IPv6 Readiness Tool
Executive Summary
Internet Protocol (IP) is the core network layer protocol upon which the Internet is built. The current version of the protocol, IPv4, has been in use since the origin of the Internet. However, with an address space of only 4 billion unique IP addresses, rapid growth of Internet usage and Internet-connected devices has created a situation in which available IPv4 address space is rapidly being depleted, with complete exhaustion estimated to occur in early 2012. The successor to IPv4, known as IPv6, supports an effectively unlimited number of Internet users and Internet-connected devices, but it is not backward-compatible with IPv4.
As the number of available IPv4 addresses dwindles, a Board of Directors should ensure that the management team for its organization has taken the appropriate steps to prepare for the exhaustion of IPv4 address space, and that it has plans in place for an eventual transition to IPv6. Such transitions are not expected to be “immediate” events, but rather may take place over the course of several years, depending on a number of influencing factors.
In order to appropriately manage risk and associated exposure around IPv4 address space exhaustion, a company’s management should be addressing some key questions that include the following:
- In what way is this company dependent on the Internet and in particular its ability to reach all current Internet users and Internet-connected devices?
- Which lines of business are dependent on public Internet access and use?
- Does the company’s internal operation rely on Internet technology? Does it use private IPv4 address space? If so, can it continue to rely on IPv4 private addressing or will it need to shift to IPv6?
- Have plans been developed for implementing IPv6 in parallel with IPv4? How long will they take to implement? What are the opex and capex costs?
- Is there an imminent crisis if additional IPv4 address space is no longer available to the company? What options are available to respond?
- Are there test plans for verifying correct and reliable operation of IPv6 Internet access with network service providers? With customers? With vendors, suppliers, and partners?
- If the company relies on assigning IP address space to customers, what is the plan for introducing IPv6 in addition to IPv4, assuming the IPv4 resources available to the company are finite and will eventually be exhausted?
- Is the company prepared to serve a remote customer/user/partner that is using IPv6 exclusively?
A Board of Directors, in its oversight role, should get comfortable that management is aware of potential IPv6 issues facing the company and is positioned to address them.
Background
Current indications are that the IPv4 address space, even if “extended” through the use of Network Address Translation devices and use of private IPv4 address space, is going to be exhausted in 2012 if not sooner. Publicly routable IPv4 address space is allocated by the Internet Corporation for Assigned Names and Numbers (ICANN) to five Regional Internet Registries (RIRs) in North America, Latin America, Europe, Africa and Asia Pacific. It is estimated that the ICANN space will be fully allocated by March 2011. The space available to the RIRs for allocation will likely be consumed within a year after that, although the rate of IPv4 consumption varies from RIR to RIR.
It is also important to understand that the primary consequence of IPv4 exhaustion is NOT a strict transition to IPv6. Rather, it is the ADDITION of IPv6 to the Internet. IPv4 will still work, but new termination points in the Internet may REQUIRE IPv6 assignment.
For some period of time -- and opinions vary considerably on exactly what "some period of time" is -- we will be in a period of co-existence, with both IPv6 and IPv4 address space in use in networks (even though not every termination point will have both IPv4 & IPv6 addresses). While the shortage of new IPv4 addresses will be sufficient to cause an increase in the use of IPv6 and the availability of IPv6 transport, products and IPv6-based services, it is not likely to lead to the cessation of IPv4 usage at the same rate. Eventually, we hope that all IPv4-bearing hosts/devices will also have IPv6 support and addresses, though we recognize that new hosts/devices may have IPv6 only.
The impact of this co-existence will vary considerably from across organizations. Some organizations will be in a position to convert entirely to IPv6 internally and limit their concerns about co-existence to their interactions with external parties. Others, who might have a very large investment in existing IPv4 technology, might need to plan a more complex co-existence and perhaps multiple stages of transition. Ultimately, this co-existence and transition will be driven by several factors, including:
- Environment: The enterprise’s current involvement/investment in IPv4. (An organization with several hundred thousand devices that only speak IPv4 and a large internal IPv4-only network will be in a different position and have different goals than a new/small organization that is about to purchase new equipment or architect a new network.)
- Drivers: The requirements of an enterprise’s customers and trading partners.
- Goals: Whether the enterprise intends to transform into a pure IPv6 shop, operate in some form of hybrid mode, go through single or multiple transitions, etc.
Ascertaining the State of IPv6 Readiness
Public company Boards of Directors (at least for those companies more than a decade old) participated in the experience of representing to shareholders that their company was as ready for the Year 2000 (Y2K) transition as possible, and that gaps had been identified and contingency plans were in place to deal with any failures. (Private companies likely went through a similar process, though without the requirements to share the results in a public forum.)
While there is no Y2K-like “drop-dead” date for the transition of IPv4 to IPv6 within an enterprise, it is critical that enterprise boards have similar visibility into the state of IPv6 readiness across the organization.
The ultimate goal of the accompanying IPv6 readiness spreadsheet template, as discussed at an NTIA-hosted forum held in September 2010, is to develop a tool that can be used to assist the management of an enterprise to understand the state of an enterprise’s IPv6 readiness. The template may also serve as supporting documentation for IPv6-related risks that the company may choose (or ultimately be required) to list in relevant filings with local governments or oversight agencies. Finally, the template may be useful in helping management communicate to the Board of Directors how the company is addressing the questions posed above in the Executive Summary.
The template attempts to provide guidelines for readiness-related investigation in areas including:
- System impact
- Key stakeholders
- Associated costs
- Key risks
- Contingency plans
- Business exposure
While comprehensive, the template is not intended to be exhaustive, as the ultimate level of detail is highly dependent on an enterprise’s size and the complexity of their organization, their business, and their infrastructure. Enterprises can modify the template as they see fit, adding or removing line items as appropriate, and may choose to use separate instances of the template across multiple business areas.
April 8, 2011