draft-ietf-ngtrans-isatap-03.txt   draft-ietf-ngtrans-isatap-04.txt 
NGTRANS Working Group F. Templin NGTRANS Working Group F. Templin
INTERNET-DRAFT SRI International INTERNET-DRAFT SRI International
T. Gleeson T. Gleeson
Cisco Systems K.K. Cisco Systems K.K.
M. Talwar M. Talwar
D. Thaler D. Thaler
Microsoft Corporation Microsoft Corporation
Expires 30 July 2002 30 January 2002 Expires 18 October 2002 18 April 2002
Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)
draft-ietf-ngtrans-isatap-03.txt draft-ietf-ngtrans-isatap-04.txt
Abstract
This document specifies the Intra-Site Automatic Tunnel Addressing
Protocol (ISATAP) that connects IPv6 hosts and routers (nodes) within
IPv4 sites. ISATAP is a transition mechanism that enables incremental
deployment of IPv6 by treating the site's IPv4 infrastructure as a
Non-Broadcast Multiple Access (NBMA) link layer. ISATAP mechanisms
use a new IPv6 interface identifier format that embeds an IPv4
address - this enables automatic IPv6-in-IPv4 tunneling within a
site, whether the site uses globally assigned or private IPv4
addresses. The new interface identifier format can be used with both
local and global unicast IPv6 prefixes - this enables IPv6 routing
both locally and globally. ISATAP mechanisms introduce no impact on
routing table size and require no special IPv4 services (e.g., IPv4
multicast).
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with all
all provisions of Section 10 of RFC2026. provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering Task
Task Force (IETF), its areas, and its working groups. Note that Force (IETF), its areas, and its working groups. Note that other groups
other groups may also distribute working documents as Internet- may also distribute working documents as Internet- Drafts.
Drafts.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet- Drafts as reference time. It is inappropriate to use Internet- Drafts as reference material
material or to cite them other than as "work in progress." or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
Copyright Notice Abstract
Copyright (C) The Internet Society (2001). All Rights Reserved. This document specifies the Intra-Site Automatic Tunnel Addressing
Protocol (ISATAP) that connects IPv6 hosts and routers (nodes) within
IPv4 sites. ISATAP is a transition mechanism that enables incremental
deployment of IPv6 by treating the site's IPv4 infrastructure as a
Non-Broadcast Multiple Access (NBMA) link layer for IPv6. ISATAP
mechanisms use an IPv6 interface identifier format that embeds an
IPv4 address - this enables automatic IPv6-in-IPv4 tunneling within a
site, whether the site uses globally assigned or private IPv4
addresses. The new interface identifier format can be used with both
local and global unicast IPv6 prefixes - this enables IPv6 routing
both locally and globally. ISATAP mechanisms introduce no impact on
routing table size and require no special IPv4 services (e.g., IPv4
multicast).
1. Introduction 1. Introduction
This document presents a simple, scalable approach that enables This document presents a simple, scalable approach that enables
incremental deployment of IPv6 within IPv4-based sites in a manner incremental deployment of IPv6 within IPv4-based sites in a manner
that is compatible with inter-domain transition mechanisms, e.g., that is compatible with inter-domain transition mechanisms, e.g.,
[6TO4]. We refer to this approach as the Intra-Site Automatic Tunnel [6TO4]. We refer to this approach as the Intra-Site Automatic Tunnel
Addressing Protocol, or ISATAP (pronounced: "ice-a-tap"). ISATAP Addressing Protocol, or ISATAP (pronounced: "ice-a-tap"). ISATAP
allows dual-stack nodes that do not share a common link with an IPv6 allows dual-stack nodes that do not share a common link with an IPv6
router to automatically tunnel packets to the IPv6 next-hop address router to automatically tunnel packets to the IPv6 next-hop address
skipping to change at page 4, line 6 skipping to change at page 3, line 47
packets not explicitly addressed to itself. packets not explicitly addressed to itself.
ISATAP host: ISATAP host:
any node that has an ISATAP interface and is not an ISATAP router. any node that has an ISATAP interface and is not an ISATAP router.
4. Transmission of IPv6 Packets on ISATAP Links 4. Transmission of IPv6 Packets on ISATAP Links
ISATAP links transmit IPv6 packets via automatic tunneling using the ISATAP links transmit IPv6 packets via automatic tunneling using the
site's IPv4 infrastructure as an NBMA link layer. Automatic tunneling site's IPv4 infrastructure as an NBMA link layer. Automatic tunneling
for ISATAP uses the same mechanisms specified in [MECH,3.1-3.6], for ISATAP uses the same mechanisms specified in [MECH,3.1-3.6],
i.e., IPv6 packets are automatically encapsulated in IPv4 using 'ip- i.e., IPv6 packets are automatically encapsulated in IPv4 using
protocol-41' as the payload type number. Specific considerations for 'ip-protocol-41' as the payload type number. Specific considerations
ISATAP links are given below: for ISATAP links are given below:
4.1. ISATAP Interface Identifier Construction 4.1. ISATAP Interface Identifier Construction
IPv6 unicast addresses [ADDR][AGGR] include a 64-bit interface iden- IPv6 unicast addresses [ADDR][AGGR] include a 64-bit interface
tifier field in "modified EUI-64 format", based on the IEEE EUI-64 identifier field in "modified EUI-64 format", based on the IEEE
[EUI64] specification. (Modified EUI-64 format inverts the sense of EUI-64 [EUI64] specification. (Modified EUI-64 format inverts the
the 'u/l' bit from its specification in [EUI64], i.e., 'u/l' = 0 sense of the 'u/l' bit from its specification in [EUI64], i.e.,
indicates local-use.) ISATAP specifies an [EUI64]-format address con- 'u/l' = 0 indicates local-use.) ISATAP specifies an [EUI64]-format
struction for the Organizationally-Unique Identifier (OUI) owned by address construction for the Organizationally-Unique Identifier (OUI)
the Internet Assigned Numbers Authority [IANA]. This format (given owned by the Internet Assigned Numbers Authority [IANA]. This format
below) is used to construct both native [EUI64] addresses for general (given below) is used to construct both native [EUI64] addresses for
use and modified EUI-64 format interface identifiers for use in IPv6 general use and modified EUI-64 format interface identifiers for use
unicast addresses: in IPv6 unicast addresses:
|0 2|2 3|3 3|4 6| |0 2|2 3|3 3|4 6|
|0 3|4 1|2 9|0 3| |0 3|4 1|2 9|0 3|
+------------------------+--------+--------+------------------------+ +------------------------+--------+--------+------------------------+
| OUI ("00-00-5E"+u+g) | TYPE | TSE | TSD | | OUI ("00-00-5E"+u+g) | TYPE | TSE | TSD |
+------------------------+--------+--------+------------------------+ +------------------------+--------+--------+------------------------+
Where the fields are: Where the fields are:
OUI IANA's OUI: 00-00-5E with 'u' and 'g' bits (3 octets) OUI IANA's OUI: 00-00-5E with 'u' and 'g' bits (3 octets)
skipping to change at page 5, line 7 skipping to change at page 4, line 49
0xFE (TSE, TSD) together contain an embedded IPv4 address 0xFE (TSE, TSD) together contain an embedded IPv4 address
0xFF TSD is interpreted based on TSE as follows: 0xFF TSD is interpreted based on TSE as follows:
TSE TSD Interpretation TSE TSD Interpretation
--- ------------------ --- ------------------
0x00-0xFD RESERVED for future IANA use 0x00-0xFD RESERVED for future IANA use
0xFE TSD contains 24-bit EUI-48 intf id 0xFE TSD contains 24-bit EUI-48 intf id
0xFF RESERVED by IEEE/RAC 0xFF RESERVED by IEEE/RAC
Thus, if TYPE=0xFE, TSE is an extension of TSD. If TYPE=0xFF, TSE is Thus, if TYPE=0xFE, TSE is an extension of TSD. If TYPE=0xFF, TSE is
an extension of TYPE. Other values for TYPE (hence, other interpreta- an extension of TYPE. Other values for TYPE are reserved for future
tions of TSE, TSD) are reserved for future IANA use. IANA use.
The above specification is compatible with all aspects of [EUI64], The above specification is compatible with all aspects of [EUI64],
including support for encapsulating legacy EUI-48 interface identif- including support for encapsulating legacy EUI-48 interface
iers (e.g., an IANA EUI-48 format multicast address such as: '01-00- identifiers (e.g., an IANA EUI-48 format multicast address such as:
5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03'). But, the '01-00-5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03').
specification also provides a special TYPE (0xFE) to indicate an IPv4 But, the specification also provides a special TYPE (0xFE) indicating
address is embedded. Thus, when the first four octets of a [ADDR]- an IPv4 address is embedded. Thus, when the first four octets of an
compatible IPv6 interface identifier are: '00-00-5E-FE' (note: the [ADDR]-compatible IPv6 interface identifier are: '00-00-5E-FE'
'u/l' bit MUST be 0) the interface identifier is said to be in "ISA- (note: the 'u/l' bit MUST be 0) the interface identifier is said to
TAP format" and the next four octets embed an IPv4 address encoded in be in "ISATAP format" and the next four octets embed an IPv4 address
network byte order (least significant octet first). Addresses con- encoded in network byte order. Addresses configured on an ISATAP
figured on the ISATAP interface MUST use the ISATAP interface iden- interface MUST use the ISATAP interface identifier format.
tifier format.
4.2. Stateless Autoconfiguration and Link-Local Addresses 4.2. Stateless Autoconfiguration and Link-Local Addresses
ISATAP addresses are unicast addresses [ADDR,2.5] that use ISATAP ISATAP addresses are IPv6 unicast addresses [ADDR,2.5] with ISATAP
format interface identifiers as follows: format interface identifiers as follows:
| 64 bits | 32 bits | 32 bits | | 64 bits | 32 bits | 32 bits |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
| link-local, site-local or | 0000:5EFE | IPv4 Address | | link-local, site-local or | 0000:5EFE | IPv4 Address |
| global unicast prefix | | of ISATAP link | | global unicast prefix | | of ISATAP link |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
Link-local, site-local, and global ISATAP addresses can be created Link-local, site-local, and global ISATAP addresses can be created
exactly as specified in [ADDR], (e.g., by auto-configuration [AUTO] exactly as specified in [ADDR], (e.g., by auto-configuration [AUTO]
or manual configuration). For example, the IPv6 address: or manual configuration). For example, the IPv6 address:
3FFE:1a05:510:1111:0:5EFE:8CAD:8108 3FFE:1A05:510:1111:0:5EFE:8CAD:8108
has a prefix of '3FFE:1a05:510:1111::/64' and an ISATAP format inter- has a prefix of '3FFE:1A05:510:1111::/64' and an ISATAP format
face identifier with embedded IPv4 address: '140.173.129.8'. The interface identifier with embedded IPv4 address: '140.173.129.8'.
address is alternately written as: The address is alternately written as:
3FFE:1a05:510:1111:0:5EFE:140.173.129.8 3FFE:1A05:510:1111:0:5EFE:140.173.129.8
The link-local and site-local variants (respectively) are: The link-local and site-local variants (respectively) are:
FE80::0:5EFE:140.173.129.8 FE80::0:5EFE:140.173.129.8
FEC0::1111:0:5EFE:140.173.129.8 FEC0::1111:0:5EFE:140.173.129.8
4.3. ISATAP Link/Interface Configuration 4.3. ISATAP Link/Interface Configuration
A node configures an ISATAP link over one or more underlying IPv4 A node configures an ISATAP link over one or more underlying IPv4
links, i.e., the ISATAP link MAY be configured over one or more links, i.e., the ISATAP link MAY be configured over one or more
link-layer (IPv4) addresses. Each link-layer address 'V4ADDR_LINK' is link-layer (IPv4) addresses. Each link-layer address 'V4ADDR_LINK' is
used to configure a link-local address 'FE80::0:5EFE:V4ADDR_LINK' on used to configure a link-local address 'FE80::0:5EFE:V4ADDR_LINK' on
an ISATAP interface. ISATAP interfaces MAY be assigned one per link- an ISATAP interface. ISATAP interfaces MAY be assigned one per
layer address, or as a single interface for multiple link-layer link-layer address, or as a single interface for multiple link-layer
addresses. addresses.
In the former case, the address of each ISATAP interface SHOULD be In the former case, the address of each ISATAP interface SHOULD be
added to the Potential Routers List. In the latter case, the inter- added to the Potential Routers List (see section 5.2.1). In the
face will accept ISATAP packets addressed to any of the IPv4 link- latter case, the interface will accept ISATAP packets addressed to
layer addresses, but will choose one as its primary address, used for any of the IPv4 link-layer addresses, but will choose one as its
sourcing packets. Only this address need be represented in the Poten- primary address, used for sourcing packets. Only this address need
tial Routers List. be represented in the Potential Routers List.
4.4. Sending Rules and Address Mapping 4.4. Sending Rules and Address Mapping
The IPv6 next-hop address for packets sent on an ISATAP link MUST be The IPv6 next-hop address for packets sent on an ISATAP link MUST be
an ISATAP address. Packets that do not satisfy this constraint MUST an ISATAP address. Packets that do not satisfy this constraint MUST
be discarded and an ICMP destination unreachable indication with code be discarded and an ICMP destination unreachable indication with code
3 (Address Unreachable) [ICMPv6] MUST be returned. No other sending 3 (Address Unreachable) [ICMPv6] MUST be returned. No other sending
rules are necessary. rules are necessary.
The procedure for mapping unicast addresses into link-layer addresses The procedure for mapping unicast addresses into link-layer addresses
is to simply treat the last four octets of the ISATAP address as an is to simply treat the last four octets of the ISATAP address as an
IPv4 address (in network byte order). No multicast address mappings IPv4 address (in network byte order). No multicast address mappings
are specified. are specified.
4.5. Validity Checks for Received Packets 4.5. Validity Checks for Received Packets
ISATAP interfaces MUST silently discard any received packets that do ISATAP interfaces MUST silently discard any received packets that do
not satisfy ONE OF the following validity checks: not satisfy at least one of the following validity checks:
- the network-layer (IPv6) source address has a prefix configured on - the network-layer (IPv6) source address has a prefix configured on
the ISATAP interface and an ISATAP-format interface identifier that the ISATAP interface and an ISATAP-format interface identifier that
embeds the link-layer (IPv4) source address, i.e., source is on-link embeds the link-layer (IPv4) source address, i.e., source is on-link
- the link-layer (IPv4) source address is in the Potential Routers List - the link-layer (IPv4) source address is in the Potential Routers List
(see section 5.2), i.e., previous hop is an on-link ISATAP router (see section 5.2.1), i.e., previous hop is an on-link ISATAP router
5. Neighbor Discovery for ISATAP Links 5. Neighbor Discovery for ISATAP Links
Section 3.2 of [DISC] ("Supported Link Types") provides the following Section 3.2 of [DISC] ("Supported Link Types") provides the following
guidelines for non-broadcast multiple access (NBMA) link support: guidelines for non-broadcast multiple access (NBMA) link support:
"Redirect, Neighbor Unreachability Detection and next-hop determi- "Redirect, Neighbor Unreachability Detection and next-hop
nation should be implemented as described in this document. Address determination should be implemented as described in this
resolution and the mechanism for delivering Router Solicitations document. Address resolution and the mechanism for delivering
and Advertisements on NBMA links is not specified in this docu- Router Solicitations and Advertisements on NBMA links is not
ment." specified in this document."
ISATAP links SHOULD implement Redirect, Neighbor Unreachability ISATAP links SHOULD implement Redirect, Neighbor Unreachability
Detection, and next-hop determination exactly as specified in [DISC]. Detection, and next-hop determination exactly as specified in [DISC].
Address resolution and the mechanisms for delivering Router Solicita- Address resolution and the mechanisms for delivering Router
tions and Advertisements for ISATAP links are not specified by Solicitations and Advertisements for ISATAP links are not specified
[DISC]; instead, they are specified in this document. (Note that by [DISC]; instead, they are specified in this document. (Note that
these mechanisms MAY potentially apply to other types of NBMA links these mechanisms MAY potentially apply to other types of NBMA links
in the future.) in the future.)
5.1. Address Resolution 5.1. Address Resolution
Protocol addresses (IPv6) in ISATAP are resolved to link-layer Protocol addresses (IPv6) on ISATAP links are resolved to link-layer
addresses (IPv4) by a static computation, i.e., the last four octets addresses (IPv4) by a static computation, i.e., the last four octets
are treated as an IPv4 address. Thus the functions and conceptual are treated as an IPv4 address. Thus the functions and conceptual
data structures used by [DISC] for the purpose of address resolution data structures used by [DISC] for the purpose of address resolution
are not required. The conceptual "neighbor cache" described in [DISC] are not required. The conceptual "neighbor cache" described in [DISC]
is still needed for other functions, such as neighbor unreachability is still needed for other functions, such as neighbor unreachability
detection, but it is not used for address resolution. detection, but it is not used for address resolution.
The link-layer address option used in [DISC] is not needed. Implemen- The link-layer address option used in [DISC] is not needed.
tations SHOULD NOT send link-layer address options in any Neighbor Link-layer address options SHOULD NOT be sent in any Neighbor
Discovery packets, and MUST silently ignore any such options in Discovery packets, and MUST be silently ignored in any received
Neighbor Discovery packets which are received. Neighbor Discovery packets.
5.2. Router and Prefix Discovery 5.2. Router and Prefix Discovery
Since the site's IPv4 infrastructure is treated as an NBMA link Since the site's IPv4 infrastructure is treated as an NBMA link
layer, unsolicited Router Advertisements do not provide sufficient layer, unsolicited Router Advertisements do not provide sufficient
means for router discovery on ISATAP links. Thus, alternate mechan- means for router discovery on ISATAP links. Thus, alternate
isms are required and specified below: mechanisms are required and specified below:
5.2.1. Conceptual Data Structures 5.2.1. Conceptual Data Structures
ISATAP nodes use the Prefix List and Default Router List conceptual ISATAP nodes use the conceptual data structures Prefix List and
data structures exactly as specified in [DISC,5.1]. ISATAP links add Default Router List exactly as specified in [DISC,5.1]. ISATAP links
a new conceptual data structure "Potential Router List" and the fol- add a new conceptual data structure "Potential Router List" and the
lowing new configuration variable: following new configuration variable:
ResolveInterval Time between name service resolutions. ResolveInterval Time between name service resolutions.
Default and suggested minimum: 1hr Default and suggested minimum: 1hr
A Potential Router List (PRL) is associated with every ISATAP link. A Potential Router List (PRL) is associated with every ISATAP link.
The PRL provides context for router discovery and a trust basis for The PRL provides context for router discovery and a trust basis for
router validation (see security considerations). Each entry in the router validation (see security considerations). Each entry in the
PRL has an IPv4 address and an associated timer used for polling. The PRL has an IPv4 address and an associated timer used for polling. The
IPv4 address represents a router's ISATAP interface (likely to be an IPv4 address represents a router's ISATAP interface (likely to be an
"advertising interface"), and is used to construct the ISATAP link- "advertising interface"), and is used to construct the ISATAP
local address for that interface. link-local address for that interface.
When the node enables an ISATAP link, it initializes the PRL with When a node enables an ISATAP link, it initializes the Potential
IPv4 addresses discovered through name service lookups for the Well- Router List (PRL) for that link. Unless other information is
Known Service name "ISATAP" (see "IANA Considerations"). Nodes available (e.g., manual address configuration, a vendor-specific
periodically repeat this process after ResolveInterval to detect DHCP option, etc.) the following method (similar to the [SIP, 1.4.2]
additions/deletions for the PRL. Initialization of the PRL through procedure) SHOULD be used:
static IPv4 address assignments and/or an alternate name for lookups
is a supported configuration option, but the method described above 1. The site administrator maintains address records for ISATAP
is preferred. router interfaces, and makes these available in the site's
name service. Nodes attempt to find one or more addresses
for the PRL by querying the name service.
2. There are no mandatory rules on the selection of domain name
to be used within a site for this purpose, but administrators
are encouraged to use the "isatap.domainname" convention
(e.g., isatap.example.com), as specified in [RFC2219]. Nodes
can construct this domain name by prepending the label "isatap"
to their parent domain name, which is established by other
means. Nodes then query this domain name for address records
(e.g., DNS 'A' resource records), and initialize the PRL with
the IPv4 addresses in the replies.
3. After initialization, nodes periodically repeat the above
procedure every ResolveInterval seconds to update the PRL with
any IPv4 addresses added/deleted since the previous iteration.
When DNS is used, nodes MUST follow the procedures in [RFC1035]
regarding cache invalidation when the DNS time-to-live expires.
5.2.2. Validation of Router Advertisement Messages 5.2.2. Validation of Router Advertisement Messages
A node MUST silently discard any received Router Advertisement mes- A node MUST silently discard any received Router Advertisement
sages that do not satisfy the validity checks in [DISC,6.1.2] as well messages that do not satisfy the validity checks in [DISC,6.1.2] as
as the following additional validity check for ISATAP: well as the following additional validity check for ISATAP:
- the network-layer (IPv6) source address is from the PRL - the network-layer (IPv6) source address is derived from
an IPv4 address in the PRL
5.2.3. Router Specification 5.2.3. Router Specification
Advertising ISATAP interfaces of routers behave the same as advertis- Advertising ISATAP interfaces of routers behave the same as
ing interfaces described in [DISC,6.2]. However, periodic unsolicited advertising interfaces described in [DISC,6.2]. However, periodic
multicast Router Advertisements are not required, thus the "interval unsolicited multicast Router Advertisements are not required, thus
timer" associated with advertising interfaces is not used for that the "interval timer" associated with advertising interfaces is not
purpose. used for that purpose.
When an ISATAP router receives a valid Router Solicitation on an When an ISATAP router receives a valid Router Solicitation on an
advertising ISATAP interface, it replies with a unicast Router Adver- advertising ISATAP interface, it replies with a unicast Router
tisement to the address of the node which sent the Router Solicita- Advertisement to the address of the node which sent the Router
tion. The source address of the Router Advertisement is a link-local Solicitation. The source address of the Router Advertisement is a
unicast address associated with the interface. This MAY be the same link-local unicast address associated with the interface. This MAY
as the destination address of the Router Solicitation. be the same as the destination address of the Router Solicitation.
ISATAP routers MAY engage in the polling process described under
By default, ISATAP routers will not receive Router Advertisements Host Specification below (e.g. if Router Advertisement consistency
from other ISATAP routers. Thus, Router Advertisement consistency verification [DISC,6.2.7] is desired), but this is not required.
verification [DISC,6.2.7] is not supported by default. Routers MAY
OPTIONALLY engage in the exchange of router advertisements with other
members of the PRL to enable this function.
5.2.4. Host Specification 5.2.4. Host Specification
Hosts periodically poll each entry in the PRL ("PRL(i)") by sending Hosts periodically poll each entry in the PRL ("PRL(i)") by sending
unicast Router Solicitation messages using the IPv4 address unicast Router Solicitation messages using the IPv4 address
("V4ADDR_PRL(i)") and associated timer in the entry. Hosts add the ("V4ADDR_PRL(i)") and associated timer in the entry. Hosts add the
following variable to support the polling process: following variable to support the polling process:
MinRouterSolicitInterval MinRouterSolicitInterval
Minimum time between sending Router Solicitations Minimum time between sending Router Solicitations
to any router. Default and suggested minimum: 15min to any router. Default and suggested minimum: 15min
When PRL(i) is first added to the list, the host sets its associated When PRL(i) is first added to the list, the host sets its associated
timer to MinRouterSolicitInterval. timer to MinRouterSolicitInterval.
Entries are polled when they are created (following a short delay as Entries are polled when they are created (following a short delay as
for initial solicitations [ND,6.3.7]), and when the associated timer for initial solicitations [ND,6.3.7]), and when the associated timer
expires. expires.
Polling consists of sending Router Solicitations to the ISATAP link- Polling consists of sending Router Solicitations to the ISATAP
local address constructed from the entry's IPv4 address, i.e., they link-local address constructed from the entry's IPv4 address, i.e.,
are sent to 'FE80::0:5EFE:V4ADDR_PRL(i)' instead of 'All-Routers mul- they are sent to 'FE80::0:5EFE:V4ADDR_PRL(i)' instead of 'All-Routers
ticast'. They are otherwise sent in the same manner described in multicast'. They are otherwise sent in the same manner described in
[DISC,6.3.7]. [DISC,6.3.7].
When the host receives a valid Router Advertisement (i.e., one that When the host receives a valid Router Advertisement (i.e., one that
satisfies the validity checks in sections 4.5 and 5.2.2) it processes satisfies the validity checks in sections 4.5 and 5.2.2) it processes
them in the same manner described in [DISC,6.3.4]. The host addition- them in the same manner described in [DISC,6.3.4]. The host
ally resets the timer associated with the PRL entry that matches the additionally resets the timer associated with the PRL entry that
network-layer source address in the Router Advertisement. The timer matches the network-layer source address in the Router Advertisement.
is reset to either 0.5 * (the minimum value in the router lifetime or The timer is reset to either 0.5 * (the minimum value in the router
valid lifetime of any on-link prefixes advertised) or MinRouterSoli- lifetime or valid lifetime of any on-link prefixes advertised) or
citInterval; whichever is longer. MinRouterSolicitInterval; whichever is longer.
6. ISATAP Deployment Considerations 6. ISATAP Deployment Considerations
6.1. Host And Router Deployment Considerations 6.1. Host And Router Deployment Considerations
For hosts, if an underlying link supports both IPv4 (over which ISA- For hosts, if an underlying link supports both IPv4 (over which
TAP is implemented) and also supports IPv6 natively, then ISATAP MAY ISATAP is implemented) and also supports IPv6 natively, then ISATAP
be enabled if the native IPv6 layer does not receive Router Adver- MAY be enabled if the native IPv6 layer does not receive Router
tisements (i.e., does not have connection with an IPv6 router). After Advertisements (i.e., does not have connection with an IPv6 router).
a non-link-local address has been configured and a default router After a non-link-local address has been configured and a default
acquired on the native link, the host MAY discontinue the 'Router router acquired on the native link, the host SHOULD discontinue the
Polling Process' process specified in section 5.2.4 and allow exist- 'Router Polling Process' process specified in section 5.2.4 and allow
ing ISATAP address configurations to expire as specified in existing ISATAP address configurations to expire as specified in
[DISC,5.3][AUTO,5.5.4]. In this way, ISATAP use will gradually dimin- [DISC,5.3][AUTO,5.5.4]. In this way, ISATAP use will gradually
ish as IPv6 routers are widely deployed throughout the site. diminish as IPv6 routers are widely deployed throughout the site.
Routers MAY configure a native link to simultaneously support both Routers MAY configure a native link to simultaneously support both
native IPv6, and also ISATAP (over IPv4). Routing will operate as native IPv6, and also ISATAP (over IPv4). Routing will operate as
usual between these two domains. Note that the prefixes used on the usual between these two domains. Note that the prefixes used on the
ISATAP and native IPv6 interfaces will be distinct. ISATAP and native IPv6 interfaces will be distinct. The IPv4
address(es) configured on a router's ISATAP interface(s) SHOULD be
When an ISATAP router is configured, the IPv4 address used for its added (either automatically or manually) to the site's address
ISATAP interface SHOULD be added (either automatically or manually) records for ISATAP router interfaces (see section 5.2.1).
to the site's name service records for the "ISATAP" Well-Known Ser-
vice name (e.g., by adding an A record in DNS), so it will be added
to the ISATAP Potential Router list of all nodes on the link.
6.2. Site Administration Considerations 6.2. Site Administration Considerations
The following considerations are noted for sites that deploy ISATAP: The following considerations are noted for sites that deploy ISATAP:
- ISATAP links are administratively defined by a set of router - ISATAP links are administratively defined by a set of router
interfaces, and set of nodes which have those interface addresses interfaces, and set of nodes which have those interface addresses
in their potential router lists. Thus, ISATAP links are defined by in their potential router lists. Thus, ISATAP links are defined by
administrative (not physical) boundaries. administrative (not physical) boundaries.
- ISATAP hosts and routers can be deployed in an ad-hoc and independent - ISATAP hosts and routers can be deployed in an ad-hoc and independent
fashion. In particular, ISATAP hosts can be deployed with little/no fashion. In particular, ISATAP hosts can be deployed with little/no
advanced knowledge of existing ISATAP routers, and ISATAP routers advanced knowledge of existing ISATAP routers, and ISATAP routers
can deployed with no reconfiguration requirements for hosts. can deployed with no reconfiguration requirements for hosts.
- ISATAP nodes periodically send Router Solicitations to all entries - ISATAP nodes periodically send Router Solicitations to all entries
in the Potential Router List. Worst-case control traffic is on the in the Potential Router List. Worst-case control traffic is on the
order of (M x N), where 'M' is the number of routers in the Potential order of (M x N), where 'M' is the number of routers in the Potential
Router List and 'N' is the total number of nodes on the ISATAP link. Router List and 'N' is the total number of nodes on the ISATAP link.
The MinRouterSolicitInterval of 15min bounds control traffic for The MinRouterSolicitInterval ([5.2.4]) bounds control traffic for
large numbers of nodes even in worst-case scenarios. large numbers of nodes even in worst-case scenarios.
- Strategic site administration, along with robust host and router - ISATAP nodes periodically refresh the entries on the PRL, typically
implementations, can provide significant reductions in control by polling the DNS. Responsible site administration, along with
traffic. At a minimum, site administrators SHOULD ensure that name robust protocol implementations, can provide significant reductions
service records for the "ISATAP" Well-Known Service name are well in control traffic. At a minimum, administrators SHOULD ensure that
maintained, and represent valid ISATAP routers. the site's address records for ISATAP router interfaces (see
section 5.2.1) are well maintained.
7. IANA considerations 7. IANA considerations
We propose that IANA adopt the interface identifier construction We propose that IANA adopt the interface identifier construction
specified in section 4.1 for the existing IANA IEEE OUI registration specified in section 4.1 for the existing IANA IEEE OUI registration
('00-00-5E'). Additionally, we request that the name "ISATAP" be ('00-00-5E').
reserved in the IANA "Protocol and Service Names" assigned numbers
document.
8. Security considerations 8. Security considerations
Site administrators are advised that, in addition to possible attacks Site administrators are advised that, in addition to possible attacks
against IPv6, security attacks against IPv4 MUST also be considered. against IPv6, security attacks against IPv4 MUST also be considered.
Many security considerations in [6OVER4,9] apply also to ISATAP. Many security considerations in [6OVER4,9] apply also to ISATAP.
Responsible IPv4 site security management is strongly encouraged. In Responsible IPv4 site security management is strongly encouraged. In
particular, border gateways SHOULD implement filtering to detect particular, border gateways SHOULD implement filtering to detect
spoofed IPv4 source addresses at a minimum; ip-protocol-41 filtering spoofed IPv4 source addresses at a minimum; ip-protocol-41 filtering
SHOULD also be implemented. SHOULD also be implemented.
If IPv4 source address filtering is not correctly implemented, the If IPv4 source address filtering is not correctly implemented, the
validity checks in section 4.7 will not be effective in preventing validity checks in section 4.7 will not be effective in preventing
IPv6 source address spoofing. IPv6 source address spoofing.
If filtering for ip-protocol-41 is not correctly implemented, IPv6 If filtering for ip-protocol-41 is not correctly implemented, IPv6
source address spoofing is clearly possible, but this can be elim- source address spoofing is clearly possible, but this can be
inated if both IPv4 source address filtering, and the validity checks eliminated if both IPv4 source address filtering, and the validity
in section 4.7 are implemented. checks in section 4.7 are implemented.
[DISC,6.1.2] implies that nodes trust Router Advertisements they [DISC,6.1.2] implies that nodes trust Router Advertisements they
receive from on-link routers, as indicated by a value of 255 in the receive from on-link routers, as indicated by a value of 255 in the
IPv6 'hop-limit' field. Since this field is not decremented when ip- IPv6 'hop-limit' field. Since this field is not decremented when
protocol-41 packets traverse multiple IPv4 hops [MECH,3.3], ISATAP ip-protocol-41 packets traverse multiple IPv4 hops [MECH,3.3], ISATAP
links require a different trust model. In particular, ONLY those links require a different trust model. In particular, ONLY those
Router Advertisements received from a member of the Potential Routers Router Advertisements received from a member of the Potential Routers
List are trusted; all others are silently discarded (see section List are trusted; all others are silently discarded (see section
5.2.2). This trust model is predicated on IPv4 source address filter- 5.2.2). This trust model is predicated on IPv4 source address
ing, as described above. filtering, as described above.
The ISATAP address format does not support privacy extensions for The ISATAP address format does not support privacy extensions for
stateless address autoconfiguration [PRIVACY]. However, since the stateless address autoconfiguration [PRIVACY]. However, since the
ISATAP interface identifier is derived from the node's IPv4 address, ISATAP interface identifier is derived from the node's IPv4 address,
ISATAP addresses do not have the same level of privacy concerns as ISATAP addresses do not have the same level of privacy concerns as
IPv6 addresses that use an interface identifier derived from the MAC IPv6 addresses that use an interface identifier derived from the MAC
address. address.
Acknowledgements Acknowledgements
Some of the ideas presented in this draft were derived from work at Some of the ideas presented in this draft were derived from work at
SRI with internal funds and contractual support. Government sponsors SRI with internal funds and contractual support. Government sponsors
who supported the work include Monica Farah-Stapleton and Russell who supported the work include Monica Farah-Stapleton and Russell
Langan from U.S. Army CECOM ASEO, and Dr. Allen Moshfegh from U.S. Langan from U.S. Army CECOM ASEO, and Dr. Allen Moshfegh from U.S.
Office of Naval Research. Within SRI, Dr. Mike Frankel, J. Peter Mar- Office of Naval Research. Within SRI, Dr. Mike Frankel, J. Peter
cotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry supported the work Marcotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry supported the
and helped foster early interest. work and helped foster early interest.
The following peer reviewers are acknowledged for taking the time to The following peer reviewers are acknowledged for taking the time to
review a pre-release of this document and provide input: Jim Bound, review a pre-release of this document and provide input: Jim Bound,
Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole
Troan, Vlad Yasevich. Troan, Vlad Yasevich.
The authors acknowledge members of the NGTRANS community who have The authors acknowledge members of the NGTRANS community who have
made significant contributions to this effort, including Rich Draves, made significant contributions to this effort, including Rich Draves,
Alain Durand, Nathan Lutchansky, Art Shelest, Margaret Wasserman, and Alain Durand, Nathan Lutchansky, Art Shelest, Margaret Wasserman, and
Brian Zill. Brian Zill.
Finally, the authors recognize that ideas similar to those in this Finally, the authors recognize that ideas similar to those in this
document may have already been presented by others and wish to ack- document may have already been presented by others and wish to
nowledge any other such contributions. acknowledge any other such contributions.
Normative References Normative References
[ADDR] Hinden, R., and S. Deering, "IP Version 6 Addressing [ADDR] Hinden, R., and S. Deering, "IP Version 6 Addressing
Architecture", RFC 2373, July 1998. (Pending approval Architecture", RFC 2373, July 1998. (Pending approval
of "addr-arch-v3"). of "addr-arch-v3").
[AGGR] Hinden., R, O'Dell, M., and Deering, S., "An IPv6 [AGGR] Hinden., R, O'Dell, M., and Deering, S., "An IPv6
Aggregatable Global Unicast Address Format", Aggregatable Global Unicast Address Format",
RFC 2374, July 1998. RFC 2374, July 1998.
skipping to change at page 13, line 20 skipping to change at page 13, line 20
[MECH] Gilligan, R., and E. Nordmark, "Transition Mechanisms for [MECH] Gilligan, R., and E. Nordmark, "Transition Mechanisms for
IPv6 Hosts and Routers", RFC 2893, August 2000. IPv6 Hosts and Routers", RFC 2893, August 2000.
[NAT] Egevang, K., and P. Francis, "The IP Network Address [NAT] Egevang, K., and P. Francis, "The IP Network Address
Translator (NAT)", RFC 1631, May 1994. Translator (NAT)", RFC 1631, May 1994.
[PRIVATE] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., [PRIVATE] Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.,
and E. Lear, "Address Allocation for Private Internets", and E. Lear, "Address Allocation for Private Internets",
RFC 1918, February 1996. RFC 1918, February 1996.
[SIP] Handley, M., Schulzrinne, H., Schooler, E., and
J. Rosenberg, "SIP: Session Initiation Protocol",
RFC 2543, March 1999.
Informative References Informative References
[6OVER4] Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4 [6OVER4] Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4
Domains without Explicit Tunnels", RFC 2529. Domains without Explicit Tunnels", RFC 2529.
[6TO4] Carpenter, B., and K. Moore, "Connection of IPv6 Domains [6TO4] Carpenter, B., and K. Moore, "Connection of IPv6 Domains
via IPv4 Clouds", RFC 3056, February 2001. via IPv4 Clouds", RFC 3056, February 2001.
[IANA] Reynolds, J., and J. Postel, "Assigned Numbers", STD 2, [IANA] Reynolds, J., and J. Postel, "Assigned Numbers", STD 2,
USC/Information Sciences Institute, October 1994. USC/Information Sciences Institute, October 1994.
[PRIVACY] Narten, T., R. Draves, "Privacy Extensions for Stateless [PRIVACY] Narten, T., R. Draves, "Privacy Extensions for Stateless
Address Autoconfiguration in IPv6", RFC 3041, Address Autoconfiguration in IPv6", RFC 3041,
January 2001. January 2001.
[RFC1035] Mockapetris, P., "Domain Names - Implementation and
Specification", RFC 1035, November 1987.
[RFC2219] Hamilton, M., and R. Wright, "Use of DNS Aliases for
Network Services", RFC 2219 (BCP), October 1997.
Authors Addresses Authors Addresses
Fred L. Templin Fred L. Templin
SRI International SRI International
333 Ravenswood Ave. 333 Ravenswood Ave.
Menlo Park, CA 94025, USA Menlo Park, CA 94025, USA
Phone: (650)-859-3144 Phone: (650)-859-3144
Email: templin@erg.sri.com Email: templin@erg.sri.com
Tim Gleeson Tim Gleeson
skipping to change at page 14, line 19 skipping to change at page 14, line 29
Dave Thaler Dave Thaler
Microsoft Corporation Microsoft Corporation
One Microsoft Way One Microsoft Way
Redmond, WA 98052-6399 Redmond, WA 98052-6399
Phone: +1 425 703 8835 Phone: +1 425 703 8835
EMail: dthaler@microsoft.com EMail: dthaler@microsoft.com
APPENDIX A: Major Changes APPENDIX A: Major Changes
changes from version 03 to version 04:
- Re-wrote section on Potential Router List initialization to
reference existing precedence in other documents
- several minor wording changes based on feedback from the
community
changes from version 02 to version 03: changes from version 02 to version 03:
- Added contributing co-authors - Added contributing co-authors
- RSs are now sent to unicast addresses rather than all-routers-multicast - RSs are now sent to unicast addresses rather than all-routers-multicast
- Brought draft into better alignment with other IPv6 - Brought draft into better alignment with other IPv6
standards-track documents standards-track documents
- Added applicability statement - Added applicability statement
skipping to change at page 15, line 17 skipping to change at page 15, line 35
changes from personal draft to version 00: changes from personal draft to version 00:
- Title change to provide higher-level description of field of - Title change to provide higher-level description of field of
use addressed by this draft. Removed other extraneous text. use addressed by this draft. Removed other extraneous text.
- Major new section on automatic discovery of off-link IPv6 routers - Major new section on automatic discovery of off-link IPv6 routers
when IPv6-IPv4 compatibility addresses are used. when IPv6-IPv4 compatibility addresses are used.
Intellectual Property Intellectual Property
The IETF has been notified of intellectual property rights claimed in The IETF has been notified of intellectual property rights claimed
regard to some or all of the specification contained in this docu- in regard to some or all of the specification contained in this
ment. For more information consult the online list of claimed document. For more information consult the online list of claimed
rights. rights.
 End of changes. 

This html diff was produced by rfcdiff 1.25, available from http://www.levkowetz.com/ietf/tools/rfcdiff/