User manual HP JETDIRECT 635N IPV6/IPSEC PRINT SERVER JETDIRECT PRINT SERVERS - PRACTICAL IPV6 DEPLOYMENT FOR PRINTING AND IMAGING DE

[. . . ] Practical IPv6 Deployment for Printing and Imaging Devices whitepaper May 2008 Table of Contents: Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 IPv6 ­ Truths, Myths, and Practical Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 The Importance of Names and Name Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 The Isolated Dual-Stack. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] This is an important point: "ping mfp2" would have worked but "ping 14 mfp2. example. internal" would have failed because "ping mfp2. example. internal" effectively says: "only check the DNS server". Effectively in these last few configurations, although all the Vista machines and HP MFPs have an IPv6 address, communication only goes over IPv4. Can we force IPv6 to be used in these environments?Sure, but we are forced to use the IPv6 Link Local address explicitly, which really provides no benefit, is extremely error-prone, and can only be used for communication on the local subnet. As we can see, IPv6 for HP's printing and imaging devices results in "IPv6 Link Local Islands" because IPv6 is not used due to how name resolution operates. What IPv6 Address Range Should We Use? We've covered IPv6 being turned on by default and being deployed in IPv4 environments. What happens if we actually want to deploy IPv6 but do not want to have an Internet IPv6 presence?Rather than discuss a way of getting an IPv6 address range from an Internet Service Provider (ISP), this whitepaper will discuss the IPv6 Unique-Local range which can be setup for a given environment or "site". This process will not allow IPv6 address to be used to access the Internet directly, but will allow the deployment of routable IPv6 addresses in the intranet. We can use Unique-Local internally to a "site" and populate the internal DNS servers with this information (e. g. "example. internal" and not "example. com"). The Unique-Local Range is formatted as follows (from RFC 4193): Prefix: 7 bits Local Bit: a single bit set to a one. Effectively, the above shows the prefix for Unique-Local will be FD in hexadecimal Global ID: 40 bits or 5 octets Subnet ID: 16 bits or 2 octets Interface ID: 64 bits or 8 octets For our purposes, the 40 bits for the Global ID is the most important. What we want to do is come up a random way of generating the 40 bits. We only have to do this once for an entire site (Note: "site" is a loose term. A company may have several physical sites, but in this discussion all of those sites will have only one global ID and the different physical sites will be differentiated through the subnet field). We can simply borrow some dice from a family game at home or buy some from the store for a small amount of money. The value of the die throw will be converted to a binary value. This conversion is done as follows: If the die value is odd, the binary value is one; if the die value is even, the binary value is zero. An example table and values is shown in Figure 8: 15 Figure 8 - Die Roll to Binary Conversion 16 Once we have this table, we can bring up the Windows calculator to do the rest of the work for us. Figure 9 - Standard View Calculator Change to the Scientific View. Figure 10 - Change to Scientific View 17 Figure 11 - Scientific View Select Binary. Figure 12 - Select Binary Enter the Binary values from your dice rolls. 18 Figure 53 - Enter Binary Value Select Hex, which will automatically conver the Binary value to Hexadecimal, to get the Global ID. Figure 64 - Convert to Hexadecimal The format of the unique-local address would be as follows: FD [insert random string here] [subnet]::/64 Assuming a subnet of zero and using the random value in Figure 14, we have: FDD6:1302:208E:0000::/64 19 To maintain and promote our general sanity, we will match our subnet values for IPv6 with the subnet values for IPv4 as shown: Figure 15 - Unique Local Network Configuration This unique-local IPv6 range was done only for example purposes so please do not use it in actual deployments. In addition, the IPv6 link local address is still available to be used, just not shown. The rest of this whitepaper will use the non link local IPv6 range assigned for use in documentation, 2001:0DB8::/32. IPv6 Stateless Automatic Address Configuration (SLAAC) Assuming the network administrator decides to upgrade the IPv4 router to support IPv4 and IPv6 or adds a separate router to support IPv6 routing, suddenly the network behavior could change quite drastically because IPv6 supports automatic IPv6 address configuration. In order to configure an IPv6 router, non link local IPv6 addresses associated with the links need to be configured. [. . . ] Before making modifications to the Registry, a backup copy should be made. The Registry key we want to modify has to first be created. Refer to Figure 22: Figure 10 - Disabled Components We can see that the key resides here: · HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters The key needs to be called DisabledComponents and should be a DWORD set to zero. Now we need to modify the value of Disabled Components to have Vista prefer IPv4 over IPv6. We can do this by setting the value to 0x20. [. . . ]