← All lessons
Foundations · Beginner · 7 min
Modern networks: IPv6, SDN and zero trust
IPv6, software-defined networks, zero trust and SASE, without the buzzwords.
What it is
IPv4 has about 4.3 billion addresses, which ran out; NAT stretched them. IPv6 addresses are 128 bits, written as eight groups of four hex digits, such as 2001:db8:4a1:10::25. Leading zeros can be dropped, and :: replaces one run of all-zero groups. Every IPv6 interface has a link-local address starting fe80, which only works on its own segment, and most get a global address too, often set up automatically with SLAAC. There are so many addresses that NAT isn't needed, though a firewall still decides what gets in. While both versions are in use, devices run dual stack (IPv4 and IPv6 side by side), and tunnelling or NAT64 joins IPv6-only and IPv4-only networks. Software-defined networking (SDN) splits the control plane (deciding where traffic goes) from the data plane (forwarding it), so one controller programs many devices. SD-WAN applies that to links between sites, choosing the best of several internet connections for each application. VXLAN carries layer 2 networks over layer 3, with about 16 million segment IDs instead of 4,094 VLANs. Zero trust drops the idea of a trusted inside network: every request is checked (who, which device, is it healthy) and given the least access needed. SASE delivers networking and security (secure web gateway, cloud access security broker, zero trust network access, firewall) as a cloud service close to the user. Infrastructure as code (IaC) keeps device and cloud settings as version-controlled files, so changes are reviewed and repeatable.
Real case · 2014
Google's BeyondCorp
Google moved its staff off a privileged internal network: instead of trusting anyone on the office network, every request to an internal app is checked against who the user is and the state of their device, wherever they are. Its 2014 paper said perimeter firewalls fail once an attacker is inside, and that mobile and cloud work makes a perimeter hard to hold. It became a model for zero trust.
Source: Google Research: BeyondCorp, a new approach to enterprise security
How defenders stop it
- Give every user and device its own identity, and check it on every request, not just at the edge
- Grant the least access needed, to each application rather than the whole network
- Firewall IPv6 as carefully as IPv4: no NAT doesn't mean no filtering
- Keep network and cloud settings as code, so every change is reviewed and can be rolled back
Check yourself
1. Which is the shortest correct way to write 2001:0db8:0000:0000:0000:0000:0000:0001?
- 2001:db8::1
- 2001:db8:0:1
- 2001::db8::1
- 21:db8::1
Show answer
2001:db8::1. Drop leading zeros in each group and replace the one run of zero groups with ::. :: can only appear once, and you can't drop zeros from the end of a group.
2. What does SDN separate?
- IPv4 from IPv6
- The control plane (deciding where traffic goes) from the data plane (forwarding it)
- Guests from staff
- Wired from wireless
Show answer
The control plane (deciding where traffic goes) from the data plane (forwarding it). With the decisions made centrally by a controller, many switches and routers can be programmed at once.
3. Why did Google move away from trusting its internal network?
- It ran out of IPv4 addresses
- Once an attacker is inside a perimeter, they can reach a lot; and mobile and cloud work make a perimeter hard to hold
- Its firewalls were too slow
- It moved everything to SD-WAN
Show answer
Once an attacker is inside a perimeter, they can reach a lot; and mobile and cloud work make a perimeter hard to hold. Zero trust checks each request on its own merits, so being on the network grants nothing.
Answer them in the app to earn XP.
Next: Encryption & hashing →