RFC 3633
IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6
RFC 3633: IPv6 Prefix Options for DHCP version 6 🎀
okay bestie, this one is RFC 3633 and it's giving standards track, which means it's an actual protocol spec 💅 It was published in December 2003 by the Network Working Group. The authors are O. Troan and R. Droms, both from Cisco Systems. The header doesn't list anything it obsoletes or updates, so no drama there 🙈
Status of this Memo ✨
So this doc specifies an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🦋 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Copyright Notice 🌸
Copyright (C) The Internet Society (2003). All Rights Reserved.
Abstract 💜
The Prefix Delegation options are a way to automatically hand out IPv6 prefixes using the Dynamic Host Configuration Protocol (DHCP) 🧚 This is meant for delegating a long-lived prefix from a delegating router to a requesting router across an administrative boundary. The delegating router does not need to know anything about the topology of the links the prefixes will get assigned to. That's the main-character move here 👑
Table of Contents 📑
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. DHCPv6 specification dependency . . . . . . . . . . . . . . 3
3. Terminology . . . . . . . . . . . . . . . . . . . . . . . . 3
4. Requirements . . . . . . . . . . . . . . . . . . . . . . . . 3
5. Model and Applicability . . . . . . . . . . . . . . . . . . 3
5.1. Example network architecture . . . . . . . . . . . . . 4
6. Identity Association for Prefix Delegation . . . . . . . . . 5
7. Overview of DHCP with Prefix Delegation . . . . . . . . . . 6
8. Interface Selection . . . . . . . . . . . . . . . . . . . . 7
9. Identity Association for Prefix Delegation Option . . . . . 7
10. IA_PD Prefix option . . . . . . . . . . . . . . . . . . . . 9
11. Delegating Router Solicitation . . . . . . . . . . . . . . . 11
11.1. Requesting router behavior . . . . . . . . . . . . . . 11
11.2. Delegating router behavior . . . . . . . . . . . . . . 11
12. Requesting router initiated prefix delegation . . . . . . . 12
12.1. Requesting router behavior . . . . . . . . . . . . . . 12
12.2. Delegating Router behavior . . . . . . . . . . . . . . 14
13. Prefix Delegation reconfiguration . . . . . . . . . . . . . 15
13.1. Delegating Router behavior . . . . . . . . . . . . . . 15
13.2. Requesting Router behavior . . . . . . . . . . . . . . 15
14. Relay agent behavior . . . . . . . . . . . . . . . . . . . . 15
15. Security Considerations . . . . . . . . . . . . . . . . . . 16
16. IANA Considerations . . . . . . . . . . . . . . . . . . . . 16
17. Intellectual Property Statement. . . . . . . . . . . . . . . 17
18. References . . . . . . . . . . . . . . . . . . . . . . . . . 17
18.1. Normative References . . . . . . . . . . . . . . . . . 17
18.2. Informative References . . . . . . . . . . . . . . . . 17
19. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 18
20. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 18
21. Full Copyright Statement . . . . . . . . . . . . . . . . . . 191. Introduction 🦋
Okay so this doc describes new options for Dynamic Host Configuration Protocol (DHCP) that give you a way to delegate IPv6 prefixes [1] 🎀 With these options, a delegating router can hand prefixes out to authorized requesting routers. It's so clean ✨
The prefix delegation mechanism here is meant for simple delegation of prefixes from a delegating router to requesting routers. It's a good fit when the delegating router doesn't know the topology of the networks the requesting router is attached to, and when it doesn't need any other info besides the identity of the requesting router to pick a prefix. Like, a service provider could use these options to give a prefix to a Customer Premise Equipment (CPE) device that acts as a router between the subscriber's internal network and the provider's core network 🏠
Many applications expect stable addresses 🥺 Even though this mechanism makes automatic renumbering easier, prefixes are expected to have a long lifespan. During renumbering, the old and the new prefix are expected to co-exist for some time 🌸
The design of this prefix delegation mechanism meets the requirements for prefix delegation in Requirements for IPv6 prefix delegation [6] 💅
Also, this use of DHCP is not tied to assigning IP addresses or other config info to hosts. There's currently no mechanism to tell a DHCP server that does that job about delegated prefixes. That could be future work, if usage ever calls for it 🔮
2. DHCPv6 specification dependency 📜
This doc describes new DHCPv6 options for IPv6 prefix delegation. You should read it alongside the DHCPv6 specification, RFC 3315 [2], since that's where you get the complete spec for the Prefix Delegation options and mechanism. Terms and acronyms that aren't specifically defined here are defined in RFC 3315 🧠
3. Terminology 💖
This doc uses the terminology from RFC 2460 [1] and RFC 3315. On top of that, it uses these terms:
- requesting router: The router that acts as a DHCP client and is requesting prefix(es) to be assigned. 🙋
- delegating router: The router that acts as a DHCP server and responds to the prefix request. 🏢
- Identity Association for Prefix Delegation (
IA_PD): A collection of prefixes assigned to the requesting router. EachIA_PDhas an associated IAID. A requesting router may have more than oneIA_PDassigned to it, for example one for each of its interfaces. 🧩
4. Requirements 🔥
The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they show up in this doc, are to be read as described in BCP 14, RFC 2119 [3] 🎀
5. Model and Applicability 👑
Here's the model of operation for prefix delegation. A delegating router gets IPv6 prefixes that it can delegate to requesting routers. There are examples of how the delegating router might get these prefixes in Section 12.2 ✨ A requesting router asks the delegating router for prefix(es), as described in Section 12.1. The delegating router picks prefix(es) for delegation and responds with them. From there, the requesting router is responsible for the delegated prefix(es) 🫶 For example, it might assign a subnet from a delegated prefix to one of its interfaces, and start sending router advertisements for that prefix on that link 📡
Each prefix has a valid lifetime and a preferred lifetime. Together they're an agreement about how long the requesting router is allowed to use the prefix ⏳ A requesting router can ask for an extension of the lifetimes on a delegated prefix, and it is required to stop using a delegated prefix once the prefix's valid lifetime expires. Strict, but fair 💅
This prefix delegation mechanism would be a good fit for an ISP delegating a prefix to a subscriber. The delegated prefix could get subnetted and assigned to the links inside the subscriber's network 🏡
5.1. Example network architecture 🗺️
Figure 1 shows a network architecture where prefix delegation could be used 🦋
______________________ \
/ \ \
| ISP core network | \
\__________ ___________/ |
| |
+-------+-------+ |
| Aggregation | | ISP
| device | | network
| (delegating | |
| router) | |
+-------+-------+ |
| /
|DSL to subscriber /
|premises /
|
+------+------+ \
| CPE | \
| (requesting | \
| router) | |
+----+---+----+ |
| | | Subscriber
---+-------------+-----+- -+-----+-------------+--- | network
| | | | |
+----+-----+ +-----+----+ +----+-----+ +-----+----+ |
|Subscriber| |Subscriber| |Subscriber| |Subscriber| /
| PC | | PC | | PC | | PC | /
+----------+ +----------+ +----------+ +----------+ /Figure 1: An example of prefix delegation.
In this example, the delegating router is set up with a bunch of prefixes to hand out to customers, one at each customer's first connection to the ISP service 🤩 The prefix delegation process starts when the requesting router asks for config info through DHCP. The DHCP messages from the requesting router get received by the delegating router in the aggregation device. When the delegating router gets the request, it picks an available prefix or prefixes for delegation to the requesting router, then sends them back 📦
The requesting router subnets the delegated prefix and gives the longer prefixes to links in the subscriber's network 🍓 In a typical scenario based on Figure 1, the requesting router subnets a single delegated /48 prefix into /64 prefixes and assigns one /64 prefix to each link in the subscriber network. Iconic math 🧮
The prefix delegation options can be used together with other DHCP options that carry other config info to the requesting router. The requesting router can then provide DHCP service to hosts on the internal network. For example, the requesting router could get the addresses of DNS and NTP servers from the ISP delegating router, then pass that config info on to the subscriber hosts through a DHCP server running in the requesting router 🌈
Part 1 wraps up right here, and Part 2 picks up at Section 6 (Identity Association for Prefix Delegation) 💜🧚
- Identity Association for Prefix Delegation ✨
okay so an IA_PD is the way a delegating router and a requesting router can identify, group and manage a whole bunch of related IPv6 prefixes 🎀 Each IA_PD is made of an IAID plus its configuration info. Basically it's the prefix version of an IA (the one from RFC 3315, which is for addresses) 💖
the big difference is that an IA_PD doesn't have to belong to exactly one interface 🦋 one IA_PD can belong to the requesting router itself, to a set of interfaces, or to just one interface. A requesting router MUST create at least one distinct IA_PD 💅 it MAY give each of its downstream interfaces its own IA_PD and use that one to get a prefix for that interface from the delegating router 🌸
the IAID is what uniquely identifies the IA_PD, and it has to be unique among the IA_PD IAIDs on that requesting router 🫶 the requesting router picks the IAID itself. for any given use of an IA_PD, the IAID MUST stay consistent across restarts of the requesting router 😭 the router can keep things consistent by saving the IAID in non-volatile storage, or by using an algorithm that spits out the same IAID every time as long as the router's configuration hasn't changed 🧚 and if the router only uses one IAID, it can just use a well-known value, like zero 🍓
the configuration info in an IA_PD is one or more IPv6 prefixes plus the times T1 and T2 for that IA_PD. check section 9 to see how an IA_PD shows up in a DHCP message 👑
- Overview of DHCP with Prefix Delegation 🌈
prefix delegation with DHCP is totally independent of address assignment with DHCP, so a requesting router can use DHCP just for prefix delegation, or for prefix delegation along with address assignment and other config info 💜
first the requesting router creates an IA_PD and gives it an IAID ✨ then it sends a Solicit message with an IA_PD option describing that IA_PD. any delegating routers that can delegate prefixes to that IA_PD reply with an Advertise message 🦋
the requesting router MAY put prefixes into the IA_PDs as a hint to the delegating router about specific prefixes it prefers 🌸
once the requesting router has found a delegating router, it sends a Request message to fill up the IA_PDs with prefixes 💅 it includes one or more IA_PD options in that Request. the delegating router sends back the prefixes and other info about the IA_PDs in IA_PD options in a Reply message 🎀 the requesting router records the lifetimes for the delegated prefix(es) and uses them the way we talked about in the previous section 🫶
before the valid lifetime on each delegated prefix runs out, the requesting router puts the prefix in an IA_PD option inside a Renew message to the delegating router 😭 the delegating router replies with the prefix and its updated lifetimes 🧚
- Interface Selection 🍓
okay this one's kinda important 👑 delegated prefixes aren't tied to a particular interface the way addresses are for address assignment, so the rules in section 16, "Client Source Address and Interface Selection" of RFC 3315 do NOT apply here 💀
hmm, wait, let me fix that: the rules in that section do not apply, so no need to worry about them 🌈
when a requesting router sends a DHCP message, it SHOULD send it on the interface connected to the upstream router (ISP network) 💜 the upstream interface is usually set by configuration ✨ and this still holds even when a separate IA_PD is used for each downstream interface 🦋
when a requesting router sends a DHCP message straight to a delegating router using unicast (after getting the Server Unicast option from that delegating router), the source address SHOULD be an address from the upstream interface, and one that works for the delegating router to reply to the requesting router 🌸
- Identity Association for Prefix Delegation Option 💖
the IA_PD option carries a prefix delegation identity association, plus the parameters for that IA_PD and the prefixes linked to it 🎀
here's what the IA_PD option looks like on the wire 👇
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_IA_PD | option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| IAID (4 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| T1 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| T2 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
. .
. IA_PD-options .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+the fields break down like this 🧁
option-code: OPTION_IA_PD (25)
option-length: 12 + length of IA_PD-options field.
IAID: The unique identifier for this IA_PD; the IAID must
be unique among the identifiers for all of this
requesting router's IA_PDs.
T1: The time at which the requesting router should
contact the delegating router from which the
prefixes in the IA_PD were obtained to extend the
lifetimes of the prefixes delegated to the IA_PD;
T1 is a time duration relative to the current time
expressed in units of seconds.
T2: The time at which the requesting router should
contact any available delegating router to extend
the lifetimes of the prefixes assigned to the
IA_PD; T2 is a time duration relative to the
current time expressed in units of seconds.
IA_PD-options: Options associated with this IA_PD.the IA_PD-options field holds all the options specific to this IA_PD ✨ for example, every IA_PD Prefix Option that carries a prefix tied to this IA_PD lives in there 🦋
an IA_PD option MAY only show up in the options area of a DHCP message 🌸 and one DHCP message can have multiple IA_PD options 💅
the status of any operation involving this IA_PD is reported in a Status Code option inside the IA_PD-options field 🎀
ngl an IA_PD doesn't have its own "lifetime" or "lease length" 🫶 once the valid lifetimes of all the prefixes in an IA_PD have expired, the IA_PD can be considered expired 😭 T1 and T2 are there so delegating routers get explicit control over when a requesting router should contact them about a specific IA_PD 🧚
in a message from a requesting router to a delegating router, the T1 and T2 values show the requesting router's preference for those parameters 🍓 if it has no preference, it sets T1 and T2 to zero 👑 in a message from a delegating router to a requesting router, the requesting router MUST use the T1 and T2 values as its T1 and T2 parameters 🌈 those values are the number of seconds until T1 and T2 💜
the delegating router picks T1 and T2 so the requesting router can extend the lifetimes of any prefixes in the IA_PD before they expire, even if the delegating router is unavailable for a short while ✨ the recommended values are .5 and .8 times the shortest preferred lifetime of the prefixes in the IA_PD that the delegating router is willing to extend, respectively 🦋 if the timing of renewals is left up to the requesting router, the delegating router sets T1 and T2 to 0 🌸
if a delegating router gets an IA_PD where T1 is greater than T2, and both T1 and T2 are greater than 0, it ignores those invalid T1 and T2 values and processes the IA_PD as though it had set T1 and T2 to 0 💅
and if a requesting router gets an IA_PD where T1 is greater than T2, and both T1 and T2 are greater than 0, the client discards the IA_PD option and processes the rest of the message as though the delegating router hadn't included the IA_PD option 🎀
10. IA_PD Prefix option 🎀
okay so the IA_PD Prefix option is how you attach IPv6 address prefixes to an IA_PD 🌸 It has to live inside the IA_PD-options field of an IA_PD option, no exceptions bestie. Here's the layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| OPTION_IAPREFIX | option-length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| preferred-lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| valid-lifetime |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| prefix-length | |
+-+-+-+-+-+-+-+-+ IPv6 prefix |
| (16 octets) |
| |
| |
| |
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | .
+-+-+-+-+-+-+-+-+ .
. IAprefix-options .
. .
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+Here's what each field does ✨
option-code:OPTION_IAPREFIX(26) 💜option-length: 25 + length of theIAprefix-optionsfieldpreferred-lifetime: the recommended preferred lifetime for the IPv6 prefix, in seconds.0xFFFFFFFFmeans infinity ♾️valid-lifetime: the valid lifetime for the IPv6 prefix, in seconds.0xFFFFFFFFalso means infinityprefix-length: the length of this prefix in bitsIPv6-prefix: an IPv6 prefixIAprefix-options: options attached to this prefix
When a requesting router sends this to a delegating router, the field values are basically it saying "here's what I'd prefer" 🙈 It can put 0 in a field to say it has no preference. It can also set the IPv6 prefix field to zero and pick a value for prefix-length to hint at the prefix size it wants.
When a delegating router sends it, the preferred and valid lifetimes should be set to the values of AdvPreferredLifetime and AdvValidLifetime as specified in section 6.2.1, "Router Configuration Variables" of RFC 2461 [4], unless administratively configured. So that's the default, unless someone's configured something else on purpose 💅
Now the lifetime drama 😭 A requesting router throws out any prefix whose preferred lifetime is bigger than its valid lifetime, no mercy. A delegating router ignores the lifetimes the requesting router sent if preferred is bigger than valid, and it also ignores the T1 and T2 values from the requesting router if those are bigger than the preferred lifetime. Honestly iconic behaviour from both sides 🔥
The lifetimes are just the number of seconds still left on each one, btw.
An IA_PD Prefix option can only show up inside an IA_PD option, and one IA_PD option can hold more than one IA_PD Prefix option 🌈 If anything is happening with this option, the status shows up in a Status Code option inside the IAprefix-options field.
11. Delegating Router Solicitation 🦋
So finding and picking a delegating router works the same way as section 17, "DHCP Server Solicitation" of RFC 3315. This section has the step-by-step for the solicitation part 🫶
11.1. Requesting router behavior
The requesting router builds and sends a Solicit message the way section 17.1.1, "Creation of Solicit Messages" and section 17.1.2, "Transmission of Solicit Messages" of RFC 3315 describe. It makes an IA_PD and gives it an IAID. The requesting router MUST include the IA_PD option in the Solicit message, no skipping it 🍓
When Advertise messages come back, the requesting router handles them the way section 17.1.3, "Receipt of Advertise Messages" of RFC 3315 says. It MAY choose to look at which prefixes were advertised when it decides which delegating router to answer, so that's a totally optional bonus ✨
The requesting router MUST ignore any Advertise message that carries a Status Code option with the value NoPrefixAvail. The one exception: it MAY show the matching status message to the user 💀
11.2. Delegating router behavior
The delegating router sends an Advertise message back to the requesting router the way section 17.2.2, "Creation and transmission of Advertise messages" of RFC 3315 says. If the message has an IA_PD option and the delegating router is set up to hand out prefixes to that requesting router, then it picks the prefix(es) to delegate. This document doesn't say how the delegating router picks them. Some examples of how it could: static assignment based on an ISP subscription, dynamic assignment from a pool of free prefixes, or selection by an outside authority like a RADIUS server using the Framed-IPv6-Prefix option described in RFC 3162 [5] 🌸
If the requesting router put an IA_PD Prefix option inside the IA_PD option of its Solicit message, the delegating router MAY use that info to choose which prefix(es) or what prefix size to delegate.
The delegating router sends an Advertise message to the requesting router the same way as section, "Creation and transmission of Advertise messages" of RFC 3315. The delegating router MUST include an IA_PD option that identifies any prefix(es) it is going to delegate to the requesting router 💜
If the delegating router won't assign any prefixes to any IA_PDs in a later Request from that requesting router, it MUST still send an Advertise message. That message includes the IA_PD with no prefixes in it, plus a Status Code option inside the IA_PD containing the NoPrefixAvail status code and a status message for the user. It also needs a Server Identifier option with the delegating router's DUID, and a Client Identifier option with the requesting router's DUID. So it's basically saying "sorry bestie, nothing for you" but in full detail 😭
12. Requesting router initiated prefix delegation 👑
A requesting router uses the same message exchanges described in section 18, "DHCP Client-Initiated Configuration Exchange" of RFC 3315 to get or update prefix(es) from a delegating router. The two routers use the IA_PD Prefix option to swap info about prefixes, kind of like how IA Address options are used for assigned addresses. It's giving déjà vu, and I love that for us 🦋
12.1. Requesting router behavior
The requesting router uses a Request message to fill up IA_PDs with prefixes. It puts one or more IA_PD options into the Request message. The delegating router then sends the prefixes for those IA_PDs back to the requesting router in IA_PD options, inside a Reply message 🎀
The requesting router puts IA_PD options into any Renew or Rebind messages it sends. Each IA_PD option has all of the prefixes the requesting router currently has tied to that IA_PD.
Sometimes the requesting router needs to check that the delegating router still has a valid binding for it. Times this might happen include:
- The requesting router reboots 🔄
- The requesting router's upstream link flaps 🫠
- The requesting router gets physically unplugged from a wired connection 🔌
If it needs that check, the requesting router MUST start a Rebind/Reply message exchange as described in section 18.1.4, "Creation and Transmission of Rebind Messages" of RFC 3315. The one difference: the retransmission parameters should be set the same way as for the Confirm message, which is in section 18.1.2, "Creation and Transmission of Confirm Messages" of RFC 3315. The requesting router puts any IA_PDs in its Rebind message, along with the prefixes tied to those IA_PDs 🧚
Every prefix has valid and preferred lifetimes, and the durations are in the IA_PD Prefix option for that prefix. The requesting router uses Renew and Rebind messages to ask for longer lifetimes on a delegated prefix ⭐
If the requesting router wants to give a delegated prefix back, it uses a Release message. The prefixes being released MUST be included in the IA_PDs 💖
The Confirm and Decline message types aren't used for Prefix Delegation, so don't even bother with them 🙅
When a valid Reply message comes in, the requesting router assigns a subnet from each delegated prefix to each link its interfaces are attached to, for each IA_PD. There's one exception 🚫 The requesting router MUST NOT assign any delegated prefixes or subnets from the delegated prefix(es) to the link it got the DHCP message from the delegating router on.
When a requesting router subnets a delegated prefix, it must add more bits to the prefix to make unique, longer prefixes. For example, if the requesting router in Figure 1 were delegated 3FFE:FFFF:0::/48, it might make 3FFE:FFFF:0:1::/64 and 3FFE:FFFF:0:2::/64 for the two links in the subscriber network. If it were delegated both 3FFE:FFFF:0::/48 and 3FFE:FFFF:5::/48, it might give 3FFE:FFFF:0:1::/64 and 3FFE:FFFF:5:1::/64 to one link, and 3FFE:FFFF:0:2::/64 and 3FFE:FFFF:5:2::/64 to the other link 🌈
If the requesting router assigns a delegated prefix to a link it's attached to, and starts sending router advertisements for that prefix on the link, it MUST set the valid lifetime in those advertisements to be no later than the valid lifetime in the IA_PD Prefix option. It MAY use the preferred lifetime from the IA_PD Prefix option too 🫶
How Status Codes options in received Reply messages get handled is described in section 18.1.8, "Receipt of Reply Messages" of RFC 3315. And the NoPrefixAvail Status Code gets treated the same way as the NoAddrsAvail Status Code 💅
12.2. Delegating Router behavior 🎀
Okay so, when a delegating router gets a Request message from a requesting router that has an IA_PD option, and it's allowed to hand out prefix(es) to that requester, it picks the prefix(es) to delegate. ✨ How it picks them is not specified in this document, but Section 11.2 has examples of ways it might do that 💅.
When a delegating router sees IA_PD Prefix options (inside an IA_PD option) in Renew and Rebind messages, it checks what's going on with those prefix(es) and responds based on their current status 🧐. It sends back IA_PD Prefix options (inside an IA_PD option) with updated lifetimes for each valid prefix in the requester's message. Now here's the tea 🫖: if it finds that any of the prefixes aren't in the requesting router's binding entry, it sends that prefix back with lifetimes of 0. Harsh but fair 💀.
Now, what happens when there's no binding for the requester's IA_PD? It depends on the message type, and it's giving very different vibes:
Renew message: If the delegating router cannot find a binding
for the requesting router's IA_PD the delegating
router returns the IA_PD containing no prefixes
with a Status Code option set to NoBinding in the
Reply message.
Rebind message: If the delegating router cannot find a binding
for the requesting router's IA_PD and the
delegating router determines that the prefixes in
the IA_PD are not appropriate for the link to
which the requesting router's interface is
attached according to the delegating routers
explicit configuration, the delegating router MAY
send a Reply message to the requesting router
containing the IA_PD with the lifetimes of the
prefixes in the IA_PD set to zero. This Reply
constitutes an explicit notification to the
requesting router that the prefixes in the IA_PD
are no longer valid. If the delegating router is
unable to determine if the prefix is not
appropriate for the link, the Rebind message is
discarded.So for Rebind, the router MAY send a Reply that zeroes out the lifetimes, which is basically a big "these prefixes are dead to you now" 🪦. If it can't even tell whether the prefix is appropriate for the link, it just tosses the Rebind message 🗑️.
A delegating router may also mark any prefix(es) in IA_PD Prefix options in a Release message as "available" 🦋. Whether it does depends on how the prefix was acquired, like if it came from a dynamic pool 🌊.
Last but definitely not least, the delegating router MUST include an IA_PD Prefix option or options (inside an IA_PD option) in Reply messages sent to a requesting router. No exceptions, bestie 🫶.
13. Prefix Delegation reconfiguration ✨
This section is all about prefix delegation in Reconfigure message exchanges 🔄.
13.1. Delegating Router behavior 🧚
The delegating router starts a configuration message exchange with a requesting router, the way section 19, "DHCP Server-Initiated Configuration Exchange" of RFC 3315 describes 💌. It does this by sending a Reconfigure message to the requesting router while acting as a DHCP server, as laid out in section 19.1, "Server Behavior" of RFC 3315. It also puts the IA_PD option in the Option Request option, so the requesting router knows to include an IA_PD option and get fresh info about its delegated prefix(es) 🍓.
13.2. Requesting Router behavior 🌸
When a requesting router gets a Reconfigure message from a delegating router, it responds while acting as a DHCP client, following section 19.4, "Client Behavior" of RFC 3315 🎀. The requesting router MUST include the IA_PD Prefix option(s) (inside an IA_PD option) for the prefix(es) that the delegating router (the one that sent the Reconfigure) gave it 👑.
14. Relay agent behavior 🦋
A relay agent forwards messages with Prefix Delegation options in the exact same way as section 20, "Relay Agent Behavior" of RFC 3315 describes 🔁.
If a delegating router talks to a requesting router through a relay agent, the delegating router may need a protocol or other out-of-band communication to add routing information for the delegated prefixes into the provider edge router 🛣️. Not automatic, so plan ahead, babe 💅.
15. Security Considerations 🔐
Okay, security is SERIOUS 😭. Security considerations in DHCP are covered in section 23, "Security Considerations" of RFC 3315, so go read that too 📖.
A rogue delegating router can issue bogus prefixes to a requesting router 👹. That can cause denial of service because things just become unreachable 🙈.
A malicious requesting router might also pull off a denial of service attack by repeatedly asking for delegated prefixes until the delegating router runs out of available prefixes 😤.
To guard against prefix delegation attacks, requesting routers and delegating routers SHOULD use DHCP authentication, as described in section 21, "Authentication of DHCP messages" of RFC 3315 🛡️. For point-to-point links, where you trust that there's no man in the middle, or you trust layer two authentication, DHCP authentication or IPsec may not be necessary 🤝. Since a requesting router and delegating routers must each have at least one assigned IPv6 address, the routers may be able to use IPsec for authentication of DHCPv6 messages 🔒. The details of using IPsec for DHCPv6 are still under development, so stay tuned 👀.
Networks with delegated prefixes should be configured to preclude intentional or inadvertent inappropriate advertisement of these prefixes 🚫📢. Don't let your prefixes get advertised where they don't belong, iykyk 💀.
16. IANA Considerations 📋
IANA has assigned option codes to:
OPTION_IA_PD (25)
OPTION_IAPREFIX (26)These come from the option-code space defined in section 24.3, "DHCP Options" of RFC 3315 🗂️.
IANA has also assigned status code 6 to:
NoPrefixAvail: Delegating router has no prefixes available to
assign to the IAPD(s)That comes from the status-code space defined in section 24.4, "Status Codes" of RFC 3315 🏷️.
17. Intellectual Property Statement ⚖️
The IETF doesn't take a position on whether any intellectual property or other rights that might be claimed for the technology in this document are valid or what their scope is, and it doesn't say whether any license under those rights is or isn't available. It also doesn't claim it has tried to find any such rights 🤷♀️. You can find the IETF's procedures for rights in standards-track and standards-related documentation in BCP-11 📜. Copies of claims of rights made available for publication, plus any assurances of licenses to be made available (or the result of an attempt to get a general license or permission for implementors or users to use those proprietary rights), can be obtained from the IETF Secretariat 📬.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to practice this standard. Send that info to the IETF Executive Director 💌.
18. References 📚
18.1. Normative References 💜
- [1] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
- [2] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C. and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
- [3] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [4] Narten, T., Nordmark, E. and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998.
- [5] Aboba, B., Zorn, G. and D. Mitton, "RADIUS and IPv6", RFC 3162, August 2001.
18.2. Informative References 🌈
- [6] Miyakawa, S. and R. Droms, "Requirements for IPv6 prefix delegation", Work in Progress, August 2003.
19. Acknowledgements 🫶
Thanks to everyone who gave input and review, listed in alphabetical order: Steve Deering, Dave Forster, Brian Haberman, Tatuya Jinmei, Shin Miyakawa, Pekka Savola, Bernie Volz, Trevor Warwick and Toshi Yamasaki 💖.
20. Authors' Addresses 🧚
Ole Troan
Cisco Systems
250 Longwater Avenue
Reading RG2 6GB
United Kingdom
Phone: +44 20 8824 8666
EMail: ot@cisco.com
Ralph Droms
Cisco Systems
1414 Massachusetts Avenue
Boxborough, MA 01719
USA
Phone: +1 978 936 1674
EMail: rdroms@cisco.com21. Full Copyright Statement ©️
Copyright (C) The Internet Society (2003). All Rights Reserved.
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assignees.
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement 💅
Funding for the RFC Editor function is currently provided by the Internet Society 🌟.
📦 where this page comes from
- ietf: rfc3633 2003-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms