draft-ietf-ngtrans-isatap-14.txt   draft-ietf-ngtrans-isatap-15.txt 
Network Working Group F. Templin Network Working Group F. Templin
Internet-Draft Nokia Internet-Draft Nokia
Expires: February 23, 2004 T. Gleeson Expires: March 10, 2004 T. Gleeson
Cisco Systems K.K. Cisco Systems K.K.
M. Talwar M. Talwar
D. Thaler D. Thaler
Microsoft Corporation Microsoft Corporation
August 25, 2003 September 10, 2003
Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)
draft-ietf-ngtrans-isatap-14.txt draft-ietf-ngtrans-isatap-15.txt
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document is an Internet-Draft and is in full conformance with
all provisions of Section 10 of RFC2026. all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that other Task Force (IETF), its areas, and its working groups. Note that other
groups may also distribute working documents as Internet-Drafts. groups may also distribute working documents as Internet-Drafts.
skipping to change at page 1, line 35 skipping to change at page 1, line 35
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at http:// The list of current Internet-Drafts can be accessed at http://
www.ietf.org/ietf/1id-abstracts.txt. www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html. http://www.ietf.org/shadow.html.
This Internet-Draft will expire on February 23, 2004. This Internet-Draft will expire on March 10, 2004.
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2003). All Rights Reserved. Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract Abstract
This document specifies an Intra-Site Automatic Tunnel Addressing This document specifies an Intra-Site Automatic Tunnel Addressing
Protocol (ISATAP) that connects IPv6 hosts and routers within IPv4 Protocol (ISATAP) that connects IPv6 hosts and routers within IPv4
sites. ISATAP treats the site's IPv4 infrastructure as a link layer sites. ISATAP treats the site's IPv4 unicast infrastructure as a link
for IPv6 with no requirement for IPv4 multicast. ISATAP enables layer for IPv6. ISATAP enables intra-site automatic IPv6-in-IPv4
intra-site automatic IPv6-in-IPv4 tunneling whether globally assigned tunneling whether globally assigned or private IPv4 addresses are
or private IPv4 addresses are used. used.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 3
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Basic IPv6 Operation . . . . . . . . . . . . . . . . . . . . . 4 4. Basic IPv6 Operation . . . . . . . . . . . . . . . . . . . . . 4
5. Automatic Tunneling . . . . . . . . . . . . . . . . . . . . . 5 5. Automatic Tunneling . . . . . . . . . . . . . . . . . . . . . 5
6. Neighbor Discovery . . . . . . . . . . . . . . . . . . . . . . 6 6. Neighbor Discovery . . . . . . . . . . . . . . . . . . . . . . 6
7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9 7. Address Autoconfiguration . . . . . . . . . . . . . . . . . . 9
8. Security considerations . . . . . . . . . . . . . . . . . . . 9 8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 9 9. Security considerations . . . . . . . . . . . . . . . . . . . 9
10. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 10
Normative References . . . . . . . . . . . . . . . . . . . . . 10 Normative References . . . . . . . . . . . . . . . . . . . . . 10
Informative References . . . . . . . . . . . . . . . . . . . . 10 Informative References . . . . . . . . . . . . . . . . . . . . 11
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . 12
A. Major Changes . . . . . . . . . . . . . . . . . . . . . . . . 12 A. Major Changes . . . . . . . . . . . . . . . . . . . . . . . . 12
B. Rationale for Interface Identifier Construction . . . . . . . 14 B. Rationale for Interface Identifier Construction . . . . . . . 14
C. Deployment Considerations . . . . . . . . . . . . . . . . . . 15 C. Deployment Considerations . . . . . . . . . . . . . . . . . . 15
D. Site Administration Considerations . . . . . . . . . . . . . . 15 D. Other Considerations . . . . . . . . . . . . . . . . . . . . . 15
Intellectual Property and Copyright Statements . . . . . . . . 17 Intellectual Property and Copyright Statements . . . . . . . . 17
1. Introduction 1. Introduction
This document presents a simple approach called the Intra-Site This document presents a simple approach called the Intra-Site
Automatic Tunnel Addressing Protocol (ISATAP) that enables Automatic Tunnel Addressing Protocol (ISATAP) that enables
incremental deployment of IPv6 [RFC2460] within IPv4 [RFC0791] sites. incremental deployment of IPv6 [RFC2460] within IPv4 [RFC0791] sites.
ISATAP allows dual-stack nodes that do not share a physical link with ISATAP allows dual-stack nodes that do not share a link with an IPv6
an IPv6 router to automatically tunnel packets to the IPv6 next-hop router to automatically tunnel packets to the IPv6 next-hop address
address through IPv4, i.e., the site's IPv4 infrastructure is treated through IPv4, i.e., the site's IPv4 infrastructure is treated as a
as a link layer for IPv6. link layer for IPv6.
Specific details for the operation of IPv6 and automatic tunneling Specific details for the operation of IPv6 and automatic tunneling
using ISATAP are given, including an interface identifier format that using ISATAP are given, including an interface identifier format that
embeds an IPv4 address. This format supports IPv6 address embeds an IPv4 address. This format supports IPv6 address
configuration and simple link-layer address mapping. Also specified configuration and simple link-layer address mapping. Also specified
is the operation of IPv6 Neighbor Discovery and deployment/security is the operation of IPv6 Neighbor Discovery and deployment/security
considerations. considerations.
2. Requirements 2. Requirements
skipping to change at page 3, line 42 skipping to change at page 3, line 42
settings influence protocol behavior are provided to demonstrate settings influence protocol behavior are provided to demonstrate
protocol behavior. An implementation is not required to have them in protocol behavior. An implementation is not required to have them in
the exact form described here, so long as its external behavior is the exact form described here, so long as its external behavior is
consistent with that described in this document. consistent with that described in this document.
3. Terminology 3. Terminology
The terminology of [RFC2460] applies to this document. The following The terminology of [RFC2460] applies to this document. The following
additional terms are defined: additional terms are defined:
site:
same as defined in [RFC3582], which is intended to be equivalent
to "enterprise" as defined in [RFC1918].
link, on-link, off-link: link, on-link, off-link:
same definitions as ([RFC2461], section 2.1). same as defined in ([RFC2461], section 2.1).
underlying link: underlying link:
a link layer that supports IPv4 (for ISATAP), and MAY also support a link layer that supports IPv4 (for ISATAP), and MAY also support
IPv6 natively. IPv6 natively.
ISATAP interface: ISATAP interface:
an interface configured over one or more underling links. an interface configured over one or more underlying links.
advertising ISATAP interface: advertising ISATAP interface:
same meaning as "advertising interface" in ([RFC2461], section same meaning as "advertising interface" in ([RFC2461], section
6.2.2). 6.2.2).
ISATAP address: ISATAP address:
an address with an on-link prefix on an ISATAP interface and with an address with an on-link prefix assigned on an ISATAP interface
an interface identifier constructed as specified in Section 4.1 and with an interface identifier constructed as specified in
Section 4.1.
4. Basic IPv6 Operation 4. Basic IPv6 Operation
ISATAP interfaces automatically tunnel IPv6 packets using the site's ISATAP interfaces automatically tunnel IPv6 packets using the site's
IPv4 infrastructure as a link layer for IPv6, i.e., IPv6 treats the IPv4 infrastructure as a link layer for IPv6, i.e., IPv6 treats the
site's IPv4 infrastructure as a Non-Broadcast, Multiple Access (NBMA) site's IPv4 infrastructure as a Non-Broadcast, Multiple Access (NBMA)
link layer. The mechanisms in [RFC2491] are used, with the following link layer, with properties similar to [RFC2491]. The following
noted exceptions for ISATAP: ISATAP-specific considerations are noted for basic IPv6 operation:
4.1 Interface Identifiers and Unicast Addresses 4.1 Interface Identifiers and Unicast Addresses
ISATAP interface identifiers use "modified EUI-64" format ([RFC3513], ISATAP interface identifiers use "modified EUI-64" format ([RFC3513],
section 2.5.1) and are formed by appending an IPv4 address assigned section 2.5.1) and are formed by appending an IPv4 address assigned
to an underlying link to the 32-bit string '00-00-5E-FE'. Appendix B to an underlying link to the 32-bit string '00-00-5E-FE'. Appendix B
includes non-normative rationale for this construction rule. includes non-normative rationale for this construction rule.
IPv6 global and local-use ([RFC3513], sections 2.5.4, 2.5.6) ISATAP IPv6 global and local-use ([RFC3513], sections 2.5.4, 2.5.6) ISATAP
addresses are constructed as follows: addresses are constructed as follows:
skipping to change at page 4, line 43 skipping to change at page 4, line 47
| global/local unicast prefix | 0000:5EFE | IPv4 Address | | global/local unicast prefix | 0000:5EFE | IPv4 Address |
+------------------------------+---------------+----------------+ +------------------------------+---------------+----------------+
4.2 ISATAP Interface Configuration 4.2 ISATAP Interface Configuration
ISATAP interfaces are configured over one or more underlying links ISATAP interfaces are configured over one or more underlying links
that support IPv4 for tunneling within a site; each IPv4 address that support IPv4 for tunneling within a site; each IPv4 address
assigned to an underlying link is seen as a link-layer address for assigned to an underlying link is seen as a link-layer address for
ISATAP. ISATAP.
4.3 Link Layer Address Options 4.3 Multicast and Anycast
With reference to ([RFC2491], section 5.2), when the [NTL] and [STL]
fields in an ISATAP link layer address option encode 0, the [NBMA
Number] field encodes a 4-octet IPv4 address.
4.4 Multicast and Anycast
ISATAP interfaces recognize an IPv6 node's required addresses ISATAP interfaces recognize an IPv6 node's required addresses
([RFC3513], section 2.8), including certain multicast/anycast ([RFC3513], section 2.8), including certain multicast/anycast
addresses. addresses.
Mechanisms for multicast/anycast emulation on ISATAP interfaces Mechanisms for multicast/anycast emulation on ISATAP interfaces
(e.g., adaptations of MLD [RFC2710], PIM-SM [RFC2362], MARS (e.g., MARS [RFC2022], etc.) are out of scope.
[RFC2022], etc.) are subject for future companion document(s).
5. Automatic Tunneling 5. Automatic Tunneling
The common tunneling mechanisms specified in ([MECH], sections 2 and The common tunneling mechanisms specified in ([MECH], sections 2 and
3) are used, with the following noted considerations for ISATAP: 3) are used, with the following noted considerations for ISATAP:
5.1 Tunnel MTU and Fragmentation 5.1 Tunnel MTU and Fragmentation
ISATAP automatic tunnel interfaces may be configured over multiple ISATAP automatic tunnel interfaces may be configured over multiple
underlying links with diverse maximum transmission units (MTUs). The underlying links with diverse maximum transmission units (MTUs). The
skipping to change at page 5, line 32 skipping to change at page 5, line 29
but the following considerations apply for ISATAP interfaces: but the following considerations apply for ISATAP interfaces:
o Nearly all IPv4 nodes connect to physical links with MTUs of 1500 o Nearly all IPv4 nodes connect to physical links with MTUs of 1500
bytes or larger (e.g., Ethernet) bytes or larger (e.g., Ethernet)
o Sub-IPv4 layer encapsulations (e.g., VPN) may occur on some paths o Sub-IPv4 layer encapsulations (e.g., VPN) may occur on some paths
o Commonly-deployed VPN interfaces use an MTU of 1400 bytes o Commonly-deployed VPN interfaces use an MTU of 1400 bytes
To maximize efficiency and minimize IPv4 fragmentation for the To maximize efficiency and minimize IPv4 fragmentation for the
predominant deployment case, the ISATAP interface MTU, or "LinkMTU" predominant deployment case, LinkMTU ([RFC2461], Section 6.3.2) for
(see: [RFC2461], Section 6.3.2), SHOULD be set to no more than 1380 the ISATAP interface SHOULD be set to no more than 1380 bytes (1400
bytes (1400 minus 20 bytes for IPv4 encapsulation). LinkMTU MAY be minus 20 bytes for IPv4 encapsulation).
set to larger values when a dynamic link layer MTU discovery
mechanism is used or when a static MTU assignment is used and
additional fragmentation in the site's IPv4 network is deemed
acceptable.
When a dynamic IPv4 MTU discovery mechanism is not used, the ISATAP LinkMTU MAY be set to larger values when a dynamic link layer MTU
interface encapsulates IPv6 packets with the Don't Fragment (DF) bit discovery mechanism is used or when a static MTU assignment is used
not set in the encapsulating IPv4 header. and the anticipated/measured level of fragmentation in the site's
IPv4 network is deemed acceptable.
When a dynamic link layer MTU discovery mechanism is not used, the
ISATAP interface MUST NOT encapsulate IPv6 packets with the Don't
Fragment (DF) bit set in the encapsulating IPv4 header.
5.2 Handling IPv4 ICMP Errors 5.2 Handling IPv4 ICMP Errors
ARP failures and persistent ICMPv4 errors SHOULD be processed as ARP failures and persistent ICMPv4 errors SHOULD be processed as
link-specific information indicating that a path to a neighbor has link-specific information indicating that a path to a neighbor has
failed ([RFC2461], section 7.3.3). failed ([RFC2461], section 7.3.3).
5.3 Local-Use IPv6 Unicast Addresses 5.3 Local-Use IPv6 Unicast Addresses
The specification in ([MECH], section 3.7) is not used; the The specification in ([MECH], section 3.7) is not used; the
specification in Section 4.1 is used instead. specification in Section 4.1 is used instead.
5.4 Ingress Filtering
The specification in ([MECH], section 3.9) is used.
Additionally, packets received on an ISATAP interface with an ISATAP
network-layer (IPv6) source address that does not embed the
link-layer (IPv4) source address in the interface identifier are
silently discarded.
6. Neighbor Discovery 6. Neighbor Discovery
The specification in ([MECH], section 3.8) applies only to configured The specification in ([MECH], section 3.8) applies only to configured
tunnels. [RFC2461] provides the following guidelines for tunnels. [RFC2461] provides the following guidelines for
non-broadcast multiple access (NBMA) link support: non-broadcast multiple access (NBMA) link support:
"Redirect, Neighbor Unreachability Detection and next-hop "Redirect, Neighbor Unreachability Detection and next-hop
determination should be implemented as described in this document. determination should be implemented as described in this document.
Address resolution and the mechanism for delivering Router Address resolution and the mechanism for delivering Router
Solicitations and Advertisements on NBMA links is not specified in Solicitations and Advertisements on NBMA links is not specified in
skipping to change at page 6, line 49 skipping to change at page 7, line 8
(NUD) as specified in ([RFC2461], section 7.3). Routers MAY perform (NUD) as specified in ([RFC2461], section 7.3). Routers MAY perform
these reachability confirmation and NUD procedures, but this might these reachability confirmation and NUD procedures, but this might
not scale in all environments. not scale in all environments.
All ISATAP nodes MUST send solicited neighbor advertisements All ISATAP nodes MUST send solicited neighbor advertisements
([RFC2461], section 7.2.4). ([RFC2461], section 7.2.4).
6.2 Duplicate Address Detection 6.2 Duplicate Address Detection
Duplicate Address Detection ([RFC2462], section 5.4) is not required Duplicate Address Detection ([RFC2462], section 5.4) is not required
for ISATAP addresses, since duplicate address detection is assumed for ISATAP addresses, since duplicate address detection is assumed to
already performed for the IPv4 addresses from which they derive. have been already performed for the IPv4 addresses from which they
derive.
6.3 Router and Prefix Discovery 6.3 Router and Prefix Discovery
The following sections describe mechanisms to support the router and The following sections describe mechanisms to support the router and
prefix discovery process ([RFC2461], section 6): prefix discovery process ([RFC2461], section 6):
6.3.1 Conceptual Data Structures 6.3.1 Conceptual Data Structures
ISATAP nodes use the conceptual data structures Prefix List and ISATAP nodes use the conceptual data structures Prefix List and
Default Router List exactly as in ([RFC2461], section 5.1). ISATAP Default Router List exactly as in ([RFC2461], section 5.1). ISATAP
adds a new conceptual data structure "Potential Router List" (PRL) adds a new conceptual data structure "Potential Router List" (PRL)
and the following new configuration variable: and the following new configuration variable:
PrlRefreshInterval PrlRefreshInterval
Time in seconds between successive refreshments of the PRL after Time in seconds between successive refreshments of the PRL after
initialization. SHOULD be no less than 3,600 seconds. initialization. It SHOULD be no less than 3,600 seconds. The
designated value of all 1's (0xffffffff) represents infinity.
Default: 3,600 seconds Default: 3,600 seconds
A PRL is associated with every ISATAP interface. Each entry in the A PRL is associated with every ISATAP interface and supports the
PRL ("PRL(i)") has an IPv4 address ("V4ADDR(i)") that represents an mechanisms specified in Section 6.3.4. Each entry in the PRL
advertising ISATAP interface and an associated timer ("TIMER(i)"). ("PRL(i)") has an associated timer ("TIMER(i)"), and an IPv4 address
("V4ADDR(i)") that represents a site border router's advertising
ISATAP interface.
When a node enables an ISATAP interface, it initializes the PRL with When a node enables an ISATAP interface, it initializes the PRL with
IPv4 addresses. The addresses MAY be discovered via a DHCPv4 IPv4 addresses. The addresses MAY be discovered via a DHCPv4
[RFC2131] option for ISATAP, manual configuration, or an unspecified [RFC2131] option for ISATAP, manual configuration, or an unspecified
alternate method (e.g., DHCPv4 vendor-specific option). alternate method (e.g., DHCPv4 vendor-specific option, etc.).
When no other mechanisms are available, a DNS fully-qualified domain When no other mechanisms are available, a DNS fully-qualified domain
name (FQDN) [RFC1035] established by an out-of-band method (e.g., name (FQDN) [RFC1035] established by an out-of-band method (e.g.,
DHCPv4, manual configuration, etc.) MAY be used. The FQDN is resolved DHCPv4, manual configuration, etc.) MAY be used. The FQDN is resolved
into IPv4 addresses for the PRL through a static host file, a into IPv4 addresses for the PRL through a static host file, a
site-specific name service, querying a DNS server within the site, or site-specific name service, querying a DNS server within the site, or
an unspecified alternate method. There are no mandatory rules for the an unspecified alternate method. There are no mandatory rules for the
selection of a FQDN, but manual configuration MUST be supported. When selection of a FQDN, but manual configuration MUST be supported. When
DNS is used, client resolvers use the IPv4 transport. DNS is used, client resolvers use the IPv4 transport.
After initialization, nodes periodically refresh the PRL (i.e., using After initialization, nodes periodically refresh the PRL (i.e., using
one or more of the methods described above) after PrlRefreshInterval. one or more of the methods described above) after PrlRefreshInterval.
6.3.2 Validation of Router Advertisements Messages 6.3.2 Validation of Router Advertisements Messages
The specification in ([RFC2461], section 6.1.2) is used. The specification in ([RFC2461], section 6.1.2) is used.
Additionally, received RA messages that contain Prefix Information
options and/or encode non-zero values in the Cur Hop Limit, Router
Lifetime, Reachable Time, or Retrans Timer fields (see: [RFC2461],
section 4.2) MUST satisfy the following validity check for ISATAP:
o the network-layer (IPv6) source address is an ISATAP address and
embeds V4ADDR(i) for some PRL(i)
6.3.3 Router Specification 6.3.3 Router Specification
Routers with advertising ISATAP interfaces behave the same as Routers with advertising ISATAP interfaces behave the same as
described in ([RFC2461], section 6.2). As permitted by ([RFC2461], described in ([RFC2461], section 6.2). As permitted by ([RFC2461],
section 6.2.6), advertising ISATAP interfaces SHOULD send unicast RA section 6.2.6), advertising ISATAP interfaces SHOULD send unicast RA
messages to a soliciting host's unicast address when the messages to a soliciting host's unicast address when the
solicitation's source address is not the unspecified address. solicitation's source address is not the unspecified address.
6.3.4 Host Specification 6.3.4 Host Specification
Hosts behave the same as described in ([RFC2461], section 6.3) and Hosts behave the same as described in ([RFC2461], section 6.3) with
([RFC2462], section 5.5) with the following additional considerations the following additional considerations for ISATAP:
for ISATAP:
6.3.4.1 Soliciting Router Advertisements 6.3.4.1 Soliciting Router Advertisements
Hosts solicit Router Advertisements (RAs) by sending Router Hosts solicit Router Advertisements (RAs) by sending Router
Solicitations (RSs) to advertising ISATAP interfaces in the PRL. The Solicitations (RSs) to advertising ISATAP interfaces in the PRL. The
manner of selecting PRL(i)'s for solicitation is up to the manner of selecting PRL(i)'s for solicitation is up to the
implementation. Hosts add the following variable to support the implementation. Hosts add the following variable to support the
solicitation process: solicitation process:
MinRouterSolicitInterval MinRouterSolicitInterval
Minimum time in seconds between successive solicitations of the Minimum time in seconds between successive solicitations of the
same advertising ISATAP interface. SHOULD be no less than 900 same advertising ISATAP interface. It SHOULD be no less than 900
seconds. seconds.
Default: 900 seconds Default: 900 seconds
RS messages use a link-local unicast address from the ISATAP RS messages use a link-local unicast address from the ISATAP
interface as the IPv6 source address. Unless otherwise specified in a interface as the IPv6 source address.
future document, RS messages use the link-local ISATAP address
constructed from V4ADDR(i) for the PRL(i) being solicited as the IPv6
destination address.
6.3.4.2 Router Advertisement Processing 6.3.4.2 Router Advertisement Processing
RA processing is exactly as specified in ([RFC2461], section 6.3.4). RAs received from a member of the PRL (i.e., RAs with an ISATAP IPv6
Prefix options in RAs with the "L" bit not set contain prefixes that source address that embeds V4ADDR(i) for some PRL(i)) are processed
are not considered on-link with the ISATAP interface and MAY be used exactly as specified in ([RFC2461], section 6.3.4). Additionally,
to configure non-ISATAP addresses, e.g., using [RFC2462] mechanisms. hosts reset TIMER(i) to schedule the next solicitation event (see:
Section 6.3.4.1). Let "MIN_LIFETIME" be the minimum value in the
When the source address of an RA message is an ISATAP address that Router Lifetime or the lifetime(s) encoded in options included in the
embeds V4ADDR(i) for some PRL(i), hosts reset TIMER(i) to schedule RA message. Then, TIMER(i) is reset as follows:
the next solicitation event (see: Section 6.3.4.1). Let
"MIN_LIFETIME" be the minimum value in the router lifetime or the
lifetime(s) encoded in options included in the RA message. Then,
TIMER(i) is reset as follows:
TIMER(i) = MAX((0.5 * MIN_LIFETIME), MinRouterSolicitInterval) TIMER(i) = MAX((0.5 * MIN_LIFETIME), MinRouterSolicitInterval)
6.3.4.3 Stateful Autoconfiguration RAs received from a router other than a member of the PRL are
processed as specified in ([RFC2461], section 6.3.4) except that any
RA contents ([RFC2461], section 6.2.3) that would alter ISATAP link
parameters are silently ignored. In particular, non-zero values in
the Router Lifetime, M and O flags, Cur Hop Limit, Reachable Time,
and Retrans Timer as well as prefix options with the L and/or A bits
set are ignored. If the MTU option is present, the option's value
SHOULD be stored in a per-neighbor cache entry for the source of the
RA; it MUST NOT be copied into LinkMTU for the ISATAP link.
If stateful autoconfiguration is invoked ([RFC2462], sections 5.5.2, 7. Address Autoconfiguration
5.5.3), the "All_DHCP_Relay_Agents_and_Servers" multicast address
([RFC3315], section 5.1) is resolved to V4ADDR(i) for some PRL(i).
7. IANA Considerations Hosts invoke stateless address autoconfiguration under the conditions
specified in ([RFC2462], sections 5.5).
Modifications to the IANA "ethernet-numbers" registry (e.g., based on Hosts invoke stateful address autoconfiguration under the conditions
text in Appendix B) are requested. specified in ([RFC2462], section 5.5). When DHCPv6 [RFC3315] is used,
hosts send messages to the "All_DHCP_Relay_Agents_and_Servers"
multicast address ([RFC3315], sections 1.2 and 1.3). Sending
implementations map the "All_DHCP_Relay_Agents_and_Servers" multicast
address to a link-layer (IPv4) address by selecting V4ADDR(i) for
some PRL(i).
8. Security considerations When the site supports the DHCPv6 service, the server/relay function
MUST be deployed equally on each router that is a member of the PRL.
ISATAP site border routers and firewalls MUST implement IPv6 and IPv4 8. IANA Considerations
ingress filtering, including ip-protocol-41 filtering. Packets with
local-use source and/or destination addresses MUST NOT be forwarded The IANA is advised to specify construction rules for IEEE EUI-64
outside of the site. addresses formed from the Organizationally Unique Identifier (OUI)
"00-00-5E" in the IANA "ethernet-numbers" registry. The non-normative
text in Appendix B is offered as an example specification.
9. Security considerations
ISATAP site border routers MUST implement IPv6 and IPv4 ingress
filtering and in particular MUST discard any packets originating from
outside of the site that use an IP address from the site as the
source address. Additionally, site border routers MUST implement
ip-protocol-41 filtering by not allowing packets for that protocol in
and out of the site. Finally, site border routers MUST NOT forward
any packets with local-use source or destination addresses outside of
the site ([RFC3513], section 2.5.6).
Even with IPv4 and IPv6 ingress filtering, reflection attacks can Even with IPv4 and IPv6 ingress filtering, reflection attacks can
originate from compromised nodes within an ISATAP site that spoof originate from compromised nodes within an ISATAP site that spoof
IPv6 source addresses. Security mechanisms for reflection attack IPv6 source addresses. Security mechanisms for reflection attack
mitigation SHOULD be used in routers with advertising ISATAP mitigation SHOULD be used in routers with advertising ISATAP
interfaces. At a minimum, border gateways SHOULD log potential source interfaces. At a minimum, site border routers SHOULD log potential
address spoofing cases. source address spoofing cases.
Site administrators maintain a list of IPv4 addresses representing
advertising ISATAP interfaces and make them available via one or more
of the mechanisms described in Section 6.3.1. The list can include
IPv4 anycast address(es) but administrators are advised to consider
operational implications of anycast (e.g., see: [RFC1546]).
ISATAP addresses do not support privacy extensions for stateless ISATAP addresses do not support privacy extensions for stateless
address autoconfiguration [RFC3041]. address autoconfiguration [RFC3041].
9. Acknowledgements 10. Acknowledgements
Portions of this work were derived from SRI International internal Portions of this work were derived from SRI International internal
funds and government contracts. Government sponsors include Monica funds and government contracts. Government sponsors include Monica
Farah-Stapleton and Russell Langan (U.S. Army CECOM ASEO), and Dr. Farah-Stapleton and Russell Langan (U.S. Army CECOM ASEO), and Dr.
Allen Moshfegh (U.S. Office of Naval Research). SRI International Allen Moshfegh (U.S. Office of Naval Research). SRI International
sponsors include Dr. Mike Frankel, J. Peter Marcotullio, Lou sponsors include Dr. Mike Frankel, J. Peter Marcotullio, Lou
Rodriguez, and Dr. Ambatipudi Sastry. Rodriguez, and Dr. Ambatipudi Sastry.
The following are acknowledged for providing peer review input: Jim The following are acknowledged for providing peer review input: Jim
Bound, Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Bound, Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader,
Ole Troan, Vlad Yasevich. Ole Troan, Vlad Yasevich.
The following additional individuals are acknowledged for their The following additional individuals are acknowledged for their
contributions: Rich Draves, Alain Durand, Nathan Lutchansky, Karen contributions: Rich Draves, Alain Durand, Nathan Lutchansky, Karen
Nielsen, Mohan Parthasarathy, Art Shelest, Margaret Wasserman, Brian Nielsen, Mohan Parthasarathy, Art Shelest, Pekka Savola, Margaret
Zill. Wasserman, Brian Zill.
The authors also acknowledge the work of Quang Nguyen [VET] under the The authors also acknowledge the work of Quang Nguyen [VET] under the
guidance of Dr. Lixia Zhang that proposed very similar ideas to those guidance of Dr. Lixia Zhang that proposed very similar ideas to those
that appear in this document. This work was first brought to the that appear in this document. This work was first brought to the
authors' attention on September 20, 2002. authors' attention on September 20, 2002.
Normative References Normative References
[MECH] Gilligan, R. and E. Nordmark, "Basic Transition Mechanisms [MECH] Gilligan, R. and E. Nordmark, "Basic Transition Mechanisms
for IPv6 Hosts and Routers", draft-ietf-v6ops-mech-v2-00 for IPv6 Hosts and Routers", draft-ietf-v6ops-mech-v2-00
skipping to change at page 10, line 37 skipping to change at page 11, line 12
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 [RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6
(IPv6) Specification", RFC 2460, December 1998. (IPv6) Specification", RFC 2460, December 1998.
[RFC2461] Narten, T., Nordmark, E. and W. Simpson, "Neighbor [RFC2461] Narten, T., Nordmark, E. and W. Simpson, "Neighbor
Discovery for IP Version 6 (IPv6)", RFC 2461, December Discovery for IP Version 6 (IPv6)", RFC 2461, December
1998. 1998.
[RFC2462] Thomson, S. and T. Narten, "IPv6 Stateless Address [RFC2462] Thomson, S. and T. Narten, "IPv6 Stateless Address
Autoconfiguration", RFC 2462, December 1998. Autoconfiguration", RFC 2462, December 1998.
[RFC2463] Conta, A. and S. Deering, "Internet Control Message
Protocol (ICMPv6) for the Internet Protocol Version 6
(IPv6) Specification", RFC 2463, December 1998.
[RFC2491] Armitage, G., Schulter, P., Jork, M. and G. Harter, "IPv6
over Non-Broadcast Multiple Access (NBMA) networks", RFC
2491, January 1999.
[RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6 [RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6
(IPv6) Addressing Architecture", RFC 3513, April 2003. (IPv6) Addressing Architecture", RFC 3513, April 2003.
Informative References Informative References
[RFC1035] Mockapetris, P., "Domain names - implementation and [RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987. specification", STD 13, RFC 1035, November 1987.
[RFC1546] Partridge, C., Mendez, T. and W. Milliken, "Host [RFC1546] Partridge, C., Mendez, T. and W. Milliken, "Host
Anycasting Service", RFC 1546, November 1993. Anycasting Service", RFC 1546, November 1993.
skipping to change at page 11, line 18 skipping to change at page 11, line 33
[RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G. and [RFC1918] Rekhter, Y., Moskowitz, R., Karrenberg, D., Groot, G. and
E. Lear, "Address Allocation for Private Internets", BCP E. Lear, "Address Allocation for Private Internets", BCP
5, RFC 1918, February 1996. 5, RFC 1918, February 1996.
[RFC2022] Armitage, G., "Support for Multicast over UNI 3.0/3.1 [RFC2022] Armitage, G., "Support for Multicast over UNI 3.0/3.1
based ATM Networks", RFC 2022, November 1996. based ATM Networks", RFC 2022, November 1996.
[RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC [RFC2131] Droms, R., "Dynamic Host Configuration Protocol", RFC
2131, March 1997. 2131, March 1997.
[RFC2185] Callon, R. and D. Haskin, "Routing Aspects Of IPv6 [RFC2491] Armitage, G., Schulter, P., Jork, M. and G. Harter, "IPv6
Transition", RFC 2185, September 1997. over Non-Broadcast Multiple Access (NBMA) networks", RFC
2491, January 1999.
[RFC2362] Estrin, D., Farinacci, D., Helmy, A., Thaler, D., Deering,
S., Handley, M. and V. Jacobson, "Protocol Independent
Multicast-Sparse Mode (PIM-SM): Protocol Specification",
RFC 2362, June 1998.
[RFC2710] Deering, S., Fenner, W. and B. Haberman, "Multicast
Listener Discovery (MLD) for IPv6", RFC 2710, October
1999.
[RFC3041] Narten, T. and R. Draves, "Privacy Extensions for [RFC3041] Narten, T. and R. Draves, "Privacy Extensions for
Stateless Address Autoconfiguration in IPv6", RFC 3041, Stateless Address Autoconfiguration in IPv6", RFC 3041,
January 2001. January 2001.
[RFC3056] Carpenter, B. and K. Moore, "Connection of IPv6 Domains
via IPv4 Clouds", RFC 3056, February 2001.
[RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and
M. Carney, "Dynamic Host Configuration Protocol for IPv6 M. Carney, "Dynamic Host Configuration Protocol for IPv6
(DHCPv6)", RFC 3315, July 2003. (DHCPv6)", RFC 3315, July 2003.
[RFC3582] Abley, J., Black, B. and V. Gill, "Goals for IPv6
Site-Multihoming Architectures", RFC 3582, August 2003.
[VET] Nguyen, Q., "http://irl.cs.ucla.edu/vet/report.ps", spring [VET] Nguyen, Q., "http://irl.cs.ucla.edu/vet/report.ps", spring
1998. 1998.
Authors' Addresses Authors' Addresses
Fred L. Templin Fred L. Templin
Nokia Nokia
313 Fairchild Drive 313 Fairchild Drive
Mountain View, CA 94110 Mountain View, CA 94110
US US
skipping to change at page 12, line 45 skipping to change at page 12, line 45
Microsoft Corporation Microsoft Corporation
One Microsoft Way One Microsoft Way
Redmond, WA 98052-6399 Redmond, WA 98052-6399
US US
Phone: +1 425 703 8835 Phone: +1 425 703 8835
EMail: dthaler@microsoft.com EMail: dthaler@microsoft.com
Appendix A. Major Changes Appendix A. Major Changes
changes from version 14 to version 15:
o several editorial changes
o revised Security; IANA considerations
o revised Section 6.3.4.2
o added new section on ingress filtering
o revised stateful autoconfiguration and moved to new section
o removed overly-restrictive text at end of Section 6.3.4.1
changes from version 13 to version 14: changes from version 13 to version 14:
o removed applicability statement; applicability TBD by v6ops o removed applicability statement; applicability TBD by v6ops
o updated deployment/site admin sections; moved to appendices o updated deployment/site admin sections; moved to appendices
o new text on "L" bit in prefix options in section 7.3.4.2 o new text on "L" bit in prefix options in section 7.3.4.2
o removed extraneous text in Security Considerations o removed extraneous text in Security Considerations
o fixed "layering bug" in section 7.3.4.3 o fixed "layering bug" in section 7.3.4.3
o revised "ISATAP address" definition o revised "ISATAP address" definition
o updated references for RFC 3315; 3513 o updated references for RFC 3315; 3513
skipping to change at page 13, line 14 skipping to change at page 13, line 28
o new text on "L" bit in prefix options in section 7.3.4.2 o new text on "L" bit in prefix options in section 7.3.4.2
o removed extraneous text in Security Considerations o removed extraneous text in Security Considerations
o fixed "layering bug" in section 7.3.4.3 o fixed "layering bug" in section 7.3.4.3
o revised "ISATAP address" definition o revised "ISATAP address" definition
o updated references for RFC 3315; 3513 o updated references for RFC 3315; 3513
changes from version 12 to version 13: changes from earlier versions to version 13:
o Added comments from co-authors
o Text cleanup; removed extraneous text
o Revised ISATAP interface/link terminology o Revised ISATAP interface/link terminology
o Returned to using symbolic reference names o Returned to using symbolic reference names
o Revised MTU section; moved non-normative MTU text to separate o Revised MTU section; moved non-normative MTU text to separate
document document
changes from earlier versions to version 12:
o Added multicast/anycast subsection o Added multicast/anycast subsection
o Revised PRL initialization o Revised PRL initialization
o Updated neighbor discovery, security consideration sections o Updated neighbor discovery, security consideration sections
o Rearranged/revised sections 5, 6, 7 o Rearranged/revised sections 5, 6, 7
o Added stateful autoconfiguration mechanism o Added stateful autoconfiguration mechanism
skipping to change at page 15, line 30 skipping to change at page 15, line 39
unavailable. When native IPv6 service is acquired, hosts can unavailable. When native IPv6 service is acquired, hosts can
discontinue the ISATAP router solicitation process (Section 6.3.4) discontinue the ISATAP router solicitation process (Section 6.3.4)
and/or allow associated state to expire (see: [RFC2461], section 5.3 and/or allow associated state to expire (see: [RFC2461], section 5.3
and [RFC2462], section 5.5.4). In this case, any associated addresses and [RFC2462], section 5.5.4). In this case, any associated addresses
added to the DNS should also be removed. added to the DNS should also be removed.
Routers can configure both native IPv6 and ISATAP interfaces over the Routers can configure both native IPv6 and ISATAP interfaces over the
same physical link. The prefixes used on each interface will be same physical link. The prefixes used on each interface will be
distinct, and normal IPv6 routing between the interfaces can occur. distinct, and normal IPv6 routing between the interfaces can occur.
Routers can include prefix options with the "L" bit not set in RAs
sent on ISATAP interfaces provided the routers maintain a table of
IPv6 host routes for addresses configured from the prefixes. Routers
maintain host routes through, e.g., an IPv6 routing protocol, manual
configuration, etc. Hosts can learn the routes through, e.g., IPv6
ICMP redirects, manual configuration, etc.
Routers can obtain IPv6 prefix delegations from a server via an Routers can obtain IPv6 prefix delegations from a server via an
ISATAP interface and advertise the delegated prefix(es) on other IPv6 ISATAP interface and advertise the delegated prefix(es) on other IPv6
interface(s). interface(s).
When stateful autoconfiguration is enabled, the DHCPv6 [RFC3315] Responsible administration can reduce control traffic overhead
server/relay function should be deployed equally on each ISATAP associated with router and prefix discovery.
router.
Appendix D. Site Administration Considerations Appendix D. Other Considerations
ISATAP sites are administratively defined by a set of advertising The Potential Router List (PRL) contains the IPv4 addresses of
interfaces and set of nodes that solicit those interfaces. Thus, advertising ISATAP interfaces on site border routers, and the
ISATAP sites are defined by administrative (not physical) boundaries. specification mandates that nodes only accept Router Advertisement
(RA) parameters that alter the ISATAP link (e.g., default router
list, on-link prefix list, LinkMTU, etc.) if they are sent by a
member of the PRL. However, the specification allows any node on the
ISATAP link to send "other" parameters in RAs and also allows any
node on the ISATAP link to act as a (non-default) IPv6 router, e.g.,
if the node is configured as a router for its other IPv6 links.
Site administrators maintain a list of IPv4 addresses representing These aspects of the specification allow useful functionality,
advertising ISATAP interfaces and make them available via one or more including the ability for ISATAP nodes other than PRL members to
of the mechanisms described in Section 6.3.1. The list can include serve as routers for "stub" IPv6 networks, the ability for ISATAP
IPv4 anycast address(es) (e.g., for use as described in [RFC2185], nodes to send IPv6 packets with non-ISATAP source addresses (e.g.,
section 3.3.2.1) but administrators are advised to consider RFC 3401 privacy addresses), etc. But, allowing this functionality
operational implications of anycast (e.g., see: [RFC1546]). prevents ISATAP nodes from perform effective ingress filtering for
Responsible administration can reduce control traffic overhead IPv6 source addresses in packets they receive. Instead, the nodes
associated with router and prefix discovery. must trust that: 1) site border routers are performing ingress
filtering, and 2) malicious nodes are effectively denied access to
the link.
Additionally, the specification expects that that IPv4 addresses are
uniquely assigned within the ISATAP site.
Intellectual Property Statement Intellectual Property Statement
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to intellectual property or other rights that might be claimed to
pertain to the implementation or use of the technology described in pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights this document or the extent to which any license under such rights
might or might not be available; neither does it represent that it might or might not be available; neither does it represent that it
has made any effort to identify any such rights. Information on the has made any effort to identify any such rights. Information on the
IETF's procedures with respect to rights in standards-track and IETF's procedures with respect to rights in standards-track and
 End of changes. 

This html diff was produced by rfcdiff 1.25, available from http://www.levkowetz.com/ietf/tools/rfcdiff/