Updates
1.1 General information on how to use this document
1.2 How to specify requirements
2 Proposed generic text for the tender initiator
3 Categories of devices in scope for this document
3.1 Definitions and descriptions of different categories of devices
3.2 Things that are out of scope of this document
4 Lists of required RFC standards for different categories of hardware
4.1 Requirements for "host" equipment
4.2 Requirements for consumer grade "layer-2 switch" equipment
4.3 Requirements for enterprise/ISP grade "layer-2 switch" equipment
4.4 Requirements for "router or layer-3 switch" equipment
4.5 Requirements for "network security equipment”
4.6 Requirements for CPE equipment
4.7 Requirements for Load balancers
5 Requirements for IPv6 support in software
6 IPsec: Mandatory vs Optional
7 Skill requirements of the systems integrator
7.1 Declaration of IPv6 competence
To ensure the smooth and cost-efficient uptake of IPv6 across their networks, it is important that large commercial, public sector or research and education enterprises specify requirements for IPv6 functionality and compatibility when drafting tenders for Information and Communication Technology (ICT) equipment and support.
This document is intended to provide a Best Current Practice (BCP) to support organisations in such tender processes, but does not specify any standards or policy itself. It is an update to ripe-554, which is the second version of the “Requirements for IPv6 in ICT Equipment” guidance.
It offers guidance on what specifications to ask for and it is intended to be used as a template that can be used by governments, universities, large enterprises or any other organisation when specifying IPv6 support in their tenders or equipment requirements. It can also serve as an aid to those people or organisations interested in tendering for government or enterprise contracts.
Be aware that the standards listed here have their origin in various bodies, principally the IETF, which operate independently of the RIPE community, and that any of these standards might be changed or become replaced with a newer version. While this document has been approved by the RIPE membership, principally via the IPv6 WG, as of the date of publication, its contents will age as new RFCs or related documents are issued.
You may also need to adjust the recommendations to your specific local needs; again, this document is purely a template, and the suggested Mandatory and Optional elements may need to be tuned for your specific use case(s).
Some parts of this section are loosely based on the NIST/USGv6 profile developed by the US government:
https://www.nist.gov/programs-projects/usgv6-program
for which there is a newer version at:
https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.500-267Ar1.pdf
The authors have modified the content of these documents to make them more universally applicable. This option includes a list of RFC specification standards, which must be supported, divided into seven categories of devices. Note that this document removes the ‘mobile device’ category, instead including such devices as hosts.
This document also follows the IPv6 Node requirements document, RFC8504 (which updated RFC6434). This RFC contains general IETF guidance and consensus on what parts of IPv6 need to be implemented by different devices, and its contents are generally reflected in this document.
This document does not dictate specific technologies to be used, rather it assumes a network design/solution has been produced, and that design, and the components it uses, needs to be mapped to the procurement document.
An IPv6 Ready Logo certificate can be required for hosts, routers, and CPE Routers. While the Logo certification was devised around 20 years ago, it is kept current with IPv6 standard updates and is a globally accepted program for vendors to promote their equipment and to assert that their equipment fulfills basic IPv6 requirements. The IPv6 Ready Logo latest updates require that devices be tested in IPv6-only environments and have IPv6 enabled by default. The tender initiator shall also provide the list of required mandatory and optional RFCs in order not to exclude vendors that did not yet put their equipment under IPv6 Ready Logo testing certifications. This way public tenders can’t be accused of preferring any type or vendor of equipment.
For more information about the IPv6 Ready Logo program see: http://www.ipv6ready.org/
When we specify the list of required RFCs, we must list all mandatory requirements, except the entries that start with, “If [functionality] is requested…” These entries are mandatory only if the tender initiator requires certain functionality. Similarly, if features listed as Optional are required for the tender initiator’s specific use case(s), then those requirements should be made Mandatory. Please note that the tender initiator should decide what functionality is required, not the equipment vendor; this document is simply a template.
As stated above, the IPv6 Ready Logo program does not cover all equipment that correctly supports IPv6; so declaring such equipment ineligible may not be desirable. This document recommends that the tender initiator specify that eligible equipment be either certified under the IPv6 Ready program or be compliant with the appropriate RFCs listed in the section below.
The IPv6 Ready Logo certification covers basic IPv6 requirements and some advanced features, but not all of them. If you require any advanced feature that is not covered by the IPv6 Ready Logo certification, please request a list of RFCs that covers those specific needs in addition to IPv6 Logo Certification. In the lists below RFCs that are covered in the IPv6 Ready Logo certification are marked with *.
In every tender, the following text shall be included:
All ICT hardware and software that is a subject of this tender must support the IPv6 protocol, and MUST operate in an IPv6-only environment. For example, where SNMP is used, it must be able to operate over IPv6 transport.
If IPv4 is supported, similar performance and capabilities must be provided for both protocols in input, output and/or throughput data-flow performance, transmission and processing of packets. The difference must not be noticeable to users.
IPv6 support can be verified and certified by the IPv6 Ready Logo certificate.
Equipment that has not been put through the IPv6 Ready testing procedures must comply appropriately with the Mandatory and Optional RFCs listed below:
[insert appropriate list of selected mandatory and optional RFCs from below lists]
Requirements are divided in hardware equipment and integrator support.
All requirements placed on IPv4 traffic capabilities like latency, bandwidth and throughput, or for monitoring and accounting, should also be required for IPv6 traffic.
The following definitions will be used for classifying the varying hardware equipment. While some hardware may have overlapping functionality (i.e. a layer-2 switch can act as a layer-3 router or a router may have some firewall capabilities), it is expected that for any overlapping functionality, the requirements for each specific device be combined.
Note that the mobile device category included in ripe-554 has been removed. Such devices now fall under the host category, such that they are considered only from their connectivity to the local infrastructure (via WiFi), and thus the 3GPP-related requirements are out of scope of this document.
Host: A host is a network participant that sends and receives packets but does not forward them on behalf of others. This includes mobile devices attaching to local network infrastructure.
Host devices in an enterprise may be multihomed, mobile devices being one example, and devices with a network and management interface being another. The IETF has worked for many years on approaches to multihoming for IPv6. Specific [RFC4191] requirements are included in this document.
Switch, or ‘Layer-2 Switch’: A switch or ‘layer-2 switch’ is a device that is primarily used for forwarding Ethernet frames, based on their attributes. Exchanging Ethernet information with other Ethernet switches is usually part of its function. This category is further split below into consumer grade (typically for home use) and enterprise/ISP grade.
WiFi access points are technically not pure layer-2 devices, but they should (possibly in cooperation with a wireless controller) perform the same functionality as a layer-2 switch as far as IPv6 features are concerned. Thus the text from this section may also be used for WiFi access points.
Router or ‘Layer-3 Switch’: A router or ‘layer-3 switch’ is a device that is primarily used for forwarding IP packets based on their attributes. Exchanging routing information with other routers is usually part of its function.
Network Security Equipment: Network security equipment is devices whose primary function is to permit, deny and/or monitor traffic between interfaces in order to detect or prevent potential malicious activity. These interfaces can also include VPNs (SSL or IPsec). Network Security Equipment is often also a layer-2 switch or a router/layer-3 switch.
Customer Premise Equipment (CPE): A CPE device is a small office or residential router that is used to connect home users and/or small offices in a myriad of configurations. Although a CPE is usually a router, the requirements are different from an Enterprise/ISP router/layer-3 switch. CPEs often need to support IPv6 transition mechanisms; this document will focus primarily on transition methods for IPv6-only networks.
Load Balancer is a networking device that distributes workload across multiple computers, servers or other resources, to achieve optimal or planned resource utilisation, maximise throughput, minimise response time, and avoid overload.
The following references are of relevance to this BCP document. At the time of publication, the editions indicated were valid. All references are subject to revision; users of this BCP document are therefore encouraged to investigate the possibility of applying the most recent edition of the references listed below.
In the interests of reaching consensus to publish an update to ripe-554 as efficiently as possible, the authors minimised the addition of new types of devices. These may be added in a future update, or as a separate update.
As stated above, mobile devices are considered in this document only in regards to their connectivity to the enterprise infrastructure (typically by WiFi) and in this respect are considered to be hosts.
Note that VMs and containers are out of scope for this document; these functions may be provided on systems procured as hosts via this guidance, but are not “ICT equipment” in themselves.
While [RFC8504] includes a section on YANG for network management, further YANG requirements are not included in this document.
Certain new routing functions that have emerged recently have also not been added at this point, one example being SRv6 [RFC8986].
We have divided the following requirements into two types, Mandatory and Optional. Equipment must meet the Mandatory standards requirements list. Support for the Optional requirements may earn the tender applicant additional points, if so specified by the tender initiator.
Any hardware that does not comply with all of the Mandatory standards should be marked as inappropriate by the tender evaluator.
The standards that are part of the IPv6 Ready Logo test procedures, typically performed by accredited labs, are marked with an asterisk *.
For every mandatory standard the applicable subgroups are specified in parentheses at the end of the line.
A Network Security Device is often placed where a layer-2 switch or a router/layer-3 switch would otherwise be placed. Depending on this placement those requirements should be included.
Functionality and features that are supported over IPv4 should be comparable with the functionality supported over IPv6. For example, if an intrusion prevention system is capable of operating over IPv4 in layer-2 and layer-3 mode, then it should also offer this functionality over IPv6. Or if a firewall is running in a cluster capable of synchronising IPv4 sessions between all members of a cluster, then this must also be possible with IPv6 sessions.
A load balancer distributes incoming requests and/or connections from clients to multiple servers. Load balancers will have to support several combinations of IPv4 and IPv6 connections:
All software must support IPv6 and be able to communicate over IPv6-only and dual-stack networks. If software includes network parameters in its local or remote server settings, it must support configuration of IPv6 parameters. The user should not experience any noticeable difference when software is communicating over IPv4 or IPv6, unless this is providing explicit benefit to the user.
Software developer/vendor must at a minimum do the following things to guarantee this:
This list is not exhaustive and only covers the basic requirements.
The white paper "IP-version dependency in application software - Preparing source code for IPv6"[1] from the Netherlands IPv6 Foundation can be used to get developers started.
In the original IPv6 Node Requirements (RFC4294) IPsec was listed as a 'MUST' implement to be standards compliant. The updated Node Requirements RFC (RFC6434) published in 2011 changed IPsec to a 'SHOULD' implement. Reasons for the change were stated in that RFC.
The RIPE IPv6 Working Group has extensively discussed whether to make IPsec support mandatory or optional. When finalising ripe-554, the most vocal constituents showed support for moving IPsec to the optional sections, which is what is also reflected in this updated document.
While the consensus of the community was to make IPsec optional in most cases, the IETF confirmed in 2019 in the latest version of the IPv6 Node Requirements standard (RFC8504) that IPsec 'SHOULD' be implemented (not ‘MUST’). In the IETF context, a ‘SHOULD’ means that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.
Organisations that use IPsec or expect to use it in the future should include the following in the mandatory section when initiating the tender:
The current set of mandatory-to-implement algorithms for the IPsec Architecture are defined in Cryptographic Algorithm Implementation Requirements for ESP and AH [RFC8221]. IPv6 nodes implementing the IPsec Architecture MUST conform to the requirements in [RFC8221].
The current set of mandatory-to-implement algorithms for IKEv2 are defined in Cryptographic Algorithm Implementation Requirements for ESP and AH [RFC8247]. IPv6 nodes implementing IKEv2 MUST conform to the requirements in [RFC8247] and/or any future updates or replacements to [RFC8247].
While the Authentication Header specified in RFC4302 was supposed to be the way to provide for integrity and non-repudiation, because it could not traverse NATs, it became common practice for ESP null to be used. As stated in Section 13.1 of RFC8504, which is taken from RFC4301, IPv6 nodes implementing the IPsec Architecture ‘MUST’ implement ESP (RFC4303) and ‘MAY’ implement AH (RFC4302).
Vendors and resellers that offer system integration services must have at least three employees who have valid certificates of competency from the equipment manufacturers for the equipment that is sold as part of the tender. Additionally these employees must have general knowledge of the IPv6 protocol, IPv6 network planning and IPv6 security (eg. as indicated by certification for these skills also). If it becomes obvious during the equipment installation and integration that the integrator’s knowledge, competence and experience is not sufficient to successfully install and configure the equipment to establish normal IPv4 and IPv6 communication with the network, the agreement shall be canceled and become null and void.
The definition of proper integration, timing and degree of disruption of the network during the assembly shall be a matter of agreement between the client and systems integrator.
It is also recommended that a systems integrator and its employees have a broad knowledge of IPv6 and generic IPv6 certificates other than those specifically offered by the equipment manufacturers. These certificates can be obtained from independent education providers. Such knowledge may be awarded extra points in the tender process.
All bidders in the tender process must sign the following form, which indicates that the company and its employees have passed technical training for design, construction and integration of ICT equipment in IPv4 and IPv6 networks.
Tender initiators should require technical IPv6 competence declaration from the equipment supplier or integrator. IPv6 knowledge and experience is required to assure proper installation and integration of equipment in the IPv6 ICT environment.
Declaration should say that the equipment supplier or system integrator declares under criminal and material responsibility:
Note that declarations like this can vary depending on local legislation. Therefore translators and tender initiators should get legal advice on the exact wording for these requirements.
The very first (Slovenian) version of this document was created in the Go6 Expert council and the Slovenian IPv6 working group back in 2009.
The original authors would like to thank all involved in the creation and modification of the first version of this document (ripe-501, year 2009). First of all, we would like to thank Janez Sterle, Urban Kunc, Matjaz Straus, Simeon Lisec, Davor Sostaric and Matjaz Lenassi from go6 expert council for their enthusiastic governance of this document. We recognise the work done in the Slovenian IPv6 working group for their review and useful input, special recognition goes to Ivan Pepelnjak, Andrej Kobal and Ragnar Us for their efforts and work done on the document. Thanks also to the Co-chairs of RIPE IPv6 Working Group, David Kessens, Shane Kerr and Marco Hogewoning, for their support and encouragement. We would also like to thank Patrik Fältström, Torbjörn Eklöv, Randy Bush, Matsuzaki Yoshinobu, Ides Vanneuville, Olaf Maennel, Ole Trøan, Teemu Savolainen and people from RIPE IPv6 WG (Joao Damas, S.P.Zeidler, Gert Doering and others) for their input, comments and review of the document. Last, but not least we would like to thank Chris Buckridge from RIPE-NCC for correcting our grammar and wording in this document. And everybody else that contributed to this work.
The authors of the previous version of the document (ripe-554, year 2012) would like to thank the RIPE IPv6 WG and its chairs for all support and encouragement to develop a followup version of the document. Special thanks goes to Ole Trøan, editor of RFC6204 for his help in the CPE section and also suggesting other changes across the document. Thanks to Marco Hogewoning, Ivan Pepelnjak and S.P. Zeidler for great input in ideas how to make document structure and content better, Timothy Winters and Erica Johnson (both IPv6 Ready Logo committee, UNH) for help with marking RFCs they test and constructive suggestions. Thanks also to Yannis Nikolopoulos and Frits Nolet. Special thanks goes to Jouni Korhonen, Jari Arkko, Eric Vyncke, David Freedman, Tero Kivinen and Michael Richardson for some very useful comments and suggestions that made this document much better.
The authors of the current version of the document would like to thank members of the RIPE IPv6 Working Group and its chairs, and especially Jens Link, Martin Schröder, Fernando Gont, Enno Rey, Dave Taht, Azalea Fernandez, Yannis Nikolopoulos and Eric Vyncke for their comments.
Suggestions for improvement of current document and comments can be sent to the RIPE IPv6 WG or RIPE BCOP TF mailing lists.
https://www.ripe.net/mailman/listinfo/ipv6-wg/https://www.ripe.net/mailman/listinfo/bcop
[1] https://www.stipv6.nl/wp-content/uploads/2013/09/ip-aspects-software-stipv6-white-paper-v12.pdf