Transition from IPv4 to IPv6 in Mongolia

October 2015

Supported by

This report has been prepared for the Information Technology, Posts and Telecommunication Authority (ITPTA) and Communications Regulatory Commission (CRC), Mongolia by the ITU and APNIC with the support from Department of Communications, Australia. The expertise for the mission was provided by Dr. Philip Smith with support from Ms. Miwa Fujii (APNIC), and Mr. Ashish Narayan (ITU).

Please consider the environment before printing this report.

i

Table of contents

Page

1.0 Introduction

1.1 Mongolia’s Telecommunications Market

1.2 Results of IPv6 Survey

1.3 IP Address allocation in Mongolia

2.0 IPv6 deployment, challenges and current assistance

2.1 Policy and regulation

2.2 IPv6 deployment for Industry and Business

2.3 Security Considerations in IPv4 to IPv6 Migration

3.0 Mongolia Industry Case Studies

4.0 IPv6 Deployment and Infrastructure Security Training for Mongolia

5.0 The way forward – Summary of preliminary Recommendations

Annex 1 IP Address allocation in Mongolia (June 2015)

Annex 2 IPv6 Transition Strategies and Planning

Annex 3 Steps to Deploy IPv6 in Telecom Networks

Annex 4 IPv6 Infrastructure Security

ii

Transition from IPv4 to IPv6 in Mongolia

1 Introduction Mongolia is a country of 3 million people located in Central Asia between 42 and 52 degrees North latitude and 88 and 118 degrees East longitude. Mongolia is land-locked with Russia to the north and China to the south. While Mongolia is one of the least densely populated country in the world (at less than 2 people per square kilometre), two thirds of its population lives in urban areas with more than one million people living in Ulaanbaatar.

The country is at the threshold of a major transformation driven by the exploitation of its vast mineral resources and the share of mining in GDP today stands at 20 percent, twice the ratio of a decade ago. The economic growth rate is estimated at 12.5 percent in 2013, compared to 6.4 percent GDP growth in 2010. GDP is expected to grow at a double-digit rate over the period from 2013 to 2017.

This economic growth has translated into some benefits for the people of Mongolia. Poverty has been on a downward trend over the past decade. Most recently, it decreased from 38.7 percent in 2010 to 27.4 percent in 2012. Substantial progress has also been made in regard to several Millennium Development Goals (MDGs) at the national level, though significant regional disparities prevail.

As part of its approach to economic development, the Government of Mongolia has identified three strategic sectors for investment: mining, banking and communications.

In its ICT Development White Paper 2013, the Information Technology Posts and Telecommunications Authority (ITPTA) set out seven strategic objectives for the following three years. The seven objectives are:

1. The launch of two national satellites, including a communications satellite and an earth observation satellite;

2. The seamless delivery of government services through the development of enabling infrastructure such as national databases and public key infrastructure;

3. Increase the availability of free Wi-Fi hotspots in rural areas through reform of tariffs for backhaul communications and the deployment of mobile broadband technologies such as 3G and 4G;

4. Encourage audience-centric radio and television services through the introduction of digital broadcasting technologies in a way that supports diversity and a wide range of high quality content;

5. Expand the number of highly qualified and well paid occupations through the introduction of new occupation classifications and the application of appropriately scaled salary schemes;

6. Support the development of world class e-products by establishing a legal framework for intellectual property, an ICT Innovation Fund and an ICT Research and Development Centre;

7. Continued development of postal services by completing implementation of addressing reform, the promotion of public-private partnerships and the automation of postal services.

To implement the strategic objectives, IP network growth and scalability is critical. It is, therefore, necessary that Mongolia facilitates a timely transition from IPv4 to IPv6. The need for IP addresses would escalate as the country rolls out LTE and Internet of Things (IoT) devices.

The Information Technology, Post and Telecommunications Authority (ITPTA) and the Communications Regulation Commission (CRC) of Mongolia have set up a joint working group (ITPTA and CRC) in 2015 to assess the status of IPv6 transition and provide guidelines for the transition.

The ITU and the APNIC, in close cooperation with ITPTA and CRC and under the ITU-Department of Communications (Australia) project, provided technical assistance (29 June - 3 July 2015) to stakeholders in Mongolia on the deployment of IPv6. The scope of the assistance included:

Three days of national workshop on IPv6 transition strategies and technologies to build awareness and capacity amongst all stakeholders;

Two days of technical engineering assistance to service providers and working group on IPv6;

3

Transition from IPv4 to IPv6 in Mongolia

Facilitating the way forward for Mongolia in accelerating IPv6 deployment.

The technical engineering assistance provided to the operators included specialized advice based on their network readiness and plans to deploy IPv6. It also included advisory on the challenges faced by them and raised during the mission (For details, please see Section 2.3.1 and 2.3.2).

1.1 Mongolia’s Telecommunication Market

The telecommunication market in Mongolia has seen rapid growth, especially in areas of mobile and Internet services. In 2014, the ICT sector had revenue of 850 Billion MNT with mobile accounting for 62.43% of the revenue followed by IPTV (4.90%), Internet Service (4.53%), Internet Wholesale Service (4.30%), VSAT (4.22%), ICN (4.17%) and others (15.45%). The investment in the ICT sector significantly increased in 2014 to 239 Billion MNT up from 122 Billion MNT in 2013.

Table 1: Mongolia ICT Revenue and Investment Trends

Mongolia ICT Market Revenue (2014) Mongolia Investment in ICT Sector (2014)

While mobile sector led the revenue and investment, there has been significant investment in Internet wholesale in 2014.

Mongolia has a well-developed market for the supply of mobile communications services, including voice, SMS and data. Mobile penetration was 165.9% by end 2014 with 4.9 million registered subscribers (3 million active subscribers). There are four mobile operators competing in the market. In terms of technology share,

3G accounts for 26% of the total subscribers. The population coverage of 3G services continues to increase as operators expand the density of their networks in Ulaanbaatar, complete their initial rollouts in aimags and extend 3G services to soums. Skytel LLC expects to provide 3G coverage to 338 soums by the end of 2015. The operators are also considering LTE deployment with some operators ready to deploy enhancing the need for rapid deployment of IPv6.

The Internet subscribers are at 1.9 million. Although the growth is steady over the years, the majority of subscribers (83%) are located in Ulaanbaatar with poor penetration in rural areas. Mobile Internet remains

Table 2: Mobile Service Competition in Mongolia (2014)

4

Transition from IPv4 to IPv6 in Mongolia

the dominant technology with a share of 88%. In addition, the country has 77 million smart phones (4.9 million mobile subscribers) by end 2014 with a growth of 56.4% in the past year (2013-2014).

The Internet services are being provided by 24 ISPs (end 2014). The Internet traffic is routed through three gateways owned by Information and Communication Networking Company (ICNC or Netcom), Mobinet, and Gemnet. Netcom is a state-owned company that was established in 2006 when the Government of Mongolia separated provision of retail and wholesale services in the fixed market (MTC became a retail provider of fixed services at this time). Mobinet is a wholly owned subsidiary of Mobicom while Skynetworks is a joint venture between Skytel and Unitel. The combined International and domestic Internet bandwidth reached 40 Gbps and 30 Gbps respectively. Gemnet is the dominant Internet bandwidth provider, accounting for 77% of International and 80% of domestic Internet bandwidth.

Most of the traffic is routed through fibre over China and Russia. Gemnet and Mobicom both have Internet capacity via terrestrial and submarine fibre through China to Los Angeles. Gemnet and ICNC have capacity via Russia to Frankfurt. And all three providers have a small amount of capacity to Hong Kong (China). The national Internet Exchange interconnects several (but not all) ISPs and is located at the National Data Centre (NDC). Gemnet also operate an Internet Exchange Point in their data centre for a number of ISPs.

1.2 IPv6 Survey

The survey questions were prepared by IPv6 WG /ITPTA, CRC/ on 2015/06/04. It is divided into 2 sections:

1. Administration

2. Technical

Table 3: Telecommunication Snapshot: Mongolia Mobile and Landline Telephone Density (2014) International Bandwidth (2014)

Percentage of Internet Connection Types (2014) Number of Internet Subscribers (2014)

5

Transition from IPv4 to IPv6 in Mongolia

The survey was sent to 22 ISP companies and 11 of them submitted responses, which is including major companies.

1) Results of Administration part

1.1. How many people does your company employ?

1.2. Does your company have a plan to deploy IPv6?

1.3. Did your company estimate the investment for IPv6 transition?

6

Transition from IPv4 to IPv6 in Mongolia

1.4. What kind of business impact do you expect following IPv6 transition?

1.5. Does your engineers have adequate skills to deploy IPv6?

2) Results of Technical part

a) Survey about IPv4

b) Survey about IPv6

7

Transition from IPv4 to IPv6 in Mongolia

• IPv6 friendly end user equipment

70% - 1 company 40% - 1 company 10% - 3 company 9% - 1 company Unknown 17 company

c) Survey about IPv4 to IPv6 Transition

8

Transition from IPv4 to IPv6 in Mongolia

1.3 IP Address allocation in Mongolia

Mongolia has around 211,968 IPv4 addresses as of end of June 2015. As per Table 4 below, the majority of the IPv4 delegation is /22 (1024 IP Addresses). Most of these delegations are made after the implementation of ‘final /8’ policy as a result of IPv4 exhaustion in global and regional supply.

The current APNIC IPv4 policy only allows each APNIC Member to receive a minimum of a /24 to up to a /22 from APNIC’s final /8 (103/8)

For detailed and updated IPv4 allocation policy, please visit APNIC website1. https://www.apnic.net/policy/resources

IPv6 delegations have already started in Mongolia with twelve /32 and one /48 (Table 4) totaling to 79 Septillion (1 Septillion = 10^27).

For IPv6, a minimum delegation of a /32 or /48 can be given, this is subject to demonstration of network technical requirement against the IPv6 policy criteria. Mongolia has forty-one Autonomous System Numbers (ASNs), which is an indication of distinct autonomous networks in Mongolia.

Table 5: IPv6 Address Allocations

1 Source: https://www.apnic.net/community/ipv4-exhaustion/ipv4-exhaustion-details

Table 4: IP address delegations in Mongolia (as on 30 June 2015) IPv4 Address

Block Number of delegations IPv6 Address

Block Number of delegations

256 (/24) 10 (/32) 12 512 (/23) 1 (/48) 1

1024 (/22) 26 2048 (/21) 9 4096 (/20) 6 8192 (/19) 5

16384 (/18) 4 32768 (/17) 1 Total IPv4 Addresses

211,968 Total IPv6 Addresses

79,229,371,440,084,000,000,000,000,000

(79 Septillion) Source: APNIC

9

Transition from IPv4 to IPv6 in Mongolia

IP Address Types Global Unicast IPv6 Address Allocation

Source: The IPv6 Protocol & IPv6 Standards by Dr. Philip Smith, p18

2. IPv6 deployment, challenges and current assistance

2.1 Policy and Regulation

The Government of Mongolia has approved "National Program on High-Speed Broadband Network: 2011-2015 year" on 03 May 2011 by Government Resolution No.145. Section-5.5.7 of the Resolution require that Government will make/develop the network strategy and roadmap plan from IPv4 to next generation internet network-IPv6 and to establish related soft infrastructure2.

Mongolia is currently examining to institute a framework, roadmap and task force on IPv6 deployment in keeping with approaches in other countries. The policy maker (ITPTA) and the regulator (CRC) have set up a joint working group to assess the status of IPv6 transition and provide guidelines for the same. At present the country does not have a task force or a national IPv4 to IPv6 Migration roadmap.

Internationally, governments have taken a number of specific steps to promote awareness on the need to use IPv6 to expand Internet resources. Key elements of governmental action have included: Establishing or supporting national IPv6 transition task forces; Establishing national “IPv6 deployment roadmap” with benchmarks and timetables for IPv6

deployment; Mandating government agencies adopt IPv6 technology and develop plans for their networks,

websites and services; Promoting the use of IPv6 in government-funded educational, science and research networks; Mandating IPv6 capable / ready equipment in procurements; Promoting overall awareness of the transition through setting up websites, hosting workshops or

forums, and setting up training programs. There is increasing focus on ensuring security of both IPv4 and IPv6 networks while making the

transition. Some of the examples of national roadmaps and development initiatives are provided in the Table 6.

Table 6: Experiences on IPv6 deployment initiatives Country Website Australia A Strategy for the Implementation of IPv6 in Australian Government Agencies

http://www.finance.gov.au/e-

2 Chapter-5: Action Plan for National Program

10

Transition from IPv4 to IPv6 in Mongolia

government/infrastructure/docs/Endorsed_Strategy_for_the_Transition_to_IPv6_for_Australian_Government_agencies.pdf

China IPv6 Deployment Experiences from China http://conference.apnic.net/data/36/0828ipv6-deployment-experience-in-ctv4_13770491941.pdf

India National IPv6 Deployment Roadmaps Version 1 & 2 http://www.dot.gov.in/sites/default/files/Roadmap%20Version-II%20English%20_1.pdf

Japan http://www.soumu.go.jp/main_sosiki/joho_tsusin/policyreports/chousa/ipv6_internet/02kiban04_03000222.html

Saudi Arabia Saudi Arabia IPv6 Task Force http://www.ipv6.org.sa/about

Singapore IDA’s efforts behind IPv6 transition in Singapore http://www.ida.gov.sg/Infocomm-Landscape/Technology/IPv6

Philippines Executive Order No. 893 Promoting The Deployment And Use Of Internet Protocol Version 6 http://www.gov.ph/2010/06/18/executive-order-no-893/

USA Planning Guide/Roadmap Toward IPv6 Adoption within the U.S. Government https://cio.gov/wp-content/uploads/downloads/2012/09/2012_IPv6_Roadmap_FINAL_20120712.pdf

Given the growth of telecom services in Mongolia (especially the advent of LTE and Smart Services based on Internet of Things)), it is important to develop a guideline / roadmap highlighting the key steps to be taken in consultation with the stakeholders.

2.1.1 Preliminary Recommendations on Roadmap and IPv6 Deployment at National Level This section (and report) provides some preliminary broad level recommendations except Recommendation 1 that requires urgent consideration. These recommendations require discussion with stakeholders and deliberation with the IPv6 Task Force once formed.

Preliminary recommendations on IPv6 deployment Recommendation 1 Establish an IPv6 task force for Mongolia including policy maker, regulator,

telecom operators, ISPs, e-government agencies, software associations & manufacturers, and data centre operators. The work of the task force will include making recommendations for IPv6 transition for the following industry sectors:

- Telecom operators (e.g. fixed, mobile, transit, ISPs) - Broadband & Enterprise customers - Government Departments responsible for IT - Local content / Data Centres - NDC Exchange Point (MIX) - Others as deemed appropriate

The example of work areas include constitution of the decision making group, promotion, skill building and awareness raising, technical (including standards and technical guidelines) and network implementation, content and applications, IPv6 Security, research and innovation.

Recommendation 2 Develop an IPv4 to IPv6 national roadmap in consultation with the task force. The working group comprising of ITPTA and CRC can continue to facilitate the Government support requirements for deployment of IPv6.

Recommendation 3 The Government should take the lead and set deadlines for deployment of IPv6 within all Government Agencies and procurement processes. Develop a detailed action plan for implementation of IPv6 in government department including create an IPv6 transition team (focal point) in each Government, allocation of required budget, upgrade of equipment and skills, security amongst others.

Recommendation 4 Internet Exchange Points need to facilitate IPv6 peering in addition to the existing IPv4 peering (by making IPv6 addresses available for the peering LAN, and via upgrading any Route Servers to support IPv6)

11

Transition from IPv4 to IPv6 in Mongolia

Recommendation 5 It is important to set up a monitoring mechanism for IPv6 implementation

based on the national roadmap.

2.2 IPv6 deployment for Industry and Business IPv6 deployment now is not only about the sustainable growth of the Internet but also about continuity of businesses requiring IP addresses. IPv4 address exhaustion itself is a major motivation to deploy IPv6. In addition, it also has the potential for new services and business opportunities on large-scale IP installations e.g. smartphones, smart grid initiatives, sensor network based services, data centres etc. The growth in these devices and services has further increases the demand for IP addresses. There are some challenges associated with IPv6 deployment in the short term, as these addressing protocols are independent. A device connected via IPv4 cannot communicate directly with a device connected via IPv6. Until all networks and devices are IPv6 capable, we need to run both protocols simultaneously and in most cases also include network address translators (NATs) as a transitory mechanism. However, IPv6 provides a long-term, scalable solution with fewer operational and maintenance issues when compared with IPv4 networks deployed in NAT environments The deployment of Large Scale NAT, or LSN, also known as Carrier Grade Nat (CGN), without having a plan for IPv6 deployment is used to extend the lifetime of the IPv4 addresses. This approach does not solve the core issue of IPv4 address depletion. Dual Stack is the best preferred solution for transition. IPv6 deployment can be only achieved through collective, multi-stakeholders efforts. Partnership between public and private sector is a very important factor in successful IPv6 adoption. The following are key messages for industry and business sectors:

2.2.1 Service providers Service providers play a key role in IPv6 deployment, especially with the growth of broadband Internet on fixed and mobile networks. Networks are growing rapidly with higher subscription rates, and service providers need to consider sustaining future growth without relying on IPv4. The key strategic choices available are: to maintain the status-quo (do nothing); extend life of IPv4; or deploy IPv6 (Figure 1).

Figure 1: Strategic choices available for Service Providers

Do Nothing

Wait and see what competitors do

Business not growing, so don’t care what

happens

Extend Life of IPv4

Force customers to NAT

Buy IPv4 address space on the marketplace

Deploy IPv6

Dual-stack infrastructure

IPv6 and NATed IPv4 for customers

6rd (Rapid Deploy) with native or NATed IPv4 for

customersDS-Lite or 464XLAT with

native IPv6 and NATed IPv4 forcustomers

Or other combinations of IPv6, IPv4 and NAT

12

Transition from IPv4 to IPv6 in Mongolia

Providers should consider how to extend the life of their IPv4 address pools while enabling customers to connect via IPv6. There may be risks associated with delaying IPv6 deployment, so it is advised that decision makers take IPv6 into consideration when planning for the short, mid, and long term to enable IPv6 access via transit, core, customer premise equipment (CPE) and websites. Corporate network of service providers or a part of it can serve as a good place to start deployment and gain experience to minimize inconvenience to customers.

The most effective way to manage IPv4 shortage is to allow networks to support both IPv4 and IPv6 simultaneously. Dual-stack is the most cost effective long-term model. Once services are on IPv6, IPv4 can simply be discontinued. Some of the disadvantages are

• IPv4 growth limited to available IPv4 address space • Running dual-stack network requires extra staff training • IPv6 on existing IPv4 infrastructure might cost extra in terms of hardware changes (RIB and FIB

memories) • IPv6-only end-points cannot access IPv4, but given most IPv6 end-points are dual-stack, require IPv4

address too However, for those service providers that fall short of IPv4 addresses, it might be necessary to deploy Network Address Translator (NAT). Detailed transition mechanisms, technologies involved, their advantages and disadvantages are provided in Annex 2.

A typical process to include IPv6 in the network requires the following steps 1. Undertaking audit and assessment of existing network 2. Optimization of the existing network 3. Procuring IPv6 Address Space from RIRs 4. Developing an IPv6 Address Plan 5. Deployment of IPv6 on Network 6. Seeking IPv6 Transit from transit providers 7. Enabling Customers/End-Users in the network

The details are provided in Annex 3.

Figure 2: Steps (Typical) For IPv6 Deployment In Service Provider Networks

13

Transition from IPv4 to IPv6 in Mongolia

A number of service provider transition case studies are available at APNIC website. https://www.apnic.net/community/ipv6-program/ipv6-stories.

2.2.1.1 Mobile Networks

The mobile Internet markets as well as smart phones are growing rapidly in Mongolia (Refer Section 1.1), as mobile devices remain the dominant mode of Internet access. Mobicom, Unitel, Skytel and G-mobile are the mobile service providers in the country. The increase of mobile handset usage has created a huge demand for IP addresses, which will significantly increase the costs and scalability issues associated with mobile network services. IPv6 provides a long term, scalable solution with lower maintenance than IPv4 deployed in Network Address Translation (NAT) environments.

Mobile network operators need to make strategic decisions for business growth, and maximize their IPv4 holdings. It is also important to think about deploying IPv6 enabled products and services to cope with the increasing demand for IP addresses, particularly when deploying new networks, such as LTE. With a large number of sessions per user, the size of the NATs (and hence the cost implications) would become challenging.

IPv6 transition technologies in practice (example)

This section provides some use cases. There are several transition technologies choices. However, some mobile operators such as T-Mobile USA, SK Telecom, Telstra Australia, Orange Poland are considering 464XLAT (Figure 2). In this transition technology, the Service Provider deploys IPv6-only infrastructure. IPv6 is made available all the way to the consumer while IPv4 is transported through IPv6 core to Internet via SIIT on customer router, and NAT64 on SP NAT device. It is applicable for operators considering scaling their existing 3G or 4G (IMT) mobile networks, and have recognised the need to scale their CGN (IPv4 NAT) installation by off-loading access to IPv6 capable content. A number of mobile IPv6 deployment case studies are available at https://www.apnic.net/community/ipv6-program/ipv6-stories.

Figure 2: 464XLAT: Introduction, Advantages and Disadvantages

Existing Network: Audit and

Assessment

Existing Network

Optimization

Procuring IPv6 Address

Space

Developing IPv6 Address

Plan

Deployment on Network

Seeking IPv6 Transit

Enabling Customers / End-Users

14

Transition from IPv4 to IPv6 in Mongolia

Advantages

• The SP is using IPv6 across their entire infrastructure, avoiding the IPv4 address pool depletion issue totally

• The SP can scale their infrastructure without any IPv4 dependencies

• Consumers can transition from IPv4 to IPv6 without being aware of any differences in the protocols

• Devices not supporting IPv6 can access IPv6-only networks

• IPv6 packets routed natively

Disadvantages • The SP requires NAT device in core

(PLAT – NAT64) • Subscriber router needs to be IPv6

capable and support • IPv4/IPv6 header translation (CLAT –

SIIT) • Model has all drawbacks of SP NAT

model for IPv4 traffic (Refer Annex 2)

Source: IPv6 Transition Planning by Dr. Philip Smith, pp39 - 40

2.2.1.2 Fixed Internet Providers

Fixed Internet services are offered through a range of technologies using xDSL, Optical Fibre, Coaxial Cable, VPN and Wi-Max. There are 24 Internet Service Providers offering these services. Some of the potential transition mechanisms for broadband providers are

• Dual Stack

• Dual Stack with Service Provider NAT

• 6rD

• Dual Stack Lite

• NAT 64

The advantages, disadvantages are applicability is provided in Annex 2.

2.2.1.3 Content Providers, Data Centre Providers, Hosting Providers, Cloud Service Providers

This group of Internet stakeholders needs to focus on how to enable IPv6 access to their content, and the implications of IPv6 deployment for their Internet connectivity, web servers, load balancers, and firewalls. It's also necessary to consider other modifications as required including backbone databases, setting an IPv6 log file, and geolocation database.

Businesses with an online presence should prepare for an increase of customers accessing their content from mobile devices. Some of these new end-users on both fixed and mobile networks may be assigned with only IPv6 addresses. It is necessary to maintain the online experience so there is no difference between IPv4 and IPv6 from the end-user perspective.

15

Transition from IPv4 to IPv6 in Mongolia

2.2.1.5 Enterprise Networks

Enterprises need to focus on their IT infrastructure, in terms of enabling IPv6 in their WiFi, Ethernet LAN and WAN. They also need to enable Dual Stack for devices such as laptops, printers, PCs, and file servers. Another aspect to consider is how to replicate IPv6 addressing infrastructure with IPv6 address management, firewalls, and security.

2.2.2 Preliminary Recommendation for Telecom Industry and Business

This section (and report) provides some preliminary broad level recommendations for telecom industry and business. These recommendations require discussion with stakeholders and deliberation with the IPv6 Task Force once formed.

Preliminary recommendations on IPv6 transition for Telecom Industry and Business Recommendation 6 Enterprise public facing content needs to support IPv6 while enterprises

should be encouraged to start migration to IPv6 within their internal networks.

Recommendation 7 Recommendations/guidelines for IPv6 address plans following industry best practices should be developed to assist organisations with their IPv6 deployment

Recommendation 8 Equipment which is type approved in Mongolia needs to be IPv6 capable as far as possible

Recommendation 9 Industry and business, including telecom service providers and enterprises, need to prepare an implementation plan for IPv6 in their own networks

2.3 Security Considerations in IPv4 to IPv6 Migration It is important to emphasize that IPv4 and IPv6 networks do not interoperate. Hence, enabling IPv6 on any device means that the device is accessible by IPv6. Failure to protect the device after enabling IPv6 means that it is wide open to abuse through IPv6 transport even though the IPv4 security is in place. The Interface filters and firewall rules already present in IPv4 must be replicated for IPv6. Also, Router vty filters already present in IPv4 must be replicated for IPv6. Some IPv6 traffic would be flowing through IPv4 networks even if IPv6 is not enabled, largely through tunnels. Table 7: Security Issues in IPv4 and IPv6

Issues specific to IPv4 Issues shared by IPv4 and IPv6 Specific IPv6 Issues

• Broadcasts • Network Address

Translation • Private vs Public

Address space

• Scanning methods • Viruses and Worms • Filtering • Amplification attacks • Layer-2 attacks • Broadcasts • Routing Authentication • Hacking

• IPv6 header manipulation

• Link Local vs Gobal Addressing

• Transition Challenges

• 6to4, 6VPE • v4/v6 translation

issues • IPv6 stack issues

End-to-end connections over IPv6 can be secured over Internet by IPsec or SSL VPN Client Software (client to server) and by Tunnel technology (GRE) protected by IPsec (Network to Network). The site-to-site VPNs using Tunnel technology (GRE or MPLS) can be protected by IPsec. Annex 4 provides details on IPv6 Infrastructure Security

16

Transition from IPv4 to IPv6 in Mongolia

Some of the risk mitigation strategies concerning the transition technologies include minimizing the need for SP-NAT, adopt a transition plan which uses native IPv6, pay careful attention to the Dual Stack operation of the CPE. It is important to deploy IPv4 and IPv6 protections on the CPE and not just IPv4. Most of the existing managing and monitoring tools support IPv6. Hence most of the managing and monitoring can be done by using existing tools with changes, wherever necessary. These include for example SNMP Monitoring, IPv6-Capable SNMP Management Tools, NetFlow Analysis, Syslog, Keeping accurate time (NTP), Intrusion Detection etc. Annex 3 provides details. The list of relevant IETF RFCs include

Table 8: List of IETF RFCs related to IPv6 Security IETF RFC

Title

IETF RFC 3964 (2004) IETF RFC 4593 (2006) IETF RFC 4795 (2007) IETF RFC 4861 (2007) IETF RFC 4942 (2007) IETF RFC 5942 (2010) IETF RFC 5969 (2010) IETF RFC 6106 (2011) IETF RFC 6333 (2011) IETF RFC 6434 (2011)

Security Considerations for 6to4. Generic Threats to Routing Protocols. Link-Local Multicast Name Resolution (LLMNR). Neighbor Discovery for IP version 6 (IPv6). IPv6 Transition/Coexistence Security Considerations. IPv6 Subnet Model: The Relationship between Links and Subnet Prefixes. IPv6 Rapid Deployment on IPv4 Infrastructures (6rd) – Protocol Specification. IPv6 Router Advertisement Options for DNS Configuration. Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion. IPv6 Node Requirements.

IETF RFC 6618 (2012) Mobile IPv6 Security Framework Using Transport Layer Security for Communication between the Mobile Node and Home Agent

IETF RFC 6686 (2013) Problem Statement for Renumbering IPv6 Hosts with Static Addresses in Enterprise Networks

IETF RFC 6879 (2013) IPv6 Enterprise Network Renumbering Scenarios, Considerations, and Methods

IETF RFC 6883 (2013) IPv6 Guidance for Internet Content Providers and Application Service Providers

IETF RFC 6889 (2013) Analysis of Stateful 64 Translation IETF RFC 6946 (2013) Processing of IPv6 "Atomic" Fragments IETF RFC 6980 (2013) Security Implications of IPv6 Fragmentation with IPv6 Neighbor Discovery IETF RFC 7059 (2013) A Comparison of IPv6-over-IPv4 Tunnel Mechanisms IETF RFC 7113 (2014) Implementation Advice for IPv6 Router Advertisement Guard (RA-Guard) IETF RFC 7123 (2014) Security Implications of IPv6 on IPv4 Networks IETF RFC 7283 (2014) Handling Unknown DHCPv6 Messages IETF RFC 7368 (2014) IPv6 Home Networking Architecture Principles IETF RFC 7381 (2014) Enterprise IPv6 Deployment Guidelines IETF RFC 7526 (2015) Deprecating the Anycast Prefix for 6to4 Relay Routers IETF RFC 7527 (2015) Enhanced Duplicate Address Detection

17

Transition from IPv4 to IPv6 in Mongolia

The ITU-T X.1037 Recommendation 3 (IPv6 technical security guidelines) provides a set of technical security guidelines for telecommunication organizations to deploy and operate IPv6 networks and services. It specifies security threats raised by the introduction of the IPv6. It also provides risk assessment related to these threats and documents the technical solutions for a secure IPv6 deployment. ITU-T X.1037 focuses on three components: network devices (e.g., router, switch), server/client devices (e.g., end nodes, DHCP server) and security devices (e.g., intrusion detection system (IDS), and firewall (FW)) that will be also deployed in an IPv6 network. Recommendation ITU-T X.1037 provides a technical security guideline to developers of network products, security operators and managers of enterprise networks that are planning to deploy IPv6, so that they are able to mitigate security threats on their IPv6 network. This Recommendation provides a security guideline focusing on IPv6 in enterprise networks. A summary of IPv6 security related preliminary recommendations include

Preliminary recommendations on IPv6 Transition Security Recommendation 10 Develop an IPv6 Security Guideline in consultation with the IPv6 task force Recommendation 11 Build human capacity on IPv6 transition mechanism including security

3.0 Mongolia Industry Case Studies An assessment of the IPv6 readiness was undertaken with interested ISPs, and technical advice was also provided during the engineering assistance. The assessment of IPv6 deployment was undertaken based on the steps in Figure 2.

3.1 Mobicom and Mobinet LLC

Mobicom offers a range of services including DSL, FTTH, leased circuits, 3G, VPN (MPLS). It also deploys Google, Akamai and other caches. The transit services are sourced from multiple countries. A half-day engineering assistance was provided to Mobicom and Mobinet with their network team. Detailed discussion on the network issues was undertaken and experiences shared.

Summary of discussions concerning IPv6 include:

Characteristics Status Comments

3 To download complete recommendation, please visit http://www.itu.int/ITU-T/recommendations/rec.aspx?rec=11946

Figure 3: Example topology of an IPv6 enterprise network

18

Transition from IPv4 to IPv6 in Mongolia

Existing Network IPv6 is currently implemented in the core and transit of Mobicom and Mobinet.

Existing Network: Optimisation

Optimization of network is suggested in routers at international level for IPv6.

Procuring IPv6 Address Space

Mobicom and Mobinet has been allocated IPv6 address space each (/32).

Apply for IPv4 (final /22) available to Mobicom and Mobinet

IPv6 Address plan IPv6 address plan is in place.

Deployment on Network

No commercial end user deployment. IPv6 strategy for mobile is important. Deployment can start from own network and websites.

Seeking IPv6 Transit Transit services are sourced from multiple countries but IPv6 enablement is important.

Request international transit providers to enable IPv6.

Customers/End-Users

End-users are operating on IPv4 It is suggested to try deploying IPv6 with some customers.

3.2 Univision LLC.

Univision (a subsidiary of Unitel) offers a number of services in Mongolia including fixed services like broadband, fixed voice, IPTV amongst others. Unitel is the largest ICT company in Mongolia. A generic presentation on transition to IPv6 was made and detailed presentations were provided. Customized assistance and advisory was provided to Univision during the visit. A brief snapshot is tabulated below.

Characteristics Status Comments

Existing Network: IPv6 Assessment

IPv6 readiness is not available at core level but operator is keen to deploy. Inventory assessment of Ipv6 readiness to be done.

Provided general information on IPv6 transition planning.

Existing Network: Optimisation

N/A N/A

Procuring IPv6 Address Space

Univision has been allocated IPv6 address space (/32).

Apply for IPv4 (final /22) available.

IPv6 Address plan No address plan Provided general information on IPv6 transition planning.

Deployment on Network

No deployment Provided general information on IPv6 transition planning.

Seeking IPv6 Transit No IPv6 transit Provided general information on IPv6 transition planning.

Customers/End Users

No customers Provided general information on IPv6 transition planning.

19

Transition from IPv4 to IPv6 in Mongolia

3.3 ICNC LLC.

ICNC is a government owned company that provides wholesale bandwidth and sale of IPLC. The status of IPv6 deployment is as under.

Characteristics Status Comments

Existing Network: IPv6 Assessment

Network assessment to be undertaken

Suggested to start with inventory of existing equipment.

Existing Network: Optimisation

Examine the network for feasibility Suggested to start with inventory of existing equipment.

Procuring IPv6 Address Space

ICNC has not been allocated IPv6 address space.

Apply for two final IPv4 /22 blocks which are available. Apply for IPv6 /32 as well.

IPv6 Address plan No address plan Provided general information on IPv6 transition planning.

Deployment on Network

No deployment Provided general information on IPv6 transition planning.

Seeking IPv6 Transit No IPv6 transit Provided general information on IPv6 transition planning.

Customers/End Users

No customers Provided general information on IPv6 transition planning.

4.0 IPv6 Deployment and Infrastructure Security Training for Mongolia A three day national training on “IPv6 deployment and Infrastructure Security” was organized by ITU, APNIC and CRC from 29 June-1 July, 2015. Around 50 participants from ITPTA, CRC, National Data Center and Industry attended the training. Dr. Philip Smith provided the lead expertise, with support from Ms. Miwa Fujii (APNIC) and ITU (Mr. Ashish Narayan). The training in particular covered the following topics

• The role of policy makers and regulators in IPv6 migration e.g., IPv6 task force composition, promotion, awareness, deployment in government agencies, developing roadmaps, building capacity, consider security implications

• The updated status of IPv4 and IPv6 deployment including the drivers to facilitate IPv4 to IPv6 transition

• A technical brief on the working of Internet Infrastructure

• The details of IPv6 Addresses, various fields and their use

• The ways and means of IPv6 address planning

• The existing IPv6 Transition Technologies, their pros and cons including experiences and practices

• An introduction to IPv6 Security, steps to secure transition and security monitoring

Hands-on lab on IPv4 and IPv6 Dual Stack network, IPv6 addressing etc. were also carried out.

20

Transition from IPv4 to IPv6 in Mongolia

Summary of Training

Training Feedback Evaluation Future areas of training requested

The workshop significantly improved the awareness of IPv6 amongst the stakeholders and was well received (Evaluation Above). Some of the training needs areas were also identified by participants.

5.0 The Way Forward – Summary of Preliminary Recommendations

Mongolia is at an important juncture of ICT growth. While a few operators have undertaken steps and have awareness on IPv6 deployment, it is very important and urgent to start a strategic process of migration from IPv4 to IPv6 at national level. The first step is to create and IPv6 Task Force. A summary of preliminary recommendations (detailed in the report) for ITPTA and CRC is provided below. However, detailed recommendations are required to be developed in consultation with the task force. Recommendations on IPv6 Transition Security Recommendation 1 Establish an IPv6 task force for Mongolia including policy maker, regulator, telecom operators, ISPs, e-government agencies, software associations & manufacturers, and data centre operators. The work of the task force will include making recommendations for IPv6 transition for the following industry sectors:

- Telecom operators (e.g. fixed, mobile, transit, ISPs) - Broadband & Enterprise customers - Government Departments responsible for IT - Local content / Data Centres - NDC Exchange Point (MIX) - Others as deemed appropriate

The example of work areas include constitution of the decision making group, promotion, skill building and awareness raising, technical (including standards and technical guidelines) and network implementation, content and applications, IPv6 Security, research and innovation. Recommendation 2 Develop an IPv4 to IPv6 national roadmap in consultation with the task force. The working group comprising of ITPTA and CRC can continue to facilitate the Government support requirements for deployment of IPv6. Recommendation 3 The Government should take the lead and set deadlines for deployment of IPv6 within all Government Agencies and procurement processes. Develop a detailed action plan for implementation of IPv6 in Government departments including creation of an IPv6 transition team (focal point) in each Government department, allocation of required budget, upgrading of equipment, skills and security amongst others. Recommendation 4

Infrastructure Security Routing Protocols BGP & ISISBGPNetwork monitoringDNS SecIOTCustomer related security issues SecurityIPv6 security deploymentIPv6 network planning in detailsIPv6 for Server, DNS and moreIP migration from v4 to v6Security cases

21

Transition from IPv4 to IPv6 in Mongolia

Internet Exchange Points need to provide their members support to enable them to peer using IPv6. Recommendation 5 It is important to set up a monitoring mechanism for IPv6 implementation based on the national roadmap. Recommendation 6 Enterprise public facing content needs to support IPv6 while enterprises should be encouraged to start migration to IPv6 within their internal networks. Recommendation 7 Recommendations/guidelines for IPv6 address plans following industry best practices should be developed to assist organisations with their IPv6 deployment Recommendation 8 Equipment which is type approved in Mongolia needs to be IPv6 capable as far as possible Recommendation 9 Industry and business, including telecom service providers and enterprises, need to prepare an implementation plan for IPv6 in their own networks Recommendation 10 Develop an IPv6 Security Guideline in consultation with the IPv6 task force Recommendation 11 Build human capacity on IPv6 transition mechanism including security Recommendations on IPv6 transition for Telecom Industry and Business s on IPv6

22

Transition from IPv4 to IPv6 in Mongolia

Annex 1: IP Address allocation in Mongolia (June 2015)

IP address allocated and assigned in Mongolia

IPv4 address allocation and assignment in Mongolia 10x256 + 1x512 + 26x1024 + 9x2048 + 6x4096 + 5x8192 + 4x16384 + 32768 = 211,968 IPv4 addresses

apnic|MN|ipv4|27.123.212.0|1024|20101011|allocated apnic|MN|ipv4|43.228.128.0|1024|20141231|assigned apnic|MN|ipv4|43.231.112.0|1024|20150213|allocated apnic|MN|ipv4|43.242.240.0|1024|20140905|allocated apnic|MN|ipv4|43.243.160.0|1024|20140912|allocated apnic|MN|ipv4|43.250.124.0|1024|20141027|allocated apnic|MN|ipv4|45.117.32.0|1024|20150515|allocated apnic|MN|ipv4|49.0.128.0|32768|20101105|allocated apnic|MN|ipv4|103.10.20.0|1024|20110513|allocated apnic|MN|ipv4|103.11.192.0|1024|20111031|allocated apnic|MN|ipv4|103.14.36.0|1024|20120613|allocated apnic|MN|ipv4|103.17.108.0|512|20130227|assigned apnic|MN|ipv4|103.20.152.0|1024|20120918|assigned apnic|MN|ipv4|103.229.120.0|1024|20140414|assigned apnic|MN|ipv4|103.229.176.0|1024|20140417|assigned apnic|MN|ipv4|103.23.48.0|1024|20111115|allocated apnic|MN|ipv4|103.230.82.0|256|20140429|assigned apnic|MN|ipv4|103.242.44.0|1024|20130912|allocated apnic|MN|ipv4|103.254.120.0|1024|20131205|allocated apnic|MN|ipv4|103.26.192.0|1024|20130624|allocated apnic|MN|ipv4|103.29.144.0|1024|20110808|allocated apnic|MN|ipv4|103.29.199.0|256|20110819|assigned apnic|MN|ipv4|103.48.116.0|256|20150121|allocated apnic|MN|ipv4|103.50.204.0|1024|20150213|allocated apnic|MN|ipv4|103.51.60.0|256|20150219|assigned apnic|MN|ipv4|103.57.92.0|1024|20150515|allocated apnic|MN|ipv4|103.60.97.0|256|20150611|assigned apnic|MN|ipv4|103.8.60.0|256|20120413|assigned apnic|MN|ipv4|103.9.88.0|1024|20120510|allocated apnic|MN|ipv4|112.72.0.0|4096|20081224|allocated apnic|MN|ipv4|115.187.88.0|1024|20080922|allocated apnic|MN|ipv4|119.40.96.0|2048|20080104|allocated apnic|MN|ipv4|121.101.176.0|2048|20071119|allocated apnic|MN|ipv4|122.201.16.0|4096|20061030|allocated apnic|MN|ipv4|122.254.64.0|16384|20060607|allocated apnic|MN|ipv4|124.158.64.0|16384|20071003|allocated apnic|MN|ipv4|150.129.140.0|1024|20140627|allocated apnic|MN|ipv4|180.149.64.0|16384|20090831|allocated apnic|MN|ipv4|180.235.160.0|8192|20091105|allocated apnic|MN|ipv4|182.160.0.0|16384|20100331|allocated apnic|MN|ipv4|183.177.96.0|4096|20091130|allocated apnic|MN|ipv4|183.81.168.0|1024|20091118|allocated apnic|MN|ipv4|202.126.88.0|2048|20060906|allocated apnic|MN|ipv4|202.131.0.0|1024|19951129|allocated apnic|MN|ipv4|202.131.224.0|8192|19991123|allocated apnic|MN|ipv4|202.131.4.0|1024|19980210|allocated apnic|MN|ipv4|202.170.64.0|8192|19990609|allocated apnic|MN|ipv4|202.179.0.0|8192|20100817|allocated apnic|MN|ipv4|202.180.216.0|2048|20051124|allocated apnic|MN|ipv4|202.21.96.0|8192|19930816|allocated apnic|MN|ipv4|202.5.192.0|4096|20000606|allocated apnic|MN|ipv4|202.55.176.0|4096|20030708|allocated apnic|MN|ipv4|202.61.97.0|256|20101007|assigned apnic|MN|ipv4|202.70.32.0|4096|20010719|allocated apnic|MN|ipv4|202.72.240.0|2048|20041123|allocated apnic|MN|ipv4|202.9.40.0|2048|20110405|allocated apnic|MN|ipv4|203.169.48.0|2048|20060418|allocated apnic|MN|ipv4|203.174.26.0|256|20080404|assigned apnic|MN|ipv4|203.194.112.0|2048|20060524|allocated

23

Transition from IPv4 to IPv6 in Mongolia

apnic|MN|ipv4|203.34.37.0|256|20091001|assigned apnic|MN|ipv4|203.91.112.0|2048|20060131|allocated apnic|MN|ipv4|218.100.84.0|256|20110124|assigned

IPv6 address allocation and assignment in Mongolia (12x“/32” and 1x“/48”) (296x12 + 280x1) = 79,229,371,440,084,000,000,000,000,000 IPv6 Address Typically an ISP is allocated a /32 and an end customer a /48

apnic|MN|ipv6|2001:df4:e800::|48|20140417|assigned apnic|MN|ipv6|2400:7480::|32|20131211|allocated apnic|MN|ipv6|2400:db80::|32|20140408|allocated apnic|MN|ipv6|2401:d600::|32|20100427|allocated apnic|MN|ipv6|2402:7580::|32|20150612|allocated apnic|MN|ipv6|2402:b900::|32|20111219|allocated apnic|MN|ipv6|2402:c900::|32|20111230|allocated apnic|MN|ipv6|2403:d700::|32|20120510|allocated apnic|MN|ipv6|2404:2700::|32|20120613|allocated apnic|MN|ipv6|2405:600::|32|20101027|allocated apnic|MN|ipv6|2405:5700::|32|20121003|allocated apnic|MN|ipv6|2405:ae00::|32|20101210|allocated apnic|MN|ipv6|2407:6400::|32|20100302|allocated

Autonomous System Numbers (41) This is an indication of distinct autonomous networks in Mongolia

apnic|MN|asn|4850|1|20060418|allocated apnic|MN|asn|9484|1|20020930|allocated apnic|MN|asn|9789|1|19991216|allocated apnic|MN|asn|9934|1|20100817|allocated apnic|MN|asn|10076|1|20000620|allocated apnic|MN|asn|10109|1|20080104|allocated apnic|MN|asn|10219|1|20030710|allocated apnic|MN|asn|17882|1|20010724|allocated apnic|MN|asn|24320|1|20041220|allocated apnic|MN|asn|24496|1|20051129|allocated apnic|MN|asn|24559|1|20060209|allocated apnic|MN|asn|38038|1|20060530|allocated apnic|MN|asn|38051|1|20060607|allocated apnic|MN|asn|38218|1|20060913|allocated apnic|MN|asn|38273|1|20061102|allocated apnic|MN|asn|38454|1|20140424|allocated apnic|MN|asn|38805|1|20071015|allocated apnic|MN|asn|38818|1|20091001|allocated apnic|MN|asn|38869|1|20080109|allocated apnic|MN|asn|45204|1|20090831|allocated apnic|MN|asn|45237|1|20080623|allocated apnic|MN|asn|45509|1|20081031|allocated apnic|MN|asn|55342|1|20091218|allocated apnic|MN|asn|55408|1|20100208|allocated apnic|MN|asn|55546|1|20100611|allocated apnic|MN|asn|55801|1|20101007|allocated apnic|MN|asn|55805|1|20101011|allocated apnic|MN|asn|56194|1|20110408|allocated apnic|MN|asn|56293|1|20110520|allocated apnic|MN|asn|56301|1|20110601|allocated apnic|MN|asn|58406|1|20110822|allocated apnic|MN|asn|58439|1|20111019|allocated apnic|MN|asn|58598|1|20120510|allocated apnic|MN|asn|58625|1|20120613|allocated apnic|MN|asn|58726|1|20121023|allocated apnic|MN|asn|59354|1|20140506|allocated apnic|MN|asn|63962|1|20150317|allocated apnic|MN|asn|133177|1|20131204|allocated apnic|MN|asn|133453|1|20140416|allocated apnic|MN|asn|134074|1|20150218|allocated apnic|MN|asn|134241|1|20150612|allocated

Source: ftp://ftp.apnic.net/public/stats/apnic/delegated-apnic-latest

24

Transition from IPv4 to IPv6 in Mongolia

Annex 2: IPv6 Transition Strategies and Planning

25

Transition from IPv4 to IPv6 in Mongolia

Annex 3: Steps to Deploy IPv6 in Telecom Networks

26

Transition from IPv4 to IPv6 in Mongolia

Annex 4: IPv6 Infrastructure Security

27

Transition from IPv4 to IPv6 in Mongolia

28