RFC 4214

Intra-Site Automatic Tunnel Addressing Protocol (ISATAP)

📅 published October 2005, from ietf

RFC 4214: Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) 🦋

okay bestie, let's get the vibes straight first 💅 This is RFC 4214 from the IETF's Network Working Group, dated October 2005. It's in the Experimental category, which is giving "we're trying this out, not a standard" 🧪 The authors are F. Templin (Nokia), T. Gleeson (Cisco Systems K.K.), M. Talwar (Microsoft Corporation), and D. Thaler (Microsoft Corporation) 🫶 Its header doesn't list anything it obsoletes or updates, so it's a solo main character 👑

Status of This Memo 📜

So this memo defines an Experimental Protocol for the Internet community ✨ It is not an Internet standard of any kind. Discussion and suggestions for improvement are requested, so bring your ideas 💖 Distribution of this memo is unlimited 🌈

Copyright Notice ©️

IESG Note 🚨

okay so this one is important 😭 The content was at one point considered by the IETF, which means it might look like a current IETF work in progress or a published IETF work 🙈 This RFC is not a candidate for any level of Internet Standard. The IETF disclaims any knowledge of how fit this RFC is for any purpose. It also notes that the decision to publish wasn't based on IETF review of things like security, congestion control, or inappropriate interaction with deployed protocols 💀 The RFC Editor chose to publish this at its own discretion, so readers should be extra careful about how much they trust it for implementation and deployment. See RFC 3932 for more info 📚

Abstract 🌸

The Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) connects IPv6 hosts and routers over IPv4 networks 🦋 It views the IPv4 network as a link layer for IPv6, and it views other nodes on that network as potential IPv6 hosts and routers. ISATAP supports an automatic tunneling abstraction that's similar to the Non-Broadcast Multiple Access (NBMA) model 🧚

1. Introduction ✨

This document specifies a simple mechanism called the Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), which connects IPv6 hosts and routers over IPv4 networks 💖 Dual-stack (IPv6/IPv4) nodes use ISATAP to automatically tunnel IPv6 packets in IPv4. In other words, ISATAP views the IPv4 network as a link layer for IPv6 and views other nodes on the network as potential IPv6 hosts and routers 🫶

ISATAP enables automatic tunneling whether global or private IPv4 addresses are used 🌈 It also presents an NBMA abstraction that's similar to [RFC2491][RFC2492][RFC2529][RFC3056] ✨

The main objectives of this document are to:

describe the domain of applicability,
specify addressing requirements,
specify automatic tunneling using ISATAP,
specify the operation of IPv6 Neighbor Discovery over ISATAP interfaces, and
discuss Site Administration, Security, and IANA considerations 📋

2. Requirements 🎯

Whenever you see MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, or OPTIONAL in this document (in caps, bestie!), read them as described in [BCP14] 💅

This document also uses internal conceptual variables to describe protocol behavior, plus external variables that an implementation must let system administrators change 🔥 The specific variable names, how their values change, and how their settings influence protocol behavior are given just to demonstrate the behavior. An implementation is not required to have them in the exact form described here, as long as its external behavior matches what this document describes 🍓

3. Terminology 📖

The terminology of [RFC2460][RFC2461] applies to this document. On top of that, these extra terms are defined:

ISATAP node: A node that implements the specifications in this document.
ISATAP interface: An ISATAP node's Non-Broadcast Multi-Access (NBMA) IPv6 interface, used for automatic tunneling of IPv6 packets in IPv4.
ISATAP interface identifier: An IPv6 interface identifier with an embedded IPv4 address, constructed as specified in Section 6.1.
ISATAP address: An IPv6 unicast address that matches an on-link prefix on an ISATAP interface of the node, and that includes an ISATAP interface identifier 🧚
locator: An IPv4 address-to-interface mapping. In other words, a node's IPv4 address and its associated interface.
locator set: A set of locators associated with an ISATAP interface. Every locator in the set belongs to the same site 🏠

4. Domain of Applicability 🌍

The domain of applicability for this technical specification is automatic tunneling of IPv6 packets in IPv4 for ISATAP nodes within sites that observe the security considerations found in this document 🔐 That includes host-to-router, router-to-host, and host-to-host automatic tunneling in certain enterprise networks and 3GPP/3GPP2 wireless operator networks 📱 Other scenarios with a sufficient trust basis, ensured by the mechanisms specified in this document, also fall within this domain of applicability 🌸

Extensions to the above domain of applicability (for example, combining the mechanisms in this document with those in other technical specifications) are out of the scope of this document 🙅‍♀️

5. Node Requirements 🧩

ISATAP nodes observe the common functionality requirements for IPv6 nodes found in [NODEREQ], and the requirements for dual IP layer operation found in ([MECH], Section 2) 💜 They also implement the additional features specified in this document ✨

6. Addressing Requirements 🏷️

6.1. ISATAP Interface Identifiers 🔢

ISATAP interface identifiers are constructed in Modified EUI-64 format ([RFC3513], Section 2.5.1 and Appendix A) 🧠 You build them by concatenating three things: the 24-bit IANA OUI (00-00-5E), the 8-bit hexadecimal value 0xFE, and a 32-bit IPv4 address in network byte order. Here's how it looks:

   |0              1|1              3|3                              6|
   |0              5|6              1|2                              3|
   +----------------+----------------+--------------------------------+
   |000000ug00000000|0101111011111110|mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm|
   +----------------+----------------+--------------------------------+

When the IPv4 address is known to be globally unique, the "u" bit (universal/local) is set to 1. Otherwise, the "u" bit is set to 0 🎀 The "g" is the individual/group bit, and the "m" bits are the bits of the IPv4 address 🦋

6.2. ISATAP Interface Address Configuration 🛠️

Each ISATAP interface configures a set of locators, made up of IPv4 address-to-interface mappings from a single site 🏠 In other words, an ISATAP interface's locator set MUST NOT span multiple sites. That's a hard rule, no cap 🚫

When an IPv4 address is removed from an interface, the corresponding locator SHOULD be removed from its associated locator set(s) 🧹 When a new IPv4 address is assigned to an interface, the corresponding locator MAY be added to the appropriate locator set(s) ✨

ISATAP interfaces form ISATAP interface identifiers from the IPv4 addresses in their locator set, then use them to create link-local ISATAP addresses ([RFC2462], Section 5.3) 💅

6.3. Multicast/Anycast 📡

It isn't possible to assume general availability of wide-area IPv4 multicast. So (unlike 6over4 [RFC2529]), ISATAP must assume that its underlying IPv4 carrier network only has unicast capability 🥺 Support for IPv6 multicast over ISATAP interfaces is not described in this document.

Similarly, support for Reserved IPv6 Subnet Anycast Addresses is not described in this document 🙈

7. Automatic Tunneling 🚇

ISATAP interfaces use the basic tunneling mechanisms specified in ([MECH], Section 3) 🌊 The following sub-sections describe additional specifications.

7.1. Encapsulation 🎁

ISATAP addresses are mapped to a link-layer address by a static computation. In other words, the last four octets are treated as an IPv4 address 🔢

7.2. Handling ICMPv4 Errors 🚨

ISATAP interfaces SHOULD process ARP failures and persistent ICMPv4 errors as link-specific information. That information indicates that a path to a neighbor may have failed ([RFC2461], Section 7.3.3) 👀

7.3. Decapsulation 📦

The specification in ([MECH], Section 3.6) is used 💜 On top of that, when an ISATAP node receives an IPv4 protocol 41 datagram that does not belong to a configured tunnel interface, it determines whether the packet's IPv4 destination address and arrival interface match a locator configured in an ISATAP interface's locator set 🔍

If an ISATAP interface that configures a matching locator is found, the decapsulator MUST verify that the packet's IPv4 source address is correct for the encapsulated IPv6 source address. This is the part where you do NOT skip the check 🙅‍♀️

The IPv4 source address is correct if either of these is true:

the IPv6 source address is an ISATAP address that embeds the IPv4 source address in its interface identifier, or
the IPv4 source address is a member of the Potential Router List (see Section 8.1) 🧚

Packets whose IPv4 source address is incorrect for this ISATAP interface get checked to see whether they belong to another tunnel interface 🔁

7.4. Link-Local Addresses 🔗

ISATAP interfaces use link-local addresses constructed as specified in Section 6 of this document 🫶

7.5. Neighbor Discovery over Tunnels 🌷

ISATAP interfaces use the neighbor discovery specifications found in the following section of this document ✨

8. Neighbor Discovery for ISATAP Interfaces 👯‍♀️

ISATAP interfaces use the neighbor discovery mechanisms specified in [RFC2461] 💖 The following sub-sections describe specifications that are also implemented.

8.1. Conceptual Model of a Host 🧠

To the list of Conceptual Data Structures ([RFC2461], Section 5.1), ISATAP interfaces add the following:

Potential Router List (PRL): A set of entries about potential routers, used to support router and prefix discovery. Each entry ("PRL(i)") has an associated timer ("TIMER(i)") and an IPv4 address ("V4ADDR(i)"). That IPv4 address represents a router's advertising ISATAP interface 🌟

8.2. Router and Prefix Discovery - Router Specification 📢

Advertising ISATAP interfaces send Solicited Router Advertisement messages as specified in ([RFC2461], Section 6.2.6). The one difference is that the messages are sent directly to the soliciting node. In other words, they might not be received by other nodes on the link 🙈

8.3. Router and Prefix Discovery - Host Specification 🏠

The Host Specification in ([RFC2461], Section 6.3) is used 💜 The following sub-sections describe specifications added by ISATAP interfaces.

8.3.1. Host Variables 🎀

To the list of host variables ([RFC2461], Section 6.3.2), ISATAP interfaces add the following:

PrlRefreshInterval: Time in seconds between successive refreshments of the PRL after initialization. The designated value of all ones (0xffffffff) represents infinity. Default: 3600 seconds ⏰
MinRouterSolicitInterval: Minimum time in seconds between successive solicitations of the same advertising ISATAP interface. The designated value of all ones (0xffffffff) represents infinity 🦋

8.3.2. Potential Router List Initialization 💖

okay so ISATAP nodes fill up their PRL (Potential Router List) with IPv4 addresses they find through manual configuration, a DNS Fully Qualified Domain Name (FQDN) [STD13], a DHCPv4 option, a DHCPv4 vendor-specific option, or some unspecified alternate method 🧚 FQDNs get set up through manual configuration or that same unspecified alternate method. Then those FQDNs get turned into IPv4 addresses through a static host file lookup, asking the DNS service, asking a site-specific name service, or an unspecified alternate method. it's giving options, bestie 💅

After a node initializes an ISATAP interface's PRL, it sets a timer for that interface to PrlRefreshInterval seconds. When the timer goes off, it re-initializes the interface's PRL the same way as above ⏰ When an FQDN is in play, and it gets resolved through a service that includes TTLs with the IPv4 addresses returned (e.g., DNS 'A' resource records [STD13]), the timer SHOULD be set to the minimum of PrlRefreshInterval and the minimum TTL returned. 🎀 Zero-valued TTLs are interpreted to mean that the PRL gets re-initialized before each Router Solicitation event (see Section 8.3.4). no cap, that's a whole vibe.

8.3.3. Processing Received Router Advertisements 📬

so Router Advertisement messages already have a list of checks to validate them ([RFC2461], Section 6.1.1), and ISATAP interfaces add one more check on top 🔥

IP Source Address is a link-local ISATAP address that embeds V4ADDR(i) for some PRL(i).

Valid Router Advertisements that show up on an ISATAP interface get processed exactly as specified in ([RFC2461], Section 6.3.4). ✨

8.3.4. Sending Router Solicitations 🦋

same energy here! Router Solicitation messages can already be sent after a bunch of events ([RFC2461], Section 6.3.7), and ISATAP interfaces add one more event to the list 💜

TIMER(i) for some PRL(i) expires.

unsolicited Router Advertisements can be incomplete and/or just not show up at all, so ISATAP nodes MAY schedule periodic Router Solicitation events for certain PRL(i)s by setting the matching TIMER(i). 🙈

when periodic Router Solicitation events are scheduled, the node SHOULD set TIMER(i) so the next event refreshes whatever lifetimes are still stored for PRL(i) before they expire. That includes the Router Lifetime, the Valid Lifetimes from Prefix Information Options, and the Route Lifetimes from Route Information Options [DEFLT]. TIMER(i) MUST be set to no less than MinRouterSolicitInterval seconds, where MinRouterSolicitInterval is configurable for the node, or for a specific PRL(i), and comes with a conservative default value (e.g., 2 minutes). 🌸

when TIMER(i) expires, the node sends Router Solicitation messages as specified in ([RFC2461], Section 6.3.7), except the messages go directly to PRL(i). which means other routers might not get them at all 👀 As long as the node still needs periodic Router Solicitation events for PRL(i), and PRL(i) is still acting as a router, the node resets TIMER(i) after each expiration event like we just described. 🫶

8.4. Neighbor Unreachability Detection 🌈

Hosts SHOULD perform Neighbor Unreachability Detection ([RFC2461], Section 7.3). Routers MAY perform neighbor unreachability detection too, but that might not scale in every environment, so keep that in mind 🍓

after address resolution, hosts SHOULD do an initial reachability confirmation by sending Neighbor Solicitation messages and receiving a Neighbor Advertisement message. Routers MAY do this initial reachability confirmation as well, but again, it might not scale in all environments. ⭐

9. Site Administration Considerations 🎀

site administrators keep a Potential Router List (PRL) of the IPv4 addresses that stand for the advertising ISATAP interfaces of routers. 🏡

the PRL is usually kept as an FQDN for the ISATAP service in the site's name service (see Section 8.3.2). There are no mandatory rules for picking the FQDN, but site administrators are encouraged to use the convention "isatap.domainname" (e.g., isatap.example.com). 💅

when the site's name service includes TTLs with the IPv4 addresses returned, site administrators SHOULD configure the TTLs with conservative values to keep control traffic low. 🧚

10. Security Considerations 🚨

Implementors should be aware that, on top of possible attacks against IPv6, security attacks against IPv4 also need to be considered. the use of IP security at both the IPv4 and IPv6 levels should still be avoided, for efficiency reasons. For example, if IPv6 is running encrypted, encrypting IPv4 would be redundant unless traffic analysis is felt to be a threat. If IPv6 is running authenticated, then authenticating IPv4 adds little. On the flip side, IPv4 security won't protect IPv6 traffic once it leaves the ISATAP domain. So implementing IPv6 security is required even when IPv4 security is available. 😭

the threats associated with IPv6 Neighbor Discovery are described in [RFC3756]. 🔍

there's a possible spoofing attack where spurious ip-protocol-41 packets get injected into an ISATAP link from outside. Since an ISATAP link spans an entire IPv4 site, you can restrict access to the link by restricting access to the site, meaning site border routers implement IPv4 ingress filtering and ip-protocol-41 filtering. 🛡️

⚠️ another possible spoofing attack involves spurious ip-protocol-41 packets injected from inside an ISATAP link by a node pretending to be a router. The Potential Router List (PRL) gives hosts a list of the IPv4 addresses representing advertising ISATAP interfaces of routers, and hosts use that list in filtering decisions. site administrators should make sure the PRL stays up to date, and that the resolution mechanism (see Section 9) cannot be subverted. this one is serious, bestie 💀

the use of temporary addresses [RFC3041] and Cryptographically Generated Addresses [CGA] on ISATAP interfaces is outside the scope of this specification. 🌙

11. IANA Considerations 🌸

The IANA has specified the format for Modified EUI-64 address construction ([RFC3513], Appendix A) in the IANA Ethernet Address Block. The text in Appendix A of this document has been offered as an example specification. The current version of the IANA registry for Ether Types can be accessed at:

http://www.iana.org/assignments/ethernet-numbers

12. Acknowledgements 💜

The ideas in this document are not original, and the authors acknowledge the original architects. Portions of this work were sponsored through SRI International internal projects and government contracts. Government sponsors include Monica Farah-Stapleton and Russell Langan (U.S. Army CECOM ASEO), and Dr. Allen Moshfegh (U.S. Office of Naval Research). SRI International sponsors include Dr. Mike Frankel, J. Peter Marcotullio, Lou Rodriguez, and Dr. Ambatipudi Sastry. 🙌

the following are acknowledged for providing peer review input: Jim Bound, Rich Draves, Cyndi Jung, Ambatipudi Sastry, Aaron Schrader, Ole Troan, and Vlad Yasevich. 🫶

the following are acknowledged for their significant contributions: Alain Durand, Hannu Flinck, Jason Goldschmidt, Nathan Lutchansky, Karen Nielsen, Mohan Parthasarathy, Chirayu Patel, Art Shelest, Markku Savela, Pekka Savola, Margaret Wasserman, and Brian Zill. ✨

the authors acknowledge the work of Quang Nguyen on "Virtual Ethernet", under the guidance of Dr. Lixia Zhang, which proposed very similar ideas to the ones in this document. This work was first brought to the authors' attention on September 20, 2002. 🦋

Appendix A. Modified EUI-64 Addresses in the IANA Ethernet Address Block 🧚

Modified EUI-64 addresses ([RFC3513], Section 2.5.1 and Appendix A) in the IANA Ethernet Address Block are formed by concatenating the 24-bit IANA OUI (00-00-5E) with a 40-bit extension identifier and inverting the "u" bit. In other words, the "u" bit is set to one (1) to indicate universal scope and set to zero (0) to indicate local scope. 🌈

Modified EUI-64 addresses look like this in memory (bits are transmitted right-to-left within octets, octets are transmitted left-to-right):

0                       23                                        63
|        OUI            |            extension identifier         |
000000ug00000000 01011110xxxxxxxx xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx

When the first two octets of the extension identifier encode the hexadecimal value 0xFFFE, the rest of the extension identifier encodes a 24-bit vendor-supplied id like this:

0                       23               39                       63
|        OUI            |     0xFFFE     |   vendor-supplied id   |
000000ug00000000 0101111011111111 11111110xxxxxxxx xxxxxxxxxxxxxxxx

When the first octet of the extension identifier encodes the hexadecimal value 0xFE, the rest of the extension identifier encodes a 32-bit IPv4 address like this:

0                       23      31                                63
|        OUI            |  0xFE |           IPv4 address          |
000000ug00000000 0101111011111110 xxxxxxxxxxxxxxxx xxxxxxxxxxxxxxxx

Normative References 📚

[BCP14] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[STD13] Mockapetris, P., "Domain names - implementation and specification", STD 13, RFC 1035, November 1987.
[RFC2460] Deering, S. and R. Hinden, "Internet Protocol, Version 6 (IPv6) Specification", RFC 2460, December 1998.
[RFC2461] Narten, T., Nordmark, E., and W. Simpson, "Neighbor Discovery for IP Version 6 (IPv6)", RFC 2461, December 1998.
[RFC2462] Thomson, S. and T. Narten, "IPv6 Stateless Address Autoconfiguration", RFC 2462, December 1998.
[RFC3513] Hinden, R. and S. Deering, "Internet Protocol Version 6 (IPv6) Addressing Architecture", RFC 3513, April 2003.
[MECH] Nordmark, E. and R. Gilligan, "Basic Transition Mechanisms for IPv6 Hosts and Routers", RFC 4213, October 2005.

Informative References 🔖

[RFC2491] Armitage, G., Schulter, P., Jork, M., and G. Harter, "IPv6 over Non-Broadcast Multiple Access (NBMA) networks", RFC 2491, January 1999.
[RFC2492] Armitage, G., Schulter, P., and M. Jork, "IPv6 over ATM Networks", RFC 2492, January 1999.
[RFC2529] Carpenter, B. and C. Jung, "Transmission of IPv6 over IPv4 Domains without Explicit Tunnels", RFC 2529, March 1999.
[RFC3041] Narten, T. and R. Draves, "Privacy Extensions for Stateless Address Autoconfiguration in IPv6", RFC 3041, January 2001.
[RFC3056] Carpenter, B. and K. Moore, "Connection of IPv6 Domains via IPv4 Clouds", RFC 3056, February 2001.
[RFC3756] Nikander, P., Kempf, J., and E. Nordmark, "IPv6 Neighbor Discovery (ND) Trust Models and Threats", RFC 3756, May 2004.
[CGA] Aura, T., "Cryptographically Generated Addresses (CGA)", RFC 3972, March 2005.
[DEFLT] Draves, R. and D. Thaler, "Default Router Preferences and More-Specific Routes", Work in Progress, December 2003.
[NODEREQ] Loughney, J., Ed., "IPv6 Node Requirements", Work in Progress, May 2004.

Authors' Addresses 🎀

okay the squad! four authors, each with their own little address card. here they are, exactly as they were written 💅

   Fred L. Templin
   Nokia
   313 Fairchild Drive
   Mountain View, CA  94110
   US

   EMail: fltemplin@acm.org


   Tim Gleeson
   Cisco Systems K.K.
   Shinjuku Mitsui Building
   2-1-1 Nishishinjuku, Shinjuku-ku
   Tokyo  163-0409
   Japan

   EMail: tgleeson@cisco.com


   Mohit Talwar
   Microsoft Corporation
   One Microsoft Way
   Redmond, WA  98052-6399
   US

   Phone: +1 425 705 3131
   EMail: mohitt@microsoft.com


   Dave Thaler
   Microsoft Corporation
   One Microsoft Way
   Redmond, WA  98052-6399
   US

   Phone: +1 425 703 8835
   EMail: dthaler@microsoft.com

Full Copyright Statement 🌈

bestie, the copyright bit! the Internet Society owns the copyright here, and it's dated 2005 📅 Copyright (C) The Internet Society (2005).

This document is subject to the rights, licenses and restrictions in BCP 78, which you can find at www.rfc-editor.org/copyright.html. Unless that says otherwise, the authors keep all their rights 🔒

Now the legal disclaimer. The document and everything in it is provided on an "AS IS" basis, and the contributor, the organization they represent or are sponsored by (if any), the Internet Society, and the Internet Engineering Task Force all disclaim every warranty, whether express or implied. That includes no warranty that using the info won't infringe anyone's rights, and no implied warranties of merchantability or fitness for a particular purpose 💀

the short version: use it as-is, nobody is promising it'll work for every single thing you do with it 🙈

Intellectual Property 🦋

the IETF is not taking a side on whether any intellectual property rights that someone might claim over the tech in this document are valid, how far they reach, or whether any license for them exists. It also doesn't say it has done any independent digging to find such rights. If you want the rules around rights in RFC documents, check BCP 78 and BCP 79 ✨

Copies of IPR disclosures sent to the IETF Secretariat are available, along with any promised licenses. You can also get the result of any attempt to secure a general license or permission for implementers or users of this spec. The IETF's on-line IPR repository is at http://www.ietf.org/ipr 🔍

And if you know of any copyrights, patents, patent applications, or other proprietary rights that might cover tech you'd need to implement this standard, the IETF invites you to tell them! Send it to ietf-ipr@ietf.org 📬

Acknowledgement 🫶

shoutout to the people keeping the lights on: funding for the RFC Editor function is currently provided by the Internet Society 💜

📦 where this page comes from

ietf: rfc4214 2005-10
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms