Ethan Banks, one of the masterminds behind the Packet Pushers podcast, wrote a spot-on blog describing why enterprises don’t deploy IPv6. Unfortunately, most of the enterprise networking engineers follow the same line of reasoning, and a few of them might feel like the proverbial deer caught in the headlights once something totally unexpected happen ... like their CEO vacationing in China, getting only IPv6 address on the iPhone, and thus not being able to access a mission-critical craplication. For a longer-term perspective, read an excellent reply written by Tom Hollingsworth.

I totally agree with Ethan that there’s no reason to deploy IPv6 throughout the enterprise network today, but that’s no excuse for lack of preparation and early deployment pilots. There are a number of things you can do today that won’t cost you much:

Make IPv6 support mandatory when re-negotiating contracts with your carriers. We did this in Slovenia with marvelous results: all three biggest ISPs offer IPv6 to business customers by default at no extra charge.

Buy only IPv6-enabled gear. You don’t have to deploy IPv6 today, but if you have to deploy it in rush, it helps if you can use the existing equipment. Use RIPE-501 (or its successor, once it comes out) as the purchasing guideline and be particularly careful with the data center gear.

Buy only applications tested to work over IPv6. Like the previous two points, buying off-the-shelf solutions or custom-developed applications that don’t support IPv6 is utterly shortsighted. If they don’t support IPv6 today, what are the chances they’ll be able to fix their code (and potentially their database structures) when you’ll need IPv6?

If you’re extremely nasty, make sure there’s only IPv6 connectivity in the room where the vendor is demonstrating the application ;)

Educate your application developers. Unless they write C/C++ code, they’re probably not exposed to the stupidities of the socket API, but they still need to understand that the IP addresses they get in REMOTE_ADDR CGI field might get longer than 14 characters and that the (\d+\.){3}\d+ regular expression no longer parses all network addresses.

Get provider-independent IPv6 address space. You could survive with Provider-Assigned (PA) address space if needed, but it makes no sense to expose yourself to unnecessary network renumbering. Get ready today.

Plan for rapid IPv6 deployment in your DMZ. If you can’t invest in proper planning, pilots, test and production deployment, at least develop an emergency plan that you can pull off the shelf when needed. It could be as easy as establishing a tunnel to Hurricane Electric, deploying IPv6 in one segment in your DMZ, and configuring 6-to-4 load balancing on your F5 BIG-IP or Cisco’s ACE-30 ... but you have to know what needs to be done.

Get educated and get some hands-on experience. Not because your company needs it, but because it won’t hurt your career to know a bit more than what you need to know to get your daily job done.

I did a Getting ready for IPv6 in 6 days presentation in early June; you might want to revisit it to get some emergency ideas ... and don’t forget what Martin Levy said:

You can either do a planned, careful migration, or you can do it in a panic. And you should know full well that panicking is more expensive.