IPv6 in Data Center: after a year, Cisco is still not ready
Today I’m delivering another IPv6 presentation, this time at the 4th Slovenian IPv6 Summit organized by tireless Jan Žorž from the go6 Slovenian IPv6 initiative. It’s thus just the right time to review the post I wrote a bit more than a year ago about lack of IPv6 readiness in Cisco’s Data Center products. Let’s see what has changed in a year:
| Equipment | Last year | This year |
|---|---|---|
| Routers | Yes (6vPE on IOS XE might be missing) | Yes |
| Firewalls (ASA) | No redundancy (IPv6 failover doesn’t work) | Yes |
| Data center switches | Yes (Catalyst and Nexus) | Yes (Not on Nexus 1000V) |
| Firewall Service Module (FWSM) | Not in transparent mode, on the main CPU (awfully slow) in routed mode. | Not in transparent mode, no failover. |
| Load balancers (ACE) | No | No |
| Application-level firewall (XML Gateway) | No | Dead |
| WAN optimization (WAAS) | No | No |
| Ironport | No | No |
The changes from last year:
- 6VPE was introduced in IOS XE release 3.1S.
- IPv6 failover bug in ASA was fixed.
- WAF and XML Gateway were killed.
Not much, I would say, but I probably have a wrong perspective. After all, John Chambers is very proud about Cisco’s IPv6 thought leadership.
Enjoy the video, I particularly liked the part around 1:50 where “every our product” quickly becomes “... every router, every switch, all of our core IOS software ...” Proves my point, does it not?
- You can throw away your ACE10's & ACE20's because they will never do IPv6
- WLC does not do IPv6
ASA IPv6 bugs and features ... don't get me started, it's still a long way to go :-)
As of 8.2 code all it really does is basic unicast routing. ASA 8.3 code added a few things (like IPv6 LAN to LAN IPsec). It doesn't change the fact that there is "poor" feature parity between IPv4 and IPv6. In this case, "poor" is a severe understatement.
IPv6 IPsec? Static LAN to LAN only.
IPv6 remote access VPN - L2TP, AnyConnect? nope.
dynamic routing - OSPFv3 or RIPng? nope
PIXes and ASAs support all of the above for IPv4 networks.
IOS boxes don't have feature parity either but they are MUCH MUCH farther along, especially if you are really brave and run 15.1T ;)
In other words forget about FWSM and IPv6, although if you have a big account behind you, contact your Cisco SE, maybe they can talk some sense into development. For everyone else, we have to wait for the next-generation-firewall-in-chassis - people from Cisco told me it's not that long of a wait (no specifics).
If anyone has anything more authoritative pointing to a different conclusion (IPv6 running on NP3), please share it.
http://www.gossamer-threads.com/lists/cisco/nsp/132935?do=post_view_threaded#132935
and reply from cisco, IPv6 is handled by CPU - PIII.
On top you might find this interesting:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtl77322
On top you might find this interesting:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtl77322