Background and Motivation

• Need to move contents for keeping the history and the contacting point
• Very old hardware
• Purached in 1999?
• 34GB SCSI HDD x5

	  % df -g
	  Filesystem  1G-blocks Used Avail Capacity  Mounted on
	  /dev/da0s1a         0    0     0    61%    /
	  /dev/da0s1f        31    7    22    24%    /usr
	  /dev/da1s1e        33    7    23    24%    /export1
	  /dev/da2s1e        33   14    16    47%    /export2
	  /dev/da3s1e        33    5    24    19%    /home
	  /dev/da5s1e        32   24     5    81%    /snap-old
	

• Make maintainance costs minimum as much as possible
• Release from hardware maintainance
• Give it someone but me in other words :-P

HDD image migration

Two options

1. Copy HDD raw image
• dd if=/dev/daX | ssh somewhere cat > hddimageX.img
• Simplest way but;
• Five disk must be mounted on single VM on wcc.wide but it does not support more than one disk currently
• Need knowledge about HDD image format on wcc.wide
• VHD, VMDK, qcow or ...?
• Need to convert the image
2. Clean install latest OS and rsync data
• OS (FreeBSD) can be upgraded to the latest version (6.4 -> 8.1)
• FreeBSD 6.4 will be End of Life in 30/Nov/2010

I choose the second option

Renumbering

• IPv4 renumbering is so hard because;
• www.kame.net is the primary DNS server of kame.net and seven secondary DNS server of other domains
• Need to ask for NIC to change the address
• Decided to keep the IPv4 address
• Announce the /32 host route of the server in WIDE backbone
• The IPv6 address can be renumberd easily
• Nothing depends on it fortunately (?)

Network

• Use Shima-san's map646
• http://github.com/keiichishima/map646
• All of IPv4 inbound connections are mapped to IPv6 connections
• 2001:200:d00:100::/64
• NAPT is used for outbound connections

Dancing KAME

• All of HTTP connections are IPv6 anymore
• Change perl scripts to check if a prefix match with the translated prefix
• Before:

	    if ($ENV{'REMOTE_ADDR'} =~ /:/) {
            $v6p = 'yes';
	    }
          

• After:

	    if ($ENV{'REMOTE_ADDR'} !~ /2001:200:d00:100::/) {
            $v6p = 'yes';
	    }
          

Issues

• IPv4 only apps does not work
• Rewrite the code to support IPv6 before the migration
• IPv4 access list does not work
• SSH bruteforceblocker (ports/security/bruteforceblocker) can share IPv4 list of attackers with other servers but it does not work
• Rewrite the code to convert the list
• Different global IPv4 is used depending on inboud and outboud connection
• NAPT box's IPv4 address is used for a outbound connection even though www.kame.net has global IPv4 address
• Primary DNS servers need to change the ACL of zone trasfer when www.kame.net is secondary DNS server of the zone
• Scalability
• Is /32 announcement correct way?
• map646 is designed as stateless
• Can be scale out (no ftp conversion of corse)
• No FTP conversion, however

Results

• There was no serious problem during the migration
• All of the service did not stop during the renumbering
• Seems quite stable
• vm2.fujisawa goes down once but vm3.nezu could migrate the VM immeadiately
• Thanks, Sekiya-san
• We can trust VM storage more than local HDD, can't we?