rfc9663v1.txt | rfc9663.txt | |||
---|---|---|---|---|
Internet Engineering Task Force (IETF) L. Colitti | Internet Engineering Task Force (IETF) L. Colitti | |||
Request for Comments: 9663 Google, LLC | Request for Comments: 9663 Google, LLC | |||
Category: Informational J. Linkova, Ed. | Category: Informational J. Linkova, Ed. | |||
ISSN: 2070-1721 X. Ma, Ed. | ISSN: 2070-1721 X. Ma, Ed. | |||
September 2024 | October 2024 | |||
Using DHCPv6 Prefix Delegation (DHCPv6-PD) to Allocate Unique IPv6 | Using DHCPv6 Prefix Delegation (DHCPv6-PD) to Allocate Unique IPv6 | |||
Prefixes per Client in Large Broadcast Networks | Prefixes per Client in Large Broadcast Networks | |||
Abstract | Abstract | |||
This document discusses an IPv6 deployment scenario when individual | This document discusses an IPv6 deployment scenario when individual | |||
nodes connected to large broadcast networks (such as enterprise | nodes connected to large broadcast networks (such as enterprise | |||
networks or public Wi-Fi networks) are allocated unique prefixes via | networks or public Wi-Fi networks) are allocated unique prefixes via | |||
DHCPv6 Prefix Delegation (DHCPv6-PD), as specified in RFC 8415. | DHCPv6 Prefix Delegation (DHCPv6-PD), as specified in RFC 8415. | |||
skipping to change at line 92 ¶ | skipping to change at line 92 ¶ | |||
deployments place many devices on a shared link with a single on-link | deployments place many devices on a shared link with a single on-link | |||
prefix. This document describes an alternative deployment model | prefix. This document describes an alternative deployment model | |||
where individual devices obtain prefixes from the network. This | where individual devices obtain prefixes from the network. This | |||
provides two important advantages. | provides two important advantages. | |||
First, it offers better scalability. Unlike IPv4, IPv6 allows hosts | First, it offers better scalability. Unlike IPv4, IPv6 allows hosts | |||
to have multiple addresses, and this is the case in most deployments | to have multiple addresses, and this is the case in most deployments | |||
(see Appendix A for more details). However, increasing the number of | (see Appendix A for more details). However, increasing the number of | |||
addresses introduces scalability issues on the network | addresses introduces scalability issues on the network | |||
infrastructure. Network devices need to maintain various types of | infrastructure. Network devices need to maintain various types of | |||
tables/hashes (Neighbor Cache on first-hop routers, Neighbor | tables and hashes (Neighbor Cache on first-hop routers, Neighbor | |||
Discovery Proxy caches on Layer 2 devices, etc.). On Virtual | Discovery Proxy caches on Layer 2 devices, etc.). On Virtual | |||
eXtensible Local Area Network (VXLAN) networks [RFC7348], each | eXtensible Local Area Network (VXLAN) networks [RFC7348], each | |||
address might be represented as a route so eight addresses instead of | address might be represented as a route. This means, for example, | |||
one requires the devices to support eight times more routes, etc. If | that if every client has 10 addresses instead of one, the network | |||
an infrastructure device's resources are exhausted, the device might | must support 10 times more routes, etc. If an infrastructure | |||
drop some IPv6 addresses from the corresponding tables, while the | device's resources are exhausted, the device might drop some IPv6 | |||
address owner might still be using the address to send traffic. This | addresses from the corresponding tables, while the address owner | |||
leads to traffic blackholing and a degraded customer experience. | might still be using the address to send traffic. This leads to | |||
traffic being discarded and a degraded customer experience. | ||||
Providing every host with one prefix allows the network to maintain | Providing every host with one prefix allows the network to maintain | |||
only one entry per device, while still providing the device the | only one entry per device, while still providing the device the | |||
ability to use an arbitrary number of addresses. | ability to use an arbitrary number of addresses. | |||
Second, this deployment model provides the ability to extend the | Second, this deployment model provides the ability to extend the | |||
network. In IPv4, a device that connects to the network can provide | network. In IPv4, a device that connects to the network can provide | |||
connectivity to subtended devices by using NAT. With DHCPv6 Prefix | connectivity to subtended devices by using NAT. With DHCPv6 Prefix | |||
Delegation (DHCPv6-PD) [RFC8415], such a device can similarly extend | Delegation (DHCPv6-PD) [RFC8415], such a device can similarly extend | |||
the network, but unlike IPv4 NAT, it can provide its subtended | the network, but unlike IPv4 NAT, it can provide its subtended | |||
devices with full end-to-end connectivity. | devices with full end-to-end connectivity. | |||
Another method of deploying unique prefixes per device is documented | Another method of deploying unique prefixes per device is documented | |||
in [RFC8273]. Similarly, the standard deployment model in cellular | in [RFC8273]. Similarly, the standard deployment model in cellular | |||
IPv6 networks [RFC6459] provides a unique prefix to every device. | IPv6 networks [RFC6459] provides a unique prefix to every device. | |||
However, providing a unique prefix per device is very uncommon in | However, providing a unique prefix per device is very uncommon in | |||
enterprise-style networks, where nodes are usually connected to | enterprise-style networks, where nodes are usually connected to | |||
broadcast segments/VLANs and each link has a single on-link prefix | broadcast segments such as VLANs and each link has a single on-link | |||
assigned. This document takes a similar approach to [RFC8273], but | prefix assigned. This document takes a similar approach to | |||
allocates the prefix using DHCPv6-PD. | [RFC8273], but allocates the prefix using DHCPv6-PD. | |||
This document focuses on the behavior of the network. Host behavior | This document focuses on the behavior of the network. Host behavior | |||
is not defined in this document. | is not defined in this document. | |||
2. Requirements Language | 2. Requirements Language | |||
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", | |||
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and | |||
"OPTIONAL" in this document are to be interpreted as described in | "OPTIONAL" in this document are to be interpreted as described in | |||
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all | BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all | |||
skipping to change at line 144 ¶ | skipping to change at line 145 ¶ | |||
Node: a device that implements IPv6 [RFC8200] | Node: a device that implements IPv6 [RFC8200] | |||
Host: any node that is not a router [RFC8200] | Host: any node that is not a router [RFC8200] | |||
Client: a node that connects to a network and acquires addresses. | Client: a node that connects to a network and acquires addresses. | |||
The node may wish to obtain addresses for its own use, or it may | The node may wish to obtain addresses for its own use, or it may | |||
be a router that wishes to extend the network to its physical or | be a router that wishes to extend the network to its physical or | |||
virtual subsystems, or both. It may be either a host or a router | virtual subsystems, or both. It may be either a host or a router | |||
as defined by [RFC8200]. | as defined by [RFC8200]. | |||
AP: (wireless) Access Point | ||||
DHCPv6 IA_NA: Identity Association for Non-temporary Addresses | ||||
(Section 21.4 of [RFC8415]) | ||||
DHCPv6 IA_PD: Identity Association for Prefix Delegation | ||||
(Section 21.21 of [RFC8415]) | ||||
DHCPv6-PD: DHCPv6 Prefix Delegation [RFC8415]; a mechanism to | ||||
delegate IPv6 prefixes to clients. | ||||
ND: Neighbor Discovery [RFC4861] | ND: Neighbor Discovery [RFC4861] | |||
NUD: Neighbor Unreachability Detection [RFC4861] | NUD: Neighbor Unreachability Detection [RFC4861] | |||
PIO: Prefix Information Option [RFC4862] | PIO: Prefix Information Option [RFC4862] | |||
SLAAC: IPv6 Stateless Address Autoconfiguration [RFC4862] | SLAAC: IPv6 Stateless Address Autoconfiguration [RFC4862] | |||
DHCPv6-PD: DHCPv6 Prefix Delegation [RFC8415]; a mechanism to | ||||
delegate IPv6 prefixes to clients. | ||||
4. Design Principles | 4. Design Principles | |||
Instead of all clients on a given link forming addresses from the | Instead of all clients on a given link forming addresses from the | |||
same shared prefix assigned to that link: | same shared prefix assigned to that link, this deployment model | |||
operates as described below: | ||||
* A device acts as a DHCPv6-PD client and requests a prefix via | * A device acts as a DHCPv6-PD client and requests a prefix via | |||
DHCPv6-PD by sending an IA_PD request. | DHCPv6-PD by sending an IA_PD request. | |||
* The server delegates a prefix to the client and the delegated | * The server delegates a prefix to the client and the delegated | |||
prefix is installed into the routing table of the first-hop router | prefix is installed into the routing table of the first-hop router | |||
as a route pointing to the client's link-local address. The | as a route pointing to the client's link-local address. The | |||
first-hop router can act as a DHCPv6 relay and snoop DHCPv6 Reply | first-hop router can act as a DHCPv6 relay and snoop DHCPv6 Reply | |||
messages from an off-link DHCPv6 server, or it can act as a DHCPv6 | messages from an off-link DHCPv6 server, or it can act as a DHCPv6 | |||
server itself. In both cases, it can install the route locally, | server itself. In both cases, it can install the route locally, | |||
skipping to change at line 188 ¶ | skipping to change at line 198 ¶ | |||
* The device can use the delegated prefix in various ways. For | * The device can use the delegated prefix in various ways. For | |||
example, it can form addresses, as described in requirement WAA-7 | example, it can form addresses, as described in requirement WAA-7 | |||
of [RFC7084]. It can also extend the network, as described in | of [RFC7084]. It can also extend the network, as described in | |||
[RFC7084] or [RFC7278]. | [RFC7084] or [RFC7278]. | |||
An example scenario is shown in Figure 1. Note that the prefix | An example scenario is shown in Figure 1. Note that the prefix | |||
lengths used in the example are /64 because that is the prefix length | lengths used in the example are /64 because that is the prefix length | |||
currently supported by SLAAC and is not otherwise required by the | currently supported by SLAAC and is not otherwise required by the | |||
proposed deployment model. | proposed deployment model. | |||
+-----------------------------------------------------------------------------+ | +------------------------------------------------------------------+ | |||
| DHCPv6 Servers | | | DHCPv6 Servers | | |||
| Pool 2001:db8:ddd0::/48 for clients on 2001:db8:c001::/64 link | | | Pool 3fff:0:d::/48 for clients on 2001:db8:ff::/64 link | | |||
+---------------+-------------------------+-----------------------------+-----+ | +------------+---------------------+----------------------------+--+ | |||
^ | | ^ | | ^ | | ^ | | |||
| | | | | | | | | | | | |||
+-------+------+-------------------------+----------------------+------+-----+ | +-------+------+---------------------+--------------------+-------+---+ | |||
|DHCPv6 | | IPv6 Network DHCPv6 | | | | | DHCPv6| | IPv6 Network DHCPv6 | | | | |||
|Relay-Forward | Relay-Forward | | | |Relay-Forward | Relay-Forward | | | |||
| ^ v Route for 2001:db8:ddd0::/48 ^ v | | | ^ v Route for 3fff:0:d::/48 ^ v | | |||
| | DHCPv6 | | | DHCPv6 | | | | DHCPv6 | | | DHCPv6 | | |||
| | Relay-Reply | | | Relay-Reply| | | | Relay-Reply | | | Relay-Reply| | |||
| | | | | | | | | | | | | | | | | | |||
+-----+-------+-------+-----+--------------------+-----+-------+-------+-----+ | +------+-------+--+----------+------------+------+-------+--------+---+ | |||
| | | | | | | | | | | | | | | | | | |||
| v | v v | | v | | v | v v | | v | |||
+----+---------------+--------------+ +--------------+-------+-------------+ | +----+----------+---------------+ +---------+-------+------------+ | |||
| First-hop router/DHCPv6 relay | | First-hop Router/DHCPv6 relay | | | First-hop router/DHCPv6 relay | | First-hop Router/DHCPv6 relay| | |||
| 2001:db8:ddd0:1::/64 -> fe80::aaaa| | 2001:db8:ddd0:1::/64 -> fe80::aaaa | | | 3fff:0:d:1::/64 -> fe80::aa | | 3fff:0:d:1::/64 -> fe80::aa | | |||
| 2001:db8:ddd0:2::/64 -> fe80::cccc| | 2001:db8:ddd0:2::/64 -> fe80::ccc | | | 3fff:0:d:2::/64 -> fe80::cc | | 3fff:0:d:2::/64 -> fe80::cc | | |||
+-----------+------------+----------+ +---------+--------------------+-----+ | +------------+----------+-------+ +--------+----------------+----+ | |||
^ | | Shared IPv6 link, | ^ | | ^ | | Shared IPv6 link | ^ | | |||
| | | 2001:db8:c001::/64 | | | | | | | 2001:db8:ff::/64 | | | | |||
| | --+-------+-----------+-----------+------+--- | | | | | -+-----+-----------+---------+-----+- | | | |||
| | | | | | | | | | | | | | | | |||
| | | +----------------+--------------+ | DHCPv6 | | | | | +---------------+-------------+ | DHCPv6 | | |||
DHCPv6 | | |Legacy (no DHCPv6-PD) client B | | Request v | DHCPv6 | | | Client B (no DHCPv6-PD) | | Request v | |||
Request | | |link-local address fe80::bbbb | | ^ DHCPv6 | Request | | |link-local address fe80::b | | ^ DHCPv6 | |||
^ | | |global address 2001:db8:c001::b| | | Reply | ^ | | |global address 2001:db8:ff::b| | | Reply | |||
| | | +-------------------------------+ | | | | | | | +-----------------------------+ | | | | |||
| v | | | v | | v | | | v | |||
| DHCPv6 | +-------------------+-----+------------+ | | DHCPv6 | +--------------------+--+----------+ | |||
| Reply | | Client C | | | Reply | | Client C | | |||
| | | | link-local address fe80::cccc | | | | | | link-local address fe80::cc | | |||
| | | | delegated prefix 2001:db8:ddd0:2::/64| | | | | | delegated prefix 3fff:0:d:2::/64 | | |||
| | | +--------------+-+---------------------+ | | | | +------------+-------------------+-+ | |||
| | | | | | | v | | | | |||
+----+-------+----+-----------------------------+ | | Router Advertisement | +---+-------------+----------------------+ | Router | | |||
| Client A | | | containing PIO | | Client A | | Advertisement | | |||
| link-local address: fe80::aaaa | | v 2001:db8:ddd0:2::/64 | | link-local address: fe80::aa | | containing PIO v | |||
| delegated prefix: 2001:db8:ddd0:1::/64 | | | | delegated prefix: 3fff:0:d:1::/64 | | 3fff:0:d:2::/64 | |||
| +---------------------+ +------------------+ | -+-----------+--------- | | +----------------+ +----------------+ | -+---------+----------- | |||
| | virtual system | | virtual system | | | | | | virtual system | | virtual system | | | | |||
| | 2001:db8:ddd0:1::f00| |2001:db8:ddd0:1::2| | +---------+-----------+ | | | 3fff:0:d:1::de | | 3fff:0:d:1::ad | | +------+----------+ | |||
| | 2001:db8:ddd0:1::caf| |2001:db8:ddd0:1::a| | | Tethered device | | | | 3fff:0:d:1::ca | | 3fff:0:d:1::fe | | | Tethered device | | |||
| +---------------------+ +------------------+ | |2001:db8:ddd0:2::6666| | | +----------------+ +----------------+ | | 3fff:0:d:2::66 | | |||
| | +---------------------+ | | | +-----------------+ | |||
+-----------------------------------------------+ | +----------------------------------------+ | |||
Figure 1: An Example Topology with Two First-Hop Routers | Figure 1: An Example Topology with Two First-Hop Routers | |||
5. Applicability and Limitations | 5. Applicability and Limitations | |||
Delegating a unique prefix per client provides all the benefits of | Delegating a unique prefix per client provides all the benefits of | |||
both SLAAC and DHCPv6 address allocation, but at the cost of greater | both SLAAC and DHCPv6 address allocation, but at the cost of greater | |||
address-space usage. This design would substantially benefit some | address-space usage. This design would substantially benefit some | |||
networks (see Section 12) in which the additional cost of an | networks (see Section 12) in which the additional cost of an | |||
additional service (such as DHCPv6 Prefix Delegation) and allocation | additional service (such as DHCPv6 Prefix Delegation) and allocation | |||
of a larger amount of address space can easily be justified. | of a larger amount of address space can easily be justified. | |||
Examples of such networks include but are not limited to: | Examples of such networks include but are not limited to: | |||
skipping to change at line 308 ¶ | skipping to change at line 318 ¶ | |||
To ensure that routes to the delegated prefixes are preserved even if | To ensure that routes to the delegated prefixes are preserved even if | |||
a relay is rebooted or replaced, the operator MUST ensure that all | a relay is rebooted or replaced, the operator MUST ensure that all | |||
relays in the network infrastructure support DHCPv6 Bulk Leasequery | relays in the network infrastructure support DHCPv6 Bulk Leasequery | |||
as defined in [RFC5460]. While Section 4.3 of [RFC8987] lists | as defined in [RFC5460]. While Section 4.3 of [RFC8987] lists | |||
keeping active prefix delegations in persistent storage as an | keeping active prefix delegations in persistent storage as an | |||
alternative to DHCPv6 Bulk Leasequery, relying on persistent storage | alternative to DHCPv6 Bulk Leasequery, relying on persistent storage | |||
has the following drawbacks: | has the following drawbacks: | |||
* In a network with multiple relays, network state can change | * In a network with multiple relays, network state can change | |||
significantly while the relay is rebooting (new prefixes | significantly while the relay is rebooting (new prefixes might be | |||
delegated, some prefixes expiring, etc.). | delegated or some prefixes might be expiring, etc). | |||
* Persistent storage might not be preserved if the router is | * Persistent storage might not be preserved if the router is | |||
physically replaced. | physically replaced. | |||
Another mechanism for first-hop routers to obtain information about | Another mechanism for first-hop routers to obtain information about | |||
delegated prefixes is by using Active Leasequery [RFC7653], though | delegated prefixes is by using Active Leasequery [RFC7653], though | |||
this is not yet widely supported. | this is not yet widely supported. | |||
6.3. Topologies with Multiple First-Hop Routers | 6.3. Topologies with Multiple First-Hop Routers | |||
skipping to change at line 408 ¶ | skipping to change at line 418 ¶ | |||
* The server MUST NOT send the Server Unicast option to the client | * The server MUST NOT send the Server Unicast option to the client | |||
unless the network topology guarantees that no client is connected | unless the network topology guarantees that no client is connected | |||
to a link with multiple relays (see Section 6.3). | to a link with multiple relays (see Section 6.3). | |||
* In order to ensure uninterrupted connectivity when a first-hop | * In order to ensure uninterrupted connectivity when a first-hop | |||
router crashes or reboots, the server MUST support Bulk Leasequery | router crashes or reboots, the server MUST support Bulk Leasequery | |||
or Active Leasequery. | or Active Leasequery. | |||
As most operators have some experience with IPv4, they can use a | As most operators have some experience with IPv4, they can use a | |||
similar approach for choosing the pool size and the timers (such as | similar approach for choosing the pool size and the timers (such as | |||
T1/T2 timers). In particular, the following factors shall be taken | T1 and T2 timers). In particular, the following factors should be | |||
into account: | taken into account: | |||
* the expected maximum number of clients; | * the expected maximum number of clients; | |||
* the average duration of a client connection; | * the average duration of client connections; | |||
* the mobility of the clients (for example, a network where all | * how mobile the clients are (a network where all clients are | |||
clients are connected to a single wired VLAN might choose longer | connected to a single wired VLAN might choose longer timers than a | |||
timers than a network where clients can switch between multiple | network where clients can switch between multiple wireless | |||
wireless SSIDs); | networks); | |||
* the expected level of recurring clients (for example, a corporate | * how often clients are expected to reconnect to the network (for | |||
authenticated Wi-Fi network might be using longer timers than an | example, a corporate authenticated Wi-Fi network might be using | |||
open public Wi-Fi). | longer timers than an open public Wi-Fi). | |||
DHCPv6 servers that delegate prefixes can interface with Dynamic DNS | DHCPv6 servers that delegate prefixes can interface with Dynamic DNS | |||
infrastructure to automatically populate reverse DNS, similarly to | infrastructure to automatically populate reverse DNS using wildcard | |||
what is described in Section 2.5.2 of [RFC8501]. Networks that also | records, similarly to what is described in Section 2.2 of [RFC8501]. | |||
wish to populate forward DNS cannot do so automatically based only on | Networks that also wish to populate forward DNS cannot do so | |||
DHCPv6 prefix delegation transactions, but they can do so in other | automatically based only on DHCPv6 prefix delegation transactions, | |||
ways, such as by supporting DHCPv6 address registration as described | but they can do so in other ways, such as by supporting DHCPv6 | |||
in [ADDR-NOTIFICATION]. | address registration as described in [ADDR-NOTIFICATION]. | |||
Some additional recommendations driven by security and privacy | Some additional recommendations driven by security and privacy | |||
considerations are discussed in Section 15 and Section 13. | considerations are discussed in Section 15 and Section 13. | |||
8. Prefix Length Considerations | 8. Prefix Length Considerations | |||
Delegating a prefix of sufficient size to use SLAAC allows the client | Delegating a prefix of sufficient size to use SLAAC allows the client | |||
to extend the network, providing limitless addresses to IPv6 nodes | to extend the network, providing limitless addresses to IPv6 nodes | |||
connected to it (e.g., virtual machines or tethered devices), because | connected to it (e.g., virtual machines or tethered devices), because | |||
all IPv6 hosts are required to support SLAAC [RFC8504]. | all IPv6 hosts are required to support SLAAC [RFC8504]. | |||
skipping to change at line 486 ¶ | skipping to change at line 496 ¶ | |||
address assignment mechanisms as well. | address assignment mechanisms as well. | |||
9. Client Mobility | 9. Client Mobility | |||
As per Section 18.2.12 of [RFC8415], when the client moves to a new | As per Section 18.2.12 of [RFC8415], when the client moves to a new | |||
link, it MUST initiate a Rebind/Reply message exchange. Therefore, | link, it MUST initiate a Rebind/Reply message exchange. Therefore, | |||
when the client moves between network attachment points, it would | when the client moves between network attachment points, it would | |||
refresh its delegated prefix the same way it refreshes addresses | refresh its delegated prefix the same way it refreshes addresses | |||
assigned (via SLAAC or DHCPv6 IA_NA) from a shared on-link prefix: | assigned (via SLAAC or DHCPv6 IA_NA) from a shared on-link prefix: | |||
* When a client moves between different attachment points on the | * When a client moves from between different attachment points on | |||
same link (e.g., roams between two APs while connected to the same | the same link (e.g., roams between two APs while connected to the | |||
SSID or moves between two switch ports belonging to the same | same wireless network or moves between two switchports belonging | |||
VLAN), the delegated prefix does not change, and the first-hop | to the same VLAN), the delegated prefix does not change, and the | |||
routers have a route for the prefix with the nexthop set to the | first-hop routers have a route for the prefix with the nexthop set | |||
client link-local address on that link. As per requirement S-2 in | to the client link-local address on that link. As per requirement | |||
Section 4.3 of [RFC8987], the DHCPv6-relays (the first-hop | S-2 in Section 4.3 of [RFC8987], the DHCPv6-relays (the first-hop | |||
routers) MUST retain the route for the delegating prefix until the | routers) MUST retain the route for the delegating prefix until the | |||
route is released or removed due to expiring DHCP timers. | route is released or removed due to expiring DHCP timers. | |||
Therefore, if the client reconnects to the same link, the prefix | Therefore, if the client reconnects to the same link, the prefix | |||
doesn't change. | doesn't change. | |||
* When a client moves to a different link, the DHCPv6 server | * When a client moves to a different link, the DHCPv6 server | |||
provides the client with a new prefix, so the behavior is | provides the client with a new prefix, so the behavior is | |||
consistent with SLAAC or DHCPv6-assigned addresses, which are also | consistent with SLAAC or DHCPv6-assigned addresses, which are also | |||
different on the new link. | different on the new link. | |||
skipping to change at line 530 ¶ | skipping to change at line 540 ¶ | |||
versus guest networks), hence clients on different links need to use | versus guest networks), hence clients on different links need to use | |||
different prefixes. | different prefixes. | |||
10. Antispoofing and SAVI Interaction | 10. Antispoofing and SAVI Interaction | |||
Enabling unicast Reverse Path Forwarding (uRPF) [RFC3704] on the | Enabling unicast Reverse Path Forwarding (uRPF) [RFC3704] on the | |||
first-hop router interfaces towards clients provides the first layer | first-hop router interfaces towards clients provides the first layer | |||
of defense against spoofing. A spoofed packet sent by a malicious | of defense against spoofing. A spoofed packet sent by a malicious | |||
client would be dropped by the router unless the spoofed address | client would be dropped by the router unless the spoofed address | |||
belongs to a prefix delegated to another client on the same | belongs to a prefix delegated to another client on the same | |||
interface. Therefore, the malicious client can only spoof addresses | interface. Therefore the malicious client can only spoof addresses | |||
already delegated to another client on the same link or another | already delegated to another client on the same link or another | |||
client link-local address. | client's link-local address. | |||
Source Address Validation Improvement (SAVI) [RFC7039] provides more | Source Address Validation Improvement (SAVI) [RFC7039] provides more | |||
reliable protection against address spoofing. Administrators | reliable protection against address spoofing. Administrators | |||
deploying the proposed solution on SAVI-enabled infrastructure SHOULD | deploying the proposed solution on SAVI-enabled infrastructure SHOULD | |||
ensure that SAVI perimeter devices support DHCPv6-PD snooping to | ensure that SAVI perimeter devices support DHCPv6-PD snooping to | |||
create the correct binding for the delegated prefixes (see | create the correct binding for the delegated prefixes (see | |||
[RFC7513]). Using FCFS SAVI [RFC6620] to protect link-local | [RFC7513]). Using FCFS SAVI [RFC6620] to protect link-local | |||
addresses and create SAVI bindings for DHCPv6-PD assigned prefixes | addresses and create SAVI bindings for DHCPv6-PD assigned prefixes | |||
would prevent spoofing. | would prevent spoofing. | |||
skipping to change at line 573 ¶ | skipping to change at line 583 ¶ | |||
from the PIO | from the PIO | |||
It would be beneficial for the network to explicitly indicate its | It would be beneficial for the network to explicitly indicate its | |||
support of DHCPv6-PD for connected clients. | support of DHCPv6-PD for connected clients. | |||
* In small networks (e.g., home networks), where the number of | * In small networks (e.g., home networks), where the number of | |||
clients is not too high, the number of available prefixes becomes | clients is not too high, the number of available prefixes becomes | |||
a limiting factor. If every phone or laptop in a home network | a limiting factor. If every phone or laptop in a home network | |||
were to request a unique prefix suitable for SLAAC, the home | were to request a unique prefix suitable for SLAAC, the home | |||
network might run out of prefixes, if the prefix allocated to the | network might run out of prefixes, if the prefix allocated to the | |||
Customer Premises Equipment (CPE) by its ISP is too small (e.g., | Customer Premises Equipment (CPE) by its ISP is too long. For | |||
if an ISP delegates a /60, it would only be able to delegate 15 | example, if an ISP delegates a /60, the CPE would only be able to | |||
/64 prefixes to clients). So while the enterprise network | delegate fifteen /64 prefixes to clients. So while the enterprise | |||
administrator might want all phones in the network to request a | network administrator might want all phones in the network to | |||
prefix, it would be highly undesirable for the same phone to | request a prefix, it would be highly undesirable for the same | |||
request a prefix when connecting to a home network. | phone to request a prefix when connecting to a home network. | |||
* When the network supports both a unique prefix per client and a | * When the network supports both a unique prefix per client and a | |||
PIO with A=1 as address assignment methods, it's highly desirable | PIO with A=1 as address assignment methods, it's highly desirable | |||
for the client NOT to use the PIO prefix to form global addresses | for the client NOT to use the PIO prefix to form global addresses | |||
and instead only use the prefix delegated via DHCPv6-PD. Starting | and instead only use the prefix delegated via DHCPv6-PD. Starting | |||
both SLAAC using the PIO prefix and DHCPv6-PD and deprecating that | both SLAAC using the PIO prefix and DHCPv6-PD, and then | |||
SLAAC addresses after receiving a delegated prefix would be very | deprecating the SLAAC addresses after receiving a delegated prefix | |||
disruptive for applications. If the client continues to use | would be very disruptive for applications. If the client | |||
addresses formed from the PIO prefix, it would not only undermine | continues to use addresses formed from the PIO prefix, it would | |||
the benefits of the proposed solution (see Section 12), but it | not only undermine the benefits of the proposed solution (see | |||
would also introduce complexity and unpredictability in the source | Section 12), but it would also introduce complexity and | |||
address selection. Therefore, the client needs to know what | unpredictability in the source address selection. Therefore, the | |||
address assignment method to use and whether or not to use the | client needs to know what address assignment method to use and | |||
prefix in the PIO, if the network provides the PIO with the 'A' | whether or not to use the prefix in the PIO, if the network | |||
flag set. | provides the PIO with the 'A' flag set. | |||
The deployment model described in this document does not require the | The deployment model described in this document does not require the | |||
network to signal support of DHCPv6-PD: for example, devices acting | network to signal support of DHCPv6-PD: for example, devices acting | |||
as compatible routers [RFC7084] will be able to receive prefixes via | as compatible routers [RFC7084] will be able to receive prefixes via | |||
DHCPv6-PD even without such signaling. Also, some clients may decide | DHCPv6-PD even without such signaling. Also, some clients may decide | |||
to start DHCPv6-PD and acquire prefixes if they detect that the | to start DHCPv6-PD and acquire prefixes if they detect that the | |||
network does not provide addresses via SLAAC. To fully achieve the | network does not provide addresses via SLAAC. To fully achieve the | |||
benefits described in this section, [PIO-PFLAG] defines a new PIO | benefits described in this section, [PIO-PFLAG] defines a new PIO | |||
flag to signal that DHCPv6-PD is the preferred method of obtaining | flag to signal that DHCPv6-PD is the preferred method of obtaining | |||
prefixes. | prefixes. | |||
skipping to change at line 631 ¶ | skipping to change at line 641 ¶ | |||
* If all clients connected to the given link support this mode of | * If all clients connected to the given link support this mode of | |||
operation and can generate addresses from the delegated prefixes, | operation and can generate addresses from the delegated prefixes, | |||
there is no reason to advertise a common prefix assigned to that | there is no reason to advertise a common prefix assigned to that | |||
link in the PIO with the 'A' flag set. Therefore, it is possible | link in the PIO with the 'A' flag set. Therefore, it is possible | |||
to remove the global shared prefix from that link and the router | to remove the global shared prefix from that link and the router | |||
interface completely, so no global addresses are on-link for the | interface completely, so no global addresses are on-link for the | |||
link. This would lead to reducing the attack surface for Neighbor | link. This would lead to reducing the attack surface for Neighbor | |||
Discovery attacks described in [RFC6583]. | Discovery attacks described in [RFC6583]. | |||
* DHCPv6-PD logs and routing tables for first-hop routers provide | * DHCPv6-PD logs and routing tables obtained from first-hop routers | |||
complete information on IPv6 to MAC mapping, which can be used for | provide complete information on IPv6 to MAC mapping, which can be | |||
forensics and troubleshooting. Such information is much less | used for forensics and troubleshooting. Such information is much | |||
dynamic than the ND cache; therefore, it's much easier for an | less dynamic than the ND cache; therefore, it's much easier for an | |||
operator to collect and process it. | operator to collect and process it. | |||
* A dedicated prefix per client allows the network administrator to | * A dedicated prefix per client allows the network administrator to | |||
create security policies per device (such as ACLs) even if the | create security policies per device (such as ACLs) even if the | |||
client is using temporary addresses. This mitigates one of the | client is using temporary addresses. This mitigates one of the | |||
issues described in [IPv6-ADDRESS]. | issues described in [IPv6-ADDRESS]. | |||
* Fate sharing: all global addresses used by a given client are | * Fate sharing: all global addresses used by a given client are | |||
routed as a single prefix. Either all of them work or not, which | routed as a single prefix. Either all of them work or none of | |||
makes failures easier to diagnose and mitigate. | them work, which makes failures easier to diagnose and mitigate. | |||
* Lower level of multicast traffic: less Neighbor Discovery | * Lower level of multicast traffic: less Neighbor Discovery | |||
[RFC4861] multicast packets, as the routers need to resolve only | [RFC4861] multicast packets, as the routers need to resolve only | |||
the clients' link-local addresses. Also, there is no Duplicate | the clients' link-local addresses. Also, there is no Duplicate | |||
Address Detection (DAD) traffic except for the clients' link-local | Address Detection (DAD) traffic except for the clients' link-local | |||
addresses. | addresses. | |||
* Ability to extend the network transparently. If the network | * Ability to extend the network transparently. If the network | |||
delegates to the client a prefix of sufficient size to support | delegates to the client a prefix of sufficient size to support | |||
SLAAC, the client can provide connectivity to other hosts, as is | SLAAC, the client can provide connectivity to other hosts, as is | |||
skipping to change at line 809 ¶ | skipping to change at line 819 ¶ | |||
[IPv6-ADDRESS] | [IPv6-ADDRESS] | |||
Gont, F. and G. Gont, "Implications of IPv6 Addressing on | Gont, F. and G. Gont, "Implications of IPv6 Addressing on | |||
Security Operations", Work in Progress, Internet-Draft, | Security Operations", Work in Progress, Internet-Draft, | |||
draft-ietf-opsec-ipv6-addressing-00, 2 June 2023, | draft-ietf-opsec-ipv6-addressing-00, 2 June 2023, | |||
<https://datatracker.ietf.org/doc/html/draft-ietf-opsec- | <https://datatracker.ietf.org/doc/html/draft-ietf-opsec- | |||
ipv6-addressing-00>. | ipv6-addressing-00>. | |||
[PIO-PFLAG] | [PIO-PFLAG] | |||
Colitti, L., Linkova, J., Ma, X., and D. Lamparter, | Colitti, L., Linkova, J., Ma, X., and D. Lamparter, | |||
"Signalling DHCPv6 Prefix per Client Availability to | "Signaling DHCPv6 Prefix per Client Availability to | |||
Hosts", Work in Progress, Internet-Draft, draft-ietf-6man- | Hosts", Work in Progress, Internet-Draft, draft-ietf-6man- | |||
pio-pflag-09, 15 August 2024, | pio-pflag-10, 30 September 2024, | |||
<https://datatracker.ietf.org/doc/html/draft-ietf-6man- | <https://datatracker.ietf.org/doc/html/draft-ietf-6man- | |||
pio-pflag-09>. | pio-pflag-10>. | |||
[RFC3704] Baker, F. and P. Savola, "Ingress Filtering for Multihomed | [RFC3704] Baker, F. and P. Savola, "Ingress Filtering for Multihomed | |||
Networks", BCP 84, RFC 3704, DOI 10.17487/RFC3704, March | Networks", BCP 84, RFC 3704, DOI 10.17487/RFC3704, March | |||
2004, <https://www.rfc-editor.org/info/rfc3704>. | 2004, <https://www.rfc-editor.org/info/rfc3704>. | |||
[RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, | [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, | |||
"Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, | "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, | |||
DOI 10.17487/RFC4861, September 2007, | DOI 10.17487/RFC4861, September 2007, | |||
<https://www.rfc-editor.org/info/rfc4861>. | <https://www.rfc-editor.org/info/rfc4861>. | |||
skipping to change at line 920 ¶ | skipping to change at line 930 ¶ | |||
assigned to its interface. At the very least, a host can be expected | assigned to its interface. At the very least, a host can be expected | |||
to have one link-local address, one temporary address, and, in most | to have one link-local address, one temporary address, and, in most | |||
cases, one stable global address. On a network providing NAT64 | cases, one stable global address. On a network providing NAT64 | |||
service, an IPv6-only host running the 464XLAT customer-side | service, an IPv6-only host running the 464XLAT customer-side | |||
translator (CLAT) [RFC6877] would use a dedicated 464XLAT address, | translator (CLAT) [RFC6877] would use a dedicated 464XLAT address, | |||
configured via SLAAC (see Section 6.3 of [RFC6877]), which brings the | configured via SLAAC (see Section 6.3 of [RFC6877]), which brings the | |||
total number of addresses to four. Other common scenarios where the | total number of addresses to four. Other common scenarios where the | |||
number of addresses per host interface might increase significantly | number of addresses per host interface might increase significantly | |||
include but are not limited to: | include but are not limited to: | |||
* Devices running containers/namespaces: each container/namespace | * Devices running containers or namespaces: each container or | |||
would have multiple addresses as described above. As a result, a | namespace would have multiple addresses as described above. As a | |||
device running just a few containers in a bridge mode can easily | result, a device running just a few containers in a bridge mode | |||
have 20 or more IPv6 addresses on the given link. | can easily have 20 or more IPv6 addresses on the given link. | |||
* Networks assigning multiple prefixes to a given link: these | * Networks assigning multiple prefixes to a given link: multihomed | |||
include multihomed networks, networks using ULA [RFC4193] and non- | networks, networks using Unique Local IPv6 Unicast Addresses (ULA, | |||
ULA prefixes together, or networks performing a graceful | [RFC4193]) and non-ULA prefixes together, or networks performing a | |||
renumbering from one prefix to another. | graceful renumbering from one prefix to another. | |||
[RFC7934] discusses this aspect and explicitly states that IPv6 | [RFC7934] discusses this aspect and explicitly states that IPv6 | |||
deployments SHOULD NOT limit the number of IPv6 addresses a host can | deployments SHOULD NOT limit the number of IPv6 addresses a host can | |||
have. However, it has been observed that networks often do limit the | have. However, it has been observed that networks often do limit the | |||
number of on-link addresses per device, likely in an attempt to | number of on-link addresses per device, likely in an attempt to | |||
protect network resources and prevent DoS attacks. | protect network resources and prevent DoS attacks. | |||
The most common scenario of network-imposed limitations is ND proxy. | The most common scenario of network-imposed limitations is ND proxy. | |||
Many enterprise-scale wireless solutions implement ND proxy to reduce | Many enterprise-scale wireless solutions implement ND proxy to reduce | |||
the amount of broadcast and multicast downstream (AP to clients) | the amount of broadcast and multicast downstream (AP to clients) | |||
End of changes. 27 change blocks. | ||||
124 lines changed or deleted | 134 lines changed or added | |||
This html diff was produced by rfcdiff 1.48. |