draft-ietf-ngtrans-isatap-13.txt   draft-ietf-ngtrans-isatap-14.txt 
Network Working Group F. Templin Network Working Group F. Templin
Internet-Draft Nokia Internet-Draft Nokia
Expires: September 25, 2003 T. Gleeson Expires: February 23, 2004 T. Gleeson
Cisco Systems K.K. Cisco Systems K.K.
M. Talwar M. Talwar
D. Thaler D. Thaler
Microsoft Corporation Microsoft Corporation
March 27, 2003 August 25, 2003
Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)
draft-ietf-ngtrans-isatap-13.txt draft-ietf-ngtrans-isatap-14.txt
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts. groups may also distribute working documents as Internet-Drafts.
skipping to change at page 1, line 35 skipping to change at page 1, line 35
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at http:// The list of current Internet-Drafts can be accessed at http://
www.ietf.org/ietf/1id-abstracts.txt. www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on September 25, 2003. This Internet-Draft will expire on February 23, 2004.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved. Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract Abstract
This document specifies an Intra-Site Automatic Tunnel Addressing This document specifies an Intra-Site Automatic Tunnel Addressing
Protocol (ISATAP) that connects IPv6 hosts and routers within IPv4 Protocol (ISATAP) that connects IPv6 hosts and routers within IPv4
sites. ISATAP treats the site's IPv4 infrastructure as a link layer sites. ISATAP treats the site's IPv4 infrastructure as a link layer
for IPv6 with no requirement for IPv4 multicast. ISATAP enables for IPv6 with no requirement for IPv4 multicast. ISATAP enables
intra-site automatic IPv6-in-IPv4 tunneling whether globally assigned intra-site automatic IPv6-in-IPv4 tunneling whether globally assigned
or private IPv4 addresses are used. or private IPv4 addresses are used.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Applicability Statement . . . . . . . . . . . . . . . . . . . 3 2. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 4. Basic IPv6 Operation . . . . . . . . . . . . . . . . . . . . . 4
5. Basic IPv6 Operation . . . . . . . . . . . . . . . . . . . . . 4 5. Automatic Tunneling . . . . . . . . . . . . . . . . . . . . . 5
6. Automatic Tunneling . . . . . . . . . . . . . . . . . . . . . 5 6. Neighbor Discovery . . . . . . . . . . . . . . . . . . . . . . 6
7. Neighbor Discovery . . . . . . . . . . . . . . . . . . . . . . 6 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
8. Deployment Considerations . . . . . . . . . . . . . . . . . . 9 8. Security considerations . . . . . . . . . . . . . . . . . . . 9
9. Site Administration Considerations . . . . . . . . . . . . . . 9 9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9
10. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 Normative References . . . . . . . . . . . . . . . . . . . . . 10
11. Security considerations . . . . . . . . . . . . . . . . . . . 10 Informative References . . . . . . . . . . . . . . . . . . . . 10
12. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
Normative References . . . . . . . . . . . . . . . . . . . . . 11
Informative References . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12
A. Major Changes . . . . . . . . . . . . . . . . . . . . . . . . 13 A. Major Changes . . . . . . . . . . . . . . . . . . . . . . . . 12
B. Rationale for Interface Identifier Construction . . . . . . . 15 B. Rationale for Interface Identifier Construction . . . . . . . 14
C. Deployment Considerations . . . . . . . . . . . . . . . . . . 15
D. Site Administration Considerations . . . . . . . . . . . . . . 15
Intellectual Property and Copyright Statements . . . . . . . . 17 Intellectual Property and Copyright Statements . . . . . . . . 17
1. Introduction 1. Introduction
This document presents a simple approach called the Intra-Site This document presents a simple approach called the Intra-Site
Automatic Tunnel Addressing Protocol (ISATAP) that enables Automatic Tunnel Addressing Protocol (ISATAP) that enables
incremental deployment of IPv6 [RFC2460] within IPv4 [RFC0791] sites. incremental deployment of IPv6 [RFC2460] within IPv4 [RFC0791] sites.
ISATAP allows dual-stack nodes that do not share a physical link with ISATAP allows dual-stack nodes that do not share a physical link with
an IPv6 router to automatically tunnel packets to the IPv6 next-hop an IPv6 router to automatically tunnel packets to the IPv6 next-hop
address through IPv4, i.e., the site's IPv4 infrastructure is treated address through IPv4, i.e., the site's IPv4 infrastructure is treated
as a link layer for IPv6. as a link layer for IPv6.
Specific details for the operation of IPv6 and automatic tunneling Specific details for the operation of IPv6 and automatic tunneling
using ISATAP are given, including an interface identifier format that using ISATAP are given, including an interface identifier format that
embeds an IPv4 address. This format supports IPv6 address embeds an IPv4 address. This format supports IPv6 address
configuration and simple link-layer address mapping. Also specified configuration and simple link-layer address mapping. Also specified
is the operation of IPv6 Neighbor Discovery and deployment/security is the operation of IPv6 Neighbor Discovery and deployment/security
considerations. considerations.
2. Applicability Statement 2. Requirements
ISATAP provides the following features:
o treats site's IPv4 infrastructure as a link layer for IPv6 using
automatic IPv6-in-IPv4 tunneling
o enables incremental deployment of IPv6 hosts within IPv4 sites
with no aggregation scaling issues at border gateways
o requires no special IPv4 services within the site (e.g.,
multicast)
o supports both stateless and stateful autoconfiguration as well as
manual configuration
o supports networks that use non-globally unique IPv4 addresses
(e.g., when private address allocations [RFC1918] are used)
o compatible with other NGTRANS mechanisms (e.g., 6to4 [RFC3056])
3. Requirements
The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD,
SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this
document, are to be interpreted as described in [RFC2119]. document, are to be interpreted as described in [RFC2119].
This document also makes use of internal conceptual variables to This document also makes use of internal conceptual variables to
describe protocol behavior and external variables that an describe protocol behavior and external variables that an
implementation must allow system administrators to change. The implementation must allow system administrators to change. The
specific variable names, how their values change, and how their specific variable names, how their values change, and how their
settings influence protocol behavior are provided to demonstrate settings influence protocol behavior are provided to demonstrate
protocol behavior. An implementation is not required to have them in protocol behavior. An implementation is not required to have them in
the exact form described here, so long as its external behavior is the exact form described here, so long as its external behavior is
consistent with that described in this document. consistent with that described in this document.
4. Terminology 3. Terminology
The terminology of [RFC2460] applies to this document. The following The terminology of [RFC2460] applies to this document. The following
additional terms are defined: additional terms are defined:
link, on-link, off-link: link, on-link, off-link:
same definitions as ([RFC2461], section 2.1). same definitions as ([RFC2461], section 2.1).
underlying link: underlying link:
a link layer that supports IPv4 (for ISATAP), and MAY also support a link layer that supports IPv4 (for ISATAP), and MAY also support
IPv6 natively. IPv6 natively.
ISATAP interface: ISATAP interface:
an interface configured over one or more underling links. an interface configured over one or more underling links.
advertising ISATAP interface: advertising ISATAP interface:
same meaning as "advertising interface" in ([RFC2461], section same meaning as "advertising interface" in ([RFC2461], section
6.2.2). 6.2.2).
ISATAP address: ISATAP address:
an on-link address on an ISATAP interface and with an interface an address with an on-link prefix on an ISATAP interface and with
identifier constructed as specified in Section 5.1 an interface identifier constructed as specified in Section 4.1
5. Basic IPv6 Operation 4. Basic IPv6 Operation
ISATAP interfaces automatically tunnel IPv6 packets using the site's ISATAP interfaces automatically tunnel IPv6 packets using the site's
IPv4 infrastructure as a link layer for IPv6, i.e., IPv6 treats the IPv4 infrastructure as a link layer for IPv6, i.e., IPv6 treats the
site's IPv4 infrastructure as a Non-Broadcast, Multiple Access (NBMA) site's IPv4 infrastructure as a Non-Broadcast, Multiple Access (NBMA)
link layer. The mechanisms in [RFC2491] are used, with the following link layer. The mechanisms in [RFC2491] are used, with the following
noted exceptions for ISATAP: noted exceptions for ISATAP:
5.1 Interface Identifiers and Unicast Addresses 4.1 Interface Identifiers and Unicast Addresses
ISATAP interface identifiers use "modified EUI-64" format ([ARCH], ISATAP interface identifiers use "modified EUI-64" format ([RFC3513],
section 2.5.1) and are formed by appending an IPv4 address assigned section 2.5.1) and are formed by appending an IPv4 address assigned
to an underlying link to the 32-bit string '00-00-5E-FE'. Appendix B to an underlying link to the 32-bit string '00-00-5E-FE'. Appendix B
includes non-normative rationale for this construction rule. includes non-normative rationale for this construction rule.
IPv6 global and local-use ([ARCH], sections 2.5.4, 2.5.6) ISATAP IPv6 global and local-use ([RFC3513], sections 2.5.4, 2.5.6) ISATAP
addresses are constructed as follows: addresses are constructed as follows:
| 64 bits | 32 bits | 32 bits | | 64 bits | 32 bits | 32 bits |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
| global/local unicast prefix | 0000:5EFE | IPv4 Address | | global/local unicast prefix | 0000:5EFE | IPv4 Address |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
5.2 ISATAP Interface Configuration 4.2 ISATAP Interface Configuration
ISATAP interfaces are configured over one or more underlying links ISATAP interfaces are configured over one or more underlying links
that support IPv4 for tunneling within a site; each IPv4 address that support IPv4 for tunneling within a site; each IPv4 address
assigned to an underlying link is seen as a link-layer address for assigned to an underlying link is seen as a link-layer address for
ISATAP. ISATAP.
5.3 Link Layer Address Options 4.3 Link Layer Address Options
With reference to ([RFC2491], section 5.2), when the [NTL] and [STL] With reference to ([RFC2491], section 5.2), when the [NTL] and [STL]
fields in an ISATAP link layer address option encode 0, the [NBMA fields in an ISATAP link layer address option encode 0, the [NBMA
Number] field encodes a 4-octet IPv4 address. Number] field encodes a 4-octet IPv4 address.
5.4 Multicast and Anycast 4.4 Multicast and Anycast
ISATAP interfaces recognize an IPv6 node's required addresses ISATAP interfaces recognize an IPv6 node's required addresses
([ARCH], section 2.8), including certain multicast/anycast addresses. ([RFC3513], section 2.8), including certain multicast/anycast
addresses.
Mechanisms for multicast/anycast emulation on ISATAP interfaces Mechanisms for multicast/anycast emulation on ISATAP interfaces
(e.g., adaptations of MLD [RFC2710], PIM-SM [RFC2362], MARS (e.g., adaptations of MLD [RFC2710], PIM-SM [RFC2362], MARS
[RFC2022], etc.) are subject for future companion document(s). [RFC2022], etc.) are subject for future companion document(s).
6. Automatic Tunneling 5. Automatic Tunneling
The common tunneling mechanisms specified in ([MECH], sections 2 and The common tunneling mechanisms specified in ([MECH], sections 2 and
3) are used, with the following noted considerations for ISATAP: 3) are used, with the following noted considerations for ISATAP:
6.1 Tunnel MTU and Fragmentation 5.1 Tunnel MTU and Fragmentation
ISATAP automatic tunnel interfaces may be configured over multiple ISATAP automatic tunnel interfaces may be configured over multiple
underlying links with diverse maximum transmission units (MTUs). The underlying links with diverse maximum transmission units (MTUs). The
minimum MTU for IPv6 interfaces is 1280 bytes ([RFC2460], Section 5), minimum MTU for IPv6 interfaces is 1280 bytes ([RFC2460], Section 5),
but the following considerations apply for ISATAP interfaces: but the following considerations apply for ISATAP interfaces:
o Nearly all IPv4 nodes connect to physical links with MTUs of 1500 o Nearly all IPv4 nodes connect to physical links with MTUs of 1500
bytes or larger (e.g., Ethernet) bytes or larger (e.g., Ethernet)
o Sub-IPv4 layer encapsulations (e.g., VPN) may occur on some paths o Sub-IPv4 layer encapsulations (e.g., VPN) may occur on some paths
skipping to change at page 6, line 17 skipping to change at page 5, line 42
predominant deployment case, the ISATAP interface MTU, or "LinkMTU" predominant deployment case, the ISATAP interface MTU, or "LinkMTU"
(see: [RFC2461], Section 6.3.2), SHOULD be set to no more than 1380 (see: [RFC2461], Section 6.3.2), SHOULD be set to no more than 1380
bytes (1400 minus 20 bytes for IPv4 encapsulation). LinkMTU MAY be bytes (1400 minus 20 bytes for IPv4 encapsulation). LinkMTU MAY be
set to larger values when a dynamic link layer MTU discovery set to larger values when a dynamic link layer MTU discovery
mechanism is used or when a static MTU assignment is used and mechanism is used or when a static MTU assignment is used and
additional fragmentation in the site's IPv4 network is deemed additional fragmentation in the site's IPv4 network is deemed
acceptable. acceptable.
When a dynamic IPv4 MTU discovery mechanism is not used, the ISATAP When a dynamic IPv4 MTU discovery mechanism is not used, the ISATAP
interface encapsulates IPv6 packets with the Don't Fragment (DF) bit interface encapsulates IPv6 packets with the Don't Fragment (DF) bit
not set in the encapsualting IPv4 header. not set in the encapsulating IPv4 header.
6.2 Handling IPv4 ICMP Errors 5.2 Handling IPv4 ICMP Errors
ARP failures and persistent ICMPv4 errors SHOULD be processed as ARP failures and persistent ICMPv4 errors SHOULD be processed as
link-specific information indicating that a path to a neighbor has link-specific information indicating that a path to a neighbor has
failed ([RFC2461], section 7.3.3). failed ([RFC2461], section 7.3.3).
6.3 Local-Use IPv6 Unicast Addresses 5.3 Local-Use IPv6 Unicast Addresses
The specification in ([MECH], section 3.7) is not used; the The specification in ([MECH], section 3.7) is not used; the
specification in Section 5.1 is used instead. specification in Section 4.1 is used instead.
7. Neighbor Discovery 6. Neighbor Discovery
The specification in ([MECH], section 3.8) applies only to configured The specification in ([MECH], section 3.8) applies only to configured
tunnels. [RFC2461] provides the following guidelines for tunnels. [RFC2461] provides the following guidelines for
non-broadcast multiple access (NBMA) link support: non-broadcast multiple access (NBMA) link support:
"Redirect, Neighbor Unreachability Detection and next-hop "Redirect, Neighbor Unreachability Detection and next-hop
determination should be implemented as described in this document. determination should be implemented as described in this document.
Address resolution and the mechanism for delivering Router Address resolution and the mechanism for delivering Router
Solicitations and Advertisements on NBMA links is not specified in Solicitations and Advertisements on NBMA links is not specified in
this document." this document."
ISATAP interfaces SHOULD implement Redirect, Neighbor Unreachability ISATAP interfaces SHOULD implement Redirect, Neighbor Unreachability
Detection, and next-hop determination exactly as specified in Detection, and next-hop determination exactly as specified in
[RFC2461]. Address resolution and the mechanisms for delivering [RFC2461]. Address resolution and the mechanisms for delivering
Router Solicitations and Advertisements are not specified by Router Solicitations and Advertisements are not specified by
[RFC2461]; instead, they are specified in the following sections of [RFC2461]; instead, they are specified in the following sections of
this document. this document.
7.1 Address Resolution and Neighbor Unreachability Detection 6.1 Address Resolution and Neighbor Unreachability Detection
ISATAP addresses are resolved to link-layer (IPv4) addresses by a ISATAP addresses are resolved to link-layer (IPv4) addresses by a
static computation, i.e., the last four octets are treated as an IPv4 static computation, i.e., the last four octets are treated as an IPv4
address. address.
Hosts SHOULD perform an initial reachability confirmation by sending Hosts SHOULD perform an initial reachability confirmation by sending
Neighbor Solicitation (NS) message(s) and receiving a Neighbor Neighbor Solicitation (NS) message(s) and receiving a Neighbor
Advertisement (NA) message as specified in ([RFC2461], section 7.2). Advertisement (NA) message as specified in ([RFC2461], section 7.2).
Unless otherwise specified in a future document, solicitations are Unless otherwise specified in a future document, solicitations are
sent to the target's unicast address. sent to the target's unicast address.
Hosts SHOULD additionally perform Neighbor Unreachability Detection Hosts SHOULD additionally perform Neighbor Unreachability Detection
(NUD) as specified in ([RFC2461], section 7.3). Routers MAY perform (NUD) as specified in ([RFC2461], section 7.3). Routers MAY perform
these reachability confirmation and NUD procedures, but this might these reachability confirmation and NUD procedures, but this might
not scale in all environments. not scale in all environments.
All ISATAP nodes MUST send solicited neighbor advertisements All ISATAP nodes MUST send solicited neighbor advertisements
([RFC2461], section 7.2.4). ([RFC2461], section 7.2.4).
7.2 Duplicate Address Detection 6.2 Duplicate Address Detection
Duplicate Address Detection ([RFC2462], section 5.4) is not required Duplicate Address Detection ([RFC2462], section 5.4) is not required
for ISATAP addresses, since duplicate address detection is assumed for ISATAP addresses, since duplicate address detection is assumed
already performed for the IPv4 addresses from which they derive. already performed for the IPv4 addresses from which they derive.
7.3 Router and Prefix Discovery 6.3 Router and Prefix Discovery
The following sections describe mechanisms to support the router and The following sections describe mechanisms to support the router and
prefix discovery process ([RFC2461], section 6): prefix discovery process ([RFC2461], section 6):
7.3.1 Conceptual Data Structures 6.3.1 Conceptual Data Structures
ISATAP nodes use the conceptual data structures Prefix List and ISATAP nodes use the conceptual data structures Prefix List and
Default Router List exactly as in ([RFC2461], section 5.1). ISATAP Default Router List exactly as in ([RFC2461], section 5.1). ISATAP
adds a new conceptual data structure "Potential Router List" (PRL) adds a new conceptual data structure "Potential Router List" (PRL)
and the following new configuration variable: and the following new configuration variable:
PrlRefreshInterval PrlRefreshInterval
Time in seconds between successive refreshments of the PRL after Time in seconds between successive refreshments of the PRL after
initialization. SHOULD be no less than 3,600 seconds. initialization. SHOULD be no less than 3,600 seconds.
skipping to change at page 8, line 18 skipping to change at page 7, line 44
DHCPv4, manual configuration, etc.) MAY be used. The FQDN is resolved DHCPv4, manual configuration, etc.) MAY be used. The FQDN is resolved
into IPv4 addresses for the PRL through a static host file, a into IPv4 addresses for the PRL through a static host file, a
site-specific name service, querying a DNS server within the site, or site-specific name service, querying a DNS server within the site, or
an unspecified alternate method. There are no mandatory rules for the an unspecified alternate method. There are no mandatory rules for the
selection of a FQDN, but manual configuration MUST be supported. When selection of a FQDN, but manual configuration MUST be supported. When
DNS is used, client resolvers use the IPv4 transport. DNS is used, client resolvers use the IPv4 transport.
After initialization, nodes periodically refresh the PRL (i.e., using After initialization, nodes periodically refresh the PRL (i.e., using
one or more of the methods described above) after PrlRefreshInterval. one or more of the methods described above) after PrlRefreshInterval.
7.3.2 Validation of Router Advertisements Messages 6.3.2 Validation of Router Advertisements Messages
The specification in ([RFC2461], section 6.1.2) is used. The specification in ([RFC2461], section 6.1.2) is used.
Additionally, received RA messages that contain Prefix Information Additionally, received RA messages that contain Prefix Information
options and/or encode non-zero values in the Cur Hop Limit, Router options and/or encode non-zero values in the Cur Hop Limit, Router
Lifetime, Reachable Time, or Retrans Timer fields (see: [RFC2461], Lifetime, Reachable Time, or Retrans Timer fields (see: [RFC2461],
section 4.2) MUST satisfy the following validity check for ISATAP: section 4.2) MUST satisfy the following validity check for ISATAP:
o the network-layer (IPv6) source address is an ISATAP address and o the network-layer (IPv6) source address is an ISATAP address and
embeds V4ADDR(i) for some PRL(i) embeds V4ADDR(i) for some PRL(i)
7.3.3 Router Specification 6.3.3 Router Specification
Routers with advertising ISATAP interfaces behave the same as Routers with advertising ISATAP interfaces behave the same as
described in ([RFC2461], section 6.2). As permitted by ([RFC2461], described in ([RFC2461], section 6.2). As permitted by ([RFC2461],
section 6.2.6), advertising ISATAP interfaces SHOULD send unicast RA section 6.2.6), advertising ISATAP interfaces SHOULD send unicast RA
messages to a soliciting host's unicast address when the messages to a soliciting host's unicast address when the
solicitation's source address is not the unspecified address. solicitation's source address is not the unspecified address.
7.3.4 Host Specification 6.3.4 Host Specification
Hosts behave the same as described in ([RFC2461], section 6.3) and Hosts behave the same as described in ([RFC2461], section 6.3) and
([RFC2462], section 5.5) with the following additional considerations ([RFC2462], section 5.5) with the following additional considerations
for ISATAP: for ISATAP:
7.3.4.1 Soliciting Router Advertisements 6.3.4.1 Soliciting Router Advertisements
Hosts solicit Router Advertisements (RAs) by sending Router Hosts solicit Router Advertisements (RAs) by sending Router
Solicitations (RSs) to advertising ISATAP interfaces in the PRL. The Solicitations (RSs) to advertising ISATAP interfaces in the PRL. The
manner of selecting PRL(i)'s for solicitation is up to the manner of selecting PRL(i)'s for solicitation is up to the
implementation. Hosts add the following variable to support the implementation. Hosts add the following variable to support the
solicitation process: solicitation process:
MinRouterSolicitInterval MinRouterSolicitInterval
Minimum time in seconds between successive solicitations of the Minimum time in seconds between successive solicitations of the
same advertising ISATAP interface. SHOULD be no less than 900 same advertising ISATAP interface. SHOULD be no less than 900
seconds. seconds.
Default: 900 seconds Default: 900 seconds
RS messages use a link-local unicast address from the ISATAP RS messages use a link-local unicast address from the ISATAP
interface as the IPv6 source address. Unless otherwise specified in a interface as the IPv6 source address. Unless otherwise specified in a
future document, RS messages use the link-local ISATAP address future document, RS messages use the link-local ISATAP address
constructed from V4ADDR(i) for the PRL(i) being solicited as the IPv6 constructed from V4ADDR(i) for the PRL(i) being solicited as the IPv6
destination address. destination address.
7.3.4.2 Router Advertisement Processing 6.3.4.2 Router Advertisement Processing
RA processing is exactly as specified in ([RFC2461], section 6.3.4).
Prefix options in RAs with the "L" bit not set contain prefixes that
are not considered on-link with the ISATAP interface and MAY be used
to configure non-ISATAP addresses, e.g., using [RFC2462] mechanisms.
When the source address of an RA message is an ISATAP address that When the source address of an RA message is an ISATAP address that
embeds V4ADDR(i) for some PRL(i), hosts reset TIMER(i) to schedule embeds V4ADDR(i) for some PRL(i), hosts reset TIMER(i) to schedule
the next solicitation event (see: Section 7.3.4.1). Let the next solicitation event (see: Section 6.3.4.1). Let
"MIN_LIFETIME" be the minimum value in the router lifetime or the "MIN_LIFETIME" be the minimum value in the router lifetime or the
lifetime(s) encoded in options included in the RA message. Then, lifetime(s) encoded in options included in the RA message. Then,
TIMER(i) is reset as follows: TIMER(i) is reset as follows:
TIMER(i) = MAX((0.5 * MIN_LIFETIME), MinRouterSolicitInterval) TIMER(i) = MAX((0.5 * MIN_LIFETIME), MinRouterSolicitInterval)
7.3.4.3 Stateful Autoconfiguration 6.3.4.3 Stateful Autoconfiguration
If stateful autoconfiguration is invoked ([RFC2462], sections 5.5.2, If stateful autoconfiguration is invoked ([RFC2462], sections 5.5.2,
5.5.3), the "ALL_DHCP_Relay_Agents_and_Servers" multicast address 5.5.3), the "All_DHCP_Relay_Agents_and_Servers" multicast address
([DHCPV6], section 5.1) is resolved to the link-local ISATAP address ([RFC3315], section 5.1) is resolved to V4ADDR(i) for some PRL(i).
constructed from V4ADDR(i) for some PRL(i).
8. Deployment Considerations
Hosts may enable ISATAP, e.g., when native IPv6 service is
unavailable. When native IPv6 service is acquired, hosts SHOULD
discontinue the ISATAP router solicitation process (Section 7.3.4)
and/or allow associated state to expire (see: [RFC2461], section 5.3
and [RFC2462], section 5.5.4). Any associated addresses added to the
DNS should also be removed.
Routers MAY configure both native IPv6 and ISATAP interfaces over the
same physical link. The prefixes used on each interface will be
distinct, and normal IPv6 routing between the interfaces may occur.
9. Site Administration Considerations
ISATAP sites are administratively defined by a set of advertising
interfaces and set of nodes that solicit those interfaces. Thus,
ISATAP sites are defined by administrative (not physical) boundaries.
Site administrators maintain a list of IPv4 addresses representing
advertising ISATAP interfaces and make them available via one or more
of the mechanisms described in Section 7.3.1. Responsible
administration can reduce control traffic overhead.
10. IANA Considerations 7. IANA Considerations
Modifications to the IANA "ethernet-numbers" registry (e.g., based on Modifications to the IANA "ethernet-numbers" registry (e.g., based on
text in Appendix B) are requested. text in Appendix B) are requested.
11. Security considerations 8. Security considerations
ISATAP site border routers and firewalls MUST implement IPv6 and IPv4 ISATAP site border routers and firewalls MUST implement IPv6 and IPv4
ingress filtering, including ip-protocol-41 filtering. Packets with ingress filtering, including ip-protocol-41 filtering. Packets with
local-use source and/or destination addresses MUST NOT be forwarded local-use source and/or destination addresses MUST NOT be forwarded
outside of the site. outside of the site.
Even with IPv4 and IPv6 ingress filtering, reflection attacks can Even with IPv4 and IPv6 ingress filtering, reflection attacks can
originate from compromised nodes within an ISATAP site that spoof originate from compromised nodes within an ISATAP site that spoof
IPv6 source addresses. Security mechanisms for reflection attack IPv6 source addresses. Security mechanisms for reflection attack
mitigation SHOULD be used in routers with advertising ISATAP mitigation SHOULD be used in routers with advertising ISATAP
interfaces. At a minimum, border gateways SHOULD log potential source interfaces. At a minimum, border gateways SHOULD log potential source
address spoofing cases. address spoofing cases.
ISATAP addresses do not support privacy extensions for stateless ISATAP addresses do not support privacy extensions for stateless
address autoconfiguration [RFC3041]. However, since the ISATAP address autoconfiguration [RFC3041].
interface identifier is derived from the node's IPv4 address, ISATAP
addresses do not have the same level of privacy concerns as IPv6
addresses that use an interface identifier derived from the MAC
address. (This is especially true when private address allocations
[RFC1918] are used.)
12. Acknowledgements 9. Acknowledgements
Some of the ideas presented in this draft were derived from work at Portions of this work were derived from SRI International internal
SRI with internal funds and contractual support. Government sponsors funds and government contracts. Government sponsors include Monica
who supported the work include Monica Farah-Stapleton and Russell Farah-Stapleton and Russell Langan (U.S. Army CECOM ASEO), and Dr.
Langan from U.S. Army CECOM ASEO, and Dr. Allen Moshfegh from U.S. Allen Moshfegh (U.S. Office of Naval Research). SRI International
Office of Naval Research. Within SRI, Dr. Mike Frankel, J. Peter sponsors include Dr. Mike Frankel, J. Peter Marcotullio, Lou
Marcotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry supported the Rodriguez, and Dr. Ambatipudi Sastry.
work and helped foster early interest.
The following peer reviewers are acknowledged for taking the time to The following are acknowledged for providing peer review input: Jim
review a pre-release of this document and provide input: Jim Bound, Bound, Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader,
Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole Ole Troan, Vlad Yasevich.
Troan, Vlad Yasevich.
The authors acknowledge members of the NGTRANS community who have The following additional individuals are acknowledged for their
made significant contributions to this effort, including Rich Draves, contributions: Rich Draves, Alain Durand, Nathan Lutchansky, Karen
Alain Durand, Nathan Lutchansky, Karen Nielsen, Art Shelest, Margaret Nielsen, Mohan Parthasarathy, Art Shelest, Margaret Wasserman, Brian
Wasserman, and Brian Zill. Zill.
The authors also wish to acknowledge the work of Quang Nguyen [VET] The authors also acknowledge the work of Quang Nguyen [VET] under the
under the guidance of Dr. Lixia Zhang that proposed very similar guidance of Dr. Lixia Zhang that proposed very similar ideas to those
ideas to those that appear in this document. This work was first that appear in this document. This work was first brought to the
brought to the authors' attention on September 20, 2002. authors' attention on September 20, 2002.
Normative References Normative References
[ARCH] Hinden, R. and S. Deering, "IP Version 6 Addressing
Architecture", draft-ietf-ipngwg-addr-arch-v3-11 (work in
progress), October 2002.
[MECH] Gilligan, R. and E. Nordmark, "Basic Transition Mechanisms [MECH] Gilligan, R. and E. Nordmark, "Basic Transition Mechanisms
for IPv6 Hosts and Routers", draft-ietf-v6ops-mech-v2-00 for IPv6 Hosts and Routers", draft-ietf-v6ops-mech-v2-00
(work in progress), February 2003. (work in progress), February 2003.
[RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, September [RFC0791] Postel, J., "Internet Protocol", STD 5, RFC 791, September
1981. 1981.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
skipping to change at page 11, line 50 skipping to change at page 10, line 45
Autoconfiguration", RFC 2462, December 1998. Autoconfiguration", RFC 2462, December 1998.
[RFC2463] Conta, A. and S. Deering, "Internet Control Message [RFC2463] Conta, A. and S. Deering, "Internet Control Message
Protocol (ICMPv6) for the Internet Protocol Version 6 Protocol (ICMPv6) for the Internet Protocol Version 6
(IPv6) Specification", RFC 2463, December 1998. (IPv6) Specification", RFC 2463, December 1998.
[RFC2491] Armitage, G., Schulter, P., Jork, M. and G. Harter, "IPv6 [RFC2491] Armitage, G., Schulter, P., Jork, M. and G. Harter, "IPv6
over Non-Broadcast Multiple Access (NBMA) networks", RFC over Non-Broadcast Multiple Access (NBMA) networks", RFC
2491, January 1999. 2491, January 1999.
[RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6
(IPv6) Addressing Architecture", RFC 3513, April 2003.
Informative References Informative References
[DHCPV6] Droms, R., "Dynamic Host Configuration Protocol for IPv6
(DHCPv6)", draft-ietf-dhc-dhcpv6-28 (work in progress),
November 2002.
[RFC1035] Mockapetris, P., "Domain names - implementation and [RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987. specification", STD 13, RFC 1035, November 1987.
[RFC1546] Partridge, C., Mendez, T. and W. Milliken, "Host
Anycasting Service", RFC 1546, November 1993.
[RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G. and [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G. and
E. Lear, "Address Allocation for Private Internets", BCP E. Lear, "Address Allocation for Private Internets", BCP
5, RFC 1918, February 1996. 5, RFC 1918, February 1996.
[RFC2022] Armitage, G., "Support for Multicast over UNI 3.0/3.1 [RFC2022] Armitage, G., "Support for Multicast over UNI 3.0/3.1
based ATM Networks", RFC 2022, November 1996. based ATM Networks", RFC 2022, November 1996.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC
2131, March 1997. 2131, March 1997.
[RFC2185] Callon, R. and D. Haskin, "Routing Aspects Of IPv6
Transition", RFC 2185, September 1997.
[RFC2362] Estrin, D., Farinacci, D., Helmy, A., Thaler, D., Deering, [RFC2362] Estrin, D., Farinacci, D., Helmy, A., Thaler, D., Deering,
S., Handley, M. and V. Jacobson, "Protocol Independent S., Handley, M. and V. Jacobson, "Protocol Independent
Multicast-Sparse Mode (PIM-SM): Protocol Specification", Multicast-Sparse Mode (PIM-SM): Protocol Specification",
RFC 2362, June 1998. RFC 2362, June 1998.
[RFC2710] Deering, S., Fenner, W. and B. Haberman, "Multicast [RFC2710] Deering, S., Fenner, W. and B. Haberman, "Multicast
Listener Discovery (MLD) for IPv6", RFC 2710, October Listener Discovery (MLD) for IPv6", RFC 2710, October
1999. 1999.
[RFC3041] Narten, T. and R. Draves, "Privacy Extensions for [RFC3041] Narten, T. and R. Draves, "Privacy Extensions for
Stateless Address Autoconfiguration in IPv6", RFC 3041, Stateless Address Autoconfiguration in IPv6", RFC 3041,
January 2001. January 2001.
[RFC3056] Carpenter, B. and K. Moore, "Connection of IPv6 Domains [RFC3056] Carpenter, B. and K. Moore, "Connection of IPv6 Domains
via IPv4 Clouds", RFC 3056, February 2001. via IPv4 Clouds", RFC 3056, February 2001.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and
M. Carney, "Dynamic Host Configuration Protocol for IPv6
(DHCPv6)", RFC 3315, July 2003.
[VET] Nguyen, Q., "http://irl.cs.ucla.edu/vet/report.ps", spring [VET] Nguyen, Q., "http://irl.cs.ucla.edu/vet/report.ps", spring
1998. 1998.
Authors' Addresses Authors' Addresses
Fred L. Templin Fred L. Templin
Nokia Nokia
313 Fairchild Drive 313 Fairchild Drive
Mountain View, CA 94110 Mountain View, CA 94110
US US
skipping to change at page 13, line 33 skipping to change at page 12, line 45
Microsoft Corporation Microsoft Corporation
One Microsoft Way One Microsoft Way
Redmond, WA 98052-6399 Redmond, WA 98052-6399
US US
Phone: +1 425 703 8835 Phone: +1 425 703 8835
EMail: dthaler@microsoft.com EMail: dthaler@microsoft.com
Appendix A. Major Changes Appendix A. Major Changes
changes from version 13 to version 14:
o removed applicability statement; applicability TBD by v6ops
o updated deployment/site admin sections; moved to appendices
o new text on "L" bit in prefix options in section 7.3.4.2
o removed extraneous text in Security Considerations
o fixed "layering bug" in section 7.3.4.3
o revised "ISATAP address" definition
o updated references for RFC 3315; 3513
changes from version 12 to version 13: changes from version 12 to version 13:
o Added comments from co-authors o Added comments from co-authors
o Text cleanup; removed extraneous text o Text cleanup; removed extraneous text
o Revised ISATAP interface/link terminology o Revised ISATAP interface/link terminology
o Returned to using symbolic reference names o Returned to using symbolic reference names
o Revised MTU section; moved non-normative MTU text to seperate o Revised MTU section; moved non-normative MTU text to separate
document document
changes from earlier versions to version 12: changes from earlier versions to version 12:
o Added multicast/anycast subsection o Added multicast/anycast subsection
o Revised PRL initialization o Revised PRL initialization
o Updated neighbor discovery, security consideration sections o Updated neighbor discovery, security consideration sections
o Rearranged/revised sections 5, 6, 7 o Rearranged/revised sections 5, 6, 7
o Added stateful autoconfiguration mechanism o Added stateful autoconfiguration mechanism
o Normative references to RFC 2491, RFC 2462 o Normative references to RFC 2491, RFC 2462
skipping to change at page 17, line 5 skipping to change at page 15, line 17
including support for encapsulating legacy EUI-48 interface including support for encapsulating legacy EUI-48 interface
identifiers (e.g., an IANA EUI-48 format multicast address such as: identifiers (e.g., an IANA EUI-48 format multicast address such as:
'01-00-5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03'). '01-00-5E-01-02-03' is encapsulated as: '01-00-5E-FF-FE-01-02-03').
But, the specification also provides a special TYPE (0xFE) to But, the specification also provides a special TYPE (0xFE) to
indicate an IPv4 address is embedded. Thus, when the first four indicate an IPv4 address is embedded. Thus, when the first four
octets of an IPv6 interface identifier are: '00-00-5E-FE' (note: the octets of an IPv6 interface identifier are: '00-00-5E-FE' (note: the
'u/l' bit MUST be 0) the interface identifier is said to be in 'u/l' bit MUST be 0) the interface identifier is said to be in
"ISATAP format" and the next four octets embed an IPv4 address "ISATAP format" and the next four octets embed an IPv4 address
encoded in network byte order. encoded in network byte order.
Appendix C. Deployment Considerations
Hosts can enable ISATAP, e.g., when native IPv6 service is
unavailable. When native IPv6 service is acquired, hosts can
discontinue the ISATAP router solicitation process (Section 6.3.4)
and/or allow associated state to expire (see: [RFC2461], section 5.3
and [RFC2462], section 5.5.4). In this case, any associated addresses
added to the DNS should also be removed.
Routers can configure both native IPv6 and ISATAP interfaces over the
same physical link. The prefixes used on each interface will be
distinct, and normal IPv6 routing between the interfaces can occur.
Routers can include prefix options with the "L" bit not set in RAs
sent on ISATAP interfaces provided the routers maintain a table of
IPv6 host routes for addresses configured from the prefixes. Routers
maintain host routes through, e.g., an IPv6 routing protocol, manual
configuration, etc. Hosts can learn the routes through, e.g., IPv6
ICMP redirects, manual configuration, etc.
Routers can obtain IPv6 prefix delegations from a server via an
ISATAP interface and advertise the delegated prefix(es) on other IPv6
interface(s).
When stateful autoconfiguration is enabled, the DHCPv6 [RFC3315]
server/relay function should be deployed equally on each ISATAP
router.
Appendix D. Site Administration Considerations
ISATAP sites are administratively defined by a set of advertising
interfaces and set of nodes that solicit those interfaces. Thus,
ISATAP sites are defined by administrative (not physical) boundaries.
Site administrators maintain a list of IPv4 addresses representing
advertising ISATAP interfaces and make them available via one or more
of the mechanisms described in Section 6.3.1. The list can include
IPv4 anycast address(es) (e.g., for use as described in [RFC2185],
section 3.3.2.1) but administrators are advised to consider
operational implications of anycast (e.g., see: [RFC1546]).
Responsible administration can reduce control traffic overhead
associated with router and prefix discovery.
Intellectual Property Statement Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and IETF's procedures with respect to rights in standards-track and
standards-related documentation can be found in BCP-11. Copies of standards-related documentation can be found in BCP-11. Copies of
skipping to change at page 18, line 12 skipping to change at page 18, line 12
The limited permissions granted above are perpetual and will not be The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assignees. revoked by the Internet Society or its successors or assignees.
This document and the information contained herein is provided on an This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement Acknowledgment
Funding for the RFC Editor function is currently provided by the Funding for the RFC Editor function is currently provided by the
Internet Society. Internet Society.
 End of changes. 

This html diff was produced by rfcdiff 1.25, available from http://www.levkowetz.com/ietf/tools/rfcdiff/