* Social Security Administration outlines rollout plans for IPv6
Try to find an enterprise that’s running IPv6 in production mode, and you’ll likely come up empty handed. That’s because few U.S. organizations are deploying or even testing the long-anticipated upgrade to the Internet’s main protocol.
The exception to the rule is the U.S. federal government, which is required by the Office of Management and Budget to support IPv6 in its core networks by 2008. IPv6 offers an order of magnitude more address space than the current IPv4 protocol, along with built-in security, administration and quality of service features that have been added to IPv4 over the years.
I recently interviewed the officials at the Social Security Administration who are responsible for IPv6 deployment. Here’s what they had to say about their hands-on experience with IPv6.
Migrating to IPv6 is a major undertaking for an agency as large as SSA, which has more than 120,000 users on its network. The agency’s network, SSANet, links its headquarters in the Baltimore area with 1,500 locations nationwide.
SSANet is an all-IP network that was recently upgraded to support Multi Protocol Label Switching (MPLS) technology. It is a converged network that supports voice, data and video. SSAnet uses two carriers for redundancy: Verizon and AT&T.
At the core of SSANet are SSA’s main data center, a new backup data center and six regional operational control centers. The links between these sites will support IPv6 in a dual-stack mode – running IPv6 and IPv4 concurrently – by June 2008.
SSA has been working with IPv6 since 2001, when it first identified IPv6 as an emerging technology. SSA was one of the first organizations in the United States to acquire IPv6 address space.
One advantage for SSA in migrating to IPv6 is the fact that it manages and controls its network infrastructure and IP addressing centrally.
“The key here is how you manage your IPv4 address space,” says Rich Terzigni, senior network advisor in SSA’s Office of Telecommunications and Systems Operations. “How you manage that will prime you for IPv6.”
SSA has conducted extensive IPv6 testing. The agency participates in Moonv6, the IPv6 testbed run by the North American IPv6 Task Force http://www.moonv6.org. SSA also is testing IPv6 in its own independent test lab, which analyzes all new technologies before installation on the production SSANet.
“We handle about 120 million transactions a day. Sixty million of those are medical evidence type claims,” Terzigni says, explaining the agency’s focus on testing prior to deployment. “We can’t have a glitch in our infrastructure.”
SSA conducted an inventory of the hardware and software on its core network to determine what could support IPv6. SSA discovered that most of its core routers didn’t need hardware upgrades but they did require updated software.
“To meet the June 2008 deadline, our hardware is already ready,” Terzigni says. “A majority of the systems need to have software upgrades, and we’re in the process of upgrading them … The software needs to be tested in our labs. And we have to have both carriers running concurrently. With all the test plans and sequences we do, we’re in a good position to meet the deadline.”
Verizon will install dual stack IPv4 and IPv6 capabilities in SSA’s independent test lab this summer. AT&T will provide dual stack support at one of SSA’s field locations before the end of 2007. This set-up will allow SSA to test dual stack mode before adding it to its core network in the first quarter of 2008.
“We need to make sure that introducing dual stacking doesn’t affect the applications we run today,” Terzigni says. “We’re using some simulators as we speak to make mythical IPv6 clouds … But we need to make sure that everything works with dual stack.”
After rolling out dual stack mode at its eight primary locations, SSA plans to offer the service through its extranet. The agency is targeting 2010 for offering dual stack connections to other agencies that have point-to-point connections with SSA or who interact with the agency via the Internet.
“Once we have the core done, then other agencies that want to talk to us through the Internet or through our own extranet may want to use IPv6,” Terzigni says. “Once we migrate our national computer center to dual stack, then if the IRS wants to talk to our mainframe and they are IPv6 capable, they can come in through the firewall and talk natively on IPv6 and we can respond back.”
SSA says it will need to upgrade some of its switches with new control modules that support IPv6 in order to support dual stack mode on its extranet.
By 2012, SSA plans to offer IPv4 and IPv6 dual stack mode in all of its field offices. This will allow the agency to support either IPv4 or IPv6 connections end-to-end across SSANet.
“From edge to edge, we’ll have both stacks running,” Terzigni says. “Then we will keep all the applications that are running today, while all future applications will be using IPv6 functionality.”
SSA is migrating its field offices to VoIP and is purchasing new routers and switches that can support IPv6, too
“By 2012, every device currently installed in our field offices will be refreshed with a new router and switch,” Terzigni says. “Our VoIP project is independent of our IPv6 project, but we are working hand-in-hand with them. We are getting rid of the digital phones and replacing them with voice over IP. When we do that, we will also put in IPv6.”
SSA’s approach to IPv6 is to migrate gradually using its regular technology refresh program. Therefore, SSA does not have a special IPv6 budget.
“The timeline that we are acting on – 2008 for the core network, 2010 for the extranet and 2012 for the field offices – we can do it if we keep the budgets that we have projected,” Terzigni says.
Meanwhile, SSA has completed an inventory of its applications to see which ones are dependent on IP addressing and will need to be upgraded. The agency also has provided basic training to 150 of its engineers. SSA will provide more intensive IPv6 training closer to when it rolls out dual stack mode on its core, extranet and field sites.
So far, SSA has not run into any major problems with IPv6.
“In our labs, we have 20 to 30 routers running dual stack capabilities,” Terzigni says. “We really haven’t hit any problems that were insurmountable … If we get the routers that have the engine we need and the right sized memory, we can support dual stacking.”
Despite its proactive stance with IPv6, SSA officials see no end in sight for IPv4 running on its network.
“I don’t know if it will happen before I retire, but someday we may be able to decommission IPv4,” Terzigni says.
Look for Terzigni’s tips on IPv6 deployment in the next issue of the Service Provider News Report.
