The same concern holds true for the journey from IPv4 to IPv6.\u00a0 Virtually all enterprise organizations start with a fully deployed IPv4 environment and then strive to make progress toward IPv6 deployment.\u00a0 Somewhere along the path, organizations move through a period of running IPv4 and IPv6 in parallel.\u00a0 However, organizations should not lose sight of the ultimate goal, which is to end up with a fully IPv6-only deployment.<\/p>\n
![](\"\/wp-content\/uploads\/infoblox-blog-measuring-ipv6-deployment-progress.png\")
<\/p>\n
Organizations can make this transition from IPv4-only, through dual-protocol, and eventually to IPv6-only very gradually, or they can accelerate their migration.\u00a0 Each organization proceeds at its own pace.\u00a0 This begs the question: how should we measure progress toward IPv6 deployment and how should we measure success?<\/p>\n
KPIs for Measuring IPv6 Adoption<\/h3>\n
When an enterprise embarks on an IPv6 deployment, they will want to document an initial baseline of IPv4 versus IPv6 traffic to use as a starting point for their ongoing measurements.\u00a0 Enterprises are encouraged to measure IPv6 deployment progress and report deployment progress regularly.\u00a0 One good idea is for the enterprise IPv6 Transition Team to create an internal dashboard with statistics of IPv6 traffic measurement showing the IPv6 program’s progress.\u00a0 The IPv6 network engineers could gather data on Key Performance Indicators (KPIs) tracking the progress of the IPv6 deployment effort.\u00a0 This dashboard could function much like the old “carrot and stick” analogy for motivating an ornery horse.\u00a0 The dashboard could recognize successes of the IPv6 deployment while simultaneously highlighting areas that are not supporting the IPv6 deployment goals.\u00a0 The dashboard could also communicate progress to IT leadership (whose sponsorship of the IPv6 initiative is essential).<\/p>\n
But which KPIs are the best for measuring progress and success?\u00a0 There are many metrics to choose from.\u00a0 Possible KPIs for the IPv6 project could include:<\/p>\n
- \n
- The number of IPv6 packets transmitted to and from the Internet.<\/li>\n
- The number of IPv6 connections\/flows\/sessions\/streams traversing the core network or the perimeter.<\/li>\n
- The number of IPv6 connection source addresses observed from flow data (NetFlow<\/a>, IPFIX, sFlow, Jflow, etc.)<\/li>\n
- The number of public-facing Internet websites and applications that are reachable over IPv6.<\/li>\n
- The number of visitors to the organization\u2019s public website accessed over IPv6 transport.<\/li>\n
- The number of IPv6-enabled end-user mobile devices and end-nodes.<\/li>\n
- The number of IPv6-enabled servers, sites, routers, access networks, etc.<\/li>\n<\/ul>\n
When measuring IPv6 connections compared to IPv4 connections, it is important to remember the tipping point effect<\/a>.\u00a0 For every connection that takes place over IPv6, there\u2019s one less connection that takes place over IPv4.\u00a0 As IPv6 connections rise, the number of IPv4 connections will fall, as a total percentage of the aggregate of traffic.<\/p>\n
It is also important to consider where within the network topology to collect the measurement.\u00a0 For example, if sampling is done closer to an Internet connection that already has IPv6 packets flowing over it then we are going to see more IPv6 activity.\u00a0 If we take the measurement on an IPv4-only LAN containing IPv6-capable nodes, then we will only observe link-local IPv6 traffic using fe80::\/10 and ff00::\/8 multicast addresses.\u00a0 Furthermore, if we measure at a point on an internal enterprise backbone network of a segment that isn\u2019t sending any Router Advertisements (RAs) on its access networks, there may not be any IPv6 packets other than OSPFv3 hello messages. It\u2019s vital that the dashboard provide context to understand what your KPIs are measuring and what they are telling you.<\/p>\n
Measuring IPv6 usage at the enterprise\u2019s Internet perimeter<\/h3>\n
It could be easy to gather statistics from the production dual-protocol Internet perimeter firewalls.\u00a0 Firewalls are often \u201cchoke points\u201d in the network topology and gathering statistics at these devices can show the usage of IPv4 and IPv6 flowing through the perimeter network.\u00a0 Firewalls could record measurements on the raw count of IPv6 packets but also the number of IPv6 sessions. \u00a0Firewalls could also record the number of VPN connections that use IPv6 which could give insight into IPv6 usage by remote users.<\/p>\n
We could also gather statistics from our upstream ISP(s).\u00a0 Maybe the ISP has a customer dashboard that shows traffic statistics for the connection.\u00a0 That would be an easy way to capture some data if their data showed total traffic volumes along with a breakout of IPv4 vs. IPv6.<\/p>\n
Measuring IPv6 packets traversing the core of the enterprise network<\/h3>\n
For an enterprise deploying IPv6 internally (per RFC 7381<\/a>), IPv6 configuration will be performed inward from the Internet perimeter across the core of the network.\u00a0 IPv6 deployment will proceed to data center networks containing shared services that will need to become IPv6-enabled, and then subsequently to end-user access networks.\u00a0 Measurements of IPv6 traffic flowing across the enterprise backbone could be collected with any modern Network Management System (NMS).\u00a0 SNMP collection of the traffic volumes on interfaces should be a standard feature that is performed automatically.\u00a0 Most NetFlow<\/a> collectors can gather IPv6 flow data and analyze that information, even if the flow data was sent from the router to the collector over IPv4.<\/p>\n
Measuring IPv6 usage across the Internet<\/h3>\n
An enterprise may want to measure the number of their public-facing applications that have IPv6 access enabled from the Internet.\u00a0 The National institute of Standards and Technology (NIST) Advanced Network Technologies Division (ANTD) has a site<\/a> where they measure and report on the IPv6 accessibility for U.S. Government<\/a> (.gov), Industry<\/a> (.com) and University<\/a> (.edu) domains.<\/p>\n
For the greater Internet, an example of this can be found in W3Techs collection of information<\/a> about the usage of various technologies.\u00a0 They collect information about Internet-reachable websites and their usage of IPv6.\u00a0 W3Techs data show the percentage of the top 1,000 websites using IPv6 is now over 54%<\/a>.\u00a0 This is evidence that the more popular the website, the more likely it is to be accessible over IPv6.<\/p>\n
Of course, we are all familiar with how content providers can gather statistics about their visitors and if they used IPv4 or IPv6 to access the website.\u00a0 Facebook maintains statistics on their IPv6 accesses<\/a> by their users.\u00a0 And no well-respected IPv6 article would dare omit Google\u2019s IPv6 Adoption statistics<\/a> (which is now at nearly 45% globally).<\/p>\n
U.S. Federal Government IPv6-Only Mandate Metrics<\/h3>\n
Much has been discussed about the U.S. Federal CIO Office of Management and Budget (OMB) IPv6 Memorandum (M-21-07), “Completing the Transition to Internet Protocol Version 6 (IPv6)<\/a>” memo that was published November 19, 2020.\u00a0 This goes along with the U.S. Department of Defense (DOD) Directive-Type Memorandum (DTM) (DTM 21-004) memo, \u201cDepartment of Defense Implementation of Internet Protocol Version 6<\/a>\u201d.\u00a0 The focus of these IPv6 mandates is solely on counting the number of IPv6-only network-connected devices.<\/p>\n
All U.S. Federal enterprises are required to document their progress toward these goals and submit their data in their quarterly Federal Information Security Management Act (FISMA<\/a>) reports<\/a>.\u00a0 In addition to reporting on progress against yearly milestones from M-21-07, the FISMA metrics<\/a> must include: 5.1, 5.2, and 5.3 Number of GFE hardware assets (from 1.2.1-1.2.3):<\/p>\n
- \n
- That only have IPv4 operational*<\/li>\n
- That have both IPv4 and IPv6 operational<\/li>\n
- That only have IPv6 operational<\/li>\n<\/ul>\n
*Operational \u2013 means that the protocol is both supported, enabled, and provisioned with addresses that are routable internally and externally to the enterprise.<\/p>\n
Note that 5.1 + 5.2 + 5.3 must add up to the total number GFE hardware assets from 1.2.1-1.2.3.<\/p>\n
It has also been stated in the Federal IPv6 Task Force forums that \u201cDual-stack systems will not count for the memo\u2019s milestones unless they are operating in IPv6-only environments while on Federal networks.\u201d<\/p>\n
Mobile devices used by employees have multiple wireless interfaces (Wi-Fi and 4G\/5G).\u00a0 The enterprise networking team doesn\u2019t have control over those wireless ISPs and as the device roams, it could be on IPv4-only, dual-protocol, or even IPv6-only networks.\u00a0 Therefore, it is difficult to count these devices\u2019 IPv6 connectedness as a measure of a successful IPv6-only enterprise IT environment.\u00a0 Mobile phones may well be operating in an IPv6-only configuration, whereas residential broadband Internet connectivity is more likely to operate in a dual-stack configuration.\u00a0 Therefore, end-user devices that are connected outside the enterprise network, for example when people work remotely or from home, are not counted toward the IPv6-only quota.<\/p>\n
There are several methods of determining the number of IPv6-connected hosts.\u00a0 An NMS may also have the ability to gather IPv4 ARP tables and IPv6 neighbor caches from the network devices and compare them to the MAC address of the end-node.\u00a0 A NetFlow collector\/analyzer could also be used to determine the unique source addresses used to create a connection\/stream\/flow to determine the number of IPv6-enabled nodes.<\/p>\n
Another option is to gather that information from DHCP\/DHCPv6 servers and share that with IT service management (ITSM) and IT asset management (ITAM) platforms.\u00a0 For instance, Infoblox has a ServiceNow integration<\/a>.\u00a0 Infoblox has an outbound API integration with ServiceNow to inform ServiceNow when a new device connects to the network and obtains an IPv4 and\/or IPv6 address.\u00a0 Infoblox updates the IP address and interface IP version \u201cDiscovery Items\u201d in ServiceNow for a particular end node in the CMDB.<\/p>\n
Maybe it is better to count the number of physical IT hardware assets that are directly connected to the private internal enterprise network.\u00a0 If we only count physical devices, then do IPv6-enabled VMs running on hypervisors, or IPv6-enabled instances running in cloud infrastructure not count as progress toward the IPv6 goal?\u00a0 When considering IT assets that are connected outside of the enterprise network, cloud infrastructure immediately comes to mind.\u00a0 Cloud service providers vary widely in their support of IPv6.\u00a0 An enterprise might have chosen an IaaS Cloud Service Provider (CSP) that is dragging their feet on IPv6 deployment and this could limit their ability to launch IPv6-enabled workloads.\u00a0 If an enterprise counts internal application services then they should also count software containers.\u00a0 These are ephemeral and come and go at a moment\u2019s notice, making them hard to count.\u00a0 Counting all the software containers in IPv6-only data center network could skew the numbers of IPv6-enabled devices in an enterprise.<\/p>\n
Summary<\/h3>\n
For most enterprises, the thought of turning off IPv4 may seem infeasible.\u00a0 However, before an enterprise gets too far along with an IPv6 deployment project they should consider how they\u2019ll measure progress and success.\u00a0 Determining what to measure early-on allows you to start to chart progress from the beginning and show progress graphs to management.\u00a0 Edwards Deming is often credited (or incorrectly credited<\/a>) as saying \u201cYou can’t manage what you can’t measure.”\u00a0 However, it is useful to measure IPv6 throughout a long-term IPv6 deployment effort.<\/p>\n
You don\u2019t have to pick just one of these KPIs to measure.\u00a0 You should pick multiple measurements from multiple perspectives and keep the data gathered and graphed over a long period of time.\u00a0 Enterprises may want to measure both the percentage of users using IPv6 and the percentage of IPv6 packets.\u00a0 Sooner than later one of these data sets may contain some useful insights into how your IPv6 deployment is progressing or possibly highlight an area for improvement.<\/p>\n