by IPv4, so you *should* be interested.  From the sound of it, you have good cause to be a keen IPv6 advocate, as the bad situation with IPv4 is giving you grief.

what I am interested in this outlook of stick lots of customers behind a single IP address and thinking that it will work.

And guess why that is --- it's because IPv4 addresses are running out, so they need to be re-used dynamically, ie. shared.

That was the whole reason why NAT and address sharing were invented --- IPv4 addresses come from a small pool so shortage is inherent.  Even in the early days of the Internet, ISPs couldn't afford to dish out more than one address to residential customers without charging more (hence mostly a business option), yet those residential customers have always owned multiple computers or devices requiring Internet access. The pressure for a solution was immense, hence NAT was embraced with open arms, in the absence of any alternative.  IPv6 was being discussed, but it was far from ready back then.

And I do want to be able to host over IPV4 when I need it.

And you expect to get a public IPv4 address from where?  Do you realize that the address alone costs over $15 now, and rising rapidly, like everything else that is in short supply?  And that's on top of the provisioning ISP's subscription cost. You have an IPv4 address currently, but you don't own that address --- it is allocated to your ISP, and they will withdraw it from your exclusive use when that is the cost-effective thing to do.

In contrast, you can host on as many addresses as you wish on IPv6, and the addresses cost you nothing.

I think you need to pick apart the various issues that are contributing to your distress, instead of starting with the unstated but clearly expected fictional requirement of "I want IPv4 but I don't want to be affected by IPv4 address shortages." It's a non-realizable requirement, and you will be suffering for as long as you hold onto that fiction. It can be hard to un-program oneself from a long-held false belief, but it needs to be done if you expect your issues to be overcome. Your problem is IPv4.

Fortunately, the solution is nearly here.  And yes, I'm aware that there are some hurdles to overcome, mainly getting the majority onboard, but that's why I'm an IPv6 advocate.  It has to be done, as there is no other viable solution.  Looking backwards, or expecting fiction, are not viable solutions.

Morgaine.

---

impromptu wrote:

The DS-Lite with public IPv4 address is an interesting one - it actually makes the problem a lot simpler.  Instead of needing a stateful CGNAT (that remembers the port and maps it to a client IP), the edge router just needs to (de)encapsulate the v4 packet in its v6 wrapper and send it on its way.  That's stateless, so can be done much more efficiently - could be done at line rate with suitable hardware. At this point the ISP network is v6 only, but customers have full v4 routing so it shouldn't break any apps.  Unlike DNS64 and friends it's completely transparent to the end user.

It doesn't solve the v4 exhaustion problem, but that could be done opportunistically (eg new customers don't get a public v4, or put lower tier customers on private v4, or some other criteria).

 

---

The thing is your forgetting that to be able to communicate you have to be able to deal with the return traffic.

There's no such thing as stateless NAT - The individual customers won't have an IPv4 address to themselves, to when that traffic comes back, unless you've stored a table telling you about the outbound traffic state, then there's no way to route the replies back to the correct customers IPv4 address.

Tim