INTERNET-DRAFT Fred L. Templin SRI International
12 March17 May 2001 Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) (Formerly: Connecting IPv6 Nodes within IPv4 Sites)Copyright Notice Placeholder for ISOC copyright. draft-ietf-ngtrans-isatap-00.txtdraft-ietf-ngtrans-isatap-01.txt Abstract This document specifies a methodan intra-site automatic tunneling protocol (ISATAP) for connecting IPv6 hosts and routers (nodes) within predominantly IPv4-based sites.networks. This method is based on an IPv6-IPv4 compatibilityIPv6 aggregatable global unicast address format (described herein) that embeds the IPv4 address of a node within the EUI-64 format interface identifier of an IPv6 address.identifier. This document assumes that, during the IPv4 to IPv6 co- existence and transition phase, many sites will deploy IPv6 incrementally within their IPv4 interior routing domains; especially those sites which have large and complex pre-existing IPv4 infrastructures. Within such sites, the address format and methods described in this document will enable IPv6 deployment for nodes that do not share a common multiple access datalinkdata link with an IPv6 gateway withinfor their site. While other works in progress in the NGTRANS working group propose mechanisms for assigning globally-unique IPv6 address prefixes to sites and methods for inter-domain routing between such sites, the approach outlined in this memo enables large-scale incremental deployment of IPv6 for nodes within a site's pre-existing IPv4 infrastructure without incurring aggregation scaling issues at the border gateways nor requiring site-wide deployment of special IPv4 services such as multicast. The approach proposed by this document supports IPv6 routing within both the site-local and global IPv6 routing domains as well as automatic IPv6 in IPv4 tunneling across portions of a site's IPv4 infrastructure which have no native IPv6 support. Moreover,Additionally, this approach supports automatic tunneling within sites which use non globally-unique IPv4 address assignments, such as when Network Address Translation [NAT] is used. Status of this Memo This document is an Internet-Draft and is in full conformance with all provisions of Section 10 of RFC2026. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet- Drafts. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet- Drafts as reference material or to cite them other than as "work in progress." The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html. 1. Introduction The IETF NGTRANS working group anticipates an heterogeneous IPv4/IPv6 infrastructure in the near future and thus is chartered to develop mechanisms to support IPv4/IPv6 coexistence and transition toward global IPv6 deployment. For the most part, existing NGTRANS approaches focus on inter-domain routing between IPv6 "islands"islands using the existing global IPv4 backbone as transit. But, these islands may themselves consist ofcomprise complex heterogeneous IPv4/IPv6 networks (e.g. large academic or commercial campus "intranets")intranets) that require intra- domain IPv4 to IPv6 transition mechanisms and strategies as well. In order to address this requirement, this document presents a simple and scalable approach that enables incremental intra-sitedeployment of IPv6 nodes within predominantly IPv4-based intranets. We refer to this approach as the Intra-Site Automatic Tunnel Addressing Protocol, or ISATAP (pronounced: "ice-a-tap"). The ISATAP approach outlined in this documentis based on a newan aggregatable global unicast address format that carries a standard 64-bit IPv6 address prefix [ADDR][AGGR] with a specially-constructed 64-bit EUI- 64EUI-64 Interface Identifier [EUI64]. The 64-bitThis address prefix used by thisformat is fully compatible with all existing and emerging prefix assignmentboth native IPv6 and inter-domainNGTRANS routing practices (e.g. [6to4],[6BONE]). But, the interface identifier in an ISATAP address employs a special construction using(using the IEEE Organizationally Unique Identifier (OUI) reserved by the Internet Assigned Numbers Authority [IANA] along with a "type" field to indicate[IANA]) that the identifierencapsulates an IPv4 address suitable for automatic intra-domainIPv6-in-IPv4 tunneling. As such,tun- neling. Since tunneling occurs only within the site-level prefix of the ISATAP address, the embedded IPv4 address NEED NOT be globally unique; rather, it need only be topologically correct for (and unique within) the context of thatthe site. This approach allows dual-stack nodes that do not share a common multiple accessdatalink with an IPv6 gateway to join the global IPv6 network by automatically tunneling IPv6 messages through the IPv4 routing infrastructure within thetheir site. Two methods for automatic discovery of an off-link IPv6 gateway within the sitefor ISATAP address autoconfiguration are provided. This approach allows large-scale intra-site deployment without incur- ringincurring aggregation scaling issues at the border gateways, since only a single IPv6 address prefix is used for the entire site. Finally, this approach supports intranets which use non-globally unique IPv4 addresses, such as when private address allocations [PRIVATE] and/or Network Address Translation [NAT] are used; even when multiple levels of NAT occur withinused. 2. Changes Major changes from version -00 to version -01: - Revised draft to require *different* /64 prefixs for ISATAP addresses and native IPv6 addresses. Thus, a given site. Innode's ISATAP interface is assigned a /64 prefix that is distinct from the following sections, we present our proposed IPv6-IPv4 compati- bility address format in detail. We further discuss technical con- siderations forprefixes assigned to any other interfaces attached to the applicationnode - be they physical or logical interfaces. This approach eliminates ISATAP-specific sending rules presented in earlier draft versions. - Changed sense of IPv6-IPv4 compatibility addresses'u/l' bit in the ISATAP address interface identifier to facilitate incremental deployment of IPv6indicate "local scope", since ISATAP interface identifiers are unique only within predominantly IPv4-based Intranets. 2. Changesthe scope of the ISATAP prefix. (See section 4.) Major changes from version 01personal draft to NGTRANS WG version 02:-00: - Title change to provide higher-level description of field of use addressed by this draft. Removed other extraneous text. - Major new section on automatic discovery of off-link IPv6 routers when IPv6-IPv4 compatibility addresses are used. 3. IPv6-IPv4 Compatibility Address Format In sections 3.1 and 3.2, we will motivate our proposed extensionsTerminology The terminology of [IPv6] applies to this document. Additionally, the existing IEEE OUIfollowing terms are used extensively throughout this document: ISATAP prefix: Any globally aggregatable 64-bit IPv6 routing prefix (whether from a native IPv6 assigned numbers authority or from a special-purpose numbering scheme such as [6BONE][6TO4]) reserved by IANAa local network administrator specifically for ISATAP purposes. ISATAP prefixes are used to configure ISATAP addresses ONLY; native IPv6 addresses SHOULD NOT be configured using an ISATAP prefix. ISATAP address: An IPv6 address with an ISATAP prefix and having an IPv4 address embedded in the interface identifier in the manner described in section 4 below. ISATAP pseudo-interface: ISATAP encapsulation of IPv6 packets inside IPv4 packets occurs at a point that is logically equivalent to an IPv6 interface, with the link layer being the IPv4 unicast network. This point is referred to as a pseudo-interface. An ISATAP pseudo-interface is assigned an ISATAP address through address autoconfiguration. ISATAP router: An IPv6 router supporting an ISATAP pseudo-interface. It is normally an interior router within an heterogeneous IPv6/IPv4 network. ISATAP host: An IPv6 host which has an ISATAP pseudo-interface. 4. ISATAP Address Format In sections 4.1 and 4.2, we will motivate our proposed extensions of the existing IEEE OUI reserved by IANA to support IEEE EUI-64 format addresses. While these proposed extensions are necessary tointended support our IPv6-IPv4 compatibilitythe ISATAP address format, they also provide a flex- ibleflexible framework for future IANA use. Therefore, we believethe exten- sionsextensions proposed in sections 3.14.1 and 3.24.2 may provide beneficial future use to theIANA beyond the scope of IPv6-IPv4 compatibilityISATAP addresses. We present our IPv6-IPv4 compatibilitythe ISATAP address format pro- posalitself in sections 3.3sec- tions 4.3 and 3.4 and conclude this section with some notes on deployment considerations. 188.8.131.52. 4.1. IEEE EUI-64 Interface Identifiers in IPv6 Addresses IPv6 aggregatable global and local-use unicast addresses [ADDR] include a 64-bit interface identifier in IEEE EUI-64 format [EUI64], which is specified as the concatenation of a 24-bit company_id value (also known as the OUI) assigned by the IEEE Registration Authority (IEEE/RAC) and a 40-bit extension identifier assigned by the organi- zation owningaddress- ing authority for that OUI. (Normally, the addressing authority is the organization to which the IEEE EUI-64has allocated the OUI). IEEE EUI- 64 interface identifiers are for- mattedformatted as follows: |0 1|1 3|3 4|4 6| |0 5|6 1|2 7|8 3| +----------------+----------------+----------------+----------------+ |ccccccugcccccccc|ccccccccmmmmmmmm|mmmmmmmmmmmmmmmm|mmmmmmmmmmmmmmmm| +----------------+----------------+----------------+----------------+ Where 'c' are the company-specific bits of the OUI, 'u' is the universal/local bit, 'g' is the individual/group bit and 'm' are the extension identifier bits. (NOTE: [ADDR] specifies that the 'u' bit is inverted from its normal sense in the IEEE context; therefore u=1 indicates global scope and u=0 indicates local scope). In order to support encapsulation of legacy IEEE EUI-48 (24-bit) extension identifier values, [EUI64] specifies that the first two octets of the EUI-64 40-bit extension identifier (bits 24 through 39 of the EUI-64 address itself) SHALL BE 0xFFFE if the extension iden- tifier encapsulates an EUI-48 value. [EUI64] further specifies that the first two octets of the extension identifier SHALL NOT be 0xFFFF, assince this value is reserved by the IEEE/RAC. However, all other 40-bit40- bit extension identifier values are available for assignment by the OUI addressing authority responsible for a given OUI. 3.2.authority. 4.2. An EUI-64 Interface Identifier Format for IANA The IANA owns IEEE OUI: 0x00005E (also written as: 00-00-5E),00-00-5E, and [IANA] specifies EUI-48 format (24-bit) interface identifier assign- mentsassignments within that OUI. But, [IANA] does not specify how these legacy EUI-48 assignments will be written in EUI-64 format, nor does it specify a format for future 40-bit extension identifier assignments. We propose the following format for EUI-64 addresses within IANA's OUI reservation: |0 2|2 3|3 3|4 6| |0 3|4 1|2 9|0 3| +------------------------+--------+--------+------------------------+ | OUI ("00-00-5E"+u+g) | TYPE | TSE | TSD | +------------------------+--------+--------+------------------------+ Where the fields are: OUI IANA's OUI: 00-00-5E with 'u' and 'g' bits (3 octets) TYPE Type field; indicates how (TSE, TSD) are interpreted (1 octet) TSE Type-Specific Extension (1 octet) TSD Type-Specific Data (3 octets) And the following interpretations are defined based on TYPE: TYPE (TSE, TSD) Interpretation ---- ------------------------- 0x00-0xFD RESERVED for future IANA use 0xFE (TSE, TSD) together contain an embedded IPv4 address 0xFF TSD is interpreted based on TSE as follows: TSE TSD Interpretation --- ------------------ 0x00-0xFD RESERVED for future IANA use 0xFE TSD contains 24-bit EUI-48 intf identif- ierid 0xFF RESERVED by IEEE/RAC Essentially, if TYPE=0xFE, TSE is treated as an extension of TSD. If TYPE=0xFF, TSE is treated as an extension of TYPE. Other values for TYPE (and hence, other interpretations of TSE, TSD) are reserved for future IANA use. This format conforms to all requirements specified in [EUI64] and supports encapsulation of EUI-48 interface identifiers in the manner described by that document. For example, an existing IANA EUI-48 format multicast address such as: 01-00-5E-01-02-03 would be written in the IANA EUI-64 format as: 01-00-5E-FF-FE-01-02-03 But, this proposed format also provides a special TYPE (0xFE) for embedding IPv4 addresses within the IANA 40-bit extension identifier. This special TYPE forms the basis for our IPv6-IPv4 compatibility aggregatable global unicastthe ISATAP address format proposalas described in the following sections. 3.3. IPv6-IPv4 Compatibility4.3. ISATAP Address Construction Using the proposed IANA-specific method for interface identifier con- struction discussed in sections 3.14.1 and 3.24.2 (with TYPE=0xFE), and with reference to [ADDR], we can construct IPv6-IPv4 compatibility aggregatable global unicast addresses. Using this methodology, we proposean IPv6 address format with embedded IPv4ISATAP address in the EUI-64 interface identifier. The following diagram shows the con- struction:as fol- lows: | 3| 13 | 8 | 24 | 16 | 8 | 8 | 8 | 8 | 32 bits | +--+-----+---+--------+--------+---+---+---+---+---+---+---+----+ |FP| TLA |RES| NLA | SLA | 0x| 0x| 0x| 0x| IPv4 Address | | | ID | | ID | ID | 02|00| 00| 5E| FE| of Endpoint | +--+-----+---+--------+--------+--------------------------------+ (NOTE: since ISATAP address interface identifiers are interpreted only within the local scope of the /64 ISATAP prefix, we set the u/l bit in the least significant octet of the OUI in the interface iden- tifier is 0x02 instead of 0x00 since u=1 for globalto '0' to indicate local scope.) By way of example, an existing node with IPv4 address 184.108.40.206 might be assigned an IPv6 64-bit prefix of 3FFE:1a05:510:200::/64. We can then construct an IPv6-IPv4 compatibility aggregatable global unicastISATAP address for this node as: 3FFE:1a05:510:200:0200:5EFE:8CAD:81083FFE:1a05:510:200:0:5EFE:8CAD:8108 or (perhaps more appropriately) written as the alternative form for an IPv6 address with embedded IPv4 address found in [ADDR]: 3FFE:1a05:510:200:0200:5EFE:220.127.116.11FFE:1a05:510:200:0:5EFE:18.104.22.168 Similarly, we can construct the link-local and site-local variants (respectively) of the IPv6-IPv4 compatibilityISATAP address as: FE80::0200:5EFE:22.214.171.124 FEC0::200:0200:5EFE:126.96.36.199 3.4.FE80::0:5EFE:188.8.131.52 FEC0::200:0:5EFE:184.108.40.206 4.4. Advantages By embedding an IPv4 address in the interface identifier portion of an IPv6 address as described in section 3.3,4.3, we can construct aggre- gatable global unicast IPv6 addresses that can either be routed globallyglo- bally via the IPv6 infrastructure or automatically tunneled locally across portions of a site's IPv4 infrastructure which have no native IPv6 routingsupport. Thus the addressing scheme supports heterogeneous IPv6/IPv4 infrastructures in transition with incremen- tal deployment of IPv6 at the site level.Additionally, a node with suchan IPv6-IPv4 compatibilityISATAP address could act as a gateway for nodes with native IPv6 addresses connected to the samewith which it shares a common physical link, since itthe ISATAP node could automaticallyautomati- cally tunnel messages across a site's IPv4 domain to reach a border IPv6 gateway for the siteon behalf of suchthe native IPv6 nodes. An example would be deployment of IPv6 on some subset of the hosts attached to a workgroup's EthernetLAN. In this case, one host would receivecould configure an IPv6-IPv4 compatibilityISATAP address and act as a gateway for theother hosts on the LAN which receiveuse native IPv6 addresses. An additional advantage for our proposed method of embedding an IPv4 address in the interface identifier portion of an IPv6 address not found in other approaches such as [6TO4] is that large numbers of IPv6-IPv4 compatibilityISATAP addresses could be assigned within a common IPv6 routing prefix,pre- fix, thus providing maximal aggregation at the border gateways. For example, the single 64-bit IPv6 prefix: 3FFE:1a05:510:2412::/64 could include literally millions of nodes with IPv6-IPv4 compatibil- ityISATAP addresses. This feature would allow a "sparse mode" IPv6 deploy- mentdeployment such as the deployment of sparse populations of IPv6 hosts on large numbers of independent links throughout a large corporate Intranet. A final important advantage is that this method supports both sites that use globally unique IPv4 address assignments and those that use non-globally unique IPv4 addresses, such as when private address assignments and/or Network Address Translation are used. By way of analogy to the US Postal system, inter-domain transition approaches such as [6TO4] provide means for routing messages "cross-country" to the "street address" of a distant site while the approach outlined in this document provides localized routing information to reach a specific (mailstop, apartment number, post office box, etc) WITHIN that site. Thus, the site-level routing information need not have relevance outside the scope of that site. 3.5.5. ISATAP Deployment Considerations IPv6-IPv4 compatibilityISATAP addresses should only be used by nodes which do not share a common multiple accessdatalink with ana native IPv6 router. At least one ISATAP router for their site. But, there are numerous cases in which such "iso- lated" nodes may occur within an heterogeneous IPv6/IPv4 Intranet. Two such examples are: - A researcher wishes to run IPv6 on his existing IPv4-based works- tation. One or more IPv6 routers aremust be configured within the researchers site, but the network administrators have not yet con- figuredsite which advertises an IPv6 router for the LAN that connects the researcher's workstation. - A network administrator within a large corporate network wishesadministratively- assigned ISATAP prefix in response to configure IPv6 on the existing IPv4 subnets under their jurisd- iction, but these subnets are separatedan Rtsol mes- sage from an off-link host. Such off-link hosts will configure an ISATAP pseudo-interface and assign it an address using the IPv6 border gate- way for the corporation by other IPv4 subnets which are not ready for IPv6 deployment. In both examples, intra-site IPv6-in-IPv4 tunneling can be used to span the "gaps"ISATAP prefix it receives in IPv6 coverage. The IPv6-IPv4 compatibilityan Rtadv message solicited from an ISATAP router. Following ISATAP address format described in the previous subsections provides a means for isolated nodes toconfiguration, ISATAP hosts automatically and transparently communicate the IPv4 address of their *own* end of the ISATAP tunnel to an off-link IPv6 gateway.any ISATAP host or router which uses the same ISATAP prefix. While suchnodes may optionally use stateful configuration to set an ISATAP prefix and a "default" route that points to the off-link gateway,an ISA- TAP router, a greatly preferred alternative is to provide for automatic intra-site IPv6 router discovery and stateless address autoconfiguration [DIS- CUSS].[DISCUSS]. The following section presents a means for the automatic discovery of off-link IPv6ISATAP routers. 4.5.1. Automatic Discovery of Off-link IPv6ISATAP Routers As described in [AUTO], a node that does not share a common multiple access datalink with an IPv6 router will NOT receive unsolicited Router Advertisements (Rtadv's), nor will Router Solicitations (Rtsol's) from that node reach an IPv6 router on the local link. But, the node may still be able to connect to the global IPv6 Internet if an ISATAP router for the site exists. Hence, a means for off-link IPv6ISATAP router discovery is required. We present the following procedure for a node to initiate off-link IPv6ISATAP router discovery (and for an off-link IPv6ISATAP router to respond) when IPv6-IPv4 compatibility addresses are used:an on-link IPv6 router is not available: - The node constructs an IPv6-IPv4 compatibilityISATAP link local address for itself (as described in section 3.)4.) as: FE80::0200:5EFE:V4ADDR_NODEFE80::0:5EFE:V4ADDR_NODE - The node discovers the IPv4 address for an off-link IPv6ISATAP router as: V4ADDR_RTR (**) - The node sends an Rtsol to the IPv6 "all-routers-multicast" address tunneled through the IPv4 infrastructure to the off-link IPv6ISATAP router's IPv4 address. The addresses used in the IPv6 and IPv4 headers are: ipv6_src: FE80::0200:5EFE:V4ADDR_NODEFE80::0:5EFE:V4ADDR_NODE ipv6_dst: FF02::2 ipv4_src: V4ADDR_NODE ipv4_dst: V4ADDR_RTR - Upon receiving the tunneled Rtsol, the off-link IPv6ISATAP router sends a unicast Rtadv to the unicast address of the node which sent the Rtsol; again, by tunneling the Rtadv through IPv4. The addresses used in the IPv6 and IPv4 headers are: ipv6_src: FE80::0200:5EFE:V4ADDR_RTRFE80::0:5EFE:V4ADDR_RTR ipv6_dst: FE80::0200:5EFE:V4ADDR_NODEFE80::0:5EFE:V4ADDR_NODE ipv4_src: V4ADDR_RTR ipv4_dst: V4ADDR_NODE - Upon receiving the Rtsol, the originating node performs address autoconfiguration as described in [AUTO] and constructs: - a fully-qualified IPv6-IPv4 compatibilityISATAP address for use as the source address for IPv6 packetsan ISATAP pseudo-interface - a default route that points to the off-link IPv6 router's IPv6-IPv4 compatibility link-local addressISATAP router Note (**) that the above procedure assumes a means for discovering V4ADDR_RTR. We present two alternative methods for the automatic discovery of V4ADDR_RTR: 220.127.116.11. DNS Well-Known Service Name The first method for discovering V4ADDR_RTR employs a new DNS Well- Known Service (WKS) name [DNS1,DNS2]. With the establishment of a new well-known service name (e.g. "V6V4GW"),"ISATAPGW"), administrators could publishpub- lish the IPv4 address of a gateway which implementations could use to discover V4ADDR_RTR. This method has the advantage that it can be deployed immediately using existing mechanisms. However, it requires name service lookups and may not always provide the optimum V4ADDR_RTR resolution for isolated hosts which use IPv6-IPv4 compati- bility addresses. 4.2.if multiple ISATAP routers are available. 5.3. IPv4 Anycast for Intra-domain IPv6 routerISATAP routers [6TO4ANY] proposes an IPv4 anycast prefix for 6to4 relay routers. The proposal suggests an IPv4 prefix assignment 'x.x.x.0/nn' ('nn' is currently proposed as 16) where the single address 'x.x.x.1' is assigned as the "6to4 IPv6 relay anycast address". We propose analo- gous assignments for the purpose of an "IPv6-IPv4 compatibility"ISATAP router anycast address". (Whether the reservation of a second /32 assignment from the 6to4 IPv4 anycast prefix proposed in [6TO4ANY] would be possible, or a separate prefix assignment would be required is a matter of debate and TBD.) Any IPv6 router capable of providing an IPv6-IPv4 compatibility address-based tunnel endpoint as described in the previous sectionsISATAP routers would advertise the IPv6-IPv4 compatibilityISATAP router anycast prefix via the intra-domain IPv4 routing infrastructure. Isolated IPv6 nodes would then use the IPv6-IPv4 compatibilityISATAP router anycast address as the V4ADDR_RTR IPv4 destination for off-link Rtsol's. This approach has the significantsignifi- cant advantages that: - implementations could hard-code the well-known V6V4CompatISATAP anycast address, thus avoiding service discovery via DNS - an optimum path to an off-link IPv6ISATAP router would be ensured by intra-domain IPv4 routing As described above, the IPv4 anycast method for locating intra-domainISATAP routers that support IPv6-IPv4 compatibility address-based tunnelingprovides significant functional advantages over the DNS approach, while the DNS approach can be implemented immediately pendingpend- ing the registration of a WKS name with IANA. While either method will work, the decision of which to push for standardization is TBD pending dis- cussiondiscussion at upcoming NGTRANS WG meetings. 5.6. Sending Rules and Routing Considerations The sending rule for a host or router that sends an IPv6 packet toSince each node will be assigned an IPv6-IPv4 compatibility destination address is simple and direct: "If the 64-bit IPv6 prefix of the IPv6-IPv4 compatibility destination address matches the 64-bit IPv6ISATAP prefix of one of my network interfaces, tunnel the packet through IPv4 - else, route the packet through IPv6." From the above rule, a sender that does NOT have an interfacewhich shares a common 64-bit routing prefix with the packet's IPv6-IPv4 compatibility destination address simply sends the packet to the next-hop gateway determinedis adminis- tratively reserved for use ONLY by an ordinary IPv6 routing table lookup. In short, when aISATAP nodes, no special sending node does not have an interface which sharesrules are needed. In particular, correspondent nodes that share a common 64-bit (site-level) routingISATAP prefix with an IPv6-IPv4 compa- tibility destination address, the sending rule is identical towill always exchange messages using their ISATAP pseudo-interfaces, whereas nodes that for a native IPv6 destination address. This decision is independent of whether the sender has an IPv6-IPv4 compatibility address itself, or whether the sender even comprises a dual-stack configuration. Indeed, the sender can simply bedo not share a nativecommon ISATAP prefix will always exchange messages via standard IPv6 node with no legacy IPv4 support.routing. When sending a sender hasmessage on an interface which shares a common 64-bit routing prefix withISATAP pseudo-interface, an IPv6-IPv4 compatibility destination address, however, the sender must assumeimplementation SHOULD verify that the IPv6 destination is NOT directly reachable at the datalink level - even thoughaddress employs the shared site-level routing prefix implies otherwise. Instead, if the sender comprises a dual- stack configuration, it should automatically tunnel the IPv6 packet (via IPv6-in-IPv4 tunneling as described in [MECH]) to the IPv4 address embedded within the IPv6-IPv4 compatibility destination address' interface identifier. If the sender is an IPv6-only node that DOES NOT comprise a dual-stack configuration, however, it has no means for automatically tunneling the packet via IPv4. In this case: - If the sender is the host that originates the packet, it should send the packet to a router that lists the 64-bit prefix in its router advertisements. If no such router exists, the sender should drop the packet and return a "No route to host" error indication to the originating application. - If the sender is a router that forwards the packet, it should drop the packet and send an ICMPv6 "Destination Unreachable" message to the source By implication, the scheme breaks down if a packet with an IPv6-IPv4 compatibility destinationISATAP address reaches an IPv6-only router that has an interface which shares a common 64-bit routing prefix with the destination address. Additional mechanisms to address this issue might be possible, such as allowing dual-stack routers to advertise 96-bit prefixes which incorporate the special 32-bit EUI-64 interface identifier prefix: 0200:5EFE. A sender could then interpret such an advertisement to mean that the advertising router comprises a dual stack and is capable of intra-site IPv6-in-IPv4 tunneling. But a reasonable argument could be made to the effect that: "By the time IPv6-only routers begin to proliferate throughout a site, nodes within the site should no longer be using IPv6-IPv4 compatibility addresses." In fact, the advent of IPv6-only routers within a site would serve as a strong indication that the site is no longer a predominantly IPv4- based infrastructure in transition, but rather that the transition is either complete or nearly complete. Therefore, IPv6-IPv4 compatibil- ity addresses should no longer be used. 6. Address Selection Other works in progress ([6TO4] and [SELECT]) have begun to explore the subject of address selection when multiple IPv6 destination address alternatives are available. These address selection policies deal with the 64-bit IPv6 routing prefix and thus can be applied independently of whether/not the destination address alternatives are constructed asconstruction rules described in this document. However,section 4 in order to ensure efficient routing within the destination's site, we propose the following simple "second-tier" address selection policy for deal- ing with IPv6-IPv4 compatibility addresses: "If multiple alternatives remain afterdetect mis-configured addresses. No other sending rules are necessary. 7. Address Selection No special address selection has been applied on the 64-bit routing prefixes, and if at least one of the remaining alternatives is constructed with a native IPv6 interface identifier (one that does NOT contain an embedded IPv4 address as described in this document), select a native IPv6 address. Other- wise, select an IPv6-IPv4 compatible address." This policy decision is in keeping with the concept that NGTRANS transition mechanisms should remain in place ONLY as long as needed and should be disabled as soon as native IPv6 mechanisms become available. 7.rules are necessary. 8. Automatic Deprecation IPv6-IPv4 compatibilityISATAP addresses constructed in the manner described in this documentare intended for use only by nodes which do not receive router advertisementsnative IPv6 Rtadv's due to not sharing a common multiple accessdatalink with an IPv6 router. When router advertisementsnative IPv6 Rtadv's become available (such as when an IPv6 router is deployed on a common multiple access datalink shared by the node),node's datalink), the node should discon- tinue use of its IPv6-IPv4 compatibility address and adoptconstruct a normalnon-ISATAP aggregatable global IPv4IPv6 unicast address using address auto- configurationauto-configuration [AUTO] for a non-ISATAP IPv6 prefix discovered through normal means [DISC]. After the node's native IPv6 address is populated in the DNS, the node should eventu- ally cease sending Rtsol's to the ISATAP router discovery [DISC] means.and discontinue use of its ISATAP pseudo-interface. In this way, IPv6-IPv4 compatibilityISATAP addresses will gradually (and automatically) disappear as IPv6 routers becomeare widely deployed within a site. 8.sites. 9. Multicast Considerations Other works in progress [6TO4MULTI] are currently investigating IPv4-mappedmul- ticast addressing issues.issues for [6TO4]. The address format discussed in this docu- mentdocument is expected to be compatible with those emerging approaches. 9. Relation to other works in progress The IPv6-IPv4 compatibility address format and routing policy deci- sions presented in this draft evolved from SRI contractual works out- side the scope of the NGTRANS working group. Additionally, the mechanisms presented in this draft were developed by the author with no prior knowledge of the activities in NGTRANS. The author recog- nizes that other works in progress seek to address very similar IPv4-IPv6 transition issues as those targeted by this draft. However, the approach described in this draft presents a number of unique advantages for NGTRANS that supplement the other works in progress. (Most specifically, advantages for incremental deployment of IPv6 nodes at the intra-domain level.)10. IANA considerations In order to support the EUI-64 address form described in this docu- ment, we propose that IANA adopt the EUI-64 Interface Identifier for- mat specified in section 3.24.2 for the existing 00-00-5E OUI owned by IANA. No other actions are required by the IANA. 11. Security considerations The IPv6-IPv4 compatibilityISATAP address format does not support privacy extensions for stateless address autoconfiguration [PRIVACY]. How- ever,However, such privacy extensions are intended primarily to avoid reveal- ingrevealing one's MAC address, and the IPv6-IPv4 compatibilityISATAP address format described in this document accomplishes this same goal. Additional security issues are called out in [6TO4] and probably apply here as well. 12. Implementation status The author has implemented the mechanisms described in this draft through modifications to the FreeBSD 3.2-RELEASE [FBSD] operating system with the INRIA [INRIA] IPv6 distribution. These modifications implement the sending rules and routing considerations as described in section 5. The source codeA Linux implementa- tion is not yet readyplanned for public distribu- tion, butthe author would be happy to discuss details with interested parties.June, 2001 timeframe. Additionally, Windows XP RC1 will implement elements of the mechanism proposed in this paper. Acknowledgements The original ideas presented in this draft were derived from SRI contractualcon- tractual work. The author recognizes that ideas similar to those in this document may have already been presented by others and wishes to ack- nowledgeacknowledge any other such authors. The author also wishes to ack- nowledge the government contract administrators who sponsored the projects from which these works derived as well as his SRI colleagues with whom he has discussed and reviewed this work, including Monica Farah-Stapleton, Dr. Mike Frankel, J. Peter Marcotullio, Lou Rodriguez,Rodri- guez, and Dr. Ambatipudi Sas- try.Sastry. The author acknowledges discussions with Alain Durand and Keith Moore duringvaluable input from numerous members of the IETF 48 conference in Pittsburgh, PA.NGTRANS community which has helped motivate ideas on restructuring this documentguide the direction of the draft. The list of contributors is too long to enumerate, but the input from the first version.community has been vital to the draft's evolution. Alain Durand deserves special mention for contributing the title of this draft and the ISATAP acronym. The author furtherfinally wishes to provide special acknowledgement to Dave Thaler, Art Shelest, Richard Draves, and their colleaguesothers at Microsoft Research for their ideas on automatic discovery of off-link IPv6 routers. Much of the text in thatsection on deployment considerations derives directly from discussions with Dave, ArtArt, Rich and others. References [AGGR] Hinden., R, O'Dell, M., and Deering, S., "An IPv6 Aggregatable Global Unicast Address Format", RFC 2374, July 1998. [ADDR] Hinden, R., and S. Deering, "IP Version 6 Addressing Architecture", RFC 2373, July 1998. [AUTO] Thomson, S., and T. Narten, "IPv6 Stateless Address Autoconfiguration", RFC 2462, December 1998. [DISC] Narten, T., Nordmark, E., and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998. [DNS1] Mockapetris, P. "Domain names - concepts and facilities", STD 13, RFC 1034, November 1987. [DNS2] Mockapetris, P. "Domain names - Implementation and Specif- ication", STD 13, RFC 1035, November 1987. [DNSSRV] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for specifying the location of services (DNS SRV)", RFC 2782, February 2000. [EUI64] IEEE, "Guidelines for 64-bit Global Identifier (EUI-64) Registration Authority", http://standards.ieee.org/regauth/oui/tutorials/EUI64.html, March 1997 [IANA] Reynolds, J., and J. Postel, "Assigned Numbers", STD 2, USC/Information Sciences Institute, October 1994. [IPV4] Postel, J., "Internet Protocol", RFC 791 [IPV6] Deering, S., and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460 [6TO4] Carpenter, B., and K. Moore, "Connection of IPv6 Domains via IPv4 Clouds", RFC 3056, February 2001. [6TO4ANY] Huitema, C., "An anycast prefix for 6to4 relay routers", draft-ietf-ngtrans-6to4anycsat-02.txt (work in progress) [6TO4MULTI] Thaler, D., "Support for Multicsat over 6to4 Networks", draft-ietf-ngtrans-6to4-multicast-00.txt (work in pro- gress) [MECH] Gilligan, R., and E. Nordmark, "Transition Mechanisms for IPv6 Hosts and Routers", RFC 2893, August 2000. [SELECT] Draves, R., Default Address Selection for IPv6, draft- ietf- ipngwg-default-addr-select-00.txt (work in progress) [FBSD] http://www.freebsd.org [INRIA] ftp://ftp.inria.fr/network/ipv6/ [6BONE] Rockell, R., and R. Fink, RFC 2772, February 2000. [PRIVATE] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G. J., and E. Lear, "Address Allocation for Private Internets", RFC 1918, February 1996. [PRIVACY] Narten, T., R. Draves, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", RFC 3041, January 2001. [NAT] Egevang, K., and P. Francis, "The IP Network Address Translator (NAT)", RFC 1631, May 1994. [DISCUSS] private discussions with Dave Thaler, Art Shelest, et al. Authors Addresses Fred L. Templin SRI International 333 Ravenswood Ave. Menlo Park, CA 94025, USA Email: email@example.com Intellectual Property PLACEHOLDER for full IETF IPR Statement if needed. Full Copyright Statement PLACEHOLDER for full ISOC copyright Statement if needed.