Details

IP Address Management

IEEE Press Series on Networks and Service Management 2. Aufl.

von: Timothy Rooney, Michael Dooley
116,99 €
Verlag:	Wiley
Format:	EPUB
Veröffentl.:	12.12.2020
ISBN/EAN:	9781119692300
Sprache:	englisch
Anzahl Seiten:	640

In den Warenkorb

Als Gutschein

DRM-geschütztes eBook, Sie benötigen z.B. Adobe Digital Editions und eine Adobe ID zum Lesen.

Beschreibungen

Titelbeschreibung

Rediscover fundamental and advanced topics in IPAM, DNS, DHCP and other core networking technologies with this updated one-stop reference The thoroughly revised second edition of IP Address Management is the definitive reference for working with core IP management technologies, like address allocation, assignment, and network navigation via DNS. Accomplished professionals and authors Timothy Rooney and Michael Dooley offer readers coverage of recent IPAM developments in the world of cloud computing, Internet of Things (IoT), and security, as well as a comprehensive treatment of foundational concepts in IPAM. The new edition addresses the way that IPAM needs and methods have evolved since the publication of the first edition. The book covers the impact of mainstream use of private and public cloud services, the maturation of IPv6 implementations, new DNS security approaches, and the proliferation of IoT devices. The authors have also reorganized the flow of the book, with much of the technical reference material appearing at the end and making for a smoother and simpler reading experience. The 2nd edition of IP Address Management also covers topics like such as: <ul> <li>Discussions about the fundamentals of Internet Protocol Address Management (IPAM), including IP addressing, address allocation and assignment, DHCP, and DNS</li> <li>An examination of IPAM practices, including core processes and tasks, deployment strategies, IPAM security best-practices, and DNS security approaches</li> <li>A treatment of IPAM in the modern context, including how to adapt to cloud computing, the Internet of Things, IPv6, and new trends in IPAM</li> <li>A one-stop reference for IPAM topics, including IP addressing, DHCP, DNS, IPv6, and DNS security</li> </ul> Perfect for IP network engineers and managers, network planners, network architects, and security engineers, the second edition of IP Address Management also belongs on the bookshelves of senior undergraduate and graduate students studying in networking, information technology, and computer security-related courses and programs.

Inhaltsverzeichnis

Preface xix Acknowledgments xxiii About the Authors xxv Part I IPAM Introduction 1 1 Introduction 3 IP Networking Overview 3 IP Routing 6 IP Addresses 7 Protocol Layering 12 OSI and TCP/IP Layers 14 TCP/UDP Ports 15 Intra-Link Communications 15 Are We on the Same Link? 17 Limiting Broadcast Domains 18 Interlink Communications 19 Worldwide IP Communications 20 Dynamic Routing 22 Routers and Subnets 24 Assigning IP addresses 25 The Human Element 26 Why Manage IP Space? 26 Basic IPAM Approaches 27 Early History 27 Today’s IP Networks and IP Management Challenges 28 2 IP Addressing 31 Internet Protocol History 31 The Internet Protocol, Take 1 32 Class-Based Addressing 32 Internet Growing Pains 35 Private Address Space 38 Classless Addressing 40 Special Use IPv4 Addresses 40 The Internet Protocol, Take 2 41 IPv6 Address Types and Structure 42 IPv6 Address Notation 43 Address Structure 45 IPv6 Address Allocations 46 2000::/3 – Global Unicast Address Space 47 fc00::/7 – Unique Local Address Space 47 fe80::/10 – Link Local Address Space 47 ff00::/8 – Multicast Address Space 48 Special Use IPv6 Addresses 48 IPv4–IPv6 Coexistence 49 3 IP Address Assignment 51 Address Planning 51 Regional Internet Registries 51 RIR Address Allocation 53 Address Allocation Efficiency 54 Multi-Homing and IP Address Space 55 Endpoint Address Allocation 58 Server-based Address Allocation Using DHCP 58 DHCP Servers and Address Assignment 61 Device Identification by Class 62 DHCP Options 62 DHCP for IPv6 (DHCPv6) 62 DHCP Comparison IPv4 vs. IPv6 63 DHCPv6 Address Assignment 64 DHCPv6 Prefix Delegation 65 Device Unique Identifiers (DUIDs) 66 Identity Associations (IAs) 66 DHCPv6 Options 67 IPv6 Address Autoconfiguration 67 Neighbor Discovery 68 Modified EUI-64 Interface Identifiers 69 Opaque Interface IDs 69 Reserved Interface IDs 72 Duplicate Address Detection (DAD) 72 4 Navigating the Internet with DNS 75 Domain Hierarchy 75 Name Resolution 76 Resource Records 80 Zones and Domains 81 Dissemination of Zone Information 83 Reverse Domains 84 IPv6 Reverse Domains 89 Additional Zones 91 Root Hints 91 Localhost Zones 92 DNS Update 92 5 IPAM Technology Applications 93 DHCP Applications 93 Device Type Specific Configuration 94 Broadband Subscriber Provisioning 95 Related Lease Assignment or Limitation Applications 101 Pre-Boot Execution Environment (PXE) clients 102 PPP/RADIUS Environments 103 Mobile IP 104 Popular DNS Applications 105 Host Name and IP Address Resolution 106 A – IPv4 Address Record 107 AAAA – IPv6 address record 107 PTR – Pointer Record 107 Alias Host Name Resolutions 108 CNAME – Canonical Name Record 108 Network Services Location 108 SRV – Services Location Record 109 Textual Information Lookup 110 TXT – Text Record 110 Many More Applications 110 Part II IPAM Mechanics 111 6 IP Management Core Tasks 113 IPAM Is Foundational 113 Impacts of Inadequate IPAM Practice 114 IPAM Is Core to Network Management 115 FCAPS Summary 116 Configuration Management 117 Address Allocation Considerations 118 Address Allocation Tasks 120 IP Address Assignment 133 Address Deletion Tasks 135 Address Renumbering or Movement Tasks 136 Network Services Configuration 140 Fault Management 143 Monitoring and Fault Detection 143 Troubleshooting and Fault Resolution 144 Accounting Management 147 Inventory Assurance 147 Performance Management 151 Services Monitoring 151 Address Capacity Management 152 Auditing and Reporting 152 Security Management 153 ITIL® Process Mappings 153 ITIL Practice Areas 154 Conclusion 162 7 IPv6 Deployment 163 IPv6 Deployment Process Overview 164 IPv6 Address Plan Objectives 165 IPv6 Address Plan Examples 166 Case 1 166 Observations 168 Case 2 169 Observations 169 General IPv6 Address Plan Guidelines 170 ULA Considerations 171 Renumbering Impacts 172 IPv4–IPv6 Coexistence Technologies 173 Dual Stack Approach 173 Dual Stack Deployment 174 DNS Considerations 174 DHCP Considerations 175 Tunneling Approaches 176 Tunneling Scenarios for IPv6 Packets over IPv4 Networks 176 Dual-Stack Lite 177 Lightweight 4over6 181 Mapping of Address and Port with Encapsulation (MAP-E) 181 Additional Tunneling Approaches 183 Translation Approaches 184 IP/ICMP Translation 185 Address Translation 186 Packet Fragmentation Considerations 187 IP Header Translation Algorithm 188 Bump in the Host (BIH) 189 Network Address Translation for IPv6–IPv4 (NAT64) 192 NAT64 and DNS64 193 464XLAT 195 Mapping of Address and Port with Translation (MAP-T) 195 Other Translation Techniques 196 Planning Your IPv6 Deployment Process 197 8 IPAM for the Internet of Things 201 IoT Architectures 201 6LoWPAN 203 Summary 209 9 IPAM in the Cloud 211 IPAM VNFs 212 Cloud IPAM Concepts 212 IP Initialization Process 212 IP Initialization Implementation 213 DHCP Method 214 Private Cloud Static Method 216 Public Cloud Static Method 218 Cloud Automation with APIs 218 Multi-Cloud IPAM 220 Private Cloud Automation 221 Public Cloud Automation 223 IPAM Automation Benefits 223 Unifying IPAM Automation 224 Streamlined Subnet Allocation Workflow 226 Workflow Realization 230 Tips for Defining Workflows 233 Automation Scenarios 234 Intra-IPAM Automation 234 DHCP Server Configuration 235 DNS Server Configuration 236 Subnet Assignment 236 IP Address Assignment Request 236 Extra-IPAM Workflow Examples 237 Regional Internet Registry Reporting 237 Router Configuration Provisioning 238 Customer Provisioning 238 Asset Inventory Integration 238 Trouble Ticket Creation 239 Summary 239 Part III IPAM and Security 241 10 IPAM Services Security 243 Securing DHCP 244 DHCP Service Availability 244 DHCP Server/OS Attacks 244 DHCP Server/OS Attack Mitigation 245 DHCP Service Threats 245 DHCP Threat Mitigation 246 DHCP Authentication and Encryption 247 DNS Infrastructure Risks and Attacks 248 DNS Service Availability 249 DNS Server/OS Attacks 249 DNS Server/OS Attack Mitigation 250 DNS Service Denial 250 Distributed Denial of Service 251 Bogus Domain Queries 251 Pseudorandom Subdomain Attacks 252 Denial of Service Mitigation 253 Reflector Style Attacks 253 Reflector Attack Mitigation 254 Authoritative Poisoning 254 Authoritative Poisoning Mitigation 255 Resolver Redirection Attacks 256 Resolver Attack Defenses 256 Securing DNS Transactions 257 Cache Poisoning Style Attacks 257 Cache Poisoning Mitigation 259 DNSSEC Overview 259 The DNSSEC Resolution Process 260 Negative Trust Anchors 262 DNSSEC Deployment 263 Last Mile Protection 264 DNS Cookies 264 DNS Encryption 264 DNS Over TLS (DoT) 264 DNS Over HTTPS (DoH) 265 Encryption Beyond the Last Mile 267 11 IPAM and Network Security 269 Securing Network Access 269 Discriminatory Address Assignment with DHCP 269 DHCP Lease Query 274 Alternative Access Control Approaches 275 Layer 2 Switch Alerting 275 802.1X 276 Securing the Network Using IPAM 277 IP-Based Security Policies (ACLs, etc.) 277 Malware Detection Using DNS 277 Malware Proliferation Techniques 278 Phishing 279 Spear Phishing 279 Software Downloads 279 File Sharing 279 Email Attachments 280 Watering Hole Attack 280 Replication 280 Brute Force 280 Malware Examples 280 Malware Mitigation 281 DNS Firewall 282 DNS Firewall Policy Precedence 284 Logging Configuration 285 Other Attacks that Leverage DNS 285 Network Reconnaissance 285 Network Reconnaissance Defenses 286 DNS Rebinding Attack 287 Data Exfiltration 287 Data Exfiltration Mitigation 287 DNS as Data Transport (Tunneling) 288 Advanced Persistent Threats 289 Advanced Persistent Threats Mitigation 290 12 IPAM and Your Internet Presence 291 IP Address Space Integrity 291 Publicizing Your Public Namespace 292 Domain Registries and Registrars 292 DNS Hosting Providers 294 Signing Your Public Namespace 295 DNSSEC Zone Signing 295 Key Rollover 296 Prepublish Rollover 297 Dual Signature Rollover 298 Algorithm Rollover 299 Key Security 301 Enhancing Internet Application Encryption Integrity 302 DNS-Based Authentication of Named Entities (DANE) 303 Securing Email with DNS 305 Email and DNS 305 DNS Block Listing 306 Sender Policy Framework (SPF) 307 Domain Keys Identified Mail (DKIM) 307 Domain-Based Message Authentication, Reporting, and Conformance (DMARC) 308 Part IV IPAM in Practice 311 13 IPAM Use Case 313 Introduction 313 IPv4 Address Allocation 316 First-Level Allocation 317 Second-Layer Allocation 318 Address Allocation Layer 3 320 Core Address Space 323 External Extensions of Address Space 323 Allocation Trade-Offs and Tracking 324 IPAM Worldwide’s Public IPv4 Address Space 325 IPAM Worldwide’s IPv6 Allocations 326 External Extensions Address Space 329 IP Address Tracking 332 DNS and IP Address Management 334 14 IPAM Deployment Strategies 337 General Deployment Principles for DHCP/DNS 337 Disaster Recovery/Business Continuity 338 DHCP Deployment 339 DHCP Server Platforms 339 DHCP Servers 339 Virtualized DHCP Deployment 339 DHCP Appliances 339 DHCP Deployment Approaches 340 Centralized DHCP Server Deployment 340 Distributed DHCP Server Deployment 342 DHCP Services Deployment Design Considerations 344 DHCP Deployment on Edge Devices 347 DNS Deployment 348 DNS Trust Sectors 349 External DNS Trust Sector 350 Extranet DNS Trust Sector 355 Recursive DNS Trust Sector 357 Internal DNS Trust Sector 361 Deploying DNS Servers with Anycast Addresses 362 Anycast Addressing Benefits 362 Anycast Caveats 364 Configuring Anycast Addressing 365 IPAM Deployment Summary 366 High Availability 366 Multiple Vendors 366 Sizing and Scalability 367 Load Balancers 367 Lab Deployment 367 15 The Business Case for IPAM 369 IPAM Business Benefits 369 Automation 370 Outage Reduction 370 Rapid Trouble Resolution 370 Accurate IPAM Inventory and Reporting 371 Expanded IP Services 371 Distributed Administration 371 Enhanced Security 371 Business Case Overview 372 Business Case Cost Basis 373 Address Block Management 374 Subnet Management 381 IP Address Assignment – Moves, Adds, and Changes 383 Inventory Assurance 386 Address Capacity Management 387 Auditing and Reporting 392 Server Upgrade Management 392 Outage and Security Recovery Costs 393 IPAM System Administration Costs 396 Cost Basis Summary 399 Savings with IPAM Deployment 399 Business Case Expenses 403 Netting it Out: Business Case Results 403 Conclusion 405 16 IPAM Evolution/Trends 407 Security Advancements 407 Intent-Based Networking 409 Artificial Intelligence Applied to IPAM 410 IP Address Capacity Management 412 DNS Query and Response Analytics 412 DNS Malware Detection 413 Network Address Intrusions 413 IPAM Administration Activity Analysis 414 AI Summary 414 Edge Computing 414 Identifier/Locator Networking 415 Information Centric Networking 416 Part V IPAM Reference 419 17 IP Addressing Reference 421 IP Version 4 421 The IPv4 Header 421 IP Version 6 423 The IPv6 Header 423 IPv6 Multicast Addressing 424 Flags 425 Special Case Multicast Addresses 429 Solicited Node Multicast Address 429 Node Information Query Address 429 IPv6 Addresses with Embedded IPv4 Addresses 430 Reserved Subnet Anycast Addresses 430 18 DHCP Reference 433 DHCPv6 Protocol 433 DHCPv6 Packet Format 433 DHCPv6 Message Types 433 DHCPv6 Failover Overview 437 DHCPv6 Options 439 DHCP for IPv4 454 DHCP Packet Format 454 DHCPv4 Message Types 456 DHCP Options 474 19 DNS Reference 475 DNS Message Format 475 Encoding of Domain Names 475 Name Compression 476 Internationalized Domain Names 478 DNS Message Format 479 Message Header 480 Question Section 482 Answer Section 485 Authority Section 487 Additional Section 487 DNS Update Messages 487 DNS Extensions (EDNS0) 489 The DNS Resolution Process Revisited 494 DNS Resolution Privacy Extension 501 DNS Resolver Configuration 502 DNS Applications and Resource Records 504 Resource Record Format 504 Host Name and IP Address Resolution 506 A – IPv4 Address Record 506 AAAA – IPv6 Address Record 506 PTR – Pointer Record 507 Alias Host and Domain Name Resolutions 507 CNAME – Canonical Name Record 507 DNAME – Domain Alias Record 508 Network Services Location 508 SRV – Services Location Record 508 AFSDB – DCE or AFS Server Record (Experimental) 509 WKS – Well Known Service Record (Historic) 510 Host and Textual Information Lookup 510 TXT – Text Record 510 HINFO – Host Information Record 510 DNS Protocol Operational Record Types 512 SOA – Start of Authority Record 512 NS – Name Server Record 513 Dynamic DNS Update Uniqueness Validation 514 DHCID – Dynamic Host Configuration Identifier Record 514 Telephone Number Resolution 515 NAPTR – Naming Authority Pointer Record 517 Email and Anti-spam Management 518 Email and DNS 519 MX – Mail Exchanger Record 519 Allow or Block Listing 523 Sender Policy Framework (SPF) 523 SPF – Sender Policy Framework Formatting for a TXT Record 524 Mechanisms 524 Modifiers 526 Macros 527 Macro Examples 528 Sender ID (Historical) 528 Domain Keys Identified Mail (DKIM) 529 DKIM Signature Email Header Field 530 DKIM TXT Record 531 DMARC TXT Record 532 Historic Email Resource Record Types 533 MR – Mail Rename Record 533 MB – Mailbox Record 533 MG – Mail Group Member Record 534 MINFO – Mailbox/Mailing List Information 534 Security Applications 534 Securing Name Resolution – DNSSEC Resource Record Types 534 DNSKEY – DNS Key Record 534 DS – Delegation Signer Record 536 NSEC – Next Secure Record 536 NSEC3 – NSEC3 Record 537 NSEC3PARAM – NSEC3 Parameters Record 538 RRSIG – Resource Record Set Signature Record 539 Other Security-oriented DNS Resource Record Types 540 TA – Trust Authority Record 540 CERT – Certificate Record 540 IPSECKEY – Public Key for IPSec Record 541 KEY – Key Record 542 KX – Key Exchanger Record 543 SIG – Signature Record 543 SSHFP – Secure Shell Fingerprint Record 544 Geographical Location Lookup 544 GPOS – Geographical Position Record 544 LOC – Location Resource Record 545 Non-IP Host-Address Lookups 545 ISDN – Integrated Services Digital Network Record (Experimental) 545 NSAP – Network Service Access Point Record 545 NSAP-PTR – Network Service Access Point Reverse Record 546 PX – Pointer for X.400 546 X25 – X.25 PSDN Address Record (Experimental) 546 RT – Route Through 547 The Null Record Type 547 NULL 547 Experimental Name-Address Lookup Records 547 IPv6 Address Chaining – The A6 Record (Experimental) 547 APL – Address Prefix List Record (Experimental) 548 DNS Resource Record Summary 549 20 RFC Reference 555 Glossary 583 Bibliography 585 Index 601

Autorenportrait

Michael Dooley is Vice President of Operations for BT Diamond IP division. He has over 20 years of experience managing and developing enterprise-scale software products. His professional expertise includes IP addressing, DHCP, and DNS. He is co-author of IPv6 Deployment and Management and DNS Security Management. Timothy Rooney is the Product Manager for BT Diamond IP product development and has led the market introduction of NetControl, IPControl, Sapphire Appliances, and ImageControl, four next-gen IP management systems. He is co-author of Introduction to IP Address Management, IP Address Management Principles and Practice, IPv6 Deployment and Management, and DNS Security Management.

Back cover copy

Rediscover fundamental and advanced topics in IPAM, DNS, DHCP and other core networking technologies with this updated one-stop reference The thoroughly revised second edition of IP Address Management is the definitive reference for working with core IP management technologies, like address allocation, assignment, and network navigation via DNS. Accomplished professionals and authors Timothy Rooney and Michael Dooley offer readers coverage of recent IPAM developments in the world of cloud computing, Internet of Things (IoT), and security, as well as a comprehensive treatment of foundational concepts in IPAM. The new edition addresses the way that IPAM needs and methods have evolved since the publication of the first edition. The book covers the impact of mainstream use of private and public cloud services, the maturation of IPv6 implementations, new DNS security approaches, and the proliferation of IoT devices. The authors have also reorganized the flow of the book, with much of the technical reference material appearing at the end and making for a smoother and simpler reading experience. The 2nd edition of IP Address Management also covers topics like such as: <ul> <li>Discussions about the fundamentals of Internet Protocol Address Management (IPAM), including IP addressing, address allocation and assignment, DHCP, and DNS</li> <li>An examination of IPAM practices, including core processes and tasks, deployment strategies, IPAM security best-practices, and DNS security approaches</li> <li>A treatment of IPAM in the modern context, including how to adapt to cloud computing, the Internet of Things, IPv6, and new trends in IPAM</li> <li>A one-stop reference for IPAM topics, including IP addressing, DHCP, DNS, IPv6, and DNS security</li> </ul> Perfect for IP network engineers and managers, network planners, network architects, and security engineers, the second edition of IP Address Management also belongs on the bookshelves of senior undergraduate and graduate students studying in networking, information technology, and computer security-related courses and programs.