Erion’s David Holder provides an insight into the recent IPv6 Security Workshop

I was privileged to be invited to speak at this year’s IPv6 Security Workshop arranged by the UK IPv6 Council. The event, held at the BT Centre in central London, was oversubscribed well in advanced with around 170 delegates registered. This was the largest subscription for any IPv6 Council event to date and the speediest registration yet! The speaker line-up included many leading IPv6 security experts, those involved in developing IPv6 security standards, the National Cyber Security Centre and a range of industry experts. We were all delighted to see such a high level of interest in IPv6.

In my introductory presentation, I gave a quick, but comprehensive, overview of the fundamentals of IPv6 Security. You can view the slide deck here. For those who were not able to attend, here are a few highlights.

IPv6 Security Fundamentals

The first crucial point to appreciate is that IPv6 is everywhere. It is the default on all major operating systems and is widely deployed across the Internet. Further, its growth is exponential and at the current rate all Internet users will be using IPv6 by 2020. If you have IPv6 today you will find that over 75% of your traffic will be carried by IPv6 rather than IPv4.

Even if you have not deployed IPv6 it is important to understand that most of current your networks areIPv6 ready and are IPv6 enabled by default. All modern operating systems contain IPv6 stacks. These are on by default. Operating systems will use IPv6 if they possibly can. This means two things: firstly the majority of security vulnerabilities associated with IPv6 are on your networks today even if you have not deployed IPv6 and secondly if you look on your networks you will see IPv6 traffic. Therefore it is essential that you implement IPv6 security, ideally you should have done this over decade ago when IPv6 was already widely implemented in common operating systems. It is not sufficient to, as some suggest, turn off IPv6. Partly because modern operating systems are IPv6 operating systems and also because turning off IPv6 is often an unsupported configuration.

There are two, possibly three, widely held misconceptions regarding IPv6 and IPv6 security. The first two are:

Misconception 1: IPv6 is more secure than IPv4

Misconception 2: IPv6 is less secure than IPv4

Dual Stack IPv6Both of these are wrong. They both assume that a comparison between IPv4 and IPv6 is meaningful, it isn’t. The reason is simple, in our networks there are no IPv4 stacks, all stacks are IPv6 stacks. Therefore, whether you are using IPv6 or not the vulnerability surface of your IPv4 network is practically identical to that of an IPv6 network. There is a combined vulnerability surface consisting of IPv4 and IPv6 vulnerabilities. Comparing the two is therefore meaningless.

There is another major misconception that is relevant to IPv6 security and that is,

Misconception 3: IPv6 is IPv4 with longer addresses

It isn’t. IPv6 has many complex and subtle differences from IPv4. It is a new protocol with many new features. Even in those areas that are superficially the same as IPv4 there are surprising differences. As a result what is often best practice in IPv4 is not best practice in IPv6.

Even IPv6 and IPv4 addresses are very different and not just in their length. For example:

  • NEW New attributes: length, scope and lifetimes
  • NEW It is normal for IPv6 interfaces to have multiple addresses
  • NEW IPv6 addresses can change over time
  • DIFFERENT Multicast is very important in IPv6
  • NEW There are large numbers of methods for assigning interface identifiers
  • DIFFERENT How addresses are used and managed are different
  • DIFFERENT Global public addresses are the norm
  • NEW And of course there are a huge number of addresses

These differences and that includes all the differences not just those relating to addresses, have a direct impact on the IPv6 vulnerability surface and the mitigation techniques required for IPv6.

Whilst it is not possible to list all the IPv6 vulnerabilities it useful to get an idea of where the problems lie. The slide below shows a rough approximation of the IPv6 vulnerability surface. It is not complete and it cannot show how probable or how significant each of the risks is. What it does show is how many new and different areas there are that need to be considered when implementing IPv6 security.

IPv6 Vulnerability Surface

In the presentation, I went through a number of key areas to illustrate three things; first that IPv6 is significantly different from IPv4, second that some of the areas of vulnerability shown in the above diagram contain many vulnerabilities themselves and finally that not everything is worse. Some things are better than IPv4. Of particular note is the area of scanning and reconnaissance. In IPv4, scanning a whole network is simple and fast. In IPv6, it is impractical to directly scan every address in an IPv6 subnet. This is because testing every address in an IPv6 subnet would take hundreds of thousands of years even on Gigabit networks. This is not to say that attackers cannot discover the addresses of IPv6 nodes, they can, it is just much more difficult for them to do so. However, do not forget that all of the vulnerabilities of IPv4 exist in the IPv6 dual stack, therefore even though scanning IPv6 might be difficult if nodes also have IPv4 addresses is it is still trivial for an attacker to find those nodes from their IPv4 addresses.

When designing and implementing your IPv6 security policy you should pay particular attention to these areas that are listed as new in the diagram. Those areas that are similar to IPv4 are often mitigated in IPv6 using the same techniques that are common in IPv4. Therefore, you should begin by ensuring that the security techniques that you use for IPv4 are also implemented for IPv6. For example, you should use ingres and egress filtering in both IPv4 and IPv6 and you should use unicast reverse path forwarding in both.

In terms of the many differences in IPv6, you need to pay particular attention to the NEW areas in the diagram. Of these, the increased end-to-end transparency, extension header attacks, neighbor discovery attacks and transition mechanism attacks are of particular importance, but this is not to say that you can ignore the other areas. In the presentation I went through each of these and gave specific examples of the types of vulnerabilities. Here are five of the areas that I covered:

  • End-to-end Transparency - Public addresses are the norm, there is no NAT44. Firewalls are necessary (as they are with IPv4).
  • ICMPv6 - Much more complex and critical then ICMPv4. Requires more complex security techniques.
  • Extension Header Manipulation - Whilst the IPv6 header is simple, extension headers that carry options are extremely complex and can be used by attackers in a variety of ways even to hide attacks from security devices.
  • Neighbor Discovery Protocol - NDP is very important to the operation of IPv6 it is also complex. It introduces a number of vulnerabilities to IPv6 nodes and subnets. Securing against these is especially important.
  • Transition Mechanisms - The huge number and complexity of transition mechanisms in itself increases the vulnerability surface. Worse, these create complex interactions between IPv4 and IPv6 and some are standard on many operating systems. Mechanisms such as Teredo are designed to tunnel through IPv4 NAT and firewalls raising the possibility of Teredo being used to circumvent perimeter security.

I then gave a whirlwind tour of IPv6 security features and their pros and cons. Briefly these were:

  • IPsec - Largely the same as IPsec in IPv4. The one key difference is how it is used. The absence of NAT44 in IPv6 makes IPsec transport mode more practical than in IPv4 changing the way IPsec is used.
  • Privacy Addresse - Useful (and the default on many platforms). The temporary nature of privacy addresses has significant implications for operational management including IPv6 Forensics, audit and legal intercept
  • Opaque Static Addresses - Useful (and becoming the default). Avoids linking IPv6 addresses to hardware addresses.
  • SeND and CGAs -Secure Neighbor Discovery (SeND) and Cryptographically Generation Addresses (CGAs) are not widely implement in many operating systems.
  • RA-Guard - Extremely useful protection against rogue IPv6 routers, but can be circumvented using extension headers.
  • DHCPv6-Shield- Extremely useful protection against rogue DHCPv6 servers, but can be circumvented using extension headers.
  • Neighbor Discovery Inspection- Extremely useful protection against attacks against Neighbor Disocvery, but can be circumvented using extension headers.
  • MLD Snooping- Useful for limiting the effectiveness of multicast attacks. Primary use is to improve LAN multicast performance.

I finished by suggesting that the real security benefits of IPv6 will only be seen when we get rid of IPv4 and move to IPv6-only networks. Indeed, some organisations are already moving to IPv6-only networks mainly for operational and cost reasons. Moving to IPv6-only networks will also have security benefits. Removing all of the IPv4 and transition mechanism vulnerabilities it will be possible to make full use of the security features of IPv6.

The key high-level points to take away from my presentation were:

  • IPv4-only networks are historic, they rarely exist today
  • IPv6 should already form a part of your security policy today
  • IPv6 has introduced many new vulnerabilities and features
  • IPv6-only networks will have fewer vulnerabilities
  • Legacy IPv4 thinking is a security risk - staff IPv6 competency is crucial

Erion IPv6 Cyber Security Training

Erion is the world’s leading IPv6 training company with the largest portfolio of IPv6 training courses covering all topics and environments. We have a range of IPv6 security training courses from short introductions to advanced and detailed technical IPv6 security courses. Further information on our IPv6 training can be found at www.ipv6training.com.

Erion recently released a NEW IPv6 Forensics course. This advanced course covers all aspects of IPv6 forensics and is ideal for all those involved in forensic activities.

Other Presentations from the IPv6 Security Work Shop

You can find many of the other presentation from the workshop at http://www.ipv6.org.uk/2017/03/31/ipv6-security-workshop-jul-2017/.


In the coming months you have the opportunity to attend advanced IPv6 training from the world’s leading IPv6 training company.

We have two new public scheduled dates for our popular and comprehensive Implementing and Securing IPv6 course as well as a date for our new course IPv6 Forensics.

IPv6 Forensics is a brand-new training course.

Our Implementing and Securing IPv6 course provides you with all that you need in order to plan for, design, deploy and secure IPv6 in your network and our IPv6 Forensics provides security professionals with the skills and tools to carry out investigations in IPv6 networks.

Implementing and Securing IPv6 is of our most popular IPv6 training courses.

These are advanced technical courses that are ideal for all technologists interested in learning how to both deploy and secure IPv6.

IPv6 training is becoming increasingly relevant in 2017 with the exponential growth in the deployment of IPv6 and the increasing deterioration of the legacy IPv4 Internet.

Deploying IPv6 not only future proofs your network but it also brings with it the opportunity for performance, functionality and operational improvements. For example, Facebook found that end users using IPv6 experience a 15% performance improvement over end users using IPv4. Also, in the long term, IPv6 is the only protocol suitable as a basis for the Internet of Things (IoT).

Furthermore, we already reaching the point where organisations are not only considering moving to IPv6-only networks but have already deployed such networks. Microsoft, Facebook, LinkedIn and Cisco are amongst those who have or are in the process of deploying IPv6-only networks.

IPv6 is very different from IPv4.

The common belief that IPv6 is IPv4 with longer addresses is wrong. IPv6 is made up of many new features and functions which are often widely and subtly different from those in IPv4. Even IPv6 addresses are significantly different from IPv4 addresses, not just in size, but in how they are structured, their types, their attributes, how many their are and how they are used. It is crucially important when deploying and securing IPv6 to move away from legacy IPv4 thinking and fully appreciate the differences from IPv4.

Course Information

Date Course Location Duration
25th Sep 2017 Implementing and Securing IPv6 Edinburgh 5 days
29th Jan 2018 Implementing and Securing IPv6 London 5 days
6th Feb 2018 IPv6 Forensics London 4 days

Book Now

Introduction to Erion

Erion is the world’s leading IPv6 training company. With over 19 years experience of providing IPv6 training and IPv6 consultancy services, Erion has the world’s most comprehensive portfolio of IPv6 training courses. Erion’s courses cover all aspects of IPv6 on all major operating systems and platforms.

All Erion’s IPv6 training courses are Gold certified by the IPv6 Forum. Our IPv6 security courses are also IPv6 Security certified from the IPv6 Forum.

These courses will be delivered by Erion’s chief consultant Dr David Holder.

Instructor Bio: Dr David Holder CEng FIET MIEEE

Dr Holder has over twenty-eight years’ experience in the IT industry in senior technical and management posts. He is currently the CEO and chief consultant at Erion Ltd, the world-leading IPv6 training and IPv6 consultancy company.

In his role at Erion, Dr Holder has had over nineteen years’ experience providing IPv6 consultancy to leading global organizations worldwide. He has assisted organizations to develop IPv6 strategies, enable IPv6 in their products, create IPv6 address schemas and deploy IPv6. His experience covers all major networking and operating system platforms. Clients include Alcatel Lucent, Arbor Networks, Atos Origins, Brocade, BT, Dell, Ericsson, HP, IBM, Sony and Sophos. He is the author of white papers, solution guides, books and training courses on IPv6 and related topics. Recent papers include two published by the UK telecommunications regulator Ofcom on IPv6 and CGN.

In addition to his role at Erion, Dr Holder is active in promoting IPv6 both in the UK and abroad where he is a regular speaker at IPv6 related conferences. He is the chairperson of the IPv6 Task Force Scotland, founder of the IPv6 Future Enabler conference and is a regular speaker at Global conferences on IPv6.

Dr Holder has a PhD in High-Frequency Semiconductor Physics and an Honors degree in Electronic Engineering. He is a Chartered Engineer, a Fellow of the Institute of Engineering Technology and a Member of the IEEE. He holds several industry qualifications.

Please contact us for further details.


Today, IPv6 comes as standard in all major operating systems. Users with IPv6 and IPv4 connectivity find that over 75% if their network traffic is carried by IPv6 rather than IPv4. Globally, the Internet is moving towards an IPv6 world.

The growth in IPv6 deployment has significant consequences for network security and in particular network forensics. Erion’s new course, IPv6 Forensics course, is designed to address the needs of those tasked with carrying out forensic investigations in IPv6 networks. This advanced course covers how to effectively collect and analyse IPv6 evidence. It covers a wide range of techniques and tools that allow an investigator to securely record the often transitory network evidence and then filter, dissect and analyse it.

Throughout the course delegates will learn how to use tools to capture packets and network information and then interpret the results. Each modules includes extensive practical work on real-life scenarios.

Modules in the four day course include:

  • IPv6 Forensics Fundamentals
  • Sources of IPv6 Evidence
  • Interpreting IPv6 Addresses
  • IPv6 Traffic Capture and Analysis
  • IPv6 Flow Capture and Analysis
  • Evidence from Neighbor Discovery (ND)
  • DHCPv6 Forensics
  • IPv6 Name Resolution Forensics
  • IPv6 Transition Forensics
  • IPv6 Application Forensics
  • IPv6 IPsec Forensics
  • IPv6 Network Evidence

Full details of the IPv6 Forensics course can be found here.

The first public course will run in February 2018. Please contact us if you require an on-site closed course or an earlier event.

Course Details

Course: IPv6 Forensics
Duration: 4 days
Location: London, UK
Dates: 6th February to 9th February 2018
Delegate Fee: £3,190.00 (GBP) + VAT if applicable

Book Now

Erion is the world’s leading IPv6 training company. With over 19 years experience of providing IPv6 training and IPv6 consultancy services, Erion has the world’s most comprehensive portfolio of IPv6 training courses. Erion’s courses cover all aspects of IPv6 on all major operating systems and platforms.

All Erion’s IPv6 training courses are Gold certified by the IPv6 Forum. Our IPv6 security courses are also IPv6 Security certified from the IPv6 Forum.

This course will take place in our London, UK venue.

The training fee includes, access to excellent facilities and the provision of a complimentary, sit-down lunch and unlimited tea, coffee, biscuits and fruit throughout the day.

This course will be delivered by Erion’s chief consultant Dr David Holder.

Instructor Bio: Dr David Holder CEng FIET MIEEE

Dr Holder has over twenty-eight years’ experience in the IT industry in senior technical and management posts. He is currently the CEO and chief consultant at Erion Ltd, the world-leading IPv6 training and IPv6 consultancy company.

In his role at Erion, Dr Holder has had over nineteen years’ experience providing IPv6 consultancy to leading global organizations worldwide. He has assisted organizations to develop IPv6 strategies, enable IPv6 in their products, create IPv6 address schemas and deploy IPv6. His experience covers all major networking and operating system platforms. Clients include Alcatel Lucent, Arbor Networks, Atos Origins, Brocade, BT, Dell, Ericsson, HP, IBM, Sony and Sophos. He is the author of white papers, solution guides, books and training courses on IPv6 and related topics. Recent papers include two published by the UK telecommunications regulator Ofcom on IPv6 and CGN.

In addition to his role at Erion, Dr Holder is active in promoting IPv6 both in the UK and abroad where he is a regular speaker at IPv6 related conferences. He is the chairperson of the IPv6 Task Force Scotland, founder of the IPv6 Future Enabler conference and is a regular speaker at Global conferences on IPv6.

Dr Holder has a PhD in High-Frequency Semiconductor Physics and an Honors degree in Electronic Engineering. He is a Chartered Engineer, a Fellow of the Institute of Engineering Technology and a Member of the IEEE. He holds several industry qualifications.

Information on other Erion IPv6 courses can be found on our IPv6 Training web-site.


Earlier this year I was privileged to speak at the North American IPv6 Task Force (NAv6TF) 2017 conference held at LinkedIn’s offices in Sunnyvale California.The NAv6TF has a long history of promoting IPv6 adoption in North America and further afield. Many well-known IPv6 names are actively involved in NAv6TF. This year, I joined a truly excellent set of  speakers from organisations such as LinkedIn, Cloudflare, Akamai, Cisco, Microsoft, NASA, ARIN, Comcast, Infoblox and T-Mobile.

My presentation described the effects that the increasing deployment of Carrier Grade NAT (CGN) is having on the legacy IPv4 Internet. CGN is causing problems for all parties from application developers, content providers, service providers, law-enforcement through to end-users. These non-trivial problems can all be mitigated or resolved through the deployment of IPv6. As a result, CGN and the degradation of the IPv4 Internet are acting as drivers for the adoption of IPv6.

You can watch a video of the session below or view the slides here.

At the conference, Kevin L. Jones from presented a very interesting talk on the status of IPv6 in NASA and the Federal government. I was delighted that he had taken the time to measure the IPv6 status of each of the organisations represented by speakers at the conference. Erion got five out of five stars!

 Erion IPv6 5 Stars

 

 


The UK IPv6 Council is running a one-day workshop on IPv6 Security in July. Erion’s David Holder is to present a session entitled “IPv6 Security Fundamentals”.

Agenda

10:00 - 10:30 - Arrivals and Registrations

Morning block - Setting the scene

10:30 - 10:40 - Opening session

10:40 - 11:00 - BT Keynote (Mark Hughes, CEO BT Security)

11:00 - 11:30 - System Design with Security in Mind (Rich, Chief IA Architect, National Cyber Security Center)

11:30 - 12:30 - IPv6 Security Fundamentals (Dr. David Holder, Erion)

12:30 - 13:30 - Lunch break

Afternoon block 1 - IPv6 security in practice

13:30 - 14:30 - Practical IPv6 Security tools (Fernando Gont, SI6 Networks)

14:30 - 15:00 - IETF IPv6 Security update (Tim Chown, JISC; Fernando Gont, SI6 Networks)

15:00 - 15:30 - Afternoon break

Afternoon block 2 - Lessons learned

15:30 - 15:50 - Stories from the end of thousands of IRC IPv6 connections (Russ Garrett, IRCCloud)

15:50 - 16:10 - The routing challenges of IPv6 DoS mitigation (David Freedman, Claranet)

16:10 - 16:30 - IPv6 first hop security in cloud environments (David Freedman, Claranet)

16:30 - 17:00 - Panel discussion

Booking Details

Full details can be found at  https://www.eventbrite.co.uk/e/ipv6-security-workshop-tickets-34850460666


In May 2017, you have the opportunity to attend advanced IPv6 training from the world’s leading IPv6 training company.

The comprehensive Implementing and Securing IPv6  course provides you with all that you need in order to plan for, design, deploy and secure IPv6 in your network.

One of our most popular IPv6 training courses.

This is an advanced technical course that is ideal for all technologists interested in learning how to both deploy and secure IPv6. It provides all that you need to understand the issues surrounding IPv6 deployment and security and includes comprehensive practical hands-on labs to allow you to gain experience with real-world scenarios.

IPv6 training is becoming increasingly relevant in 2017 with the exponential growth in the deployment of IPv6 and the increasing deterioration of the legacy IPv4 Internet.

Deploying IPv6 not only future proofs your network but it also brings with it the opportunity for performance, functionality and operational improvements. For example, Facebook found that end users using IPv6 experience a 15% performance improvement over end users using IPv4. Also, in the long term, IPv6 is the only protocol suitable as a basis for the Internet of Things (IoT).

Furthermore, we already reaching the point where organisations are not only considering moving to IPv6-only networks but have already deployed such networks. Microsoft, Facebook, LinkedIn and Cisco are amongst those who have or are in the process of deploying IPv6-only networks.

IPv6 is very different from IPv4.

The common belief that IPv6 is IPv4 with longer addresses is wrong. IPv6 is made up of many new features and functions which are often widely and subtly different from those in IPv4. Even IPv6 addresses are significantly different from IPv4 addresses, not just in size, but in how they are structured, their types, their attributes, how many their are and how they are used. It is crucially important when deploying and securing IPv6 to move away from legacy IPv4 thinking and fully appreciate the differences from IPv4.

Course Details

Course: Implementing and Securing IPv6
Duration: 5 days
Location: Edinburgh, UK
Dates: 15th to 19th May 2017
Exercise platforms: Linux (default), Cisco IOS, Windows
Delegate Fee: £2,195.00 (GBP) + VAT if applicable

  Book Now

Erion is the world’s leading IPv6 training company. With over 19 years experience of providing IPv6 training and IPv6 consultancy services, Erion has the world’s most comprehensive portfolio of IPv6 training courses. Erion’s courses cover all aspects of IPv6 on all major operating systems and platforms.

All Erion’s IPv6 training courses are Gold certified by the IPv6 Forum. Our IPv6 security courses are also IPv6 Security certified from the IPv6 Forum.

This course will take place in our Edinburgh, UK venue which is situated in the city centre near to the world famous Edinburgh castle. There are many excellent facilities and hotels within walking distance. Edinburgh is easily reached via Edinburgh airport and by the UK rail and road network.

The training fee includes, access to excellent facilities and the provision of a complimentary breakfast, sit-down lunch and unlimited tea, coffee, biscuits and fruit throughout the day.

This course will be delivered by Erion’s chief consultant Dr David Holder.

Instructor Bio: Dr David Holder CEng FIET MIEEE

Dr Holder has over twenty-eight years’ experience in the IT industry in senior technical and management posts. He is currently the CEO and chief consultant at Erion Ltd, the world-leading IPv6 training and IPv6 consultancy company.

In his role at Erion, Dr Holder has had over nineteen years’ experience providing IPv6 consultancy to leading global organizations worldwide. He has assisted organizations to develop IPv6 strategies, enable IPv6 in their products, create IPv6 address schemas and deploy IPv6. His experience covers all major networking and operating system platforms. Clients include Alcatel Lucent, Arbor Networks, Atos Origins, Brocade, BT, Dell, Ericsson, HP, IBM, Sony and Sophos. He is the author of white papers, solution guides, books and training courses on IPv6 and related topics. Recent papers include two published by the UK telecommunications regulator Ofcom on IPv6 and CGN.

In addition to his role at Erion, Dr Holder is active in promoting IPv6 both in the UK and abroad where he is a regular speaker at IPv6 related conferences. He is the chairperson of the IPv6 Task Force Scotland, founder of the IPv6 Future Enabler conference and is a regular speaker at Global conferences on IPv6.

Dr Holder has a PhD in High-Frequency Semiconductor Physics and an Honors degree in Electronic Engineering. He is a Chartered Engineer, a Fellow of the Institute of Engineering Technology and a Member of the IEEE. He holds several industry qualifications.

Please contact us for further details.


The North American IPv6 Task Force (NAv6TF) 2017 conference is to be held at LinkedIn’s headquarters (Sunnyvale, CA) on the 26th and 27th April 2017. Details can be found here.

Erion’s chief consultancy and CEO Dr. David Holder will be speaking at the event on  CGN a Driver for IPv6 Adoption. Here is the abstract:

Abstract

The IPv4 address space is exhausted and the scarcity of addresses is leading to the deployment of techniques to preserve and better utilise currently allocated addresses. Amongst these techniques, Carrier Grade NAT (CGN) is one which service providers are increasingly deploying in their access networks.

The long-term solution to address exhaustion is IPv6 with its enormous address space. However, the existing and widespread deployment of IPv4 networks and systems make it necessary to continue to support IPv4 into the near future.

The deployment of CGN is not without its challenges. CGN in the data path affects all players; end users, application developers, service providers, carriers and content providers. CGNs can impact banking applications, internet advertising, internet analytics, legal Intercept, computer forensics, privacy, voice and messaging applications, games consoles applications, AJAX applications and much more.

This presentation reviews the implications of CGN, how it affects all parties, the actions that can mitigate CGN issues and why the increasing deployment of CGN is an important driver for the adoption of IPv6

Bio: Dr David Holder CEng FIET MIEEE

Dr Holder has over twenty-eight years’ experience in the IT industry in senior technical and management posts. He is currently the CEO and chief consultant at Erion Ltd, the world-leading IPv6 training and IPv6 consultancy company.

In his role at Erion, Dr Holder has had over nineteen years’ experience providing IPv6 consultancy to leading global organizations worldwide. He has assisted organizations to develop IPv6 strategies, enable IPv6 in their products, create IPv6 address schemas and deploy IPv6. His experience covers all major networking and operating system platforms.  Clients include Alcatel Lucent, Arbor Networks, Atos Origins, Brocade, BT, Dell, Ericsson, HP, IBM, Sony and Sophos.  He is the author of white papers, solution guides, books and training courses on IPv6 and related topics. Recent papers include two published by the UK telecommunications regulator Ofcom on IPv6 and CGN.

In addition to his role at Erion, Dr Holder is active in promoting IPv6 both in the UK and abroad where he is a regular speaker at IPv6 related conferences. He is the chairperson of the IPv6 Task Force Scotland, founder of the IPv6 Future Enabler conference and is a regular speaker at Global conferences on IPv6.

Dr Holder has a PhD in High-Frequency Semiconductor Physics and an Honors degree in Electronic Engineering. He is a Chartered Engineer, a Fellow of the Institute of Engineering Technology and a Member of the IEEE. He holds several industry qualifications.


Google have now joined Amazon and Microsoft in adding IPv6 support to their cloud platform. However, the service is not a native IPv6 offering. Both EC2 and Azure provide native IPv6 to VMs. In contrast, Google Cloud Platform (GCP) only supports IPv6 on load balancers.

At the moment GCP IPv6 support is an “Alpha trial”. So it remains to be seen when it will become a production service and when Google will eventually deliver a native IPv6 service on GCP.

The leading cloud providers have been slow to provide native IPv6 support. It is only recently that Amazon and Microsoft have enabled native IPv6 support in EC2 and Azure. Even so, Microsoft’s native support has limitations; address translation at the edge (NPTv6), no connectivity between VMs and an inability to add IPv6 to existing VMs.

It hoped that Google’s trial will lead to a production service fairly soon but it is unclear when Google plans to deliver a native IPv6 service.


As the world’s leading IPv6 training company, we are pleased to announced that we will be running some of our most popular IPv6 courses in Edinburgh, UK during 2017.

These include our comprehensive 5-day Implementing and Securing IPv6 course which covers all that you need to deploy and secure IPv6 in your networks.

Erion has over 19 years experience in IPv6. Over that time we have provided IPv6 consultancy and IPv6 training to leading organisations, enterprises and governments world-wide. Throughout the many IPv6 deployments and implementations that we have carried out we have consistently noticed two things; people underestimate the need for IPv6 training and IPv6 training is crucial to success.

Many assume that IPv6 is simply IPv4 with longer addresses. This is naive. Whilst the purpose and basic function of IPv6 is the same as IPv4; that is to route datagrams from a one node to another node (possibly on a different network), the features, functions, attributes and management of IPv6 are very different. Crucially, in many cases what is considered best practice in IPv4 is the opposite in IPv6. This means that staff with extensive experience of IPv4 have to have a change of mindset in order to successfully deploy IPv6.

For this reason, we have created the world’s largest portfolio of IPv6 training courses, covering all aspects if IPv6, across many different platforms and for a wide range of audiences. Continuously updated to reflect the latest standards and best practice our courses are ideally suited to ensure that you are ready to deploy IPv6 in an efficient and safe. Thereby maximising the benefit to your business.

Full details of our upcoming IPv6 training schedule can be found here. Alternatively, we can run on-site IPv6 courses for you at your premises when we can tailor the training programme to meet your exact requirements.

May 2017 Schedule

We have just scheduled courses in May 2017 for Edinburgh, UK. This includes our Implementing and Securing IPv6 course on a range of different platforms including Linux, Cisco IOS and Windows.

Full details can be found at our IPv6 training site.

Please contact us for further details.


At long last Amazon have announced native IPv6 support for EC2 instances in Amazon VPCs. This is great news for those whose IPv6 deployments have been held back by the lack of native IPv6 support in EC2.

The IPv6 service was first released in a limited deployment in the US East (Ohio) Region back in December 2016. It is now available in all regions.

In Amazon VPCs, public IPv6 address bocks are assigned to VPCs in /56 blocks. You can allocated space out of an assigned /56 block to subnets and instances.

Instances are dual stack, that is they can use both native IPv4 and native IPv6. An instance can use IPv6 addresses to communicate with other instances as well as the wider internet.

In contrast with Microsoft Azure, Amazon is not using IPv6 network address translation (NAT). Azure uses a form of Network Prefix Translation (NPTv6) on their load balancers to map between internal and external IPv6 addresses. Azure is also limited in how IPv6 addresses can be used. You cannot assigned IPv6 addresses to existing VMs, whereas in Amazon EC2 you can assign IPv6 addresses to existing instances. In addition, in Azure, you cannot use IPv6 to communicate between VMs. In EC2 you can.

This is an important move forward in the deployment of IPv6. It is to be expected that the few suppliers who continue to provide a legacy-IPv6 only service will move to deploying IPv6 in the near future.