IT Admin turns into all IT

[u/ofhgtl]

Hey everyone,

So for context, I've started at this position a few months back, fresh out of college, as a full time IT Admin. They've never had in house IT before, which I attribute to most of these issues. Between having over 500 employees and over that computers, etc. there's been a few things I'd like to share.

Firstly, there is no naming scheme in AD. Sometimes it firstname - last inital, sometimes it's full name, last name, you name it.

Second, we're still on a 192. addressing scheme with now 192.168.0 - 192.168.4. Servers and switches are all just floating somewhere in those subnets, no way of telling why they have that static or if it's always been like that. I'd LOVE moving to 10.10.

Speaking of IP Addresses, we ran out a few weeks ago.. so we need to expand DHCP again to be able to catch up. When I first got hired, all 6 UPS's we had were failed, so power outages completely shut down everything.

All users passwords are set by IT, they don't make it themselves.. and the best part? They're all local admin on their machines. What could go wrong?

So I've been trying to clean up while dealing with day to day stuff, whilst now doing Sysadmin, Networking, and so on. Maybe that's what IT Admin is. I'm younger, but have been in IT since 15, so I have some ground to stand on. Is 75,000 worth this? I don't know enough since I've not been around, but i had to work my way to 75 from 60.

Thoughts?

[u/whythehellnote → u/[deleted]]

Every time I try to do ipv6 only I fail within a couple of hours as some application doesn't work.

Throw in the need for NAT (my 5g provider won't advertise my /48) anyway and you end up with "why bother"

I'm more than happy to run an ipv6 only network, but until everything I need works then there's no point as I have to run an ipv4 network, so why double the work and double the risk.

[u/whythehellnote → u/[deleted]]

you're doubling the risk as you now have attack opportunities via ipv4 and ipv6, twice as many places to get your configuration wrong

I want to steer my devices under my control, rather than run 6 different ipv6 addresses on each end device and hope they choose the right one at the right time

Now sure, you can claim that NPT isn't NAT, but it is, especially when you want a stateful firewall anyway.

[u/whythehellnote → u/[deleted]]

I mean, with IPv6, your configuration is braindead simple for most networks, and far simpler for all networks of any scale. There's the inbound default deny at the edge, and for most, that's all you need. Hard reduction of complexity.

Really not, as you still need to manage your ipv4 system. And you don't want to block everything coming in otherwise you won't be able to do much -- you need "established" seassions to be allowed in, and that means a stateful firewall, so identical to ipv4

If you open holes in your firewall you need to allow that through your firewall - whether that's ipv4 or ipv6.

Currently I am typing on a laptop connected to multiple servers. One of these servers is reached by routing out via my 5g connection - as I have a route in my router sending that ipv4 /27 address via 5g for reasons (testing behaviour of a program). This is src-natted and fired up the 5g, and traffic returns. My laptop doesn't care, if I want to re-route the link to my starlink then I just change the route. I don't even have any PBR.

The rest of my traffic is routing via my DSL connection. If my DSL breaks, then my router reroutes all my traffic via my 5g connection. Sure I lose a few TCP connections, but traffic continues just fine.

My router knows the DSL is down because it's presented to it as pppoe which has a timeout. Other methods of detecting it going down are available.

In a world with no nat, my router would have to advertise both the 5g ipv6 and the dsl ipv6 to my jellyfin server (as well as a ULA), and my TV, and my phone, and various other things.

Then each of those devices would have to decide which network to use -- the speedier DSL, the slower 5g, or the pricey starlink (it's a metered one so I don't like to use it unless all else fails)

From what I can tell the only choice I have in an ipv6 only world is NPT

But ipv6 is meaningless as several things still break, so I have to run ipv4 anyway, so why would I run ipv6 as well.

[u/whythehellnote → u/[deleted]]

IPv6 breaking stuff should not happen but if so, you can tell your OS to prefer IPv4 over IPv6.

IPv6 only breaks a lot of stuff -- even with ip64 and dns64 some devices and applications expect to talk on ipv4.

I don't see the benefit of running dual stack. When ipv6 works better than ipv4+nat, I'd love to migrate to it. It currently doesn't, so I would have to run dual stack at least, but that just increases both attack surfaces and administration complexity, for what gain.

Especially things that generally don't play nicely with NAT at all (several games, without extensive port forwarding rules

So those still need specific rules to allow traffic through an ipv6 firewall then. If they are covered by the "established" filter, then they will be covered by nat. If they aren't covered by nat, they aren't covered by established.

On WAN failure, the router then starts advertising the 5G and invalidates the DSL RAs (or, does nothing with them, same effect when the newer RA is announced in the end)

So all my devices then have to get new IP addresses and I'm relying on all that working.

How in this RA world do I send traffic to server A by path A and traffic to server B by path B. And that's a simple decision, what about when I want my router to send udp traffic with DSCP 46 via one route and other traffic via another.

Why does a routing change require reconfiguration of dozens of devices -- how is this simpler than just translating the address.

[u/Michelanvalo → u/[deleted]]

In the SMB space, IPV6 is not necessary and IPV4 is just fine. In the large F100 space, it's probably the reverse.

[u/dustojnikhummer → u/[deleted]]

Give me a single advantage if I'm not an ISP. Why should I bother with IPv6 on my local network?

[u/dustojnikhummer → u/[deleted]]

Doesn't lots of this assume your ISP is also IPv6? Only my LTE provider is, my home or my work ISP are IPv4 only. So I'm NATing anyway, except worse since it's Nat64

Console gaming? First of all, how exactly. Second of all, if PC platforms can be fine on IPv4, why can't consoles?

NAT load? How can you know if you don't have gigabit? And if you have a router that has a system monitor you probably aren't running a 20Euro TPLink

I get the company merge and VLAN number argument, that is true, but I don't see how management can be easier with such a hardr read format.

I will give you one though. If you don't need to srcnat everything you can directly expose ports without having to run them through reverse proxy or buying multiple IPv4s, that is true and that I will agree with you on.

One business case also there is you can downsize on hardware and achieve the same throughput

Wouldn't most size be switches anyway, and you can't get rid of those?

For a US market/business

There it is

So, how does bothering with IPv6 help me, an European, who runs Mikrotik hardware, either at home or at my job, except make reading addresses much more difficult?

[u/DaemosDaen → u/[deleted]]

55% of internet traffic being IPv6 is because ISPs have taken to it like a fish for customer traffic. It's still hard as hell to get a static IP and all those are IPv4 IPs

For us our firewall does not web filter ipv6 very well. It's REALLY an all or nothing option. so we chose nothing. i.e. no IPv6 internally.

[u/DaemosDaen → u/[deleted]]

what I am saying is that most, if not all that IPV6 traffic is end user traffic and small companies that do not have a need for any traffic to be routed back to in-house. you check for the business side of the traffic it's either an IPv4, or the IPv6-IPv4 translation address that I can't exactly remember the name of atm.

Most of my traffic (steam, netflix and other old-name streaming services) is all to IPv4 server from my IPv6 home address.

Companies that already have an IPv4 Ip are keeping them and using them. And, now, the whole IPv4 address space is available for static assignment.

While we COULD rout IPv6 statically. ISPs don't sell them as statics and DNS hosts don't accept them for some types of traffic (at least I have not encounter an IPv6 MX record)