Cost of IPv6 for IT operations team

[Seth Mos]

> Op 27 mrt. 2015, om 00:23 heeft Brian E Carpenter <brian.e.carpenter at gmail.com> het volgende geschreven:
> 
> On 26/03/2015 22:04, BERENGUER Christophe wrote:
>> Hello everybody,
>> 
>> 
>> I work for a consulting firm.
>> 
>> 
>> For a client, I would like to estimate the work overload for IT operations team to deploy IPv6 dual stack and for day to day operations.
>> 
>> 
>> On the internet, I have found an estimation around 20% of work overload for the run phase.
> 
> Is that evidence-based, or a hand-waving guess?
> I would expect a bit of extra workload at the beginning of the run phase
> but in the steady state are there really 20% more incidents?

We use pfSense at work and I’m using hostnames and other DNS names in the firewall rules to great lengths so that they automatically adjust when a host changes IPs, be that 4 or 6. I can select IPv4 and IPv6 in the rule so the same rule applies to both.

Ofcourse, there is a security tradeoff, but considering the sheer amount of CDN hosting today it’s becoming harder to just assign a IP to the rule and have it work for over a week :)

Firewalling by (prefixes from) ASN would be something useful to have too, for abuse purposes.

I’m mostly talking about outbound firewall rules, the LAN is pretty much closed off. Proxy or bust.

Cheers,
Seth

> 
>    Brian
> 
>> But if you have operational feedback it would be the best!
>> 
>> 
>> Thanks in advance for your answers,
>> 
>> Have a nice day.
>> 
>> 
>> Best regards,
>> 
>> 
>> Christophe BERENGUER
>> Consultant
>> Fixe : +33 (0)1 49 03 85 86
>> christophe.berenguer at solucom.fr<mailto:christophe.berenguer at solucom.fr>
>> solucom
>> Tour Franklin : 100 - 101 terrasse Boieldieu
>> 92042 Paris La Défense Cedex
>> 
>