IPv6: Dual stack where you can; tunnel where you must

The benefits of dual-stack and tunneling techniques

IPv6 was delivered with migration techniques to cover every conceivable IPv4 upgrade case, but many were ultimately rejected by the technology community, and today we are left with a small set of practical approaches.

One technique, called dual stack, involves running IPv4 and IPv6 at the same time. End nodes and routers/switches run both protocols, and if IPv6 communication is possible that is the preferred protocol.

A common dual-stack migration strategy is to make the transition from the core to the edge. This involves enabling two TCP/IP protocol stacks on the WAN core routers, then perimeter routers and firewalls, then the server-farm routers and finally the desktop access routers. After the network supports IPv6 and IPv4 protocols, the process will enable dual protocol stacks on the servers and then the edge computer systems.

Another approach is to use tunnels to carry one protocol inside another. These tunnels take IPv6 packets and encapsulate them in IPv4 packets to be sent across portions of the network that haven't yet been upgraded to IPv6. Tunnels can be created where there are IPv6 islands separated by an IPv4 ocean, which will be the norm during the early stages of the transition to IPv6. Later there will be IPv4 islands that will need to be bridged across an IPv6 ocean.

Other techniques, such as network address translation--protocol translation (NAT-PT) simply translate IPv6 packets into IPv4 packets. These translation techniques are more complicated than IPv4 NAT because the protocols have different header formats. Translation techniques were intended to be used as a last resort.

Using dual-stack and tunneling techniques is preferable to using NAT-PT.

There are two types of tunnels: manual and dynamic. Manually configured IPv6 tunneling (RFC 2893) requires configuration at both ends of the tunnel, whereas dynamic tunnels are created automatically based on the packet destination address and routing. Dynamic tunneling techniques simplify maintenance compared with statically configured tunnels, but static tunnels make traffic information available for each endpoint, providing extra security against injected traffic.

There are, in fact, concerns over the security of tunneling techniques. For example, with dynamic tunnels it isn't easy to track who is communicating over the transient tunnels, and you don't know the tunnel destination endpoint. It is a scary proposition when your routers communicate with other nonauthenticated routers. It is also possible to send forged traffic toward a tunnel endpoint and get traffic spuriously inserted into the tunnel. Tunneling creates situations in which traffic will be encapsulated, and many firewalls won't inspect the traffic if it is in a tunnel. Allowing IP Protocol 41 (IPv6 encapsulated in IPv4) through an IPv4 firewall is not a best practice. This is like creating an "IPv6 permit any any all" rule through the firewall.

Tunnels will constantly have to be changed and monitored as your transition progresses. Tunnels will also have to be removed when the IPv6 ocean gets larger and we migrate to full IPv6. Tunnels are, therefore, just a transitional technique, and troubleshooting in an environment full of tunnels will be challenging.

Dynamic tunnel techniques don't create tunnel interfaces that can be monitored with SNMP. Dynamic tunnel techniques such as 6 to 4 use 2002::/16 addresses, which means you will need to re-address the network twice as part of the transition to IPv6. Many of the dynamic tunneling techniques are also unable to forward multicast traffic and can't traverse an IPv4 NAT in the middle of the network.

It will be easier to try to run everything in a dual-stack mode first and then remove the IPv4 protocol over time. Currently there aren't many systems being developed for IPv6-only communications, but there are many systems that work in dual-stack mode. Microsoft's new operating systems, for example, have a dual-layer architecture that makes for seamless operation of either protocol. Therefore, migration plans should maximize the use of dual stack and minimize the amount of tunneling. It should also be mentioned that running dual stack is not the final state. We can't forget that full migration to IPv6 is the final destination.

In the 1990s the network industry used the phrase "Switch where you can, route where you must." However, over time the performance gap between routing and switching closed. For IPv6 transitions the new moniker will be "Dual stack where you can, tunnel where you must."

Hogg is director of Advanced Technology Services Global Technology Resources, Inc. You can reach him at SHogg@GTRI.com.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Scott Hogg

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?