draft-ietf-ngtrans-isatap-04.txt   draft-ietf-ngtrans-isatap-05.txt 
NGTRANS Working Group F. Templin NGTRANS Working Group F. Templin
INTERNET-DRAFT SRI International INTERNET-DRAFT Nokia
T. Gleeson T. Gleeson
Cisco Systems K.K. Cisco Systems K.K.
M. Talwar M. Talwar
D. Thaler D. Thaler
Microsoft Corporation Microsoft Corporation
Expires 18 October 2002 18 April 2002 Expires 18 April 2003 18 October 2002
Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)
draft-ietf-ngtrans-isatap-04.txt draft-ietf-ngtrans-isatap-05.txt
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with all This document is an Internet-Draft and is in full conformance with all
provisions of Section 10 of RFC2026. provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Task Internet-Drafts are working documents of the Internet Engineering Task
Force (IETF), its areas, and its working groups. Note that other groups Force (IETF), its areas, and its working groups. Note that other groups
may also distribute working documents as Internet- Drafts. may also distribute working documents as Internet- Drafts.
skipping to change at page 2, line 9 skipping to change at page 2, line 9
IPv4 address - this enables automatic IPv6-in-IPv4 tunneling within a IPv4 address - this enables automatic IPv6-in-IPv4 tunneling within a
site, whether the site uses globally assigned or private IPv4 site, whether the site uses globally assigned or private IPv4
addresses. The new interface identifier format can be used with both addresses. The new interface identifier format can be used with both
local and global unicast IPv6 prefixes - this enables IPv6 routing local and global unicast IPv6 prefixes - this enables IPv6 routing
both locally and globally. ISATAP mechanisms introduce no impact on both locally and globally. ISATAP mechanisms introduce no impact on
routing table size and require no special IPv4 services (e.g., IPv4 routing table size and require no special IPv4 services (e.g., IPv4
multicast). multicast).
1. Introduction 1. Introduction
This document presents a simple, scalable approach that enables This document presents a simple approach that enables incremental
incremental deployment of IPv6 within IPv4-based sites in a manner deployment of IPv6 within IPv4-based sites in a manner that is com-
that is compatible with inter-domain transition mechanisms, e.g., patible with inter-domain transition mechanisms, e.g., [6TO4]. We
[6TO4]. We refer to this approach as the Intra-Site Automatic Tunnel refer to this approach as the Intra-Site Automatic Tunnel Addressing
Addressing Protocol, or ISATAP (pronounced: "ice-a-tap"). ISATAP Protocol, or ISATAP (pronounced: "ice-a-tap"). ISATAP allows dual-
allows dual-stack nodes that do not share a common link with an IPv6 stack nodes that do not share a common link with an IPv6 router to
router to automatically tunnel packets to the IPv6 next-hop address automatically tunnel packets to the IPv6 next-hop address through
through IPv4, i.e., the site's IPv4 infrastructure is treated as an IPv4, i.e., the site's IPv4 infrastructure is treated as an NBMA link
NBMA link layer. layer.
This document specifies details for the transmission of IPv6 packets This document specifies details for the transmission of IPv6 packets
over ISATAP links (i.e., automatic IPv6-in-IPv4 tunneling), including over ISATAP links (i.e., automatic IPv6-in-IPv4 tunneling), including
a new EUI-64 [EUI64] based interface identifier [ADDR][AGGR] format a new EUI-64 [EUI64] based interface identifier [ADDR][AGGR] format
that embeds an IPv4 address. This format supports configuration of that embeds an IPv4 address. This format supports configuration of
global, site-local and link-local addresses as specified in [AUTO] as global, site-local and link-local addresses as specified in [AUTO] as
well as simple link-layer address mapping. Simple validity checks for well as simple link-layer address mapping. Simple validity checks for
received packets are given. Also specified in this document is the received packets are given. Also specified in this document is the
operation of IPv6 Neighbor Discovery for ISATAP, as permitted for operation of IPv6 Neighbor Discovery for ISATAP, as permitted for
NBMA links by [DISC]. The document finally presents deployment and NBMA links by [DISC]. The document finally presents deployment and
security considerations for ISATAP. security considerations for ISATAP.
********************************************************************
PLEASE NOTE:
The current version of this specification embodies several opera-
tional issues for anticipated deployment scenarios. These issues are
clearly delineated in "starred" blocks such as this in the current
document for now. They will be resolved in a new version of the spec-
ification to be released in the near future.
********************************************************************
2. Applicability Statement 2. Applicability Statement
ISATAP provides the following features: ISATAP provides the following features:
- treats site's IPv4 infrastructure as an NBMA link layer using - treats site's IPv4 infrastructure as an NBMA link layer using
automatic IPv6-in-IPv4 tunneling (i.e., no configured tunnel state) automatic IPv6-in-IPv4 tunneling (i.e., no configured tunnel state)
- enables incremental deployment of IPv6 hosts within IPv4 sites with - enables incremental deployment of IPv6 hosts within IPv4 sites with
no aggregation scaling issues at border gateways no aggregation scaling issues at border gateways
skipping to change at page 3, line 47 skipping to change at page 4, line 13
packets not explicitly addressed to itself. packets not explicitly addressed to itself.
ISATAP host: ISATAP host:
any node that has an ISATAP interface and is not an ISATAP router. any node that has an ISATAP interface and is not an ISATAP router.
4. Transmission of IPv6 Packets on ISATAP Links 4. Transmission of IPv6 Packets on ISATAP Links
ISATAP links transmit IPv6 packets via automatic tunneling using the ISATAP links transmit IPv6 packets via automatic tunneling using the
site's IPv4 infrastructure as an NBMA link layer. Automatic tunneling site's IPv4 infrastructure as an NBMA link layer. Automatic tunneling
for ISATAP uses the same mechanisms specified in [MECH,3.1-3.6], for ISATAP uses the same mechanisms specified in [MECH,3.1-3.6],
i.e., IPv6 packets are automatically encapsulated in IPv4 using i.e., IPv6 packets are automatically encapsulated in IPv4 using 'ip-
'ip-protocol-41' as the payload type number. Specific considerations protocol-41' as the payload type number.
for ISATAP links are given below:
4.1. ISATAP Interface Identifier Construction
IPv6 unicast addresses [ADDR][AGGR] include a 64-bit interface
identifier field in "modified EUI-64 format", based on the IEEE
EUI-64 [EUI64] specification. (Modified EUI-64 format inverts the
sense of the 'u/l' bit from its specification in [EUI64], i.e.,
'u/l' = 0 indicates local-use.) ISATAP specifies an [EUI64]-format
address construction for the Organizationally-Unique Identifier (OUI)
owned by the Internet Assigned Numbers Authority [IANA]. This format
(given below) is used to construct both native [EUI64] addresses for
general use and modified EUI-64 format interface identifiers for use
in IPv6 unicast addresses:
|0 2|2 3|3 3|4 6| ********************************************************************
|0 3|4 1|2 9|0 3|
+------------------------+--------+--------+------------------------+
| OUI ("00-00-5E"+u+g) | TYPE | TSE | TSD |
+------------------------+--------+--------+------------------------+
Where the fields are: Operational Issue #1:
OUI IANA's OUI: 00-00-5E with 'u' and 'g' bits (3 octets) The [MECH] document referenced above is currently undergoing a (bis)
revision that will likely require future changes to the above text.
TYPE Type field; specifies interpretation of (TSE, TSD) (1 octet) ********************************************************************
TSE Type-Specific Extension (1 octet) Specific considerations for ISATAP links are given below:
TSD Type-Specific Data (3 octets) 4.1. ISATAP Interface Identifier Construction
And the following interpretations are specified based on TYPE: IPv6 unicast addresses [ADDR][AGGR] include a 64-bit interface iden-
tifier field in "modified EUI-64 format", based on the IEEE EUI-64
[EUI64] specification. (Modified EUI-64 format inverts the sense of
the 'u/l' bit from its specification in [EUI64], i.e., 'u/l' = 0
indicates local-use.) ISATAP interface identifiers are constructed by
prepending the 32-bit string '00-00-5E-FE' with an IPv4 address (see
the following section for examples). Appendix B includes text
explaining the historical basis for this construction rule.
TYPE (TSE, TSD) Interpretation ********************************************************************
---- -------------------------
0x00-0xFD RESERVED for future IANA use
0xFE (TSE, TSD) together contain an embedded IPv4 address
0xFF TSD is interpreted based on TSE as follows:
TSE TSD Interpretation Operational Issue #2:
--- ------------------
0x00-0xFD RESERVED for future IANA use
0xFE TSD contains 24-bit EUI-48 intf id
0xFF RESERVED by IEEE/RAC
Thus, if TYPE=0xFE, TSE is an extension of TSD. If TYPE=0xFF, TSE is The above construction rule unnecessarily wastes bits in the inter-
an extension of TYPE. Other values for TYPE are reserved for future face identifier that may be useful for other purposes.
IANA use.
The above specification is compatible with all aspects of [EUI64], ********************************************************************
including support for encapsulating legacy EUI-48 interface
identifiers (e.g., an IANA EUI-48 format multicast address such as:
'01-00-5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03').
But, the specification also provides a special TYPE (0xFE) indicating
an IPv4 address is embedded. Thus, when the first four octets of an
[ADDR]-compatible IPv6 interface identifier are: '00-00-5E-FE'
(note: the 'u/l' bit MUST be 0) the interface identifier is said to
be in "ISATAP format" and the next four octets embed an IPv4 address
encoded in network byte order. Addresses configured on an ISATAP
interface MUST use the ISATAP interface identifier format.
4.2. Stateless Autoconfiguration and Link-Local Addresses 4.2. Stateless Autoconfiguration and Link-Local Addresses
ISATAP addresses are IPv6 unicast addresses [ADDR,2.5] with ISATAP ISATAP addresses are unicast addresses [ADDR,2.5] that use ISATAP
format interface identifiers as follows: format interface identifiers as follows:
| 64 bits | 32 bits | 32 bits | | 64 bits | 32 bits | 32 bits |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
| link-local, site-local or | 0000:5EFE | IPv4 Address | | link-local, site-local or | 0000:5EFE | IPv4 Address |
| global unicast prefix | | of ISATAP link | | global unicast prefix | | of ISATAP link |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
Link-local, site-local, and global ISATAP addresses can be created Link-local, site-local, and global ISATAP addresses can be created
exactly as specified in [ADDR], (e.g., by auto-configuration [AUTO] exactly as specified in [ADDR], (e.g., by auto-configuration [AUTO]
or manual configuration). For example, the IPv6 address: or manual configuration). For example, the IPv6 address:
3FFE:1A05:510:1111:0:5EFE:8CAD:8108 3FFE:1A05:510:1111:0:5EFE:8CAD:8108
has a prefix of '3FFE:1A05:510:1111::/64' and an ISATAP format has a prefix of '3FFE:1A05:510:1111::/64' and an ISATAP format inter-
interface identifier with embedded IPv4 address: '140.173.129.8'. face identifier with embedded IPv4 address: '140.173.129.8'. The
The address is alternately written as: address is alternately written as:
3FFE:1A05:510:1111:0:5EFE:140.173.129.8 3FFE:1A05:510:1111:0:5EFE:140.173.129.8
The link-local and site-local variants (respectively) are: The link-local and site-local variants (respectively) are:
FE80::0:5EFE:140.173.129.8 FE80::0:5EFE:140.173.129.8
FEC0::1111:0:5EFE:140.173.129.8 FEC0::1111:0:5EFE:140.173.129.8
4.3. ISATAP Link/Interface Configuration 4.3. ISATAP Link/Interface Configuration
A node configures an ISATAP link over one or more underlying IPv4 A node configures an ISATAP link over one or more underlying IPv4
links, i.e., the ISATAP link MAY be configured over one or more links, i.e., the ISATAP link MAY be configured over one or more link-
link-layer (IPv4) addresses. Each link-layer address 'V4ADDR_LINK' is layer (IPv4) addresses. Each link-layer address 'V4ADDR_LINK' is used
used to configure a link-local address 'FE80::0:5EFE:V4ADDR_LINK' on to configure a link-local address 'FE80::0:5EFE:V4ADDR_LINK' on an
an ISATAP interface. ISATAP interfaces MAY be assigned one per ISATAP interface. ISATAP interfaces MAY be assigned one per link-
link-layer address, or as a single interface for multiple link-layer layer address, or as a single interface for multiple link-layer
addresses. addresses.
In the former case, the address of each ISATAP interface SHOULD be In the former case, the address of each ISATAP interface SHOULD be
added to the Potential Routers List (see section 5.2.1). In the added to the Potential Routers List (see section 5.2.1). In the lat-
latter case, the interface will accept ISATAP packets addressed to ter case, the interface will accept ISATAP packets addressed to any
any of the IPv4 link-layer addresses, but will choose one as its of the IPv4 link-layer addresses, but will choose one as its primary
primary address, used for sourcing packets. Only this address need address, used for sourcing packets. Only this address need be repre-
be represented in the Potential Routers List. sented in the Potential Routers List.
4.4. Sending Rules and Address Mapping 4.4. Sending Rules and Address Mapping
The IPv6 next-hop address for packets sent on an ISATAP link MUST be The IPv6 next-hop address for packets sent on an ISATAP link MUST be
an ISATAP address. Packets that do not satisfy this constraint MUST an ISATAP address. Packets that do not satisfy this constraint MUST
be discarded and an ICMP destination unreachable indication with code be discarded and an ICMP destination unreachable indication with code
3 (Address Unreachable) [ICMPv6] MUST be returned. No other sending 3 (Address Unreachable) [ICMPv6] MUST be returned. No other sending
rules are necessary. rules are necessary.
The procedure for mapping unicast addresses into link-layer addresses The procedure for mapping unicast addresses into link-layer addresses
skipping to change at page 6, line 37 skipping to change at page 6, line 28
4.5. Validity Checks for Received Packets 4.5. Validity Checks for Received Packets
ISATAP interfaces MUST silently discard any received packets that do ISATAP interfaces MUST silently discard any received packets that do
not satisfy at least one of the following validity checks: not satisfy at least one of the following validity checks:
- the network-layer (IPv6) source address has a prefix configured on - the network-layer (IPv6) source address has a prefix configured on
the ISATAP interface and an ISATAP-format interface identifier that the ISATAP interface and an ISATAP-format interface identifier that
embeds the link-layer (IPv4) source address, i.e., source is on-link embeds the link-layer (IPv4) source address, i.e., source is on-link
- the link-layer (IPv4) source address is in the Potential Routers List - the link-layer (IPv4) source address is in the Potential Routers List
(see section 5.2.1), i.e., previous hop is an on-link ISATAP router (see section 5.2), i.e., previous hop is an on-link ISATAP router
********************************************************************
Operational Issue #3:
The Potential Routers List gives no router reachabilty information.
The second validity check above can lead to packets being accepted
from nodes claiming to be routers, but for which the accepting node
has no affiliation.
********************************************************************
5. Neighbor Discovery for ISATAP Links 5. Neighbor Discovery for ISATAP Links
Section 3.2 of [DISC] ("Supported Link Types") provides the following Section 3.2 of [DISC] ("Supported Link Types") provides the following
guidelines for non-broadcast multiple access (NBMA) link support: guidelines for non-broadcast multiple access (NBMA) link support:
"Redirect, Neighbor Unreachability Detection and next-hop "Redirect, Neighbor Unreachability Detection and next-hop determi-
determination should be implemented as described in this nation should be implemented as described in this document. Address
document. Address resolution and the mechanism for delivering resolution and the mechanism for delivering Router Solicitations
Router Solicitations and Advertisements on NBMA links is not and Advertisements on NBMA links is not specified in this docu-
specified in this document." ment."
ISATAP links SHOULD implement Redirect, Neighbor Unreachability ISATAP links SHOULD implement Redirect, Neighbor Unreachability
Detection, and next-hop determination exactly as specified in [DISC]. Detection, and next-hop determination exactly as specified in [DISC].
Address resolution and the mechanisms for delivering Router Address resolution and the mechanisms for delivering Router Solicita-
Solicitations and Advertisements for ISATAP links are not specified tions and Advertisements for ISATAP links are not specified by
by [DISC]; instead, they are specified in this document. (Note that [DISC]; instead, they are specified in this document. (Note that
these mechanisms MAY potentially apply to other types of NBMA links these mechanisms MAY potentially apply to other types of NBMA links
in the future.) in the future.)
5.1. Address Resolution 5.1. Address Resolution
Protocol addresses (IPv6) on ISATAP links are resolved to link-layer Protocol addresses (IPv6) in ISATAP are resolved to link-layer
addresses (IPv4) by a static computation, i.e., the last four octets addresses (IPv4) by a static computation, i.e., the last four octets
are treated as an IPv4 address. Thus the functions and conceptual are treated as an IPv4 address. Thus the functions and conceptual
data structures used by [DISC] for the purpose of address resolution data structures used by [DISC] for the purpose of address resolution
are not required. The conceptual "neighbor cache" described in [DISC] are not required. The conceptual "neighbor cache" described in [DISC]
is still needed for other functions, such as neighbor unreachability is still needed for other functions, such as neighbor unreachability
detection, but it is not used for address resolution. detection, but it is not used for address resolution.
The link-layer address option used in [DISC] is not needed. ********************************************************************
Link-layer address options SHOULD NOT be sent in any Neighbor
Discovery packets, and MUST be silently ignored in any received Operational Issue #4.1:
Neighbor Discovery packets.
The static computation used for address resolution on ISATAP links
does not trigger neighbor reachability detection as specified in
[DISC, 7.3.3], leading to possible black holes.
********************************************************************
The link-layer address option used in [DISC] is not needed. Link-
layer address options SHOULD NOT be sent in any Neighbor Discovery
packets, and MUST be silently ignored in any received Neighbor Dis-
covery packets.
5.2. Router and Prefix Discovery 5.2. Router and Prefix Discovery
Since the site's IPv4 infrastructure is treated as an NBMA link Since the site's IPv4 infrastructure is treated as an NBMA link
layer, unsolicited Router Advertisements do not provide sufficient layer, unsolicited Router Advertisements do not provide sufficient
means for router discovery on ISATAP links. Thus, alternate means for router discovery on ISATAP links. Thus, alternate mecha-
mechanisms are required and specified below: nisms are required and specified below:
5.2.1. Conceptual Data Structures 5.2.1. Conceptual Data Structures
ISATAP nodes use the conceptual data structures Prefix List and ISATAP nodes use the conceptual data structures Prefix List and
Default Router List exactly as specified in [DISC,5.1]. ISATAP links Default Router List exactly as specified in [DISC,5.1]. ISATAP links
add a new conceptual data structure "Potential Router List" and the add a new conceptual data structure "Potential Router List" and the
following new configuration variable: following new configuration variable:
ResolveInterval Time between name service resolutions. ResolveInterval Time between name service resolutions.
Default and suggested minimum: 1hr Default and suggested minimum: 1hr
A Potential Router List (PRL) is associated with every ISATAP link. A Potential Router List (PRL) is associated with every ISATAP link.
The PRL provides context for router discovery and a trust basis for The PRL provides context for router discovery and a trust basis for
router validation (see security considerations). Each entry in the router validation (see security considerations). Each entry in the
PRL has an IPv4 address and an associated timer used for polling. The PRL has an IPv4 address and an associated timer used for polling. The
IPv4 address represents a router's ISATAP interface (likely to be an IPv4 address represents a router's ISATAP interface (likely to be an
"advertising interface"), and is used to construct the ISATAP "advertising interface"), and is used to construct the ISATAP link-
link-local address for that interface. local address for that interface.
When a node enables an ISATAP link, it initializes the Potential When a node enables an ISATAP link, it initializes the Potential
Router List (PRL) for that link. Unless other information is Router List (PRL) for that link. Unless other information is avail-
available (e.g., manual address configuration, a vendor-specific able (e.g., manual address configuration, a vendor-specific DHCP
DHCP option, etc.) the following method (similar to the [SIP, 1.4.2] option, etc.) the following method (similar to the [SIP, 1.4.2] pro-
procedure) SHOULD be used: cedure) SHOULD be used:
1. The site administrator maintains address records for ISATAP 1. The site administrator maintains address records for ISATAP
router interfaces, and makes these available in the site's router interfaces, and makes these available in the site's
name service. Nodes attempt to find one or more addresses name service. Nodes attempt to find one or more addresses
for the PRL by querying the name service. for the PRL by querying the name service.
2. There are no mandatory rules on the selection of domain name 2. There are no mandatory rules on the selection of domain name
to be used within a site for this purpose, but administrators to be used within a site for this purpose, but administrators
are encouraged to use the "isatap.domainname" convention are encouraged to use the "isatap.domainname" convention
(e.g., isatap.example.com), as specified in [RFC2219]. Nodes (e.g., isatap.example.com), as specified in [RFC2219]. Nodes
skipping to change at page 8, line 36 skipping to change at page 8, line 46
the IPv4 addresses in the replies. the IPv4 addresses in the replies.
3. After initialization, nodes periodically repeat the above 3. After initialization, nodes periodically repeat the above
procedure every ResolveInterval seconds to update the PRL with procedure every ResolveInterval seconds to update the PRL with
any IPv4 addresses added/deleted since the previous iteration. any IPv4 addresses added/deleted since the previous iteration.
When DNS is used, nodes MUST follow the procedures in [RFC1035] When DNS is used, nodes MUST follow the procedures in [RFC1035]
regarding cache invalidation when the DNS time-to-live expires. regarding cache invalidation when the DNS time-to-live expires.
5.2.2. Validation of Router Advertisement Messages 5.2.2. Validation of Router Advertisement Messages
A node MUST silently discard any received Router Advertisement A node MUST silently discard any received Router Advertisement mes-
messages that do not satisfy the validity checks in [DISC,6.1.2] as sages that do not satisfy the validity checks in [DISC,6.1.2] as well
well as the following additional validity check for ISATAP: as the following additional validity check for ISATAP:
- the network-layer (IPv6) source address is derived from - the network-layer (IPv6) source address is derived from
an IPv4 address in the PRL an IPv4 address in the PRL
5.2.3. Router Specification 5.2.3. Router Specification
Advertising ISATAP interfaces of routers behave the same as Advertising ISATAP interfaces of routers behave the same as advertis-
advertising interfaces described in [DISC,6.2]. However, periodic ing interfaces described in [DISC,6.2]. However, periodic unsolicited
unsolicited multicast Router Advertisements are not required, thus multicast Router Advertisements are not required, thus the "interval
the "interval timer" associated with advertising interfaces is not timer" associated with advertising interfaces is not used for that
used for that purpose. purpose.
When an ISATAP router receives a valid Router Solicitation on an When an ISATAP router receives a valid Router Solicitation on an
advertising ISATAP interface, it replies with a unicast Router advertising ISATAP interface, it replies with a unicast Router Adver-
Advertisement to the address of the node which sent the Router tisement to the address of the node which sent the Router Solicita-
Solicitation. The source address of the Router Advertisement is a tion. The source address of the Router Advertisement is a link-local
link-local unicast address associated with the interface. This MAY unicast address associated with the interface. This MAY be the same
be the same as the destination address of the Router Solicitation. as the destination address of the Router Solicitation. ISATAP routers
ISATAP routers MAY engage in the polling process described under MAY engage in the polling process described under Host Specification
Host Specification below (e.g. if Router Advertisement consistency below (e.g. if Router Advertisement consistency verification
verification [DISC,6.2.7] is desired), but this is not required. [DISC,6.2.7] is desired), but this is not required.
5.2.4. Host Specification 5.2.4. Host Specification
Hosts periodically poll each entry in the PRL ("PRL(i)") by sending Hosts periodically poll each entry in the PRL ("PRL(i)") by sending
unicast Router Solicitation messages using the IPv4 address unicast Router Solicitation messages using the IPv4 address
("V4ADDR_PRL(i)") and associated timer in the entry. Hosts add the ("V4ADDR_PRL(i)") and associated timer in the entry. Hosts add the
following variable to support the polling process: following variable to support the polling process:
MinRouterSolicitInterval MinRouterSolicitInterval
Minimum time between sending Router Solicitations Minimum time between sending Router Solicitations
to any router. Default and suggested minimum: 15min to any router. Default and suggested minimum: 15min
When PRL(i) is first added to the list, the host sets its associated When PRL(i) is first added to the list, the host sets its associated
timer to MinRouterSolicitInterval. timer to MinRouterSolicitInterval.
Entries are polled when they are created (following a short delay as Entries are polled when they are created (following a short delay as
for initial solicitations [ND,6.3.7]), and when the associated timer for initial solicitations [ND,6.3.7]), and when the associated timer
expires. expires.
Polling consists of sending Router Solicitations to the ISATAP Polling consists of sending Router Solicitations to the ISATAP link-
link-local address constructed from the entry's IPv4 address, i.e., local address constructed from the entry's IPv4 address, i.e., they
they are sent to 'FE80::0:5EFE:V4ADDR_PRL(i)' instead of 'All-Routers are sent to 'FE80::0:5EFE:V4ADDR_PRL(i)' instead of 'All-Routers mul-
multicast'. They are otherwise sent in the same manner described in ticast'. They are otherwise sent in the same manner described in
[DISC,6.3.7]. [DISC,6.3.7].
When the host receives a valid Router Advertisement (i.e., one that When the host receives a valid Router Advertisement (i.e., one that
satisfies the validity checks in sections 4.5 and 5.2.2) it processes satisfies the validity checks in sections 4.5 and 5.2.2) it processes
them in the same manner described in [DISC,6.3.4]. The host them in the same manner described in [DISC,6.3.4]. The host addition-
additionally resets the timer associated with the PRL entry that ally resets the timer associated with the PRL entry that matches the
matches the network-layer source address in the Router Advertisement. network-layer source address in the Router Advertisement. The timer
The timer is reset to either 0.5 * (the minimum value in the router is reset to either 0.5 * (the minimum value in the router lifetime or
lifetime or valid lifetime of any on-link prefixes advertised) or valid lifetime of any on-link prefixes advertised) or MinRouterSolic-
MinRouterSolicitInterval; whichever is longer. itInterval; whichever is longer.
********************************************************************
Operational Issue #4.2:
The Router and Host specifications above effectively treat the IPv4
path as a single IPv6 hop. The host caches link state information for
the hop, but the link is unidirectional (from the host to the router)
and subject to change due to network topology fluctuations. The
router caches no information, thus has no level of assurance that the
host will receive critical ICMPv6 messages, e.g., ICMPv6 Packet Too
Big.
********************************************************************
********************************************************************
Operational Issue #5:
Solutions to 4.1 and 4.2 above may impart control message overhead
explosion if hosts are to poll all routers in the PRL as currently
suggested above.
********************************************************************
6. ISATAP Deployment Considerations 6. ISATAP Deployment Considerations
6.1. Host And Router Deployment Considerations 6.1. Host And Router Deployment Considerations
For hosts, if an underlying link supports both IPv4 (over which For hosts, if an underlying link supports both IPv4 (over which ISA-
ISATAP is implemented) and also supports IPv6 natively, then ISATAP TAP is implemented) and also supports IPv6 natively, then ISATAP MAY
MAY be enabled if the native IPv6 layer does not receive Router be enabled if the native IPv6 layer does not receive Router Adver-
Advertisements (i.e., does not have connection with an IPv6 router). tisements (i.e., does not have connection with an IPv6 router). After
After a non-link-local address has been configured and a default a non-link-local address has been configured and a default router
router acquired on the native link, the host SHOULD discontinue the acquired on the native link, the host SHOULD discontinue the 'Router
'Router Polling Process' process specified in section 5.2.4 and allow Polling Process' process specified in section 5.2.4 and allow exist-
existing ISATAP address configurations to expire as specified in ing ISATAP address configurations to expire as specified in
[DISC,5.3][AUTO,5.5.4]. In this way, ISATAP use will gradually [DISC,5.3][AUTO,5.5.4]. In this way, ISATAP use will gradually dimin-
diminish as IPv6 routers are widely deployed throughout the site. ish as IPv6 routers are widely deployed throughout the site.
Routers MAY configure a native link to simultaneously support both Routers MAY configure a native link to simultaneously support both
native IPv6, and also ISATAP (over IPv4). Routing will operate as native IPv6, and also ISATAP (over IPv4). Routing will operate as
usual between these two domains. Note that the prefixes used on the usual between these two domains. Note that the prefixes used on the
ISATAP and native IPv6 interfaces will be distinct. The IPv4 ISATAP and native IPv6 interfaces will be distinct. The IPv4
address(es) configured on a router's ISATAP interface(s) SHOULD be address(es) configured on a router's ISATAP interface(s) SHOULD be
added (either automatically or manually) to the site's address added (either automatically or manually) to the site's address
records for ISATAP router interfaces (see section 5.2.1). records for ISATAP router interfaces (see section 5.2.1).
6.2. Site Administration Considerations 6.2. Site Administration Considerations
skipping to change at page 10, line 48 skipping to change at page 11, line 32
can deployed with no reconfiguration requirements for hosts. can deployed with no reconfiguration requirements for hosts.
- ISATAP nodes periodically send Router Solicitations to all entries - ISATAP nodes periodically send Router Solicitations to all entries
in the Potential Router List. Worst-case control traffic is on the in the Potential Router List. Worst-case control traffic is on the
order of (M x N), where 'M' is the number of routers in the Potential order of (M x N), where 'M' is the number of routers in the Potential
Router List and 'N' is the total number of nodes on the ISATAP link. Router List and 'N' is the total number of nodes on the ISATAP link.
The MinRouterSolicitInterval ([5.2.4]) bounds control traffic for The MinRouterSolicitInterval ([5.2.4]) bounds control traffic for
large numbers of nodes even in worst-case scenarios. large numbers of nodes even in worst-case scenarios.
- ISATAP nodes periodically refresh the entries on the PRL, typically - ISATAP nodes periodically refresh the entries on the PRL, typically
by polling the DNS. Responsible site administration, along with by polling the DNS. Responsible site administration can reduce the
robust protocol implementations, can provide significant reductions control traffic. At a minimum, administrators SHOULD ensure that
in control traffic. At a minimum, administrators SHOULD ensure that
the site's address records for ISATAP router interfaces (see the site's address records for ISATAP router interfaces (see
section 5.2.1) are well maintained. section 5.2.1) are well maintained.
********************************************************************
Operational Issue #6:
Sites may enable Network Address Translators (NATs) internally, but
most NATs work only for UDP/IPv4 and TCP/IPv4 packets. ISATAP uses
IPv6/IPv4 encapsulation, and may encounter operational problems in
sites that deploy NATs internally.
********************************************************************
7. IANA considerations 7. IANA considerations
We propose that IANA adopt the interface identifier construction Appendix B gives historical considerations for managing the IEEE OUI
specified in section 4.1 for the existing IANA IEEE OUI registration assigned to IANA for EUI-64 interface identifier construction. These
('00-00-5E'). considerations are noted and made freely available to IANA for any
purpose they may find useful.
8. Security considerations 8. Security considerations
Site administrators are advised that, in addition to possible attacks Site administrators are advised that, in addition to possible attacks
against IPv6, security attacks against IPv4 MUST also be considered. against IPv6, security attacks against IPv4 MUST also be considered.
Many security considerations in [6OVER4,9] apply also to ISATAP. Many security considerations in [6OVER4,9] apply also to ISATAP.
Responsible IPv4 site security management is strongly encouraged. In Responsible IPv4 site security management is strongly encouraged. In
particular, border gateways SHOULD implement filtering to detect particular, border gateways SHOULD implement filtering to detect
spoofed IPv4 source addresses at a minimum; ip-protocol-41 filtering spoofed IPv4 source addresses at a minimum; ip-protocol-41 filtering
SHOULD also be implemented. SHOULD also be implemented.
If IPv4 source address filtering is not correctly implemented, the If IPv4 source address filtering is not correctly implemented, the
validity checks in section 4.7 will not be effective in preventing validity checks in section 4.7 will not be effective in preventing
IPv6 source address spoofing. IPv6 source address spoofing.
If filtering for ip-protocol-41 is not correctly implemented, IPv6 If filtering for ip-protocol-41 is not correctly implemented, IPv6
source address spoofing is clearly possible, but this can be source address spoofing is clearly possible, but this can be elimi-
eliminated if both IPv4 source address filtering, and the validity nated if both IPv4 source address filtering, and the validity checks
checks in section 4.7 are implemented. in section 4.7 are implemented.
[DISC,6.1.2] implies that nodes trust Router Advertisements they [DISC,6.1.2] implies that nodes trust Router Advertisements they
receive from on-link routers, as indicated by a value of 255 in the receive from on-link routers, as indicated by a value of 255 in the
IPv6 'hop-limit' field. Since this field is not decremented when IPv6 'hop-limit' field. Since this field is not decremented when ip-
ip-protocol-41 packets traverse multiple IPv4 hops [MECH,3.3], ISATAP protocol-41 packets traverse multiple IPv4 hops [MECH,3.3], ISATAP
links require a different trust model. In particular, ONLY those links require a different trust model. In particular, ONLY those
Router Advertisements received from a member of the Potential Routers Router Advertisements received from a member of the Potential Routers
List are trusted; all others are silently discarded (see section List are trusted; all others are silently discarded (see section
5.2.2). This trust model is predicated on IPv4 source address 5.2.2). This trust model is predicated on IPv4 source address filter-
filtering, as described above. ing, as described above.
********************************************************************
Operational Issue #7:
The above trust basis specification incurs the same issue identified
in "Operational Issue #3.
********************************************************************
The ISATAP address format does not support privacy extensions for The ISATAP address format does not support privacy extensions for
stateless address autoconfiguration [PRIVACY]. However, since the stateless address autoconfiguration [PRIVACY]. However, since the
ISATAP interface identifier is derived from the node's IPv4 address, ISATAP interface identifier is derived from the node's IPv4 address,
ISATAP addresses do not have the same level of privacy concerns as ISATAP addresses do not have the same level of privacy concerns as
IPv6 addresses that use an interface identifier derived from the MAC IPv6 addresses that use an interface identifier derived from the MAC
address. address.
Acknowledgements Acknowledgements
Some of the ideas presented in this draft were derived from work at Some of the ideas presented in this draft were derived from work at
SRI with internal funds and contractual support. Government sponsors SRI with internal funds and contractual support. Government sponsors
who supported the work include Monica Farah-Stapleton and Russell who supported the work include Monica Farah-Stapleton and Russell
Langan from U.S. Army CECOM ASEO, and Dr. Allen Moshfegh from U.S. Langan from U.S. Army CECOM ASEO, and Dr. Allen Moshfegh from U.S.
Office of Naval Research. Within SRI, Dr. Mike Frankel, J. Peter Office of Naval Research. Within SRI, Dr. Mike Frankel, J. Peter Mar-
Marcotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry supported the cotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry supported the work
work and helped foster early interest. and helped foster early interest.
The following peer reviewers are acknowledged for taking the time to The following peer reviewers are acknowledged for taking the time to
review a pre-release of this document and provide input: Jim Bound, review a pre-release of this document and provide input: Jim Bound,
Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole
Troan, Vlad Yasevich. Troan, Vlad Yasevich.
The authors acknowledge members of the NGTRANS community who have The authors acknowledge members of the NGTRANS community who have
made significant contributions to this effort, including Rich Draves, made significant contributions to this effort, including Rich Draves,
Alain Durand, Nathan Lutchansky, Art Shelest, Margaret Wasserman, and Alain Durand, Nathan Lutchansky, Art Shelest, Margaret Wasserman, and
Brian Zill. Brian Zill.
The authors wish to acknowledge the work of Quang Nguyen [VET] under
the guidance of Dr. Lixia Zhang that proposed very similar ideas to
those that appear in this document. This work was first brought to
the authors' attention on September 20, 2002.
Finally, the authors recognize that ideas similar to those in this Finally, the authors recognize that ideas similar to those in this
document may have already been presented by others and wish to document may have already been presented by others and wish to
acknowledge any other such contributions. acknowledge any other such contributions.
Normative References Normative References
[ADDR] Hinden, R., and S. Deering, "IP Version 6 Addressing [ADDR] Hinden, R., and S. Deering, "IP Version 6 Addressing
Architecture", RFC 2373, July 1998. (Pending approval Architecture", RFC 2373, July 1998. (Pending approval
of "addr-arch-v3"). of "addr-arch-v3").
skipping to change at page 12, line 45 skipping to change at page 14, line 11
[AUTO] Thomson, S., and T. Narten, "IPv6 Stateless Address [AUTO] Thomson, S., and T. Narten, "IPv6 Stateless Address
Autoconfiguration", RFC 2462, December 1998. Autoconfiguration", RFC 2462, December 1998.
[DISC] Narten, T., Nordmark, E., and W. Simpson, "Neighbor [DISC] Narten, T., Nordmark, E., and W. Simpson, "Neighbor
Discovery for IP Version 6 (IPv6)", RFC 2461, Discovery for IP Version 6 (IPv6)", RFC 2461,
December 1998. December 1998.
[EUI64] IEEE, "Guidelines for 64-bit Global Identifier (EUI-64) [EUI64] IEEE, "Guidelines for 64-bit Global Identifier (EUI-64)
Registration Authority", Registration Authority",
http://standards.ieee.org/regauth/oui/tutorials/EUI64.html, http://standards.ieee.org/regauth/oui/tutori-
als/EUI64.html,
March 1997. March 1997.
[ICMPv6] Conta, A. and S. Deering, "Internet Control Message [ICMPv6] Conta, A. and S. Deering, "Internet Control Message
Protocol (ICMPv6) for the Internet Protocol Version 6 Protocol (ICMPv6) for the Internet Protocol Version 6
(IPv6) Specification", RFC 2463, December 1998. (IPv6) Specification", RFC 2463, December 1998.
[IPV4] Postel, J., "Internet Protocol", RFC 791. [IPV4] Postel, J., "Internet Protocol", RFC 791.
[IPV6] Deering, S., and R. Hinden, "Internet Protocol, Version 6 [IPV6] Deering, S., and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460. (IPv6) Specification", RFC 2460.
skipping to change at page 13, line 45 skipping to change at page 15, line 11
[PRIVACY] Narten, T., R. Draves, "Privacy Extensions for Stateless [PRIVACY] Narten, T., R. Draves, "Privacy Extensions for Stateless
Address Autoconfiguration in IPv6", RFC 3041, Address Autoconfiguration in IPv6", RFC 3041,
January 2001. January 2001.
[RFC1035] Mockapetris, P., "Domain Names - Implementation and [RFC1035] Mockapetris, P., "Domain Names - Implementation and
Specification", RFC 1035, November 1987. Specification", RFC 1035, November 1987.
[RFC2219] Hamilton, M., and R. Wright, "Use of DNS Aliases for [RFC2219] Hamilton, M., and R. Wright, "Use of DNS Aliases for
Network Services", RFC 2219 (BCP), October 1997. Network Services", RFC 2219 (BCP), October 1997.
[VET] Nguyen, Quang, "Virtual Ethernet: A New Approach to
IPv6 Transition", http://irl.cs.ucla.edu/vet/report.ps,
MS Project Report, Spring 1998.
Authors Addresses Authors Addresses
Fred L. Templin Fred L. Templin
SRI International Nokia
333 Ravenswood Ave. 313 Fairchild Drive
Menlo Park, CA 94025, USA Mountain View, CA, USA
Phone: (650)-859-3144 Phone: (650)-625-2331
Email: templin@erg.sri.com Email: ftemplin@iprg.nokia.com
Tim Gleeson Tim Gleeson
Cisco Systems K.K. Cisco Systems K.K.
Shinjuku Mitsu Building Shinjuku Mitsu Building
2-1-1 Nishishinjuku, Shinjuku-ku 2-1-1 Nishishinjuku, Shinjuku-ku
Tokyo 163-0409, JAPAN Tokyo 163-0409, JAPAN
email: tgleeson@cisco.com email: tgleeson@cisco.com
Mohit Talwar Mohit Talwar
Microsoft Corporation Microsoft Corporation
skipping to change at page 14, line 29 skipping to change at page 15, line 47
Dave Thaler Dave Thaler
Microsoft Corporation Microsoft Corporation
One Microsoft Way One Microsoft Way
Redmond, WA 98052-6399 Redmond, WA 98052-6399
Phone: +1 425 703 8835 Phone: +1 425 703 8835
EMail: dthaler@microsoft.com EMail: dthaler@microsoft.com
APPENDIX A: Major Changes APPENDIX A: Major Changes
changes from version 04 to version 05:
- Moved historical text in section 4.1 to Appendix B in
response to comments from Pekka Savola
- Identified operational issues for anticipated deployment
scenarios
- Included SRI IPR statement and contact information
- Included reference to Quang Nguyen work
changes from version 03 to version 04: changes from version 03 to version 04:
- Re-wrote section on Potential Router List initialization to - Re-wrote section on Potential Router List initialization to
reference existing precedence in other documents reference existing precedence in other documents
- several minor wording changes based on feedback from the - several minor wording changes based on feedback from the
community community
changes from version 02 to version 03: changes from version 02 to version 03:
skipping to change at page 15, line 12 skipping to change at page 16, line 38
changes from version 01 to version 02: changes from version 01 to version 02:
- Cleaned up text and tightened up terminology. Changed "IPv6 destination - Cleaned up text and tightened up terminology. Changed "IPv6 destination
address" to "IPv6 next-hop address" under "sending rules". Changed address" to "IPv6 next-hop address" under "sending rules". Changed
definition of ISATAP prefix to include link and site-local. Changed definition of ISATAP prefix to include link and site-local. Changed
language in sections 4 and 5 language in sections 4 and 5
changes from version 00 to version 01: changes from version 00 to version 01:
- Revised draft to require different /64 prefixs for ISATAP - Revised draft to require different /64 prefixes for ISATAP
addresses and native IPv6 addresses. Thus, a node's ISATAP addresses and native IPv6 addresses. Thus, a node's ISATAP
interface is assigned a /64 prefix that is distinct from the interface is assigned a /64 prefix that is distinct from the
prefixes assigned to any other interfaces attached to the prefixes assigned to any other interfaces attached to the
node - be they physical or logical interfaces. This approach node - be they physical or logical interfaces. This approach
eliminates ISATAP-specific sending rules presented in earlier eliminates ISATAP-specific sending rules presented in earlier
draft versions. draft versions.
- Changed sense of 'u/l' bit in the ISATAP address interface - Changed sense of 'u/l' bit in the ISATAP address interface
identifier to indicate "local scope", since ISATAP interface identifier to indicate "local scope", since ISATAP interface
identifiers are unique only within the scope of the ISATAP identifiers are unique only within the scope of the ISATAP
skipping to change at page 15, line 24 skipping to change at page 17, line 4
interface is assigned a /64 prefix that is distinct from the interface is assigned a /64 prefix that is distinct from the
prefixes assigned to any other interfaces attached to the prefixes assigned to any other interfaces attached to the
node - be they physical or logical interfaces. This approach node - be they physical or logical interfaces. This approach
eliminates ISATAP-specific sending rules presented in earlier eliminates ISATAP-specific sending rules presented in earlier
draft versions. draft versions.
- Changed sense of 'u/l' bit in the ISATAP address interface - Changed sense of 'u/l' bit in the ISATAP address interface
identifier to indicate "local scope", since ISATAP interface identifier to indicate "local scope", since ISATAP interface
identifiers are unique only within the scope of the ISATAP identifiers are unique only within the scope of the ISATAP
prefix. (See section 4.) prefix. (See section 4.)
changes from personal draft to version 00: changes from personal draft to version 00:
- Title change to provide higher-level description of field of - Title change to provide higher-level description of field of
use addressed by this draft. Removed other extraneous text. use addressed by this draft. Removed other extraneous text.
- Major new section on automatic discovery of off-link IPv6 routers - Major new section on automatic discovery of off-link IPv6 routers
when IPv6-IPv4 compatibility addresses are used. when IPv6-IPv4 compatibility addresses are used.
Intellectual Property APPENDIX B: Historical Interface Identifier Construction Rules
The IETF has been notified of intellectual property rights claimed ISATAP specifies an [EUI64]-format address construction for the Orga-
in regard to some or all of the specification contained in this nizationally-Unique Identifier (OUI) owned by the Internet Assigned
document. For more information consult the online list of claimed Numbers Authority [IANA]. This format (given below) is used to con-
rights. struct both native [EUI64] addresses for general use and modified
EUI-64 format interface identifiers for use in IPv6 unicast
addresses:
|0 2|2 3|3 3|4 6|
|0 3|4 1|2 9|0 3|
+------------------------+--------+--------+------------------------+
| OUI ("00-00-5E"+u+g) | TYPE | TSE | TSD |
+------------------------+--------+--------+------------------------+
Where the fields are:
OUI IANA's OUI: 00-00-5E with 'u' and 'g' bits (3 octets)
TYPE Type field; specifies interpretation of (TSE, TSD) (1 octet)
TSE Type-Specific Extension (1 octet)
TSD Type-Specific Data (3 octets)
And the following interpretations are specified based on TYPE:
TYPE (TSE, TSD) Interpretation
---- -------------------------
0x00-0xFD RESERVED for future IANA use
0xFE (TSE, TSD) together contain an embedded IPv4 address
0xFF TSD is interpreted based on TSE as follows:
TSE TSD Interpretation
--- ------------------
0x00-0xFD RESERVED for future IANA use
0xFE TSD contains 24-bit EUI-48 intf id
0xFF RESERVED by IEEE/RAC
Thus, if TYPE=0xFE, TSE is an extension of TSD. If TYPE=0xFF, TSE is
an extension of TYPE. Other values for TYPE (hence, other interpreta-
tions of TSE, TSD) are reserved for future IANA use.
The above specification is compatible with all aspects of [EUI64],
including support for encapsulating legacy EUI-48 interface identi-
fiers (e.g., an IANA EUI-48 format multicast address such as:
'01-00-5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03').
But, the specification also provides a special TYPE (0xFE) to indi-
cate an IPv4 address is embedded. Thus, when the first four octets of
a [ADDR]-compatible IPv6 interface identifier are: '00-00-5E-FE'
(note: the 'u/l' bit MUST be 0) the interface identifier is said to
be in "ISATAP format" and the next four octets embed an IPv4 address
encoded in network byte order.
INTELLECTUAL PROPERTY
SRI International has sent the following message to the IETF Execu-
tive Director (Steve Coya) regarding intellectual property rights.
(An auto-reply from Steve Coya's mailer also appears below.) Please
direct all inquiries regarding intellectual property rights pertain-
ing to this document to the contact given in the message below:
Date: Tue, 15 Oct 2002 15:37:47 -0700
To: scoya@ietf.org
From: Peter Marcotullio <jpm@erg.sri.com>
Subject: Revised IPR statement
Dear Mr. Coya,
Please replace SRI's previous IPR statement for the ISATAP Draft "ISI
patent statement pertaining to draft-ietf-ngtrans-isatap" (by the way the
previous statement was mislabeled as "ISI" when it should have been "SRI
International") with the following:
SRI International Patent statement pertaining to draft-ietf-ngtrans-isatap
Statement for 'draft-ietf-ngtrans-isatap-04.txt':
*****************************************************
Patent Rights Statement. SRI International has filed one or more patent
applications pertaining to aspects of this submission. SRI grants
royalty-free permission under such applications and resulting patents for
both commercial and non-commercial uses, for development of and compliance
with IETF standardization purposes. Any aspects or variants of SRI's
submission or intellectual property that are not included in IETF
standards and/or are not necessary for compliance with IETF standards may
require an additional license from SRI under terms to be negotiated by the
parties.
Please feel free to contact me if you have any questions or comments.
Thanks,
Peter Marcotullio
Please note that this revised IPR statement expands the rights that SRI is
granting to the IETF community.
------------------------------------------------------------------------------
Peter Marcotullio
Director, Business Development
Information, Telecommunications and Automation Division
SRI International
333 Ravenswood Ave.
Menlo Park, CA 94025
+1 650.859.5457
+1 650.859.4812 fax
peter.marcotullio@sri.com
www.sri.com
Date: Tue, 15 Oct 2002 18:35:46 -0400 (EDT)
From: Steve Coya <scoya@ietf.org>
Subject: Gone again
X-Spam-Status: No, score=0.7 threshold=6.0
X-Spam-Level: x
Hi, this is Steve Coya's mail account.
Steve is out of the office and will not return until Tuesday,
October 22. He will NOT be able to respond to email during that
period.
I will make Steve read your message regarding "Revised IPR statement" when he
returns (though replies may take longer - sigh).
Thanks for your patience and understanding.
 End of changes. 

This html diff was produced by rfcdiff 1.25, available from http://www.levkowetz.com/ietf/tools/rfcdiff/